semcod/koru
github Python analyzed 628d1ff deep scan · partial (1,158/3,958 files)
unconfirmed MCP
Closed-loop automation across semcod/ repositories.
drift
- HIGH code analysis flagged dynamic code execution ×4 in semcod/koru
- HIGH code analysis flagged dynamic code execution ×4 in semcod/koru
- HIGH code analysis flagged dynamic code execution ×4 in semcod/koru
- HIGH code analysis flagged dynamic code execution ×4 in semcod/koru
- HIGH code analysis flagged dynamic code execution ×4 in semcod/koru
- HIGH code analysis flagged dynamic code execution ×4 in semcod/koru
- HIGH code analysis flagged dynamic code execution ×4 in semcod/koru
- HIGH code analysis flagged dynamic code execution ×4 in semcod/koru
- HIGH code analysis flagged dynamic code execution ×4 in semcod/koru
- HIGH code analysis flagged dynamic code execution ×4 in semcod/koru
- HIGH code analysis flagged dynamic code execution ×4 in semcod/koru
- HIGH code analysis flagged dynamic code execution ×4 in semcod/koru
- HIGH code analysis flagged dynamic code execution ×4 in semcod/koru
- HIGH code analysis flagged dynamic code execution ×4 in semcod/koru
- HIGH code analysis flagged dynamic code execution ×4 in semcod/koru
- HIGH code analysis flagged dynamic code execution ×4 in semcod/koru
- HIGH code analysis flagged dynamic code execution ×4 in semcod/koru
- HIGH code analysis flagged dynamic code execution ×4 in semcod/koru
- HIGH code analysis flagged dynamic code execution ×4 in semcod/koru
- HIGH code analysis flagged dynamic code execution ×4 in semcod/koru
capabilities
transport stdio · http counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
skills & danger signals
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit 628d1ff · analyzer v33 · 1d ago
skills & prompt files 5
- agent-rules .cursor/rules/new-project-standard.mdc
- agent-rules .github/copilot-instructions.md
- agent-rules AGENTS.md
- agent-rules CLAUDE.md
- agent-rules GEMINI.md
danger signals11
- dynamic code execution __import__() packages/coru/src/coru/cli_startup.py :486
__import__(module_name) - dynamic code execution __import__ sink src/koru/autopilot/diagnose_vdisplay_cli.py :47
source = __import__("os").environ.get("KORU_VDISPLAY_SOURCE", "DP-1") - dynamic code execution __import__ sink src/koru/autopilot/vdisplay_up_cli.py :12
explicit = __import__("os").environ.get("KORU_VDISPLAY_SOURCE", "").strip() - dynamic code execution __import__() src/koru/cli.py :150
return getattr(__import__(module_name, fromlist=[attr_name]), attr_name)(argv) - dynamic code execution __import__() src/koru/cli/__init__.py :103
value = getattr(__import__(module_name, fromlist=[attr_name]), attr_name) - dynamic code execution unsafe yaml.load() src/koru/context_sprint.py :23
return yaml.load(f, Loader=loader) - dynamic code execution unsafe yaml.load() src/koru/planfile_compat.py :86
document = yaml.load(stream, Loader=_yaml_loader()) - dynamic code execution eval()/exec() test_openrouter_simple.py :56
exec(code, namespace) - dynamic code execution __import__ sink tests/test_ide_doctor_cli.py :375
assert "KORU_AUTOPILOT_INSTANCE" not in __import__("os").environ - dynamic code execution __import__ sink tests/test_loop.py :88
with patch("koru.loop.os.scandir", wraps=__import__("os").scandir) as scan: - dynamic code execution __import__ sink tests/test_vdisplay_env_session.py :20
assert "KORU_AUTONOMY_SESSION_DIR" not in __import__("os").environ
code evidence
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 1853
filesystem 400
- fs .governance/agent_host_check.py :20
from pathlib import Path - fs .governance/branch_intent_reconciliation.py :14
from pathlib import Path - fs .governance/branch_lifecycle_check.py :10
