MCP Observatory
4m ago Tracked 56,279 Last 4m ago 24h 2,472
github TypeScript analyzed 8aac79d

semcod/todo2code

github

Dependency-free Python SDK for todo2code A2A and the local TypeScript runtime

maintainer
semcod
licence
Apache-2.0
first seen
2026-07-29
last seen
2026-08-14
releases · 30d
0
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 28 tools
transport stdio · http counts 28 tools · 0 res · 0 prompts permission surface via code analysis

tools

  • analyze_communication
  • apply_source_patch
  • apply_todo
  • close_code_change
  • compare_workspace
  • diagnose
  • diff
  • diff_files
  • diff_git
  • evaluate_code_change
  • extract_ast
  • extract_communication
  • extract_config
  • extract_docs
  • extract_git
  • extract_markdown
  • extract_nl
  • intake_command
  • intake_query
  • link
  • pipeline
  • propose_code_change
  • propose_source_patch
  • propose_todo
  • reality
  • render_code_change
  • render_todo
  • summarize
skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 8aac79d · analyzer v33 · 5d ago

skills & prompt files 7

code evidence vHEAD · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 322

filesystem 108

  • fs (weak) autogrammar-todo2code-8aac79d/examples/sdk/typescript.mjs :1 import { readFile } from 'node:fs/promises';
  • fs (weak) autogrammar-todo2code-8aac79d/scripts/assert-demollm-run.mjs :1 import { readFile } from 'node:fs/promises';
  • fs (weak) autogrammar-todo2code-8aac79d/scripts/generate-response-schemas.mjs :3 import { promises as fs } from 'node:fs';
  • fs (weak) autogrammar-todo2code-8aac79d/scripts/github-event-log.mjs :2 import { promises as fs } from 'node:fs';
  • fs (weak) autogrammar-todo2code-8aac79d/scripts/live-contract-check.mjs :17 import { promises as fs } from 'node:fs';
  • fs (weak) autogrammar-todo2code-8aac79d/scripts/live-model-comparison.mjs :14 import { promises as fs } from 'node:fs';
  • fs (weak) autogrammar-todo2code-8aac79d/scripts/normalize-generated-analysis-roots.mjs :3 import { promises as fs } from 'node:fs';
  • fs (weak) autogrammar-todo2code-8aac79d/scripts/research/audit-changelog-sample.mjs :4 import { promises as fs } from 'node:fs';
  • fs (weak) autogrammar-todo2code-8aac79d/scripts/research/rerank-embedding-shortlist.mjs :3 import { promises as fs } from 'node:fs';
  • fs (weak) autogrammar-todo2code-8aac79d/scripts/sync-generated-readme-metadata.mjs :3 import { promises as fs } from 'node:fs';
  • fs (weak) autogrammar-todo2code-8aac79d/scripts/verify-env-contract.mjs :2 import { promises as fs } from 'node:fs';
  • fs (weak) autogrammar-todo2code-8aac79d/scripts/verify-generated-analysis.mjs :4 import { promises as fs } from 'node:fs';
show 28 more
  • fs (weak) autogrammar-todo2code-8aac79d/scripts/verify-module-boundaries.mjs :2 import { promises as fs } from 'node:fs';
  • fs (weak) autogrammar-todo2code-8aac79d/scripts/verify-no-llm-imports.mjs :2 import { promises as fs } from 'node:fs';
