MCP Observatory
4m ago Tracked 26,652 Last 4m ago 24h 1,625
github analyzed 35a77c7

scopeblind/scopeblind-gateway

github

Signed receipts and Cedar policies for AI agent tool calls. Claude Code hooks, MCP gateway.

maintainer
scopeblind
license
—
first seen
2026-06-03
last seen
2026-06-03
releases · 30d
0
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 8 tools
transport stdio · http verified reported listed in the official MCP registry counts 8 tools · 0 res · 0 prompts permission surface via code analysis

tools

  • delete_file
  • deploy
  • github_create_pr
  • pms_book_fill
  • read_file
  • send_email
  • web_search
  • write_file
skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 35a77c7 · analyzer v28 · 3d ago

skills & prompt files 1

code evidence vHEAD · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 105

filesystem 26

  • fs ScopeBlind-scopeblind-gateway-35a77c7/dist/chunk-5AYAOZ34.mjs :10 import { readFileSync } from "fs";
  • fs ScopeBlind-scopeblind-gateway-35a77c7/dist/chunk-5WH4VGW2.mjs :11 import { readFileSync } from "fs";
  • fs ScopeBlind-scopeblind-gateway-35a77c7/dist/chunk-FGCNKEEW.mjs :7 import { readFileSync, readdirSync, existsSync } from "fs";
  • fs ScopeBlind-scopeblind-gateway-35a77c7/dist/chunk-SOJBLPPX.mjs :6 import { readFileSync, existsSync } from "fs";
  • fs ScopeBlind-scopeblind-gateway-35a77c7/dist/chunk-YJPBADHC.mjs :28 import { appendFileSync, readFileSync, existsSync, readdirSync, statSync } from "fs";
  • fs ScopeBlind-scopeblind-gateway-35a77c7/dist/chunk-ZX7MTVDL.mjs :19 import { readFileSync, writeFileSync, existsSync } from "fs";
  • fs ScopeBlind-scopeblind-gateway-35a77c7/dist/cli.js :213 import_node_fs = require("fs");
  • fs ScopeBlind-scopeblind-gateway-35a77c7/dist/cli.mjs :43 import { readFileSync as readFileSyncCli, existsSync as existsSyncCli, appendFileSync as appendFileSyncCli, mkdirSync as mkdirSyncCli, readdirSync as readdirSyncCli, writeFileSync as writeFileSyncCli
  • fs ScopeBlind-scopeblind-gateway-35a77c7/dist/hook-server.js :28 var import_node_fs6 = require("fs");
  • fs ScopeBlind-scopeblind-gateway-35a77c7/dist/mcp-server.js :30 var import_node_fs2 = require("fs");
  • fs ScopeBlind-scopeblind-gateway-35a77c7/dist/receipt-registry-6CAOY6RP.mjs :5 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
  • fs ScopeBlind-scopeblind-gateway-35a77c7/dist/sample-O3KYZWOX.mjs :7 import { existsSync, mkdirSync, writeFileSync } from "fs";
  • fs ScopeBlind-scopeblind-gateway-35a77c7/src/cedar-evaluator.ts :13 import { readFileSync, readdirSync, existsSync } from 'node:fs';
  • fs ScopeBlind-scopeblind-gateway-35a77c7/src/cli.ts :44 import { readFileSync as readFileSyncCli, existsSync as existsSyncCli, appendFileSync as appendFileSyncCli, mkdirSync as mkdirSyncCli, readdirSync as readdirSyncCli, writeFileSync as writeFileSyncCli
  • fs ScopeBlind-scopeblind-gateway-35a77c7/src/connector-pilots.ts :1 import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
  • fs ScopeBlind-scopeblind-gateway-35a77c7/src/evidence-store.ts :12 import { readFileSync, writeFileSync, existsSync } from 'node:fs';
  • fs ScopeBlind-scopeblind-gateway-35a77c7/src/gateway.ts :4 import { appendFileSync, readFileSync } from 'node:fs';
  • fs ScopeBlind-scopeblind-gateway-35a77c7/src/hook-server.ts :29 import { appendFileSync, readFileSync, existsSync, readdirSync, statSync } from 'node:fs';
  • fs ScopeBlind-scopeblind-gateway-35a77c7/src/http-server.ts :18 import { readFileSync, existsSync } from 'node:fs';
  • fs ScopeBlind-scopeblind-gateway-35a77c7/src/policy-digest.ts :32 import { readFileSync, readdirSync, existsSync } from 'node:fs';
  • fs ScopeBlind-scopeblind-gateway-35a77c7/src/policy.ts :2 import { readFileSync } from 'node:fs';
  • fs ScopeBlind-scopeblind-gateway-35a77c7/src/receipt-registry.ts :2 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
  • fs ScopeBlind-scopeblind-gateway-35a77c7/src/report.ts :12 import { readFileSync, existsSync } from 'node:fs';
  • fs ScopeBlind-scopeblind-gateway-35a77c7/src/sample.ts :18 import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
  • fs ScopeBlind-scopeblind-gateway-35a77c7/src/signing.ts :12 import { readFileSync, existsSync } from 'node:fs';
  • fs ScopeBlind-scopeblind-gateway-35a77c7/src/simulate.ts :12 import { readFileSync } from 'node:fs';

