github TypeScript analyzed fc92e59

smigolsmigol/llmkit

Know what your AI agents cost. API gateway with budget enforcement, session tracking, and MCP tools.

maintainer: smigolsmigol
licence: MIT
first seen: 2026-07-12
last seen: 2026-09-09
releases · 30d: 0
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 6 tools

transport stdio · http verified reported listed in the official MCP registry counts 6 tools · 0 res · 0 prompts permission surface via code analysis

tools

llmkit_budget_status
llmkit_cost_query
llmkit_health
llmkit_list_keys
llmkit_session_summary
llmkit_usage_stats

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit fc92e59 · analyzer v33 · 4d ago

danger signals3

suspicious endpoint api.telegram.org smigolsmigol-llmkit-fc92e59/packages/dashboard/src/app/(auth)/dashboard/support-action.ts :42 await fetch(`https://api.telegram.org/bot${TG_TOKEN}/sendMessage`, {
suspicious endpoint api.telegram.org smigolsmigol-llmkit-fc92e59/packages/proxy/src/notify.ts :1 const TELEGRAM_API = 'https://api.telegram.org/bot';
credential in logs credential in log smigolsmigol-llmkit-fc92e59/.semgrep/llmkit-security.ts :10 console.log({ apiKey });

code evidence vv0.10.0 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 294

filesystem 43

fs (weak) smigolsmigol-llmkit-fc92e59/packages/ai-sdk-provider/test/smoke-test.mjs :11 import { readFile } from 'node:fs/promises';
fs smigolsmigol-llmkit-fc92e59/packages/cli/src/index.ts :3 import { readFileSync } from 'node:fs';
fs (weak) smigolsmigol-llmkit-fc92e59/packages/dashboard/scripts/build-cloudflare.mjs :5 import { readFile, readdir, writeFile } from 'node:fs/promises';
fs (weak) smigolsmigol-llmkit-fc92e59/packages/dashboard/test/public-content-contract-test.mjs :2 import { existsSync, readFileSync } from 'node:fs';
fs (weak) smigolsmigol-llmkit-fc92e59/packages/dashboard/test/recovery-boundary-test.mjs :2 import { readFileSync } from 'node:fs';
fs smigolsmigol-llmkit-fc92e59/packages/mcp-server/src/adapters/cline.ts :4 import { existsSync, readdirSync } from 'node:fs';
fs smigolsmigol-llmkit-fc92e59/packages/mcp-server/src/claude-code.ts :1 import { createReadStream, existsSync, readdirSync } from 'node:fs';
fs smigolsmigol-llmkit-fc92e59/packages/mcp-server/src/hook.ts :5 import { lstatSync, realpathSync } from 'node:fs';
fs (weak) smigolsmigol-llmkit-fc92e59/packages/mcp-server/test/local-adapters-test.mjs :1 import { mkdir, mkdtemp, rm, utimes, writeFile } from 'node:fs/promises';
fs (weak) smigolsmigol-llmkit-fc92e59/packages/proxy/test/database-compatibility-runtime-proof.mjs :3 import { existsSync } from 'node:fs';
fs (weak) smigolsmigol-llmkit-fc92e59/packages/proxy/test/log-secret-boundary-test.mjs :1 import { readdirSync, readFileSync } from 'node:fs';
fs (weak) smigolsmigol-llmkit-fc92e59/packages/proxy/test/worker-deploy-guard-test.mjs :2 import { readFileSync } from 'node:fs';