from pathlib import Path - fs .governance/change_lease_check.py :11
from pathlib import Path - fs .governance/check_required_checks.py :22
from pathlib import Path - fs .governance/decision_record.py :16
from pathlib import Path - fs .governance/docs_gate.py :11
from pathlib import Path - fs .governance/generate_required_checks.py :23
from pathlib import Path - fs .governance/governance_check.py :19
from pathlib import Path - fs .governance/precommit_standard_update.py :8
import shutil - fs .governance/prune_merged_worktrees.py :18
from pathlib import Path - fs .governance/publication-policy/ruleset_readback.py :29
from pathlib import Path
show 28 more
- fs .governance/remediation_intent.py :13
from pathlib import Path, PurePosixPath - fs .governance/snapshot_migration.py :9
from pathlib import Path - fs .governance/standard_pack_check.py :10
from pathlib import Path - fs .governance/standard_pack_projection_check.py :10
from pathlib import Path - fs .governance/templates/conftest-worktree-bootstrap.py :16
from pathlib import Path - fs (weak) .governance/tests/test_docs_gate.py :10
from pathlib import Path - fs .governance/ticket_activity.py :15
from pathlib import Path - fs .governance/ticket_allocation.py :12
from pathlib import Path - fs .governance/ticket_index_merge_driver.py :13
from pathlib import Path - fs .governance/ticket_input.py :14
from pathlib import Path - fs .governance/ticket_recovery.py :16
from pathlib import Path - fs .governance/ticket_storage.py :11
from pathlib import Path - fs .governance/work_continuity.py :17
from pathlib import Path - fs .governance/work_start_check.py :10
from pathlib import Path - fs .governance/workspace_lifecycle_check.py :14
from pathlib import Path - fs .governance/worktree_guard.py :13
from pathlib import Path - fs .governance/worktree_overlap_check.py :18
import shutil - fs .governance/worktree_path_check.py :13
from pathlib import Path, PurePath, PurePosixPath, PureWindowsPath - fs check_dups.py :17
with open(g, 'r') as gf: - fs docker/capture/smoke.py :37
from pathlib import Path - fs (weak) examples/remote_orchestration_demo.py :9
from pathlib import Path - fs packages/cli2koru/src/cli2koru/cli.py :9
from pathlib import Path - fs (weak) packages/cli2koru/tests/test_parity.py :1
from pathlib import Path - fs packages/coru/src/coru/cli.py :8
import shutil # noqa: F401 - fs packages/coru/src/coru/cli_calibration.py :12
from pathlib import Path - fs packages/coru/src/coru/cli_checks.py :14
from pathlib import Path - fs packages/coru/src/coru/cli_daemon.py :12
from pathlib import Path - fs packages/coru/src/coru/cli_diagnose.py :9
from pathlib import Path
shell / exec 227
- shell .governance/agent_host_check.py :17
import subprocess - shell .governance/check_required_checks.py :19
import subprocess - shell .governance/docs_gate.py :8
import subprocess - shell .governance/generate_required_checks.py :21
import subprocess - shell .governance/governance_check.py :14
import subprocess - shell .governance/precommit_standard_update.py :9
import subprocess - shell .governance/prune_merged_worktrees.py :16
import subprocess - shell .governance/publication-policy/ruleset_readback.py :26
import subprocess - shell .governance/snapshot_migration.py :12
import subprocess - shell .governance/templates/conftest-worktree-bootstrap.py :14
import subprocess - shell (weak) .governance/tests/test_docs_gate.py :6
import subprocess - shell .governance/ticket_activity.py :10
import subprocess
show 28 more
- shell .governance/ticket_index_merge_driver.py :11
import subprocess - shell .governance/ticket_input.py :17
import subprocess - shell .governance/ticket_storage.py :14