shell / exec 8

  • shell ScopeBlind-scopeblind-gateway-35a77c7/dist/chunk-ZX7MTVDL.mjs :592 import { spawn } from "child_process";
  • shell ScopeBlind-scopeblind-gateway-35a77c7/dist/cli.js :1591 import_node_child_process = require("child_process");
  • shell ScopeBlind-scopeblind-gateway-35a77c7/dist/cli.mjs :1242 const { execFile } = await import("child_process");
  • shell ScopeBlind-scopeblind-gateway-35a77c7/dist/index.mjs :1106 const { execSync } = await import("child_process");
  • shell ScopeBlind-scopeblind-gateway-35a77c7/src/cli.ts :1406 const { execFile } = await import('node:child_process');
  • shell ScopeBlind-scopeblind-gateway-35a77c7/src/gateway.ts :1 import { spawn, type ChildProcess } from 'node:child_process';
  • shell ScopeBlind-scopeblind-gateway-35a77c7/src/sandbox.ts :221 const { execSync } = await import('node:child_process');
  • shell ScopeBlind-scopeblind-gateway-35a77c7/src/types.ts :320 /** Command to spawn (first element of child process) */

network 19

  • net ScopeBlind-scopeblind-gateway-35a77c7/dist/chunk-5AYAOZ34.mjs :230 import { createServer } from "http";
  • net ScopeBlind-scopeblind-gateway-35a77c7/dist/chunk-YJPBADHC.mjs :26 import { createServer } from "http";
  • net ScopeBlind-scopeblind-gateway-35a77c7/dist/chunk-ZX7MTVDL.mjs :258 const response = await fetch(config.endpoint, {
  • net ScopeBlind-scopeblind-gateway-35a77c7/dist/cli.js :709 const response = await fetch(config.endpoint, {
  • net ScopeBlind-scopeblind-gateway-35a77c7/dist/cli.mjs :1039 state = await fetch('/api/summary').then(function(r){ return r.json(); });
  • net ScopeBlind-scopeblind-gateway-35a77c7/dist/hook-server.js :26 var import_node_http2 = require("http");
  • net ScopeBlind-scopeblind-gateway-35a77c7/dist/http-transport-TTVNALF4.mjs :10 import { createServer } from "http";
  • net ScopeBlind-scopeblind-gateway-35a77c7/dist/index.mjs :528 const response = await fetch(`${REKOR_API}/log/entries`, {
  • net ScopeBlind-scopeblind-gateway-35a77c7/dist/receipt-registry-6CAOY6RP.mjs :171 const res = await fetch(endpoint, {
  • net ScopeBlind-scopeblind-gateway-35a77c7/src/cli.ts :1202 state = await fetch('/api/summary').then(function(r){ return r.json(); });
  • net ScopeBlind-scopeblind-gateway-35a77c7/src/external-pdp.ts :38 const response = await fetch(config.endpoint, {
  • net ScopeBlind-scopeblind-gateway-35a77c7/src/hook-server.ts :27 import { createServer, type IncomingMessage, type ServerResponse, type Server } from 'node:http';
  • net ScopeBlind-scopeblind-gateway-35a77c7/src/http-server.ts :17 import { createServer, type Server, type IncomingMessage, type ServerResponse } from 'node:http';
  • net ScopeBlind-scopeblind-gateway-35a77c7/src/http-transport.ts :16 import { createServer, type IncomingMessage, type ServerResponse } from 'node:http';
  • net ScopeBlind-scopeblind-gateway-35a77c7/src/notifications.ts :90 const response = await fetch(
  • net ScopeBlind-scopeblind-gateway-35a77c7/src/receipt-registry.ts :288 const res = await fetch(endpoint, {
  • net ScopeBlind-scopeblind-gateway-35a77c7/src/rekor-anchor.ts :86 const response = await fetch(`${REKOR_API}/log/entries`, {
  • net ScopeBlind-scopeblind-gateway-35a77c7/src/sandbox.ts :237 const response = await fetch('https://api.e2b.dev/sandboxes', {
  • net ScopeBlind-scopeblind-gateway-35a77c7/src/scopeblind-bridge.ts :117 const res = await fetch(`${this.base}/fn/console/${slug}/receipts`, {

