github TypeScript analyzed 823fa84 deep scan · partial (284/2,262 files)

sv-grid/sv-grid

github

Native Svelte 5 data grid. Headless-first engine + drop-in render component. Row + column virtualization (1M rows), Excel-style filters, inline editing, grouping, pivot, server-side data. MIT core (@svgrid/grid), MCP server for Claude / Cursor. https://svgrid.com

maintainer
sv-grid
licence
NOASSERTION
first seen
2026-06-20
last seen
2026-09-10
releases · 30d
4
short id

Drift inferred · capture-to-capture

  1. HIGH code analysis flagged dynamic code execution in sv-grid/sv-grid
  2. HIGH code analysis flagged dynamic code execution in sv-grid/sv-grid
  3. HIGH code analysis flagged dynamic code execution in sv-grid/sv-grid
capabilities 0 tools
transport stdio · streamable-http · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 823fa84 · analyzer v33 · 9h ago

skills & prompt files 40

code evidence vv2.7.0 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 879

filesystem 111

  • fs sv-grid-sv-grid-823fa84/.tmp-check.mjs :5 import { readFileSync } from 'node:fs'
  • fs (weak) sv-grid-sv-grid-823fa84/examples/gen-studio-check.mjs :1 import { mkdirSync, writeFileSync, rmSync } from 'node:fs'
  • fs sv-grid-sv-grid-823fa84/packages/create-studio/index.mjs :15 import { cp, mkdir, readdir, rename, rm, stat, readFile, writeFile } from 'node:fs/promises'
  • fs sv-grid-sv-grid-823fa84/packages/create-sv-grid/index.mjs :12 import { cp, mkdir, readdir, rename, stat, readFile, writeFile } from 'node:fs/promises'
  • fs sv-grid-sv-grid-823fa84/packages/create-sv-grid/sync-templates.mjs :11 import { cp, mkdir, rename, rm, readdir, stat } from 'node:fs/promises'
  • fs (weak) sv-grid-sv-grid-823fa84/packages/enterprise/scripts/build-cdn.mjs :23 import { readFileSync, writeFileSync, existsSync, rmSync, readdirSync } from 'node:fs'
  • fs (weak) sv-grid-sv-grid-823fa84/packages/enterprise/scripts/build-designer.mjs :18 import { existsSync } from 'node:fs'
  • fs (weak) sv-grid-sv-grid-823fa84/packages/enterprise/scripts/build-node.mjs :20 import { existsSync, readFileSync, rmSync } from 'node:fs'
  • fs (weak) sv-grid-sv-grid-823fa84/packages/enterprise/scripts/extract-ui-props.mjs :14 import { readFileSync, writeFileSync } from 'node:fs'
  • fs (weak) sv-grid-sv-grid-823fa84/packages/enterprise/scripts/measure-ai.mjs :14 import { writeFileSync, mkdtempSync } from 'node:fs'
  • fs (weak) sv-grid-sv-grid-823fa84/packages/enterprise/src/studio/ui-components-surface.test.ts :2 import { readFileSync } from 'node:fs'
  • fs (weak) sv-grid-sv-grid-823fa84/packages/enterprise/src/version.test.ts :2 import { readFileSync } from 'node:fs'
show 28 more
  • fs (weak) sv-grid-sv-grid-823fa84/packages/grid-wc/scripts/build.mjs :21 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
  • fs (weak) sv-grid-sv-grid-823fa84/packages/grid-wc/scripts/check-examples.mjs :20 import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs'
  • fs (weak) sv-grid-sv-grid-823fa84/packages/grid-wc/scripts/check-size.mjs :17 import { readFileSync, existsSync } from 'node:fs'
  • fs (weak) sv-grid-sv-grid-823fa84/packages/grid-wc/scripts/generate-surface.mjs :16 import { existsSync, readFileSync, readdirSync, writeFileSync } from 'node:fs'
  • fs (weak) sv-grid-sv-grid-823fa84/packages/grid-wc/scripts/generate-wrappers.mjs :25 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
