AI-native artifact sharing — a pastebin, gist and requestbin for agents. Short, shareable links with provenance, comments, reactions and TTLs, over MCP and HTTP.
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport — counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit 162de10 · analyzer v33 · 6d ago
skills & prompt files 1
- agent-rules stump-wtf-cairn-162de10/CLAUDE.md
danger signals3
- committed secret GitHub token stump-wtf-cairn-162de10/.gitleaks.toml :42
ghp_01…(40 chars, redacted) - committed secret GitHub token stump-wtf-cairn-162de10/website/plugins/record/__tests__/least-privilege.test.ts :71
ghp_01…(40 chars, redacted) - committed secret GitHub token stump-wtf-cairn-162de10/website/scripts/scan-bundle.test.mjs :138
ghp_01…(40 chars, redacted)
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 299
filesystem 22
- fs (weak) stump-wtf-cairn-162de10/website/plugins/record/__tests__/counts.test.ts :10
import fs from 'node:fs/promises'; - fs (weak) stump-wtf-cairn-162de10/website/plugins/record/__tests__/generate.test.ts :9
import fs from 'node:fs/promises'; - fs (weak) stump-wtf-cairn-162de10/website/plugins/record/__tests__/parse.test.ts :5
import fs from 'node:fs/promises'; - fs (weak) stump-wtf-cairn-162de10/website/plugins/record/__tests__/tokens.test.ts :10
import fs from 'node:fs/promises'; - fs stump-wtf-cairn-162de10/website/plugins/record/counts.ts :67
import fs from 'node:fs/promises'; - fs stump-wtf-cairn-162de10/website/plugins/record/parse.ts :10
import fs from 'node:fs/promises'; - fs stump-wtf-cairn-162de10/website/plugins/record/stage.ts :20
import fs from 'node:fs/promises'; - fs stump-wtf-cairn-162de10/website/plugins/record/tokens.ts :31
import fs from 'node:fs/promises'; - fs stump-wtf-cairn-162de10/website/plugins/record/validate.ts :13
import fs from 'node:fs/promises'; - fs stump-wtf-cairn-162de10/website/plugins/security/index.ts :43
import fs from 'node:fs/promises'; - fs (weak) stump-wtf-cairn-162de10/website/scripts/check-a11y.mjs :65
import {existsSync, readFileSync, readdirSync, statSync} from 'node:fs'; - fs (weak) stump-wtf-cairn-162de10/website/scripts/check-a11y.test.mjs :24
} from 'node:fs';
show 10 more
- fs (weak) stump-wtf-cairn-162de10/website/scripts/check-assets.mjs :34
import {existsSync, readFileSync, readdirSync, statSync} from 'node:fs'; - fs (weak) stump-wtf-cairn-162de10/website/scripts/check-assets.test.mjs :18
import {mkdtempSync, mkdirSync, writeFileSync} from 'node:fs'; - fs (weak) stump-wtf-cairn-162de10/website/scripts/check-links.mjs :31
import {readdirSync, readFileSync, statSync} from 'node:fs'; - fs (weak) stump-wtf-cairn-162de10/website/scripts/check-links.test.mjs :16
import {mkdirSync, mkdtempSync, writeFileSync} from 'node:fs'; - fs (weak) stump-wtf-cairn-162de10/website/scripts/check-tokens.mjs :44
import {existsSync, readFileSync, readdirSync, statSync} from 'node:fs'; - fs (weak) stump-wtf-cairn-162de10/website/scripts/check-tokens.test.mjs :18
import {cpSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync, appendFileSync} from 'node:fs'; - fs (weak) stump-wtf-cairn-162de10/website/scripts/prism-languages.test.mjs :20
import {readFileSync} from 'node:fs'; - fs (weak) stump-wtf-cairn-162de10/website/scripts/required-languages.mjs :15
import {readFileSync} from 'node:fs'; - fs (weak) stump-wtf-cairn-162de10/website/scripts/scan-bundle.mjs :41