secrets 7

  • secrets ScopeBlind-scopeblind-gateway-35a77c7/dist/chunk-ZX7MTVDL.mjs :569 const twilioToken = process.env.TWILIO_AUTH_TOKEN;
  • secrets ScopeBlind-scopeblind-gateway-35a77c7/dist/cli.js :1233 const twilioToken = process.env.TWILIO_AUTH_TOKEN;
  • secrets ScopeBlind-scopeblind-gateway-35a77c7/dist/cli.mjs :1321 token: typeof body.token === "string" && body.token.trim() ? body.token.trim() : process.env.SCOPEBLIND_TOKEN,
  • secrets ScopeBlind-scopeblind-gateway-35a77c7/dist/index.mjs :1043 const runtime = config.runtime || (config.apiKey || process.env.E2B_API_KEY ? "e2b" : "docker");
  • secrets ScopeBlind-scopeblind-gateway-35a77c7/src/cli.ts :1486 token: typeof body.token === 'string' && body.token.trim() ? body.token.trim() : process.env.SCOPEBLIND_TOKEN,
  • secrets ScopeBlind-scopeblind-gateway-35a77c7/src/notifications.ts :241 const twilioToken = process.env.TWILIO_AUTH_TOKEN;
  • secrets ScopeBlind-scopeblind-gateway-35a77c7/src/sandbox.ts :128 const runtime = config.runtime || (config.apiKey || process.env.E2B_API_KEY ? 'e2b' : 'docker');

tool registrations 8

  • read_file ScopeBlind-scopeblind-gateway-35a77c7/src/demo-server.ts :249
  • write_file ScopeBlind-scopeblind-gateway-35a77c7/src/demo-server.ts :252
  • delete_file ScopeBlind-scopeblind-gateway-35a77c7/src/demo-server.ts :255
  • web_search ScopeBlind-scopeblind-gateway-35a77c7/src/demo-server.ts :258
  • deploy ScopeBlind-scopeblind-gateway-35a77c7/src/demo-server.ts :261
  • github_create_pr ScopeBlind-scopeblind-gateway-35a77c7/src/demo-server.ts :264
  • send_email ScopeBlind-scopeblind-gateway-35a77c7/src/demo-server.ts :272
  • pms_book_fill ScopeBlind-scopeblind-gateway-35a77c7/src/demo-server.ts :280

install hooks 1

  • prepublishOnly ScopeBlind-scopeblind-gateway-35a77c7/package.json :23 npm run build

declared dependencies 10

  • @modelcontextprotocol/sdk@^1.29.0
  • @veritasacta/artifacts@^0.2.2
  • @veritasacta/protocol@^0.1.0
  • @noble/curves@^1.9.7
  • @noble/hashes@^1.8.0
  • @types/node@^20.0.0
  • tsup@^8.0.0
  • typescript@^5.0.0
  • vitest@^2.1.9
  • @cedar-policy/cedar-wasm@^4.9.1