show 28 more

fs (weak) smigolsmigol-llmkit-fc92e59/scripts/assert-scorecard-supply-chain.mjs :1 import { readFileSync } from 'node:fs';
fs (weak) smigolsmigol-llmkit-fc92e59/scripts/assert-unpublished-version.mjs :2 import { readdir, readFile, stat } from 'node:fs/promises';
fs (weak) smigolsmigol-llmkit-fc92e59/scripts/bootstrap-quality.mjs :2 import { existsSync } from 'node:fs';
fs (weak) smigolsmigol-llmkit-fc92e59/scripts/build-mcpb.mjs :12 } from 'node:fs';
fs (weak) smigolsmigol-llmkit-fc92e59/scripts/check-budget-falsifier-coverage.mjs :3 import { readFileSync } from 'node:fs';
fs (weak) smigolsmigol-llmkit-fc92e59/scripts/check-mcp-registry-version.mjs :1 import { readFileSync } from 'node:fs';
fs (weak) smigolsmigol-llmkit-fc92e59/scripts/check-npmrc.mjs :1 import { readFileSync } from 'node:fs';
fs (weak) smigolsmigol-llmkit-fc92e59/scripts/check-public-pricing-contract.mjs :1 import { readFileSync } from 'node:fs';
fs (weak) smigolsmigol-llmkit-fc92e59/scripts/clean-package-dist.mjs :1 import { access, rm } from 'node:fs/promises';
fs (weak) smigolsmigol-llmkit-fc92e59/scripts/fetch-pricing.mjs :11 import { readFileSync, writeFileSync } from 'node:fs';
fs (weak) smigolsmigol-llmkit-fc92e59/scripts/generate-pricing.mjs :16 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
fs (weak) smigolsmigol-llmkit-fc92e59/scripts/run-artifact-reproducibility.mjs :12 } from 'node:fs';
fs (weak) smigolsmigol-llmkit-fc92e59/scripts/run-budget-falsifier.mjs :3 import { mkdir, readFile, stat, writeFile } from 'node:fs/promises';
fs (weak) smigolsmigol-llmkit-fc92e59/scripts/run-dashboard-reproducibility.mjs :12 } from 'node:fs';
fs (weak) smigolsmigol-llmkit-fc92e59/scripts/run-hosted-budget-proof.mjs :3 import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
fs (weak) smigolsmigol-llmkit-fc92e59/scripts/run-local-supabase-cli.mjs :2 import { existsSync } from 'node:fs';
fs (weak) smigolsmigol-llmkit-fc92e59/scripts/run-package-coverage.mjs :3 import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
fs (weak) smigolsmigol-llmkit-fc92e59/scripts/run-populated-migration-proof.mjs :2 import { existsSync } from 'node:fs';
fs (weak) smigolsmigol-llmkit-fc92e59/scripts/run-project-coverage.mjs :3 import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
fs (weak) smigolsmigol-llmkit-fc92e59/scripts/run-python-files.mjs :2 import { existsSync } from 'node:fs';
fs (weak) smigolsmigol-llmkit-fc92e59/scripts/run-quality-gate.mjs :2 import { existsSync, readFileSync } from 'node:fs';
fs (weak) smigolsmigol-llmkit-fc92e59/scripts/run-semgrep.mjs :2 import { existsSync, lstatSync, mkdirSync, readFileSync, rmSync } from 'node:fs';
fs (weak) smigolsmigol-llmkit-fc92e59/scripts/run-ts-quality.mjs :2 import { existsSync } from 'node:fs';
fs (weak) smigolsmigol-llmkit-fc92e59/scripts/run-worker-deploy.mjs :2 import { existsSync, readFileSync } from 'node:fs';
fs (weak) smigolsmigol-llmkit-fc92e59/test/contract-test.mjs :4 import { readFileSync } from 'node:fs';
fs (weak) smigolsmigol-llmkit-fc92e59/test/health-check-workflow-test.mjs :2 import { readFileSync } from 'node:fs';
fs (weak) smigolsmigol-llmkit-fc92e59/test/notification-signal-workflow-test.mjs :1 import { existsSync, readFileSync } from 'node:fs';
fs (weak) smigolsmigol-llmkit-fc92e59/test/package-build-clean-test.mjs :2 import { mkdir, rm, writeFile } from 'node:fs/promises';

3 more not shown — this panel samples each group; the count above is the real total.

