MCP Observatory
41s ago Tracked 55,861 Last 41s ago 24h 2,736
github Python analyzed bcf00ed deep scan unknown unconfirmed MCP

semcod/koru

github

Closed-loop automation across semcod/ repositories.

maintainer
semcod
licence
Apache-2.0
first seen
2026-06-04
last seen
2026-09-08
releases · 30d
1
short id

Drift inferred · capture-to-capture

  1. HIGH code analysis flagged dynamic code execution ×3 in semcod/koru
  2. HIGH code analysis flagged dynamic code execution ×3 in semcod/koru
  3. HIGH code analysis flagged dynamic code execution ×3 in semcod/koru
  4. HIGH code analysis flagged dynamic code execution ×3 in semcod/koru
  5. HIGH code analysis flagged dynamic code execution ×3 in semcod/koru
  6. HIGH code analysis flagged dynamic code execution ×3 in semcod/koru
  7. HIGH code analysis flagged dynamic code execution ×3 in semcod/koru
  8. HIGH code analysis flagged dynamic code execution ×3 in semcod/koru
  9. HIGH code analysis flagged dynamic code execution ×3 in semcod/koru
  10. HIGH code analysis flagged dynamic code execution ×3 in semcod/koru
  11. HIGH code analysis flagged dynamic code execution ×3 in semcod/koru
  12. HIGH code analysis flagged dynamic code execution ×3 in semcod/koru
  13. HIGH code analysis flagged dynamic code execution ×3 in semcod/koru
  14. HIGH code analysis flagged dynamic code execution ×3 in semcod/koru
  15. HIGH code analysis flagged dynamic code execution ×3 in semcod/koru
  16. HIGH code analysis flagged dynamic code execution ×3 in semcod/koru
  17. HIGH code analysis flagged dynamic code execution ×3 in semcod/koru
  18. HIGH code analysis flagged dynamic code execution ×3 in semcod/koru
  19. HIGH code analysis flagged dynamic code execution ×3 in semcod/koru
  20. HIGH code analysis flagged dynamic code execution ×3 in semcod/koru
capabilities 0 tools
transport stdio · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit bcf00ed · analyzer v33 · 1d ago

skills & prompt files 5

danger signals9

code evidence vv0.1.461 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 1649