  • fs (weak) autogrammar-todo2code-8aac79d/scripts/verify-structured-responses.mjs :3 import { promises as fs } from 'node:fs';
  • fs (weak) autogrammar-todo2code-8aac79d/scripts/verify-workflow-yaml.mjs :2 import { promises as fs } from 'node:fs';
  • fs autogrammar-todo2code-8aac79d/src/cli.ts :3 import { promises as fs } from 'node:fs';
  • fs autogrammar-todo2code-8aac79d/src/communication/communication-llm-helpers.ts :1 import { promises as fs } from 'node:fs';
  • fs autogrammar-todo2code-8aac79d/src/communication/intake-service.ts :2 import { promises as fs } from 'node:fs';
  • fs autogrammar-todo2code-8aac79d/src/communication/intake-store.ts :2 import { promises as fs } from 'node:fs';
  • fs autogrammar-todo2code-8aac79d/src/comparison/workspace-deadline.ts :1 import { promises as fs } from 'node:fs';
  • fs autogrammar-todo2code-8aac79d/src/comparison/workspace-helpers.ts :2 import { promises as fs } from 'node:fs';
  • fs autogrammar-todo2code-8aac79d/src/comparison/workspace.ts :1 import { promises as fs } from 'node:fs';
  • fs autogrammar-todo2code-8aac79d/src/config/env.ts :1 import { promises as fs } from 'node:fs';
  • fs autogrammar-todo2code-8aac79d/src/core/content-cache.ts :1 import { promises as fs } from 'node:fs';
  • fs autogrammar-todo2code-8aac79d/src/core/ignore.ts :11 import { promises as fs } from 'node:fs';
  • fs autogrammar-todo2code-8aac79d/src/core/io.ts :1 import { promises as fs } from 'node:fs';
  • fs autogrammar-todo2code-8aac79d/src/core/security.ts :1 import { promises as fs } from 'node:fs';
  • fs autogrammar-todo2code-8aac79d/src/diff/git.ts :9 import { promises as fs } from 'node:fs';
  • fs autogrammar-todo2code-8aac79d/src/evaluation/gold-cli.ts :2 import { promises as fs } from 'node:fs';
  • fs autogrammar-todo2code-8aac79d/src/evaluation/gold-extraction.ts :1 import { promises as fs } from 'node:fs';
  • fs autogrammar-todo2code-8aac79d/src/evaluation/gold.ts :1 import { promises as fs } from 'node:fs';
  • fs autogrammar-todo2code-8aac79d/src/extractors/ast/php.ts :1 import { promises as fs } from 'node:fs';
  • fs autogrammar-todo2code-8aac79d/src/extractors/ast/python.ts :1 import { promises as fs } from 'node:fs';
  • fs autogrammar-todo2code-8aac79d/src/extractors/docs-llm.ts :1 import { promises as fs } from 'node:fs';
  • fs autogrammar-todo2code-8aac79d/src/extractors/markdown-llm.ts :1 import { promises as fs } from 'node:fs';
  • fs autogrammar-todo2code-8aac79d/src/extractors/markdown-paths.ts :2 import { promises as fs } from 'node:fs';
  • fs autogrammar-todo2code-8aac79d/src/extractors/nl-llm.ts :1 import { promises as fs } from 'node:fs';
  • fs autogrammar-todo2code-8aac79d/src/interfaces/a2a-history.ts :1 import { promises as fs, type Dirent } from 'node:fs';
  • fs autogrammar-todo2code-8aac79d/src/interfaces/a2a-task-store.ts :2 import { promises as fs } from 'node:fs';