  • fs (weak) sv-grid-sv-grid-823fa84/packages/grid-wc/scripts/sync-example-docs.mjs :21 import { readFileSync, readdirSync, statSync, writeFileSync } from 'node:fs'
  • fs (weak) sv-grid-sv-grid-823fa84/packages/grid-wc/test/angular.test.ts :2 import { readFileSync, existsSync } from 'node:fs'
  • fs (weak) sv-grid-sv-grid-823fa84/packages/grid-wc/test/enterprise-interop.test.ts :22 import { existsSync, readFileSync } from 'node:fs'
  • fs (weak) sv-grid-sv-grid-823fa84/packages/grid-wc/test/stackblitz-payload.test.ts :2 import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs'
  • fs (weak) sv-grid-sv-grid-823fa84/packages/grid-wc/test/surface.test.ts :3 import { readdirSync, readFileSync } from 'node:fs'
  • fs (weak) sv-grid-sv-grid-823fa84/packages/grid/scripts/build-cdn.mjs :20 import { readFileSync, writeFileSync, existsSync, rmSync, readdirSync } from 'node:fs'
  • fs (weak) sv-grid-sv-grid-823fa84/packages/grid/scripts/build-themes.mjs :12 import { mkdirSync, writeFileSync, readdirSync, unlinkSync } from 'node:fs'
  • fs (weak) sv-grid-sv-grid-823fa84/packages/grid/scripts/check-node-entry.mjs :24 import { readdirSync, readFileSync, existsSync, statSync, writeFileSync, rmSync } from 'node:fs'
  • fs (weak) sv-grid-sv-grid-823fa84/packages/grid/scripts/check-ssr.mjs :23 import { writeFileSync, rmSync } from 'node:fs'
  • fs (weak) sv-grid-sv-grid-823fa84/packages/grid/scripts/measure-entry-breakdown.mjs :8 import { writeFileSync, mkdtempSync } from 'node:fs'
  • fs (weak) sv-grid-sv-grid-823fa84/packages/grid/scripts/measure-size.mjs :13 import { writeFileSync, mkdtempSync } from 'node:fs'
  • fs (weak) sv-grid-sv-grid-823fa84/packages/grid/src/editor-block-prop.test.ts :17 import { readFileSync, readdirSync } from 'node:fs'
  • fs (weak) sv-grid-sv-grid-823fa84/packages/grid/src/filtering/node-entry.test.ts :2 import { readdirSync, readFileSync } from 'node:fs'
  • fs (weak) sv-grid-sv-grid-823fa84/packages/grid/src/icon-seam.test.ts :14 import { readFileSync } from 'node:fs'
  • fs (weak) sv-grid-sv-grid-823fa84/packages/grid/src/svgrid.new-features.wrapper.test.ts :15 import { readFileSync } from 'node:fs'
  • fs (weak) sv-grid-sv-grid-823fa84/packages/grid/src/svgrid.wrapper.test.ts :1 import { readFileSync } from 'node:fs'
  • fs (weak) sv-grid-sv-grid-823fa84/packages/mcp/scripts/api-surface.mjs :16 import { readFileSync, existsSync, readdirSync } from 'node:fs'
  • fs (weak) sv-grid-sv-grid-823fa84/packages/mcp/scripts/build-manifests.mjs :5 import { readFileSync, writeFileSync, mkdirSync, readdirSync, statSync } from 'node:fs'
  • fs (weak) sv-grid-sv-grid-823fa84/packages/mcp/scripts/build-mcpb.mjs :15 import { cp, mkdir, readFile, rm, writeFile, stat } from 'node:fs/promises'
  • fs sv-grid-sv-grid-823fa84/packages/mcp/src/installed.ts :17 import { existsSync, readFileSync } from 'node:fs'
  • fs sv-grid-sv-grid-823fa84/packages/migrate/index.mjs :10 import { readFileSync, writeFileSync, statSync, readdirSync } from 'node:fs'
  • fs sv-grid-sv-grid-823fa84/packages/studio/src/cli.ts :13 import { mkdir, readFile, writeFile } from 'node:fs/promises'
  • fs sv-grid-sv-grid-823fa84/packages/studio/src/designer-server.ts :14 import { createReadStream, existsSync } from 'node:fs'

71 more not shown — this panel samples each group; the count above is the real total.

