MCP Observatory
3m ago Tracked 59,936 Last 3m ago 24h 2,437
github TypeScript re-analysis due

sairam0424/ag-bash

github

🐚 Ag-Bash: The AI-Native Shell Gateway. A production-grade, sandboxed Bash environment designed for AI agents. Features high-fidelity Tree-sitter AST parsing, automated agentic observability (AgTrace), and cross-platform MCP support.

maintainer
sairam0424
licence
Apache-2.0
first seen
2026-06-14
last seen
2026-09-17
releases · 30d
0
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools
transport stdio · http verified reported listed in the official MCP registry counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit f1d3fd4 · analyzer v33 · 4d ago

skills & prompt files 4

danger signals12

code evidence v@ag-bash/agent-bridge@6.0.4 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 1530

filesystem 176

  • fs (weak) sairam0424-ag-bash-f1d3fd4/examples/custom-command/commands.ts :58 input = await ctx.fs.readFile(ctx.fs.resolvePath(ctx.cwd, args[0]));
  • fs (weak) sairam0424-ag-bash-f1d3fd4/examples/website/app/api/fs/route.ts :1 import { readdir, readFile } from "fs/promises";
  • fs (weak) sairam0424-ag-bash-f1d3fd4/examples/website/scripts/fetch-agent-data.mjs :4 import fs, { existsSync, rmSync, writeFileSync } from "fs";
  • fs (weak) sairam0424-ag-bash-f1d3fd4/examples/website/scripts/generate-terminal-content.mjs :8 import fs from "node:fs";
  • fs (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/scripts/bench-check.js :46 import { readFileSync, writeFileSync } from "node:fs";
  • fs (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/scripts/differential-fuzz.js :48 import { existsSync, writeFileSync } from "node:fs";
  • fs (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/scripts/make-root-dcts.cjs :50 const fs = require("node:fs");
  • fs (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/scripts/setup-vendor.js :1 import fs from "node:fs";
  • fs sairam0424-ag-bash-f1d3fd4/packages/bash/src/Bash.ts :1155 await this.fs.writeFile(path, content);
  • fs (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/src/agent-examples/feature-implementation.test.ts :116 let entries = await ctx.fs.readdir(ctx.cwd);
  • fs (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/src/agent-examples/python-scripting.test.ts :1 import fs from "node:fs";
  • fs sairam0424-ag-bash-f1d3fd4/packages/bash/src/agentic/EditTool.ts :70 const _currentContent = await bash.fs.readFile(path, "utf8");
show 28 more
  • fs sairam0424-ag-bash-f1d3fd4/packages/bash/src/agentic/MultiReplaceTool.ts :114 await bash.fs.mkdir("/.ag-bash", { recursive: true });
  • fs sairam0424-ag-bash-f1d3fd4/packages/bash/src/agentic/agentic-healer.ts :91 const files = await ctx.fs.readdir(dir);
  • fs sairam0424-ag-bash-f1d3fd4/packages/bash/src/agentic/toolbox/executor.ts :82 await bash.fs.mkdir(ARTIFACT_DIR, { recursive: true });
  • fs sairam0424-ag-bash-f1d3fd4/packages/bash/src/agentic/toolbox/registry.ts :113 const content = await bash.fs.readFile(path, "utf-8");
  • fs (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/src/browser.bundle.test.ts :10 import { readFileSync } from "node:fs";