shell / exec 37

shell smigolsmigol-llmkit-fc92e59/packages/cli/src/index.ts :2 import { spawn } from 'node:child_process';
shell (weak) smigolsmigol-llmkit-fc92e59/packages/cli/test/smoke-test.mjs :4 import { spawnSync } from 'node:child_process';
shell (weak) smigolsmigol-llmkit-fc92e59/packages/dashboard/next.config.ts :1 import { execFileSync } from 'node:child_process';
shell (weak) smigolsmigol-llmkit-fc92e59/packages/dashboard/scripts/build-cloudflare.mjs :2 import { spawnSync } from 'node:child_process';
shell (weak) smigolsmigol-llmkit-fc92e59/packages/mcp-server/test/smoke-test.mjs :4 import { spawnSync } from 'node:child_process';
shell (weak) smigolsmigol-llmkit-fc92e59/packages/proxy/test/database-compatibility-runtime-proof.mjs :1 import { spawn, spawnSync } from 'node:child_process';
shell (weak) smigolsmigol-llmkit-fc92e59/packages/proxy/test/log-secret-runtime-proof.mjs :1 import { spawn } from 'node:child_process';
shell (weak) smigolsmigol-llmkit-fc92e59/packages/proxy/test/worker-deploy-guard-test.mjs :1 import { spawnSync } from 'node:child_process';
shell (weak) smigolsmigol-llmkit-fc92e59/scripts/bootstrap-quality.mjs :1 import { spawnSync } from 'node:child_process';
shell (weak) smigolsmigol-llmkit-fc92e59/scripts/build-mcpb.mjs :1 import { spawn, spawnSync } from 'node:child_process';
shell (weak) smigolsmigol-llmkit-fc92e59/scripts/check-budget-falsifier-coverage.mjs :1 import { spawnSync } from 'node:child_process';
shell (weak) smigolsmigol-llmkit-fc92e59/scripts/fetch-pricing.mjs :10 import { execSync } from 'node:child_process';

show 25 more

shell (weak) smigolsmigol-llmkit-fc92e59/scripts/generate-pricing.mjs :15 import { execFileSync } from 'node:child_process';
shell (weak) smigolsmigol-llmkit-fc92e59/scripts/install-git-hooks.mjs :1 import { spawnSync } from 'node:child_process';
shell (weak) smigolsmigol-llmkit-fc92e59/scripts/run-actionlint-hook.mjs :1 import { spawnSync } from 'node:child_process';
shell (weak) smigolsmigol-llmkit-fc92e59/scripts/run-artifact-reproducibility.mjs :1 import { spawnSync } from 'node:child_process';
shell (weak) smigolsmigol-llmkit-fc92e59/scripts/run-biome-files.mjs :1 import { spawnSync } from 'node:child_process';
shell (weak) smigolsmigol-llmkit-fc92e59/scripts/run-biome-policy.mjs :1 import { spawnSync } from 'node:child_process';
shell (weak) smigolsmigol-llmkit-fc92e59/scripts/run-budget-falsifier-coverage.mjs :1 import { spawnSync } from 'node:child_process';
shell (weak) smigolsmigol-llmkit-fc92e59/scripts/run-budget-falsifier.mjs :1 import { spawnSync } from 'node:child_process';
shell (weak) smigolsmigol-llmkit-fc92e59/scripts/run-dashboard-reproducibility.mjs :1 import { spawnSync } from 'node:child_process';
shell (weak) smigolsmigol-llmkit-fc92e59/scripts/run-hosted-budget-proof.mjs :1 import { spawnSync } from 'node:child_process';
shell (weak) smigolsmigol-llmkit-fc92e59/scripts/run-js-tests.mjs :1 import { spawnSync } from 'node:child_process';
shell (weak) smigolsmigol-llmkit-fc92e59/scripts/run-local-supabase-cli.mjs :1 import { spawnSync } from 'node:child_process';
shell (weak) smigolsmigol-llmkit-fc92e59/scripts/run-package-coverage.mjs :1 import { spawnSync } from 'node:child_process';
shell (weak) smigolsmigol-llmkit-fc92e59/scripts/run-populated-migration-proof.mjs :1 import { spawnSync } from 'node:child_process';
shell (weak) smigolsmigol-llmkit-fc92e59/scripts/run-project-coverage.mjs :1 import { spawnSync } from 'node:child_process';
shell (weak) smigolsmigol-llmkit-fc92e59/scripts/run-python-files.mjs :1 import { spawnSync } from 'node:child_process';
shell (weak) smigolsmigol-llmkit-fc92e59/scripts/run-quality-gate.mjs :1 import { spawnSync } from 'node:child_process';
shell (weak) smigolsmigol-llmkit-fc92e59/scripts/run-semgrep.mjs :1 import { spawnSync } from 'node:child_process';
shell (weak) smigolsmigol-llmkit-fc92e59/scripts/run-ts-quality.mjs :1 import { spawnSync } from 'node:child_process';
shell (weak) smigolsmigol-llmkit-fc92e59/scripts/run-worker-deploy.mjs :1 import { spawnSync } from 'node:child_process';
shell (weak) smigolsmigol-llmkit-fc92e59/test/health-check-workflow-test.mjs :1 import { spawnSync } from 'node:child_process';
shell (weak) smigolsmigol-llmkit-fc92e59/test/package-build-clean-test.mjs :1 import { spawnSync } from 'node:child_process';
shell (weak) smigolsmigol-llmkit-fc92e59/test/quality-gate-contract-test.mjs :1 import { spawnSync } from 'node:child_process';
shell (weak) smigolsmigol-llmkit-fc92e59/test/release-workflow-contract-test.mjs :2 import { spawnSync } from 'node:child_process';
shell (weak) smigolsmigol-llmkit-fc92e59/test/silver-regression-audit-test.mjs :2 import { execFileSync } from 'node:child_process';