filesystem 400

  • fs semcod-koru-bcf00ed/.governance/agent_host_check.py :20 from pathlib import Path
  • fs semcod-koru-bcf00ed/.governance/branch_intent_reconciliation.py :14 from pathlib import Path
  • fs semcod-koru-bcf00ed/.governance/branch_lifecycle_check.py :10 from pathlib import Path
  • fs semcod-koru-bcf00ed/.governance/change_lease_check.py :11 from pathlib import Path
  • fs semcod-koru-bcf00ed/.governance/check_required_checks.py :20 from pathlib import Path
  • fs semcod-koru-bcf00ed/.governance/decision_record.py :16 from pathlib import Path
  • fs semcod-koru-bcf00ed/.governance/generate_required_checks.py :23 from pathlib import Path
  • fs semcod-koru-bcf00ed/.governance/governance_check.py :18 from pathlib import Path
  • fs semcod-koru-bcf00ed/.governance/precommit_standard_update.py :8 import shutil
  • fs semcod-koru-bcf00ed/.governance/remediation_intent.py :13 from pathlib import Path, PurePosixPath
  • fs semcod-koru-bcf00ed/.governance/standard_pack_check.py :10 from pathlib import Path
  • fs semcod-koru-bcf00ed/.governance/standard_pack_projection_check.py :10 from pathlib import Path
show 28 more
  • fs semcod-koru-bcf00ed/.governance/templates/conftest-worktree-bootstrap.py :16 from pathlib import Path
  • fs semcod-koru-bcf00ed/.governance/ticket_activity.py :14 from pathlib import Path
  • fs semcod-koru-bcf00ed/.governance/ticket_allocation.py :12 from pathlib import Path
  • fs semcod-koru-bcf00ed/.governance/work_continuity.py :16 from pathlib import Path
  • fs semcod-koru-bcf00ed/.governance/workspace_lifecycle_check.py :14 from pathlib import Path
  • fs semcod-koru-bcf00ed/.governance/worktree_guard.py :13 from pathlib import Path
  • fs semcod-koru-bcf00ed/.governance/worktree_overlap_check.py :18 import shutil
  • fs semcod-koru-bcf00ed/.governance/worktree_path_check.py :13 from pathlib import Path, PurePath, PurePosixPath, PureWindowsPath
  • fs semcod-koru-bcf00ed/check_dups.py :17 with open(g, 'r') as gf:
  • fs semcod-koru-bcf00ed/docker/capture/smoke.py :37 from pathlib import Path
  • fs (weak) semcod-koru-bcf00ed/examples/remote_orchestration_demo.py :9 from pathlib import Path
  • fs semcod-koru-bcf00ed/packages/cli2koru/src/cli2koru/cli.py :9 from pathlib import Path
  • fs (weak) semcod-koru-bcf00ed/packages/cli2koru/tests/test_parity.py :1 from pathlib import Path
  • fs semcod-koru-bcf00ed/packages/coru/src/coru/cli.py :8 import shutil
  • fs semcod-koru-bcf00ed/packages/coru/src/coru/cli_calibration.py :12 from pathlib import Path
  • fs semcod-koru-bcf00ed/packages/coru/src/coru/cli_checks.py :14 from pathlib import Path
  • fs semcod-koru-bcf00ed/packages/coru/src/coru/cli_lane.py :14 from pathlib import Path
  • fs semcod-koru-bcf00ed/packages/coru/src/coru/cli_reexec.py :12 from pathlib import Path
  • fs semcod-koru-bcf00ed/packages/coru/src/coru/ecosystem.py :10 from pathlib import Path
  • fs semcod-koru-bcf00ed/packages/coru/src/coru/ide_detection.py :12 from pathlib import Path
  • fs semcod-koru-bcf00ed/packages/coru/src/coru/repair/diagnostics.py :7 from pathlib import Path
  • fs semcod-koru-bcf00ed/packages/coru/src/coru/repair/pipeline.py :6 import shutil
  • fs semcod-koru-bcf00ed/packages/coru/src/coru/repair/query.py :7 from pathlib import Path
  • fs semcod-koru-bcf00ed/packages/coru/src/coru/repair/runtime.py :5 from pathlib import Path
  • fs semcod-koru-bcf00ed/packages/coru/src/coru/repair/service.py :7 from pathlib import Path
  • fs semcod-koru-bcf00ed/packages/coru/src/coru/repair/store.py :6 from pathlib import Path
  • fs semcod-koru-bcf00ed/packages/coru/src/coru/repair_registry.py :6 from pathlib import Path
  • fs semcod-koru-bcf00ed/packages/coru/src/coru/supervisor/cli.py :10 from pathlib import Path

360 more not shown — this panel samples each group; the count above is the real total.