import subprocess - shell .governance/work_continuity.py :19
import subprocess - shell .governance/work_start_check.py :12
import subprocess - shell .governance/workspace_lifecycle_check.py :11
import subprocess - shell .governance/worktree_guard.py :10
import subprocess - shell .governance/worktree_overlap_check.py :19
import subprocess - shell .governance/worktree_path_check.py :9
import subprocess - shell packages/coru/src/coru/cli.py :9
import subprocess - shell packages/coru/src/coru/cli_calibration.py :9
import subprocess - shell packages/coru/src/coru/cli_daemon.py :8
import subprocess - shell packages/coru/src/coru/cli_diagnose.py :6
import subprocess - shell packages/coru/src/coru/cli_doctor.py :8
import subprocess - shell packages/coru/src/coru/cli_startup.py :8
import subprocess - shell packages/coru/src/coru/ecosystem.py :6
import subprocess - shell packages/coru/src/coru/supervisor/cli.py :8
import subprocess - shell packages/coru/src/coru/supervisor/daemon_ctl.py :6
import subprocess - shell packages/coru/src/coru/supervisor/probe.py :7
import subprocess - shell (weak) packages/coru/tests/test_coru_cli.py :5
import subprocess - shell (weak) packages/dsl2coru/tests/test_dsl2coru_codec.py :1
import subprocess - shell packages/dsl2koru/src/dsl2koru/handlers/runner.py :6
import subprocess - shell packages/koruenv/src/koruenv/cli.py :8
import subprocess - shell packages/koruide/src/koruide/daemon/metadata.py :7
import subprocess - shell packages/koruide/src/koruide/host_setup.py :15
import subprocess - shell packages/koruide/src/koruide/ide.py :13
import subprocess - shell packages/koruide/src/koruide/plugin_installer.py :14
import subprocess - shell (weak) scripts/install-benchmark-timer.py :7
import subprocess
network 62
- net .governance/ticket_allocation.py :13
from urllib.parse import urlparse - net .governance/ticket_recovery.py :20
from urllib.parse import urlparse - net .governance/work_continuity.py :24
from urllib.parse import urlsplit - net .governance/workspace_lifecycle_check.py :16
from urllib.parse import urlparse - net .governance/worktree_overlap_check.py :24
from urllib.parse import urlparse - net packages/coru/src/coru/supervisor/http_handlers.py :6
from urllib.parse import unquote - net packages/coru/src/coru/supervisor/http_server.py :8
from urllib.parse import urlparse - net (weak) packages/coru/tests/test_supervisor.py :179
import urllib.request - net packages/koruide/src/koruide/client.py :6
import socket - net packages/koruide/src/koruide/daemon/handlers.py :7
import socket - net packages/koruide/src/koruide/daemon/protocol.py :4
import socket - net packages/koruide/src/koruide/daemon/server.py :7
import socket
show 28 more
- net packages/uri2koru/src/uri2koru/uri.py :5
from urllib.parse import quote, unquote, urlparse - net src/koru/autonomy/environment.py :19
import socket as _socket - net src/koru/autonomy/operator/operator_loop_interfaces.py :102
from urllib.parse import urlencode - net src/koru/autonomy/operator/operator_loop_quick_actions.py :7
from urllib.parse import parse_qs, urlparse - net src/koru/autonomy/operator_pipeline.py :14
import urllib.error - net src/koru/autonomy/process_uri.py :17
from urllib.parse import parse_qsl, urlsplit - net src/koru/autopilot/install_manager.py :14
import urllib.parse - net src/koru/cli_shell.py :18
import urllib.request - net src/koru/events.py :8
import urllib.error - net src/koru/global_control.py :25
import socket - net src/koru/ide_adapters/shared.py :8
import socket - net src/koru/integrations/imgl_client.py :8
import urllib.error - net src/koru/integrations/vdisplay_agent_bootstrap.py :7
import urllib.error - net src/koru/integrations/vdisplay_readiness.py :11