  • fs (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/src/cli/ag-bash.test.ts :2 import * as fs from "node:fs";
  • fs sairam0424-ag-bash-f1d3fd4/packages/bash/src/cli/ag-bash.ts :40 import { readFileSync } from "node:fs";
  • fs (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/src/cli/ag-bash.v-next.e2e.test.ts :2 import fs from "node:fs";
  • fs (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/src/cli/shell.bundle.test.ts :2 import { existsSync } from "node:fs";
  • fs sairam0424-ag-bash-f1d3fd4/packages/bash/src/cli/shell.ts :10 import * as fs from "node:fs";
  • fs sairam0424-ag-bash-f1d3fd4/packages/bash/src/commands/ag-analyze/ag-analyze.ts :54 const content = await ctx.fs.readFile(filePath, "utf8");
  • fs (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/src/commands/ag-convert/ag-convert.test.ts :1 import { existsSync, unlinkSync, writeFileSync } from "node:fs";
  • fs sairam0424-ag-bash-f1d3fd4/packages/bash/src/commands/ag-convert/ag-convert.ts :2 import { existsSync } from "node:fs";
  • fs sairam0424-ag-bash-f1d3fd4/packages/bash/src/commands/ag-diff/ag-diff.ts :48 : await ctx.fs.readFile(ctx.fs.resolvePath(ctx.cwd, f1));
  • fs (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/src/commands/ag-edit/ag-edit.test.ts :28 const content = await fs.readFile("/test.txt", "utf8");
  • fs sairam0424-ag-bash-f1d3fd4/packages/bash/src/commands/ag-edit/ag-edit.ts :61 const content = await ctx.fs.readFile(filePath, "utf8");
  • fs (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/src/commands/ag-find-files/ag-find-files.test.ts :10 await bash.fs.mkdir("/src");
  • fs sairam0424-ag-bash-f1d3fd4/packages/bash/src/commands/ag-find-files/ag-find-files.ts :44 const entries = await ctx.fs.readdir(currentPath);
  • fs sairam0424-ag-bash-f1d3fd4/packages/bash/src/commands/ag-glob/ag-glob.ts :96 const entries = await ctx.fs.readdir(currentPath);
  • fs (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/src/commands/ag-grep/ag-grep.test.ts :10 await bash.fs.writeFile(
  • fs sairam0424-ag-bash-f1d3fd4/packages/bash/src/commands/ag-grep/ag-grep.ts :39 const content = await ctx.fs.readFile(currentPath, "utf8");
  • fs sairam0424-ag-bash-f1d3fd4/packages/bash/src/commands/ag-hover/ag-hover.ts :46 const content = await ctx.fs.readFile(filePath, "utf8");
  • fs sairam0424-ag-bash-f1d3fd4/packages/bash/src/commands/ag-notebook/ag-notebook.ts :57 await ctx.fs.readFile(filePath, "utf8"),
  • fs sairam0424-ag-bash-f1d3fd4/packages/bash/src/commands/ag-plan/ag-plan.ts :69 plan = JSON.parse(await ctx.fs.readFile(PLAN_FILE, "utf8"));
  • fs sairam0424-ag-bash-f1d3fd4/packages/bash/src/commands/ag-snapshot/ag-snapshot.ts :32 await ctx.fs.mkdir(SNAPSHOT_DIR, { recursive: true });
  • fs sairam0424-ag-bash-f1d3fd4/packages/bash/src/commands/ag-todo/ag-todo.ts :30 const content = await ctx.fs.readFile(todosPath, "utf8");
  • fs sairam0424-ag-bash-f1d3fd4/packages/bash/src/commands/ag-worktree/ag-worktree.ts :80 await ctx.fs.mkdir(worktree.path, { recursive: true });
  • fs sairam0424-ag-bash-f1d3fd4/packages/bash/src/commands/awk/awk2.ts :112 readFile: ctx.fs.readFile.bind(ctx.fs),

