github TypeScript re-analysis due

sandbaseai/sandbase-harness

github

Local-first, self-hosted AI agent runtime and MCP bridge with sandboxed sessions, memory, credentials, audit/replay, and a local Console.

maintainer
sandbaseai
licence
Apache-2.0
first seen
2026-08-14
last seen
2026-09-14
releases · 30d
6
short id

sandbaseai/sandbase-harness is an MCP server distributed on github, maintained by sandbaseai, tracked here since August 2026. It has shipped 9 releases and exposes 6 tools. Tools include create_session, get_session, list_agents, list_artifacts, run_session, stop_session. Its composite risk grade is B — an inferred review prompt computed from observed signals, not a verdict.

what we found

Reading the source raised one review prompt — dangerous code — each a pattern worth a human look rather than a finding of fault.

Its 6 tools appear to reach filesystem, shell / exec, network and secrets, inferred from tool names, descriptions and input schemas rather than from observed behaviour.

full security breakdown →
tools 6
  • create_session
  • get_session
  • list_agents
  • list_artifacts
  • run_session
  • stop_session
release cadence · 90d 9 releases
06-18 00:00 08-01 00:00 now
recent releases last 9
version date src
v0.3.8 2026-08-30 github
v0.3.7 2026-08-20 github
v0.3.6 2026-08-20 github
v0.3.5 2026-08-20 github
v0.3.4 2026-08-19 github
v0.3.3 2026-08-19 github
v0.3.2 2026-08-15 github
v0.3.1 2026-08-15 github
v0.3.0 2026-08-14 github

view all →