network 39

net smigolsmigol-llmkit-fc92e59/packages/ai-sdk-provider/src/index.ts :148 const res = await fetch(`${baseUrl}/v1/chat/completions`, {
net smigolsmigol-llmkit-fc92e59/packages/cli/src/proxy.ts :1 import http, { type IncomingMessage, type ServerResponse } from 'node:http';
net (weak) smigolsmigol-llmkit-fc92e59/packages/cli/test/proxy-test.mjs :1 import http from 'node:http';
net smigolsmigol-llmkit-fc92e59/packages/dashboard/cloudflare-worker.ts :42 async fetch(request: Request, env: unknown, context: unknown): Promise<Response> {
net smigolsmigol-llmkit-fc92e59/packages/dashboard/src/app/(auth)/dashboard/admin/alerts-panel.tsx :25 fetch('/api/analytics', { cache: 'no-store' })
net smigolsmigol-llmkit-fc92e59/packages/dashboard/src/app/(auth)/dashboard/support-action.ts :42 await fetch(`https://api.telegram.org/bot${TG_TOKEN}/sendMessage`, {
net smigolsmigol-llmkit-fc92e59/packages/dashboard/src/app/api/pricing/route.ts :28 const res = await fetch(endpoint, {
net smigolsmigol-llmkit-fc92e59/packages/dashboard/src/components/analytics-status.tsx :26 fetch('/api/analytics', { cache: 'no-store' })
net smigolsmigol-llmkit-fc92e59/packages/dashboard/src/components/ecosystem-panel.tsx :112 fetch('/api/analytics', { cache: 'no-store' })
net smigolsmigol-llmkit-fc92e59/packages/dashboard/src/lib/ecosystem-analytics.ts :90 const response = await fetch(url, {
net (weak) smigolsmigol-llmkit-fc92e59/packages/dashboard/test/fixtures/https-redirect-worker.ts :4 fetch(request: Request): Response {
net (weak) smigolsmigol-llmkit-fc92e59/packages/dashboard/test/https-redirect-runtime-test.mjs :28 const response = await worker.fetch(source, { redirect: 'manual' });