136 more not shown — this panel samples each group; the count above is the real total.

shell / exec 59

  • shell (weak) sairam0424-ag-bash-f1d3fd4/examples/website/app/components/terminal-content.ts :471 1. **Isolation**: Each \`exec()\` call is isolated. Environment variables, functions, and cwd changes don't persist between calls. Only filesystem changes persist.
  • shell (weak) sairam0424-ag-bash-f1d3fd4/examples/website/scripts/fetch-agent-data.mjs :3 import { execSync } from "child_process";
  • shell (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/scripts/differential-fuzz.js :47 import { execFileSync } from "node:child_process";
  • shell sairam0424-ag-bash-f1d3fd4/packages/bash/src/Bash.ts :236 * When provided, an AgBashTracer is initialized and wraps each exec() call
  • shell (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/src/agent-examples/feature-implementation.test.ts :48 async exec(command: string): Promise<ExecResult> {
  • shell sairam0424-ag-bash-f1d3fd4/packages/bash/src/agentic/Orchestrator.ts :25 public async spawn(parent: Bash, options: SpawnOptions): Promise<Bash> {
  • shell (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/src/cli/ag-bash.bundle.test.ts :1 import { execFile } from "node:child_process";
  • shell (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/src/cli/ag-bash.test.ts :1 import { execSync } from "node:child_process";
  • shell (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/src/cli/ag-bash.v-next.e2e.test.ts :1 import { execFile } from "node:child_process";
  • shell sairam0424-ag-bash-f1d3fd4/packages/bash/src/cli/exec.ts :25 import { spawnSync } from "node:child_process";
  • shell (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/src/cli/shell.bundle.test.ts :1 import { execFile } from "node:child_process";
  • shell sairam0424-ag-bash-f1d3fd4/packages/bash/src/commands/ag-convert/ag-convert.ts :1 import { spawnSync } from "node:child_process";
show 28 more
  • shell (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/src/commands/history/history.test.ts :24 // history -c and verify in same exec (each exec is a new shell)
  • shell (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/src/commands/js-exec/js-exec.esm.test.ts :30 "import { execSync } from 'node:child_process';\nconsole.log(execSync('echo hi').trim());\n",
  • shell (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/src/commands/js-exec/js-exec.exec.test.ts :10 `js-exec -c "const cp = require('child_process'); console.log(cp.execSync('echo hello').trim())"`,
  • shell (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/src/commands/js-exec/js-exec.node-compat.test.ts :395 `js-exec -m -c "import { execSync } from 'node:child_process'; const out = execSync('echo hello'); console.log(out.trim())"`,
  • shell sairam0424-ag-bash-f1d3fd4/packages/bash/src/commands/js-exec/js-exec.ts :91 execSync(cmd) throws on non-zero exit, returns stdout
  • shell (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/src/commands/pwd/pwd.test.ts :29 // cd and pwd must be in same exec (each exec is a new shell)
  • shell (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/src/commands/python3/python3.security.test.ts :85 "python3 -c \"import sys; sys.path.insert(0,'/tmp'); exec('try:\\n import evil\\n print(chr(86)+chr(85)+chr(76)+chr(78))\\nexcept SystemError:\\n print(chr(86)+chr(85)+chr(76)+chr(78))\\nexcept Import
  • shell (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/src/commands/tar/tar.bundle.test.ts :1 import { execFile } from "node:child_process";
  • shell sairam0424-ag-bash-f1d3fd4/packages/bash/src/commands/worker-bridge/sync-backend.ts :86 private execSync(
  • shell (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/src/comparison-tests/cd.comparison.test.ts :41 // All commands in same exec (each exec is isolated like a new shell)
  • shell (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/src/comparison-tests/fixture-runner.ts :1 import { exec } from "node:child_process";
  • shell (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/src/comparison-tests/parse-errors.comparison.test.ts :1 import { execSync } from "node:child_process";
  • shell (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/src/execution/ExecutionPipeline.test.ts :53 * model persistence/state across exec() calls on the SAME instance.
  • shell sairam0424-ag-bash-f1d3fd4/packages/bash/src/execution/types.ts :34 /** The raw script string passed to exec() */
  • shell sairam0424-ag-bash-f1d3fd4/packages/bash/src/interpreter/helpers/xtrace.ts :122 // Need to escape $ ` \ " in double quotes
  • shell sairam0424-ag-bash-f1d3fd4/packages/bash/src/interpreter/interpreter.ts :1242 // Append extra args injected via exec({ args }) and consume them so only
  • shell sairam0424-ag-bash-f1d3fd4/packages/bash/src/interpreter/types.ts :422 /** Extra arguments injected via exec({ args }), appended to first command's args */
  • shell sairam0424-ag-bash-f1d3fd4/packages/bash/src/lsp/LSPConnection.ts :1 import { type ChildProcess, spawn } from "node:child_process";
  • shell sairam0424-ag-bash-f1d3fd4/packages/bash/src/network/allow-list/shared.ts :147 exec(
  • shell (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/src/readme.test.ts :10 import { execSync } from "node:child_process";
  • shell (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/src/regex/user-regex.test.ts :54 describe("exec()", () => {
  • shell sairam0424-ag-bash-f1d3fd4/packages/bash/src/regex/user-regex.ts :28 exec(input: string): RegExpExecArray | null;
  • shell (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/src/sandbox/Sandbox.test.ts :32 // Define and call recursive function in same exec (each exec is a new shell)
  • shell (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/src/security/attacks/defense-dynamic-import-builtin.test.ts :1 import { execFile } from "node:child_process";
  • shell (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/src/security/attacks/js-exec-host-runtime-breakout-probes.test.ts :13 const cp = require('child_process');
  • shell (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/src/security/attacks/js-exec-recursion-guard-bypass.test.ts :9 it("blocks nested js-exec via child_process.execSync", async () => {
  • shell sairam0424-ag-bash-f1d3fd4/packages/bash/src/security/defense-in-depth-box.ts :15 * - Reference counting for nested exec() calls
  • shell (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/src/security/defense-in-depth-hardening.test.ts :1063 const { execFile } = await import("node:child_process");