shell / exec 26

  • shell (weak) sv-grid-sv-grid-823fa84/packages/enterprise/scripts/build-designer.mjs :17 import { spawnSync } from 'node:child_process'
  • shell (weak) sv-grid-sv-grid-823fa84/packages/enterprise/src/studio/ui-components-surface.test.ts :1 import { execFileSync } from 'node:child_process'
  • shell (weak) sv-grid-sv-grid-823fa84/packages/grid-wc/scripts/build-test-apps.mjs :15 import { spawnSync } from 'node:child_process'
  • shell (weak) sv-grid-sv-grid-823fa84/packages/grid-wc/scripts/build.mjs :20 import { spawnSync } from 'node:child_process'
  • shell (weak) sv-grid-sv-grid-823fa84/packages/grid-wc/scripts/check-examples.mjs :19 import { spawnSync } from 'node:child_process'
  • shell (weak) sv-grid-sv-grid-823fa84/packages/grid-wc/test/surface.test.ts :2 import { execFileSync } from 'node:child_process'
  • shell (weak) sv-grid-sv-grid-823fa84/packages/grid/scripts/check-node-entry.mjs :26 import { execFileSync } from 'node:child_process'
  • shell (weak) sv-grid-sv-grid-823fa84/packages/mcp/scripts/build-mcpb.mjs :14 import { execFileSync, spawn } from 'node:child_process'
  • shell sv-grid-sv-grid-823fa84/packages/studio/src/cli.ts :14 import { spawnSync } from 'node:child_process'
  • shell sv-grid-sv-grid-823fa84/packages/studio/src/designer-server.ts :19 import { spawn } from 'node:child_process'
  • shell sv-grid-sv-grid-823fa84/packages/studio/src/dev.ts :10 import { spawn, spawnSync, type ChildProcess } from 'node:child_process'
  • shell sv-grid-sv-grid-823fa84/packages/studio/src/driver-install.ts :11 import { spawn } from 'node:child_process'
show 14 more
  • shell sv-grid-sv-grid-823fa84/packages/svgrid-ui/index.mjs :24 import { spawnSync } from 'node:child_process'
  • shell sv-grid-sv-grid-823fa84/tools/audit-demos.mjs :30 import { spawn, spawnSync } from 'node:child_process'
  • shell sv-grid-sv-grid-823fa84/tools/bench.mjs :151 const { execFileSync } = await import('node:child_process')
  • shell sv-grid-sv-grid-823fa84/tools/build-changelog.mjs :18 import { execFileSync } from 'node:child_process'
  • shell sv-grid-sv-grid-823fa84/tools/check-doc-snippets.mjs :17 import { spawnSync } from 'node:child_process'
  • shell sv-grid-sv-grid-823fa84/tools/generate-blog-batch.mjs :25 import { spawnSync } from 'node:child_process'
  • shell sv-grid-sv-grid-823fa84/tools/mcp-eval/run.mjs :21 import { spawn } from 'node:child_process'
  • shell (weak) sv-grid-sv-grid-823fa84/tools/mcp-offline.test.ts :2 import { spawn } from 'node:child_process'
  • shell (weak) sv-grid-sv-grid-823fa84/tools/mcp-tools.test.ts :13 import { spawn, type ChildProcessWithoutNullStreams } from 'node:child_process'
  • shell sv-grid-sv-grid-823fa84/tools/prerender-site.mjs :69 // replacements treat $$, $&, $` and $' in the inserted text as substitution
  • shell (weak) sv-grid-sv-grid-823fa84/tools/published-imports.test.ts :2 import { execSync, spawnSync } from 'node:child_process'
  • shell sv-grid-sv-grid-823fa84/tools/release-packages.mjs :62 import { execFileSync, spawnSync } from 'node:child_process'
  • shell (weak) sv-grid-sv-grid-823fa84/tools/scaffold-templates.test.ts :12 import { execFileSync } from 'node:child_process'
  • shell sv-grid-sv-grid-823fa84/tools/verify-generated-app.mjs :27 import { execFileSync } from 'node:child_process'