shell / exec 169

  • shell semcod-koru-bcf00ed/.governance/agent_host_check.py :16 import subprocess
  • shell semcod-koru-bcf00ed/.governance/generate_required_checks.py :21 import subprocess
  • shell semcod-koru-bcf00ed/.governance/governance_check.py :14 import subprocess
  • shell semcod-koru-bcf00ed/.governance/precommit_standard_update.py :9 import subprocess
  • shell semcod-koru-bcf00ed/.governance/templates/conftest-worktree-bootstrap.py :14 import subprocess
  • shell semcod-koru-bcf00ed/.governance/ticket_activity.py :10 import subprocess
  • shell semcod-koru-bcf00ed/.governance/work_continuity.py :18 import subprocess
  • shell semcod-koru-bcf00ed/.governance/workspace_lifecycle_check.py :11 import subprocess
  • shell semcod-koru-bcf00ed/.governance/worktree_guard.py :10 import subprocess
  • shell semcod-koru-bcf00ed/.governance/worktree_overlap_check.py :19 import subprocess
  • shell semcod-koru-bcf00ed/.governance/worktree_path_check.py :9 import subprocess
  • shell semcod-koru-bcf00ed/packages/coru/src/coru/cli.py :9 import subprocess
show 28 more
  • shell semcod-koru-bcf00ed/packages/coru/src/coru/cli_calibration.py :9 import subprocess
  • shell semcod-koru-bcf00ed/packages/coru/src/coru/ecosystem.py :6 import subprocess
  • shell semcod-koru-bcf00ed/packages/coru/src/coru/supervisor/cli.py :8 import subprocess
  • shell semcod-koru-bcf00ed/packages/coru/src/coru/supervisor/daemon_ctl.py :6 import subprocess
  • shell semcod-koru-bcf00ed/packages/coru/src/coru/supervisor/probe.py :7 import subprocess
  • shell (weak) semcod-koru-bcf00ed/packages/coru/tests/test_coru_cli.py :5 import subprocess
  • shell (weak) semcod-koru-bcf00ed/packages/dsl2coru/tests/test_dsl2coru_codec.py :1 import subprocess
  • shell semcod-koru-bcf00ed/packages/dsl2koru/src/dsl2koru/handlers/runner.py :6 import subprocess
  • shell semcod-koru-bcf00ed/packages/koruenv/src/koruenv/cli.py :8 import subprocess
  • shell semcod-koru-bcf00ed/packages/koruide/src/koruide/daemon/metadata.py :7 import subprocess
  • shell semcod-koru-bcf00ed/packages/koruide/src/koruide/host_setup.py :15 import subprocess
  • shell semcod-koru-bcf00ed/packages/koruide/src/koruide/ide.py :13 import subprocess
  • shell semcod-koru-bcf00ed/packages/koruide/src/koruide/plugin_installer.py :14 import subprocess
  • shell (weak) semcod-koru-bcf00ed/scripts/koru-gate-capture.py :18 import subprocess
  • shell (weak) semcod-koru-bcf00ed/scripts/planfile-sync-todo.py :33 import subprocess
  • shell (weak) semcod-koru-bcf00ed/scripts/subactor-development-repair-pilot.py :28 import subprocess
  • shell (weak) semcod-koru-bcf00ed/scripts/validate_testql_conversations.py :6 import subprocess
  • shell semcod-koru-bcf00ed/services/healing-webhook/app.py :35 import subprocess
  • shell semcod-koru-bcf00ed/services/healing-webhook/ticket_builder.py :23 import subprocess
  • shell semcod-koru-bcf00ed/src/koru/agents.py :10 import subprocess
  • shell semcod-koru-bcf00ed/src/koru/autoloop_cli.py :6 import subprocess
  • shell semcod-koru-bcf00ed/src/koru/autonomous.py :19 import subprocess
  • shell semcod-koru-bcf00ed/src/koru/autonomy/checkpoint/checkpoint.py :6 import subprocess
  • shell semcod-koru-bcf00ed/src/koru/autonomy/code2llm_discovery.py :19 import subprocess
  • shell semcod-koru-bcf00ed/src/koru/autonomy/cycle/cycle.py :4 import subprocess # noqa: F401
  • shell semcod-koru-bcf00ed/src/koru/autonomy/cycle/cycle_chat_activity_tickets.py :11 import subprocess
  • shell semcod-koru-bcf00ed/src/koru/autonomy/cycle_diagnostics.py :14 import subprocess
  • shell semcod-koru-bcf00ed/src/koru/autonomy/execution_plan.py :6 import subprocess

129 more not shown — this panel samples each group; the count above is the real total.