68 more not shown — this panel samples each group; the count above is the real total.

shell / exec 36

  • shell (weak) autogrammar-todo2code-8aac79d/scripts/research/audit-changelog-sample.mjs :3 import { execFileSync } from 'node:child_process';
  • shell (weak) autogrammar-todo2code-8aac79d/scripts/verify-generated-analysis.mjs :3 import { execFile } from 'node:child_process';
  • shell autogrammar-todo2code-8aac79d/src/cli.ts :2 import { execFile } from 'node:child_process';
  • shell autogrammar-todo2code-8aac79d/src/comparison/workspace-helpers.ts :1 import { execFile } from 'node:child_process';
  • shell autogrammar-todo2code-8aac79d/src/diff/git.ts :8 import { execFile } from 'node:child_process';
  • shell autogrammar-todo2code-8aac79d/src/extractors/ast/external.ts :1 import { execFile } from 'node:child_process';
  • shell autogrammar-todo2code-8aac79d/src/extractors/git.ts :1 import { execFile } from 'node:child_process';
  • shell autogrammar-todo2code-8aac79d/src/llm/subllm.ts :1 import { execFile } from 'node:child_process';
  • shell autogrammar-todo2code-8aac79d/src/pipeline/event-log-persistence.ts :1 import { execFile } from 'node:child_process';
  • shell autogrammar-todo2code-8aac79d/src/semantic/reranker-llm.ts :1 import { execFile } from 'node:child_process';
  • shell autogrammar-todo2code-8aac79d/src/services/branch-snapshot-git.ts :1 import { spawn } from 'node:child_process';
  • shell autogrammar-todo2code-8aac79d/src/services/workspace-preflight.ts :1 import { spawn } from 'node:child_process';
show 24 more
  • shell (weak) autogrammar-todo2code-8aac79d/test/ast-go.test.ts :5 import { execFile } from 'node:child_process';
  • shell (weak) autogrammar-todo2code-8aac79d/test/ast-languages.test.ts :2 import { execFile } from 'node:child_process';
  • shell (weak) autogrammar-todo2code-8aac79d/test/ast-php.test.ts :2 import { execFile } from 'node:child_process';
  • shell (weak) autogrammar-todo2code-8aac79d/test/cli-compare-workspace.test.ts :2 import { execFile } from 'node:child_process';
  • shell (weak) autogrammar-todo2code-8aac79d/test/cli-help.test.ts :2 import { execFile } from 'node:child_process';
  • shell (weak) autogrammar-todo2code-8aac79d/test/cli-intake.test.ts :2 import { execFile } from 'node:child_process';
  • shell (weak) autogrammar-todo2code-8aac79d/test/cli-summary.test.ts :2 import { execFile } from 'node:child_process';
  • shell (weak) autogrammar-todo2code-8aac79d/test/cli-todo.test.ts :2 import { execFile } from 'node:child_process';
  • shell (weak) autogrammar-todo2code-8aac79d/test/cli-watch.test.ts :2 import { execFile, spawn } from 'node:child_process';
  • shell (weak) autogrammar-todo2code-8aac79d/test/code-change-plan.test.ts :2 import { execFile } from 'node:child_process';
  • shell (weak) autogrammar-todo2code-8aac79d/test/communication-intake.test.ts :2 import { execFile } from 'node:child_process';
  • shell (weak) autogrammar-todo2code-8aac79d/test/communication.test.ts :2 import { execFile } from 'node:child_process';
  • shell (weak) autogrammar-todo2code-8aac79d/test/generated-analysis-roots.test.ts :2 import { execFile } from 'node:child_process';
  • shell (weak) autogrammar-todo2code-8aac79d/test/generated-analysis.test.ts :2 import { execFile } from 'node:child_process';
  • shell (weak) autogrammar-todo2code-8aac79d/test/generated-readme.test.ts :2 import { execFile } from 'node:child_process';
  • shell (weak) autogrammar-todo2code-8aac79d/test/git-branch-snapshot.test.ts :2 import { execFile } from 'node:child_process';
  • shell (weak) autogrammar-todo2code-8aac79d/test/git-workspace-preflight.test.ts :2 import { execFile } from 'node:child_process';
  • shell (weak) autogrammar-todo2code-8aac79d/test/git.test.ts :2 import { execFile } from 'node:child_process';
  • shell (weak) autogrammar-todo2code-8aac79d/test/pipeline.test.ts :2 import { execFile } from 'node:child_process';
  • shell (weak) autogrammar-todo2code-8aac79d/test/python-runtime.test.ts :2 import { execFile } from 'node:child_process';
  • shell (weak) autogrammar-todo2code-8aac79d/test/sdk.test.ts :2 import { execFile } from 'node:child_process';
  • shell (weak) autogrammar-todo2code-8aac79d/test/semantic-reranker.test.ts :2 import { execFile } from 'node:child_process';
  • shell (weak) autogrammar-todo2code-8aac79d/test/workflow-validation.test.ts :2 import { execFile, spawn } from 'node:child_process';
  • shell (weak) autogrammar-todo2code-8aac79d/test/workspace.test.ts :2 import { execFile } from 'node:child_process';

network 9

  • net (weak) autogrammar-todo2code-8aac79d/examples/backend/src/server.ts :6 import { createServer, type IncomingMessage, type Server, type ServerResponse } from 'node:http';
  • net (weak) autogrammar-todo2code-8aac79d/examples/frontend/src/api.ts :31 const response = await fetch(url.toString(), { headers: { accept: 'application/json' } });
  • net autogrammar-todo2code-8aac79d/src/interfaces/a2a-card.ts :2 import type { IncomingMessage, ServerResponse } from 'node:http';
  • net autogrammar-todo2code-8aac79d/src/interfaces/a2a.ts :2 import http, { type IncomingHttpHeaders, type IncomingMessage, type ServerResponse } from 'node:http';
  • net autogrammar-todo2code-8aac79d/src/llm/openrouter.ts :72 const response = await fetch(`${transport.apiBase}/models`, {
  • net autogrammar-todo2code-8aac79d/src/web/diff-ui.ts :43 ery.set(key,value)}const response=await fetch('/api/runs?'+query.toString(),{headers:requestHeaders(false)});const payload=await response.json();if(!response.ok)throw new Error(typeof payload.error===
  • net (weak) autogrammar-todo2code-8aac79d/test/a2a-intake.test.ts :4 import type { Server } from 'node:http';
  • net (weak) autogrammar-todo2code-8aac79d/test/a2a.test.ts :3 import type { Server } from 'node:http';
  • net (weak) autogrammar-todo2code-8aac79d/test/sdk.test.ts :4 import type { Server } from 'node:http';