import urllib.error - net src/koru/local_manager_client.py :8
import urllib.error - net src/koru/queue/runners.py :10
import urllib.error - net src/koru/remote/client.py :2
import urllib.error - net src/koru/repository_admission.py :17
import urllib.error - net src/koru/self_control.py :11
import urllib.parse - net src/koru/wizard/gui/server.py :5
import socket - net src/koru/wizard/templates.py :8
import urllib.error - net src/koruapi/dashboard_http.py :9
from urllib.parse import parse_qs, urlparse - net src/koruapi/dashboard_logs.py :204
import urllib.parse - net src/koruapi/dashboard_projects.py :10
from urllib.parse import unquote, urlparse - net src/koruapi/dashboard_routes.py :15
from urllib.parse import parse_qs, urlencode, urlparse - net src/koruapi/dashboard_state.py :6
import socket - net src/koruapi/desktop_uri.py :8
from urllib.parse import parse_qsl, urlencode, urlsplit, urlunsplit - net src/koruapi/opencode_terminals.py :22
import urllib.error
secrets 13
- secrets packages/coru/src/coru/cli_diagnose.py :516
return use_llm or bool((os.environ.get("OPENROUTER_API_KEY") or "").strip()) - secrets packages/koruide/src/koruide/ide.py :593
bool(os.environ.get("WINDSURF_CSRF_TOKEN")) and "cursor" not in chrome - secrets src/koru/agents.py :307
openrouter_ready = bool(os.getenv("OPENROUTER_API_KEY")) - secrets src/koru/autonomy/planning_llm_runtime.py :16
return os.environ.get("ZAI_API_KEY", "").strip() - secrets src/koru/cli_tillm_setup.py :15
import getpass - secrets src/koru/global_control.py :22
import getpass - secrets src/koru/integrations/vdisplay/portal_input.py :183
tok = os.environ.get("KORU_VDISPLAY_PORTAL_TOKEN") or None - secrets src/koru/queue/runners.py :621
auth_token = os.getenv("TASKAND_AUTH_TOKEN") or "taskand-admin-key" - secrets src/koru/ticket_command/service.py :55
credential = os.environ.get("GITHUB_TOKEN") - secrets src/koru/work/llm_provenance.py :122
if os.environ.get("OPENROUTER_API_KEY", "").strip(): - secrets src/koruvision/providers/obs_websocket.py :30
return os.environ.get("KORU_OBS_PASSWORD", "").strip() - secrets (weak) tests/test_dotenv_loader.py :110
os.environ.get("OPENROUTER_API_KEY"),
show 1 more
- secrets (weak) tests/test_queue_verification_sandbox.py :115
old = os.environ.get("KORU_VERIFICATION_TEST_CREDENTIAL")
database 10
- db .governance/ticket_input.py :16
import sqlite3 - db src/koru/autonomy/verification_engine/budget.py :3
import sqlite3 - db src/koru/ide_adapters/shared.py :9
import sqlite3 - db src/koru/model_history.py :7
import sqlite3 - db src/koru/queue/routing/ledger.py :4
import sqlite3 - db src/koru/repair_runs/sqlite_store.py :15
import sqlite3 - db (weak) tests/test_autonomous_retry_guard.py :7
import sqlite3 - db (weak) tests/test_cycle_post_drive.py :11
import sqlite3 - db (weak) tests/test_ide_adapters.py :6
import sqlite3 - db (weak) tests/test_model_history.py :4
import sqlite3
declared dependencies 60
- gillm@>=0.1.24
- jsonschema@>=4.0,<5.0
- pyyaml@>=6.0,<7.0
- rich@>=14.3.4
- korullm@>=0.1.0,<2.0
- tillm@>=0.1.35
- websockets@>=12.0,<17.0
- mss@>=9.0,<11.0
- vdisplay@>=0.1.58
- nlp2uri@>=0.4.7
- env2llm@>=0.1.14
- planfile@>=0.1.117
show 28 more
- testql@>=1.2.64
- httpx@>=0.27,<1.0
- curllm@>=1.0.0
- playwright@>=1.40,<2.0
- pytest@>=8.0,<10.0
- pytest-cov@>=5.0,<8.0
- pytest-rerunfailures@>=14.0,<17.0
- pytest-timeout@>=2.3,<3.0
- pytest-xdist@>=3.0,<4.0
- ruff@>=0.11,<0.16
- mypy@>=1.11,<3.0
- pyright@>=1.1.390,<2.0
- hypothesis@>=6.112,<7.0
- pre-commit@>=3.8,<5.0
- types-PyYAML@>=6.0,<7.0
- cryptography@>=42.0,<50.0
- goal@>=2.2.0
- costs@>=0.1.53; python_version >=
- fastapi@>=0.115,<1.0
- uvicorn@>=0.30,<1.0