network 50

  • net semcod-koru-bcf00ed/.governance/ticket_allocation.py :13 from urllib.parse import urlparse
  • net semcod-koru-bcf00ed/.governance/work_continuity.py :23 from urllib.parse import urlsplit
  • net semcod-koru-bcf00ed/.governance/workspace_lifecycle_check.py :16 from urllib.parse import urlparse
  • net semcod-koru-bcf00ed/.governance/worktree_overlap_check.py :24 from urllib.parse import urlparse
  • net semcod-koru-bcf00ed/packages/coru/src/coru/supervisor/http_handlers.py :6 from urllib.parse import unquote
  • net semcod-koru-bcf00ed/packages/coru/src/coru/supervisor/http_server.py :8 from urllib.parse import urlparse
  • net (weak) semcod-koru-bcf00ed/packages/coru/tests/test_supervisor.py :179 import urllib.request
  • net semcod-koru-bcf00ed/packages/koruide/src/koruide/client.py :6 import socket
  • net semcod-koru-bcf00ed/packages/koruide/src/koruide/daemon/handlers.py :7 import socket
  • net semcod-koru-bcf00ed/packages/koruide/src/koruide/daemon/protocol.py :4 import socket
  • net semcod-koru-bcf00ed/packages/koruide/src/koruide/daemon/server.py :7 import socket
  • net semcod-koru-bcf00ed/packages/uri2koru/src/uri2koru/uri.py :5 from urllib.parse import quote, unquote, urlparse
show 28 more
  • net semcod-koru-bcf00ed/src/koru/autonomy/environment.py :19 import socket as _socket
  • net semcod-koru-bcf00ed/src/koru/autonomy/operator/operator_loop_interfaces.py :102 from urllib.parse import urlencode
  • net semcod-koru-bcf00ed/src/koru/autonomy/operator/operator_loop_quick_actions.py :7 from urllib.parse import parse_qs, urlparse
  • net semcod-koru-bcf00ed/src/koru/autonomy/operator_pipeline.py :14 import urllib.error
  • net semcod-koru-bcf00ed/src/koru/autopilot/install_manager.py :14 import urllib.parse
  • net semcod-koru-bcf00ed/src/koru/cli_shell.py :18 import urllib.request
  • net semcod-koru-bcf00ed/src/koru/events.py :8 import urllib.error
  • net semcod-koru-bcf00ed/src/koru/global_control.py :25 import socket
  • net semcod-koru-bcf00ed/src/koru/ide_adapters/shared.py :8 import socket
  • net semcod-koru-bcf00ed/src/koru/integrations/imgl_client.py :8 import urllib.error
  • net semcod-koru-bcf00ed/src/koru/integrations/vdisplay_agent_bootstrap.py :7 import urllib.error
  • net semcod-koru-bcf00ed/src/koru/integrations/vdisplay_client.py :15 import urllib.error
  • net semcod-koru-bcf00ed/src/koru/local_manager_client.py :8 import urllib.error
  • net semcod-koru-bcf00ed/src/koru/queue/runners.py :11 import urllib.error
  • net semcod-koru-bcf00ed/src/koru/remote/client.py :2 import urllib.error
  • net semcod-koru-bcf00ed/src/koru/self_control.py :11 import urllib.parse
  • net semcod-koru-bcf00ed/src/koru/wizard/gui/server.py :5 import socket
  • net semcod-koru-bcf00ed/src/koru/wizard/templates.py :8 import urllib.error
  • net semcod-koru-bcf00ed/src/koruapi/dashboard_http.py :9 from urllib.parse import parse_qs, urlparse
  • net semcod-koru-bcf00ed/src/koruapi/dashboard_projects.py :10 from urllib.parse import unquote, urlparse
  • net semcod-koru-bcf00ed/src/koruapi/dashboard_routes.py :15 from urllib.parse import parse_qs, urlencode, urlparse
  • net semcod-koru-bcf00ed/src/koruapi/dashboard_state.py :6 import socket
  • net semcod-koru-bcf00ed/src/koruapi/desktop_uri.py :8 from urllib.parse import parse_qsl, urlencode, urlsplit, urlunsplit
  • net semcod-koru-bcf00ed/src/koruapi/server.py :10 from urllib.parse import parse_qs, urlparse
  • net semcod-koru-bcf00ed/src/korumesh/browser_capture.py :9 from urllib.parse import parse_qs, urlparse
  • net semcod-koru-bcf00ed/src/koruobserve/lifecycle.py :11 import socket
  • net semcod-koru-bcf00ed/src/koruvision/mesh.py :11 import socket
  • net (weak) semcod-koru-bcf00ed/tests/test_autonomy_environment.py :6 import socket as _socket

10 more not shown — this panel samples each group; the count above is the real total.