network 24

  • net (weak) sv-grid-sv-grid-823fa84/examples/src/shared/mock-api.ts :4 * What it gives you, beyond `await fetch(...)`:
  • net sv-grid-sv-grid-823fa84/packages/enterprise/src/sources/introspect-supabase.ts :23 /** Custom fetch (SSR, tests). Defaults to the global `fetch`. */
  • net sv-grid-sv-grid-823fa84/packages/enterprise/src/sources/rest.ts :30 /** Custom fetch (SSR, auth). Defaults to the global `fetch`. */
  • net (weak) sv-grid-sv-grid-823fa84/packages/enterprise/src/studio/emit-project.test.ts :1678 expect(page).toContain(`fetch('/api/actions/${actionId}'`)
  • net sv-grid-sv-grid-823fa84/packages/enterprise/src/studio/emit-project.ts :1043 const res = await fetch('/api/actions/${a.id}', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(payload ?? {}) })
  • net sv-grid-sv-grid-823fa84/packages/enterprise/src/studio/project.ts :668 case 'apiAction': return `await fetch(${q('/api/actions/' + step.actionId)}, { method: 'POST' })`
  • net sv-grid-sv-grid-823fa84/packages/enterprise/src/sveltekit/transport.ts :67 const doFetch: FetchLike = options.fetch ?? ((i, init) => fetch(i, init))
  • net sv-grid-sv-grid-823fa84/packages/grid/src/server-group-model.ts :32 /** True during the initial top-level fetch (before the root has ever loaded). */
  • net sv-grid-sv-grid-823fa84/packages/mcp/src/data.ts :100 *\r\n * Replace `mockEndpoint` with `fetch('/api/people?...')` and the rest of\r\n * the structure stays the same.\r\n */\r\n import {\r\n SvGrid,\r\n tableFeatures,\r\n rowSortingFea
  • net sv-grid-sv-grid-823fa84/packages/studio/src/cli.ts :293 /^https?:\/\//.test(source) ? (await fetch(source)).text() : readFile(source, 'utf8')
  • net sv-grid-sv-grid-823fa84/packages/studio/src/designer-server.ts :13 import { createServer, type IncomingMessage, type ServerResponse } from 'node:http'
  • net sv-grid-sv-grid-823fa84/tools/audit-demos.mjs :54 await fetch(`http://localhost:${PORT}/`)
show 12 more
  • net sv-grid-sv-grid-823fa84/tools/fetch-discussions.mjs :47 const res = await fetch('https://api.github.com/graphql', {
  • net sv-grid-sv-grid-823fa84/tools/generate-blog-post.mjs :493 const res = await fetch('https://api.anthropic.com/v1/messages', {
  • net (weak) sv-grid-sv-grid-823fa84/tools/mcp-offline.test.ts :184 // inside it are full of `fetch(` as example code.
  • net (weak) sv-grid-sv-grid-823fa84/tools/mcp-worker.test.ts :32 async fetch(input: Request | string) {
  • net sv-grid-sv-grid-823fa84/tools/scorecard.mjs :49 const res = await fetch(url, { headers })
  • net sv-grid-sv-grid-823fa84/tools/seed-community-discussions.mjs :85 const res = await fetch('https://api.github.com/graphql', {
  • net sv-grid-sv-grid-823fa84/tools/twitter/compose.mjs :54 const res = await fetch('https://api.anthropic.com/v1/messages', {
  • net sv-grid-sv-grid-823fa84/tools/twitter/select-content.mjs :91 const res = await fetch(`https://registry.npmjs.org/${encodeURIComponent(pkg)}`)
  • net sv-grid-sv-grid-823fa84/tools/twitter/tips-data.mjs :118 code: `const payload = $state.snapshot(form)\nawait fetch('/api/save', { method: 'POST', body: JSON.stringify(payload) })`,
  • net sv-grid-sv-grid-823fa84/tools/twitter/x-client.mjs :60 const res = await fetch(url, { headers: { Authorization: authHeader('GET', url) } })
  • net sv-grid-sv-grid-823fa84/workers/svgrid-mcp/src/index.ts :51 docBodies ??= env.ASSETS.fetch('https://assets.local/_data/docs.json')
  • net sv-grid-sv-grid-823fa84/workers/svgrid-vote/src/index.js :40 async fetch(request, env) {

secrets 10

  • secrets sv-grid-sv-grid-823fa84/packages/enterprise/src/studio/emit-project.ts :4501 creds: 'dbCredentials: { url: process.env.DATABASE_URL!, authToken: process.env.DATABASE_AUTH_TOKEN }',
  • secrets sv-grid-sv-grid-823fa84/packages/mcp/src/index.ts :59 return checkLicenseKey(process.env.SVGRID_LICENSE_KEY ?? null).valid
  • secrets sv-grid-sv-grid-823fa84/packages/mcp/src/project-tools.ts :76 return checkLicenseKey(process.env.SVGRID_LICENSE_KEY ?? null).valid
  • secrets sv-grid-sv-grid-823fa84/packages/mcp/src/studio-tools.ts :29 return checkLicenseKey(process.env.SVGRID_LICENSE_KEY ?? null).valid
  • secrets sv-grid-sv-grid-823fa84/packages/studio/src/designer-server.ts :243 const copilotKey = process.env.ANTHROPIC_API_KEY
  • secrets sv-grid-sv-grid-823fa84/tools/fetch-discussions.mjs :25 process.env.GITHUB_TOKEN || process.env.GH_TOKEN || process.env.SVGRID_GH_TOKEN
  • secrets sv-grid-sv-grid-823fa84/tools/generate-blog-post.mjs :75 const API_KEY = process.env.ANTHROPIC_API_KEY
  • secrets sv-grid-sv-grid-823fa84/tools/seed-community-discussions.mjs :26 const TOKEN = process.env.GITHUB_TOKEN || process.env.GH_TOKEN
  • secrets sv-grid-sv-grid-823fa84/tools/twitter/compose.mjs :26 const API_KEY = process.env.ANTHROPIC_API_KEY
  • secrets sv-grid-sv-grid-823fa84/tools/twitter/x-client.mjs :22 key: process.env.X_API_KEY,