- prometheus-client@>=0.21,<1.0
- instructor@>=1.6,<2.0
- litellm@>=1.51,<2.0
- openai@>=1.54,<3.0
- tiktoken@>=0.8,<1.0
- fullm@>=0.1.22
- nfo@>=0.2.22,<1.0
- opentelemetry-exporter-otlp@>=1.28,<2.0
clipboard 6
- clipboard shell call src/koru/init_host_environment.py :100
"xclip": shutil.which("xclip") is not None, - clipboard shell call src/koru/integrations/vdisplay/input_actuation.py :681
if shutil.which("wl-copy"): - clipboard shell call tests/test_decision_engine.py :107
"winning_paste": "host-clipboard:wl-copy+xdotool key ctrl+v", - clipboard shell call tests/test_docker_ide_matrix.py :144
assert "wl-copy" in source - clipboard shell call tests/test_docker_ide_matrix_config.py :39
"wl-copy", - clipboard shell call tests/test_drive_orchestrator.py :94
"winning_paste": "host-clipboard:wl-copy+xdotool key ctrl+v",
cursor-plugin 2
- opaque (low) .cursor/rules/new-project-standard.mdc
bundled .cursor/ plugin descriptor (semcod-koru-628d1ff/.cursor/rules/new-project-standard.mdc) — presence-detected; review the descriptor - opaque (low) .cursor/settings.json
bundled .cursor/ plugin descriptor (semcod-koru-628d1ff/.cursor/settings.json) — presence-detected; review the descriptor
ide-extension 13
- eager-activation (medium) plugins/koru-autopilot-antigravity/package.json
activationEvents includes "*" — runs on every window load - eager-activation (medium) plugins/koru-autopilot-cursor/package.json
activationEvents includes "*" — runs on every window load - eager-activation (medium) plugins/koru-autopilot-vscode/package.json
activationEvents includes "*" — runs on every window load - eager-activation (medium) plugins/koru-autopilot-vscodium/package.json
activationEvents includes "*" — runs on every window load - eager-activation (medium) plugins/koru-autopilot-windsurf/package.json
activationEvents includes "*" — runs on every window load - eager-activation (medium) src/koru/assets/koru-autopilot-vscode/koru-autopilot-0.1.29.vsix!/extension/package.json
activationEvents includes "*" — runs on every window load - eager-activation (medium) src/koru/assets/koru-autopilot-vscode/koru-autopilot-0.1.30.vsix!/extension/package.json
activationEvents includes "*" — runs on every window load - eager-activation (medium) src/koru/assets/koru-autopilot-vscode/koru-autopilot-0.1.32.vsix!/extension/package.json
activationEvents includes "*" — runs on every window load - eager-activation (medium) src/koru/assets/koru-autopilot-vscode/koru-autopilot-0.1.36.vsix!/extension/package.json
activationEvents includes "*" — runs on every window load - eager-activation (medium) src/koru/assets/koru-autopilot-vscode/koru-autopilot-0.1.38.vsix!/extension/package.json
activationEvents includes "*" — runs on every window load - eager-activation (medium) src/koru/assets/koru-autopilot-vscode/koru-autopilot-0.1.39.vsix!/extension/package.json
activationEvents includes "*" — runs on every window load - eager-activation (medium) src/koru/assets/koru-autopilot-vscode/koru-autopilot-0.1.40.vsix!/extension/package.json
activationEvents includes "*" — runs on every window load
show 1 more
- eager-activation (medium) src/koru/assets/koru-autopilot-vscode/koru-autopilot-0.2.13.vsix!/extension/package.json
activationEvents includes "*" — runs on every window load
jetbrains-plugin 1
- opaque (low) plugins/koru-autopilot-jetbrains/src/main/resources/META-INF/plugin.xml
bundled JetBrains plugin "koru Autopilot" (semcod-koru-628d1ff/plugins/koru-autopilot-jetbrains/src/main/resources/META-INF/plugin.xml) — presence-detected; review the plugin descriptor
transport_posture 1
- network-listening, binds all interfaces, no auth detected tests/test_serve.py :689
host="0.0.0.0",