secrets 10

  • secrets semcod-koru-bcf00ed/packages/coru/src/coru/cli.py :2655 return use_llm or bool((os.environ.get("OPENROUTER_API_KEY") or "").strip())
  • secrets semcod-koru-bcf00ed/packages/koruide/src/koruide/ide.py :589 bool(os.environ.get("WINDSURF_CSRF_TOKEN")) and "cursor" not in chrome
  • secrets semcod-koru-bcf00ed/src/koru/agents.py :306 openrouter_ready = bool(os.getenv("OPENROUTER_API_KEY"))
  • secrets semcod-koru-bcf00ed/src/koru/autonomy/planning_llm_runtime.py :16 return os.environ.get("ZAI_API_KEY", "").strip()
  • secrets semcod-koru-bcf00ed/src/koru/cli_tillm_setup.py :15 import getpass
  • secrets semcod-koru-bcf00ed/src/koru/global_control.py :22 import getpass
  • secrets semcod-koru-bcf00ed/src/koru/integrations/vdisplay/portal_input.py :183 tok = os.environ.get("KORU_VDISPLAY_PORTAL_TOKEN") or None
  • secrets semcod-koru-bcf00ed/src/koru/work/llm_provenance.py :122 if os.environ.get("OPENROUTER_API_KEY", "").strip():
  • secrets semcod-koru-bcf00ed/src/koruvision/providers/obs_websocket.py :30 return os.environ.get("KORU_OBS_PASSWORD", "").strip()
  • secrets (weak) semcod-koru-bcf00ed/tests/test_dotenv_loader.py :110 os.environ.get("OPENROUTER_API_KEY"),

database 3

  • db semcod-koru-bcf00ed/src/koru/ide_adapters/shared.py :9 import sqlite3
  • db semcod-koru-bcf00ed/src/koru/repair_runs/sqlite_store.py :15 import sqlite3
  • db (weak) semcod-koru-bcf00ed/tests/test_ide_adapters.py :6 import sqlite3

declared dependencies 62

  • gillm@>=0.1.24
  • jsonschema@>=4.0,<5.0
  • pyyaml@>=6.0,<7.0
  • rich@>=14.3.4
  • korullm@>=0.1.0,<2.0
  • tillm@>=0.1.35
  • websockets@>=12.0,<17.0
  • mss@>=9.0,<11.0
  • vdisplay@>=0.1.58
  • nlp2uri@>=0.4.7
  • env2llm@>=0.1.14
  • planfile@>=0.1.117
show 28 more
  • testql@>=1.2.64
  • httpx@>=0.27,<1.0
  • curllm@>=1.0.0
  • playwright@>=1.40,<2.0
  • pytest@>=8.0,<10.0
  • pytest-cov@>=5.0,<8.0
  • pytest-rerunfailures@>=14.0,<17.0
  • pytest-timeout@>=2.3,<3.0
  • pytest-xdist@>=3.0,<4.0
  • ruff@>=0.11,<0.16
  • mypy@>=1.11,<3.0
  • pyright@>=1.1.390,<2.0
  • hypothesis@>=6.112,<7.0
  • pre-commit@>=3.8,<5.0
  • types-PyYAML@>=6.0,<7.0
  • cryptography@>=42.0,<50.0
  • goal@>=2.2.0
  • costs@>=0.1.53; python_version >=
  • 3.10@*
  • fastapi@>=0.115,<1.0
  • uvicorn@>=0.30,<1.0
  • prometheus-client@>=0.21,<1.0
  • instructor@>=1.6,<2.0
  • litellm@>=1.51,<2.0
  • openai@>=1.54,<3.0
  • tiktoken@>=0.8,<1.0
  • fullm@>=0.1.22
  • nfo@>=0.2.22,<1.0

22 more not shown — this panel samples each group; the count above is the real total.