19 more not shown — this panel samples each group; the count above is the real total.

network 17

  • net (weak) sairam0424-ag-bash-f1d3fd4/examples/website/app/components/Terminal.tsx :18 const response = await fetch("/api/fs");
  • net (weak) sairam0424-ag-bash-f1d3fd4/examples/website/app/opengraph-image.tsx :14 const font = await fetch(
  • net sairam0424-ag-bash-f1d3fd4/packages/agent-bridge/src/adapters.ts :73 const response = await fetch(this.apiEndpoint, {
  • net sairam0424-ag-bash-f1d3fd4/packages/agent-bridge/src/index.ts :116 const response = await fetch(apiEndpoint, {
  • net (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/src/agent-examples/multi-file-migration.test.ts :51 "/project/src/server.js": `const http = require('http');
  • net (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/src/agent-examples/text-processing-workflows.test.ts :521 fetch(url)
  • net sairam0424-ag-bash-f1d3fd4/packages/bash/src/commands/curl/curl.ts :220 const result = await ctx.fetch(url, {
  • net sairam0424-ag-bash-f1d3fd4/packages/bash/src/commands/js-exec/fetch-polyfill.ts :4 * Provides URLSearchParams, URL, Headers, Response, Request, and fetch().
  • net (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/src/commands/js-exec/js-exec.http.test.ts :33 `js-exec -c "fetch('http://example.com').then(function(r) { console.log('status: ' + r.status); }, function(e) { console.log('error: ' + e.message); })"`,
  • net (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/src/commands/js-exec/js-exec.node-compat.test.ts :1182 it("should give clear error for require('http') with fetch hint and help pointer", async () => {
  • net (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/src/commands/js-exec/js-exec.security.test.ts :14 // require('http') should throw (not a supported module)
  • net sairam0424-ag-bash-f1d3fd4/packages/bash/src/commands/js-exec/js-exec.ts :120 fetch(url, opts) HTTP; returns Promise<Response> (Web Fetch API)
show 5 more
  • net sairam0424-ag-bash-f1d3fd4/packages/bash/src/commands/js-exec/module-shims.ts :541 http: "Use fetch() for HTTP requests.",
  • net (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/src/network/allow-list/dns-rebinding.test.ts :177 // Request proceeds to fetch (which would fail naturally)
  • net sairam0424-ag-bash-f1d3fd4/packages/bash/src/network/fetch.ts :37 * allowed to proceed to the real fetch (which performs its own bounded
  • net sairam0424-ag-bash-f1d3fd4/packages/bash/src/services/McpClient.ts :177 const response = await fetch(this.url, {
  • net sairam0424-ag-bash-f1d3fd4/vendor/cpython-emscripten/python.cjs :1 ect;xhr.send(null)})}var response=await fetch(url,{credentials:"same-origin"});if(response.ok){return response.arrayBuffer()}throw new Error(response.status+" : "+response.url)}}}else{}var out=console

secrets 2

  • secrets (weak) sairam0424-ag-bash-f1d3fd4/examples/custom-command/commands.ts :190 const apiKey = process.env.AI_GATEWAY_API_KEY;
  • secrets (weak) sairam0424-ag-bash-f1d3fd4/examples/custom-command/main.ts :77 if (process.env.AI_GATEWAY_API_KEY) {

install hooks 2

  • postinstall sairam0424-ag-bash-f1d3fd4/packages/bash/package.json :128 node scripts/setup-vendor.js
  • prepublishOnly sairam0424-ag-bash-f1d3fd4/packages/bash/package.json :138 pnpm prepublish:ci

declared dependencies 7

  • @biomejs/biome@^2.3.10
  • @changesets/changelog-github@^0.7.0
  • @changesets/cli@^2.31.0
  • @types/node@^25.0.3
  • esbuild@^0.27.2
  • typescript@^5.9.3
  • vitest@^4.0.16

perm:untrusted 1

  • untrusted (weak) sairam0424-ag-bash-f1d3fd4/packages/bash/src/commands/js-exec/js-exec.http.test.ts :33 `js-exec -c "fetch('http://example.com').then(function(r) { console.log('status: ' + r.status); }, function(e) { console.log('error: ' + e.message); })"`,

transport_posture 1

  • punycode (IDN homograph) host in endpoint sairam0424-ag-bash-f1d3fd4/packages/bash/src/network/allow-list/bypass.test.ts :417 await expectBlocked(env, "https://xn--pi-7ba.example.com/data");