import {existsSync, readFileSync, readdirSync, statSync} from 'node:fs'; - fs (weak) stump-wtf-cairn-162de10/website/scripts/scan-bundle.test.mjs :17
import {mkdtempSync, mkdirSync, writeFileSync} from 'node:fs';
shell / exec 2
- shell (weak) stump-wtf-cairn-162de10/website/scripts/check-a11y.test.mjs :27
import {spawnSync} from 'node:child_process'; - shell (weak) stump-wtf-cairn-162de10/website/scripts/check-tokens.test.mjs :21
import {spawnSync} from 'node:child_process';
network 7
- net stump-wtf-cairn-162de10/internal/httpapi/web/assets/code.js :53
return fetch('/v1/artifacts/' + encodeURIComponent(id) + '/reactions', { - net stump-wtf-cairn-162de10/internal/httpapi/web/assets/hook.js :79
return fetch('/v1/artifacts/' + encodeURIComponent(hookID) + '/reactions', { - net stump-wtf-cairn-162de10/internal/httpapi/web/assets/image.js :190
return fetch('/v1/artifacts/' + encodeURIComponent(id) + '/reactions', { - net stump-wtf-cairn-162de10/internal/httpapi/web/assets/markdown.js :71
fetch('/v1/artifacts/' + encodeURIComponent(id) + '/reactions', { - net stump-wtf-cairn-162de10/internal/httpapi/web/assets/settings.js :10
// CSP note: everything here is same-origin fetch() + DOM APIs, no eval or - net stump-wtf-cairn-162de10/internal/httpapi/web/assets/share.js :13
// CSP note: everything here is same-origin fetch() + DOM APIs, no eval or - net stump-wtf-cairn-162de10/internal/httpapi/web/assets/trajectory.js :805
return fetch('/v1/artifacts/' + encodeURIComponent(runID) + '/reactions', {
declared dependencies 97
- github.com/modelcontextprotocol/go-sdk@v1.7.0
- @babel/parser@^8.0.4
- @docusaurus/core@3.10.1
- @docusaurus/faster@3.10.1
- @docusaurus/preset-classic@3.10.1
- @mdx-js/react@^3.0.0
- acorn@^8.17.0
- clsx@^2.0.0
- js-yaml@^4.1.0
- prism-react-renderer@^2.3.0
- react@^19.0.0
- react-dom@^19.0.0
show 28 more
- @docusaurus/module-type-aliases@3.10.1
- @docusaurus/tsconfig@3.10.1
- @docusaurus/types@3.10.2
- @types/js-yaml@^4.0.9
- @types/react@^19.0.0
- typescript@~6.0.2
- charm.land/fang/v2@v2.0.1
- charm.land/lipgloss/v2@v2.0.6
- github.com/BurntSushi/toml@v1.6.0
- github.com/alecthomas/chroma/v2@v2.27.0
- github.com/aymanbagabas/go-osc52/v2@v2.0.1
- github.com/charmbracelet/bubbles@v1.0.0
- github.com/charmbracelet/bubbletea@v1.3.10
- github.com/charmbracelet/lipgloss@v1.1.0
- github.com/coreos/go-oidc/v3@v3.20.0
- github.com/dustin/go-humanize@v1.0.1
- github.com/go-chi/chi/v5@v5.3.2
- github.com/google/jsonschema-go@v0.4.3
- github.com/google/uuid@v1.6.0
- github.com/jackc/pgx/v5@v5.10.0
- github.com/mattn/go-isatty@v0.0.24
- github.com/microcosm-cc/bluemonday@v1.0.27
- github.com/minio/minio-go/v7@v7.3.0
- github.com/spf13/cobra@v1.10.2
- github.com/stump-wtf/md2a2ui@v0.2.0
- github.com/yuin/goldmark@v1.8.6
- github.com/zalando/go-keyring@v0.2.8
- golang.org/x/oauth2@v0.36.0
57 more not shown — this panel samples each group; the count above is the real total.
clipboard 1
- clipboard shell call stump-wtf-cairn-162de10/website/docusaurus.config.ts :127
tagline: 'AI-native artifact sharing — pbcopy for the agent era.',
perm:untrusted 2
- untrusted stump-wtf-cairn-162de10/internal/httpapi/web/assets/hook.js :215
fetch(url, { credentials: 'same-origin' }).then(function (r) { return r.text(); }).then(function (text) { - untrusted stump-wtf-cairn-162de10/internal/httpapi/web/assets/trajectory.js :1167
fetch(url, { credentials: 'same-origin' }).then(function (r) { return r.text(); }).then(function (text) {