clipboard 6

  • clipboard shell call semcod-koru-bcf00ed/src/koru/init_host_environment.py :100 "xclip": shutil.which("xclip") is not None,
  • clipboard shell call semcod-koru-bcf00ed/src/koru/integrations/vdisplay_client.py :4623 if shutil.which("wl-copy"):
  • clipboard shell call semcod-koru-bcf00ed/tests/test_decision_engine.py :107 "winning_paste": "host-clipboard:wl-copy+xdotool key ctrl+v",
  • clipboard shell call semcod-koru-bcf00ed/tests/test_docker_ide_matrix.py :144 assert "wl-copy" in source
  • clipboard shell call semcod-koru-bcf00ed/tests/test_docker_ide_matrix_config.py :39 "wl-copy",
  • clipboard shell call semcod-koru-bcf00ed/tests/test_drive_orchestrator.py :94 "winning_paste": "host-clipboard:wl-copy+xdotool key ctrl+v",

cursor-plugin 2

  • opaque (low) semcod-koru-bcf00ed/.cursor/rules/new-project-standard.mdc bundled .cursor/ plugin descriptor (semcod-koru-bcf00ed/.cursor/rules/new-project-standard.mdc) — presence-detected; review the descriptor
  • opaque (low) semcod-koru-bcf00ed/.cursor/settings.json bundled .cursor/ plugin descriptor (semcod-koru-bcf00ed/.cursor/settings.json) — presence-detected; review the descriptor

ide-extension 13

  • eager-activation (medium) semcod-koru-bcf00ed/plugins/koru-autopilot-antigravity/package.json activationEvents includes "*" — runs on every window load
  • eager-activation (medium) semcod-koru-bcf00ed/plugins/koru-autopilot-cursor/package.json activationEvents includes "*" — runs on every window load
  • eager-activation (medium) semcod-koru-bcf00ed/plugins/koru-autopilot-vscode/package.json activationEvents includes "*" — runs on every window load
  • eager-activation (medium) semcod-koru-bcf00ed/plugins/koru-autopilot-vscodium/package.json activationEvents includes "*" — runs on every window load
  • eager-activation (medium) semcod-koru-bcf00ed/plugins/koru-autopilot-windsurf/package.json activationEvents includes "*" — runs on every window load
  • eager-activation (medium) semcod-koru-bcf00ed/src/koru/assets/koru-autopilot-vscode/koru-autopilot-0.1.29.vsix!/extension/package.json activationEvents includes "*" — runs on every window load
  • eager-activation (medium) semcod-koru-bcf00ed/src/koru/assets/koru-autopilot-vscode/koru-autopilot-0.1.30.vsix!/extension/package.json activationEvents includes "*" — runs on every window load
  • eager-activation (medium) semcod-koru-bcf00ed/src/koru/assets/koru-autopilot-vscode/koru-autopilot-0.1.32.vsix!/extension/package.json activationEvents includes "*" — runs on every window load
  • eager-activation (medium) semcod-koru-bcf00ed/src/koru/assets/koru-autopilot-vscode/koru-autopilot-0.1.36.vsix!/extension/package.json activationEvents includes "*" — runs on every window load
  • eager-activation (medium) semcod-koru-bcf00ed/src/koru/assets/koru-autopilot-vscode/koru-autopilot-0.1.38.vsix!/extension/package.json activationEvents includes "*" — runs on every window load
  • eager-activation (medium) semcod-koru-bcf00ed/src/koru/assets/koru-autopilot-vscode/koru-autopilot-0.1.39.vsix!/extension/package.json activationEvents includes "*" — runs on every window load
  • eager-activation (medium) semcod-koru-bcf00ed/src/koru/assets/koru-autopilot-vscode/koru-autopilot-0.1.40.vsix!/extension/package.json activationEvents includes "*" — runs on every window load
show 1 more
  • eager-activation (medium) semcod-koru-bcf00ed/src/koru/assets/koru-autopilot-vscode/koru-autopilot-0.2.13.vsix!/extension/package.json activationEvents includes "*" — runs on every window load

jetbrains-plugin 1

  • opaque (low) semcod-koru-bcf00ed/plugins/koru-autopilot-jetbrains/src/main/resources/META-INF/plugin.xml bundled JetBrains plugin "koru Autopilot" (semcod-koru-bcf00ed/plugins/koru-autopilot-jetbrains/src/main/resources/META-INF/plugin.xml) — presence-detected; review the plugin descriptor

transport_posture 1

  • network-listening, binds all interfaces, no auth detected semcod-koru-bcf00ed/tests/test_serve.py :689 host="0.0.0.0",