secrets 2

  • secrets (weak) autogrammar-todo2code-8aac79d/sdk/typescript/examples/basic.ts :14 const token = process.env.T2C_A2A_TOKEN ?? null;
  • secrets (weak) autogrammar-todo2code-8aac79d/test/subllm.test.ts :72 process.env.T2C_UNRELATED_SECRET = 'placeholder-not-forwarded';

tool registrations 28

  • intake_command autogrammar-todo2code-8aac79d/src/interfaces/mcp-tools.ts :14
  • intake_query autogrammar-todo2code-8aac79d/src/interfaces/mcp-tools.ts :20
  • extract_nl autogrammar-todo2code-8aac79d/src/interfaces/mcp-tools.ts :26
  • extract_git autogrammar-todo2code-8aac79d/src/interfaces/mcp-tools.ts :32
  • extract_ast autogrammar-todo2code-8aac79d/src/interfaces/mcp-tools.ts :36
  • extract_config autogrammar-todo2code-8aac79d/src/interfaces/mcp-tools.ts :39
  • extract_markdown autogrammar-todo2code-8aac79d/src/interfaces/mcp-tools.ts :42
  • extract_docs autogrammar-todo2code-8aac79d/src/interfaces/mcp-tools.ts :48
  • extract_communication autogrammar-todo2code-8aac79d/src/interfaces/mcp-tools.ts :53
  • analyze_communication autogrammar-todo2code-8aac79d/src/interfaces/mcp-tools.ts :59
  • link autogrammar-todo2code-8aac79d/src/interfaces/mcp-tools.ts :69
  • diagnose autogrammar-todo2code-8aac79d/src/interfaces/mcp-tools.ts :74
show 16 more
  • summarize autogrammar-todo2code-8aac79d/src/interfaces/mcp-tools.ts :77
  • diff autogrammar-todo2code-8aac79d/src/interfaces/mcp-tools.ts :83
  • diff_files autogrammar-todo2code-8aac79d/src/interfaces/mcp-tools.ts :96
  • diff_git autogrammar-todo2code-8aac79d/src/interfaces/mcp-tools.ts :106
  • reality autogrammar-todo2code-8aac79d/src/interfaces/mcp-tools.ts :115
  • compare_workspace autogrammar-todo2code-8aac79d/src/interfaces/mcp-tools.ts :122
  • propose_todo autogrammar-todo2code-8aac79d/src/interfaces/mcp-tools.ts :136
  • render_todo autogrammar-todo2code-8aac79d/src/interfaces/mcp-tools.ts :145
  • apply_todo autogrammar-todo2code-8aac79d/src/interfaces/mcp-tools.ts :157
  • propose_code_change autogrammar-todo2code-8aac79d/src/interfaces/mcp-tools.ts :166
  • render_code_change autogrammar-todo2code-8aac79d/src/interfaces/mcp-tools.ts :179
  • propose_source_patch autogrammar-todo2code-8aac79d/src/interfaces/mcp-tools.ts :186
  • apply_source_patch autogrammar-todo2code-8aac79d/src/interfaces/mcp-tools.ts :195
  • close_code_change autogrammar-todo2code-8aac79d/src/interfaces/mcp-tools.ts :203
  • evaluate_code_change autogrammar-todo2code-8aac79d/src/interfaces/mcp-tools.ts :221
  • pipeline autogrammar-todo2code-8aac79d/src/interfaces/mcp-tools.ts :235

declared dependencies 7

  • typescript@>=5.8.3 <7
  • @types/node@>=20 <25
  • proc-macro2@1
  • quote@1
  • serde@1
  • serde_json@1
  • syn@2