database 6

  • db (weak) sv-grid-sv-grid-823fa84/packages/enterprise/src/studio/emit-project.test.ts :2048 expect(route!.contents).toContain("import pg from 'pg'")
  • db sv-grid-sv-grid-823fa84/packages/enterprise/src/studio/emit-project.ts :4481 client: "import { drizzle } from 'drizzle-orm/node-postgres'\nimport pg from 'pg'",
  • db sv-grid-sv-grid-823fa84/packages/enterprise/src/studio/emit-schema.ts :355 postgres: { dep: 'pg', imports: `import pg from 'pg'`, setup: `const pool = new pg.Pool({ connectionString: env.DATABASE_URL })`, exec: `const result = await pool.query(text, params)\n return resul
  • db (weak) sv-grid-sv-grid-823fa84/packages/enterprise/src/studio/scaffold.test.ts :104 expect(pg).toContain("import pg from 'pg'")
  • db sv-grid-sv-grid-823fa84/packages/enterprise/src/studio/scaffold.ts :59 imports: `import pg from 'pg'`,
  • db sv-grid-sv-grid-823fa84/packages/studio/src/designer-server.ts :94 ["import pg from 'pg'", 'pg', '^8.11.0'],

install hooks 5

  • prepack sv-grid-sv-grid-823fa84/packages/create-sv-grid/package.json :40 node sync-templates.mjs
  • prepublishOnly sv-grid-sv-grid-823fa84/packages/enterprise/package.json :77 svelte-package --input ./src --output ./dist && node ../../tools/strip-dist-tests.mjs ./dist && node ../../tools/add-dist-extensions.mjs ./dist && node ./scripts/build-cdn.mjs && node ./scripts/build-
  • prepack sv-grid-sv-grid-823fa84/packages/grid-wc/package.json :88 node ./scripts/generate-surface.mjs --check && node ./scripts/generate-wrappers.mjs --check && node ./scripts/build.mjs
  • prepublishOnly sv-grid-sv-grid-823fa84/packages/mcp/package.json :37 pnpm build
  • prepublishOnly sv-grid-sv-grid-823fa84/packages/studio/package.json :31 tsc -p tsconfig.json

declared dependencies 10

  • @eslint/js@^10.0.1
  • @playwright/test@^1.60.0
  • @types/node@^22.10.7
  • eslint@^10.8.1
  • globals@^17.11.0
  • playwright@^1.60.0
  • typescript@6.0.3
  • typescript-eslint@^8.67.0
  • vite@^8.2.1
  • vitest@^4.1.5

clipboard 3

  • navigator.clipboard sv-grid-sv-grid-823fa84/packages/grid/src/editing.ts :369 if (!navigator.clipboard?.readText) return;
  • navigator.clipboard sv-grid-sv-grid-823fa84/packages/grid/src/keyboard-handlers.ts :33 if (typeof navigator.clipboard?.readText === "function") {
  • navigator.clipboard sv-grid-sv-grid-823fa84/tests/e2e/clipboard.spec.ts :82 const clip = await page.evaluate(() => navigator.clipboard.readText())

obfuscation 1

  • dynamic require()/import() sv-grid-sv-grid-823fa84/tests/e2e/api-examples.spec.ts :24 const { sections } = (await import(/* @vite-ignore */ `${base}api-reference.ts`)) as any

perm:untrusted 2

  • untrusted sv-grid-sv-grid-823fa84/packages/enterprise/src/studio/emit-project.ts :4340 const disc = (await (await fetch(issuer + '/.well-known/openid-configuration')).json()) as { authorization_endpoint: string; token_endpoint: string; userinfo_endpoint: string }
  • untrusted sv-grid-sv-grid-823fa84/packages/studio/src/cli.ts :293 /^https?:\/\//.test(source) ? (await fetch(source)).text() : readFile(source, 'utf8')