show 27 more

net smigolsmigol-llmkit-fc92e59/packages/mcp-server/src/client.ts :39 const res = await fetch(`${proxyUrl}/v1${path}`, {
net smigolsmigol-llmkit-fc92e59/packages/mcp-server/src/proxy-handlers.ts :115 const res = await fetch(`${config.proxyUrl}/health`, { signal: AbortSignal.timeout(5000) });
net smigolsmigol-llmkit-fc92e59/packages/proxy/src/bench.ts :81 await fetch(url, {
net smigolsmigol-llmkit-fc92e59/packages/proxy/src/db.ts :102 return fetch(`${url}/rest/v1/${path}`, {
net smigolsmigol-llmkit-fc92e59/packages/proxy/src/index.ts :35 const res = await fetch(
net smigolsmigol-llmkit-fc92e59/packages/proxy/src/middleware/budget.ts :308 await fetch(alert.webhookUrl, {
net smigolsmigol-llmkit-fc92e59/packages/proxy/src/middleware/logger.ts :15 const res = await fetch(
net smigolsmigol-llmkit-fc92e59/packages/proxy/src/notify.ts :9 await fetch(`${TELEGRAM_API}${botToken}/sendMessage`, {
net smigolsmigol-llmkit-fc92e59/packages/proxy/src/pricing.ts :37 const res = await fetch(SOURCE, {
net smigolsmigol-llmkit-fc92e59/packages/proxy/src/providers/request.ts :18 return fetch(input, init);
net smigolsmigol-llmkit-fc92e59/packages/proxy/src/routes/analytics.ts :6 fetch(`${url}/rest/v1/${path}`, {
net smigolsmigol-llmkit-fc92e59/packages/proxy/src/routes/chat.ts :307 // warm up: force the generator past the fetch() call so connection errors
net smigolsmigol-llmkit-fc92e59/packages/proxy/src/routes/mcp.ts :80 const res = await fetch(`${supabaseUrl}/rest/v1/${path}`, {
net smigolsmigol-llmkit-fc92e59/packages/proxy/src/routes/responses.ts :96 const res = await fetch(`${baseUrl}/responses`, {
net (weak) smigolsmigol-llmkit-fc92e59/packages/proxy/test/break-test.mjs :14 const res = await fetch(`${BASE}${path}`, {
net (weak) smigolsmigol-llmkit-fc92e59/packages/proxy/test/budget-falsifier/gate0.test.ts :159 async fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response> {
net (weak) smigolsmigol-llmkit-fc92e59/packages/proxy/test/budget-falsifier/production-routes.behavior.test.ts :170 const response = await app.fetch(
net (weak) smigolsmigol-llmkit-fc92e59/packages/proxy/test/budget-falsifier/worker.ts :168 fetch(request, env, ctx) {
net (weak) smigolsmigol-llmkit-fc92e59/packages/proxy/test/concurrency-test.mjs :29 const res = await fetch(`${BASE}/v1/chat/completions`, {
net (weak) smigolsmigol-llmkit-fc92e59/packages/proxy/test/database-compatibility-runtime-proof.mjs :4 import { createServer } from 'node:net';
net (weak) smigolsmigol-llmkit-fc92e59/packages/proxy/test/e2e.mjs :38 const res = await fetch(`${BASE}/health`);
net (weak) smigolsmigol-llmkit-fc92e59/packages/proxy/test/live-test.mjs :66 const res = await fetch(`${BASE}/v1/chat/completions`, {
net (weak) smigolsmigol-llmkit-fc92e59/packages/proxy/test/log-secret-runtime-proof.mjs :2 import { createServer } from 'node:http';
net (weak) smigolsmigol-llmkit-fc92e59/packages/proxy/test/verify-budget-join.mjs :18 const res = await fetch(`${url}/rest/v1/${path}`, {
net smigolsmigol-llmkit-fc92e59/packages/sdk/src/client.ts :44 const res = await this.fetch(req);
net (weak) smigolsmigol-llmkit-fc92e59/scripts/fetch-pricing.mjs :69 const res = await fetch(url, { signal: AbortSignal.timeout(15000) });
net (weak) smigolsmigol-llmkit-fc92e59/scripts/run-hosted-budget-proof.mjs :148 const response = await fetch(`${supabaseUrl.origin}/rest/v1/${path}`, {

secrets 16

secrets (weak) smigolsmigol-llmkit-fc92e59/examples/sdk-basic.ts :7 apiKey: process.env.LLMKIT_API_KEY!,
secrets (weak) smigolsmigol-llmkit-fc92e59/examples/streaming.ts :7 apiKey: process.env.LLMKIT_API_KEY!,
secrets (weak) smigolsmigol-llmkit-fc92e59/examples/vercel-ai-sdk.ts :8 apiKey: process.env.LLMKIT_API_KEY!,
secrets (weak) smigolsmigol-llmkit-fc92e59/packages/dashboard/scripts/build-cloudflare.mjs :169 const buildSecret = process.env.NEXT_SERVER_ACTIONS_ENCRYPTION_KEY;
secrets smigolsmigol-llmkit-fc92e59/packages/dashboard/src/app/(auth)/dashboard/providers/actions.ts :41 const encryptionKey = process.env.ENCRYPTION_KEY;
secrets smigolsmigol-llmkit-fc92e59/packages/dashboard/src/app/(auth)/dashboard/support-action.ts :6 const TG_TOKEN = process.env.TELEGRAM_BOT_TOKEN;
secrets (weak) smigolsmigol-llmkit-fc92e59/packages/dashboard/src/app/(public)/docs/page.tsx :308 apiKey: process.env.LLMKIT_API_KEY!,
secrets smigolsmigol-llmkit-fc92e59/packages/dashboard/src/lib/supabase.ts :5 const key = process.env.SUPABASE_SERVICE_KEY;
secrets (weak) smigolsmigol-llmkit-fc92e59/packages/dashboard/test/server-actions.test.ts :70 delete process.env.ENCRYPTION_KEY;
secrets smigolsmigol-llmkit-fc92e59/packages/mcp-server/src/client.ts :16 const apiKey = process.env.LLMKIT_API_KEY;
secrets (weak) smigolsmigol-llmkit-fc92e59/packages/mcp-server/test/unit-test.mjs :22 const previousKey = process.env.LLMKIT_API_KEY;
secrets (weak) smigolsmigol-llmkit-fc92e59/packages/proxy/test/break-test.mjs :2 const API_KEY = process.env.API_KEY || 'x';

show 4 more

secrets (weak) smigolsmigol-llmkit-fc92e59/packages/proxy/test/concurrency-test.mjs :17 const API_KEY = process.env.API_KEY;
secrets (weak) smigolsmigol-llmkit-fc92e59/packages/proxy/test/e2e.mjs :6 const ANTHROPIC_KEY = process.env.ANTHROPIC_API_KEY;
secrets (weak) smigolsmigol-llmkit-fc92e59/packages/proxy/test/live-test.mjs :5 const OPENAI_KEY = process.env.OPENAI_API_KEY;
secrets (weak) smigolsmigol-llmkit-fc92e59/packages/proxy/test/verify-budget-join.mjs :9 const key = process.env.SUPABASE_KEY;

tool registrations 6

llmkit_usage_stats smigolsmigol-llmkit-fc92e59/packages/proxy/src/routes/mcp.ts :22
llmkit_cost_query smigolsmigol-llmkit-fc92e59/packages/proxy/src/routes/mcp.ts :32
llmkit_list_keys smigolsmigol-llmkit-fc92e59/packages/proxy/src/routes/mcp.ts :46
llmkit_budget_status smigolsmigol-llmkit-fc92e59/packages/proxy/src/routes/mcp.ts :51
llmkit_health smigolsmigol-llmkit-fc92e59/packages/proxy/src/routes/mcp.ts :61
llmkit_session_summary smigolsmigol-llmkit-fc92e59/packages/proxy/src/routes/mcp.ts :66

install hooks 1

prepare smigolsmigol-llmkit-fc92e59/package.json :6 node scripts/install-git-hooks.mjs

declared dependencies 10

@anthropic-ai/mcpb@2.1.2
@biomejs/biome@^2.5.11
c8@12.0.0
esbuild@0.28.2
kguard@^0.1.0
knip@^5.85.0
publint@^0.3.24
supabase@2.116.0
turbo@^2.10.12
typescript@^5.7.0