MCP Observatory
4m ago Tracked 39,510 Last 4m ago 24h 3,139
github Rust re-analysis due unconfirmed MCP

varun29ankuS/Roshera-CAD

github

Agent-native geometry kernel: a Rust B-Rep engine where every operation returns a validity certificate — nine structural invariants, computed under the write lock, failing closed. Outside its verified envelope it refuses with a typed error rather than approximating. The kernel cannot lie.

maintainer
varun29ankuS
license
NOASSERTION
first seen
2026-07-03
last seen
2026-08-14
releases · 30d
0
short id

Drift inferred · capture-to-capture

  1. HIGH code analysis flagged committed secret in varun29ankuS/Roshera-CAD
  2. HIGH code analysis flagged committed secret in varun29ankuS/Roshera-CAD
  3. HIGH code analysis flagged committed secret in varun29ankuS/Roshera-CAD
  4. HIGH code analysis flagged committed secret in varun29ankuS/Roshera-CAD
  5. HIGH code analysis flagged committed secret in varun29ankuS/Roshera-CAD
capabilities 0 tools
transport stdio counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit f71773b · analyzer v32 · 1h ago

skills & prompt files 2

danger signals1

code evidence vHEAD · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 1067

filesystem 18

  • fs (weak) varun29ankuS-Roshera-CAD-f71773b/roshera-app/scripts/dead-modules.mjs :16 import { readdirSync, readFileSync, statSync } from 'node:fs'
  • fs varun29ankuS-Roshera-CAD-f71773b/roshera-eval/run.mjs :32 import { writeFile } from "node:fs/promises";
  • fs varun29ankuS-Roshera-CAD-f71773b/roshera-eval/scenarios/07-step-roundtrip.mjs :12 import { writeFile } from "node:fs/promises";
  • fs (weak) varun29ankuS-Roshera-CAD-f71773b/roshera-mcp/test/ask_choice.test.mjs :29 import { readFileSync } from "node:fs";
  • fs (weak) varun29ankuS-Roshera-CAD-f71773b/roshera-mcp/test/auto_feedback.mjs :16 import { readFileSync } from "node:fs";
  • fs (weak) varun29ankuS-Roshera-CAD-f71773b/roshera-mcp/test/drawing_gates.test.mjs :39 import { readFileSync, rmSync, existsSync } from "node:fs";
  • fs (weak) varun29ankuS-Roshera-CAD-f71773b/roshera-mcp/test/kb_lookup.mjs :25 import fs from "node:fs";
  • fs (weak) varun29ankuS-Roshera-CAD-f71773b/roshera-mcp/test/ontology_coverage.mjs :42 import { readFileSync } from "node:fs";
  • fs (weak) varun29ankuS-Roshera-CAD-f71773b/roshera-mcp/test/structured_errors.test.mjs :39 import { readFileSync } from "node:fs";
  • fs varun29ankuS-Roshera-CAD-f71773b/roshera-rl/lib/runner.mjs :11 import { mkdirSync } from "node:fs";
  • fs varun29ankuS-Roshera-CAD-f71773b/roshera-rl/lib/trajectory.mjs :50 import { appendFileSync, writeFileSync, readFileSync } from "node:fs";
  • fs (weak) varun29ankuS-Roshera-CAD-f71773b/roshera-rl/test/episode.test.mjs :17 import { mkdtempSync, rmSync } from "node:fs";
  • fs (weak) varun29ankuS-Roshera-CAD-f71773b/roshera-rl/test/mcp_session.test.mjs :25 import { readFileSync } from "node:fs";
  • fs (weak) varun29ankuS-Roshera-CAD-f71773b/roshera-rl/test/part_isolation.test.mjs :23 import { mkdtempSync, rmSync } from "node:fs";
  • fs (weak) varun29ankuS-Roshera-CAD-f71773b/roshera-rl/test/runner.test.mjs :16 import { mkdtempSync, rmSync } from "node:fs";
  • fs (weak) varun29ankuS-Roshera-CAD-f71773b/roshera-rl/test/trajectory.test.mjs :13 import { mkdtempSync, rmSync } from "node:fs";
  • fs (weak) varun29ankuS-Roshera-CAD-f71773b/roshera-rl/test/wiring.test.mjs :13 import { readFileSync, existsSync, mkdtempSync, rmSync } from "node:fs";
  • fs varun29ankuS-Roshera-CAD-f71773b/shoot.mjs :3 import { writeFileSync } from "node:fs";

shell / exec 3

  • shell varun29ankuS-Roshera-CAD-f71773b/roshera-rl/lib/episode.mjs :244 session = await spawn({ documentId, partId, baseUrl, authHeader, mcpEntry });
  • shell varun29ankuS-Roshera-CAD-f71773b/roshera-rl/lib/mcp_session.mjs :209 * anything else is REFUSED loudly at spawn (a SETUP_FAILED naming the reason)
  • shell (weak) varun29ankuS-Roshera-CAD-f71773b/roshera-rl/test/wiring.test.mjs :11 import { spawnSync } from "node:child_process";

network 68

  • net varun29ankuS-Roshera-CAD-f71773b/build_f1.mjs :14 const r = await fetch(`${BASE}${path}`, {
  • net varun29ankuS-Roshera-CAD-f71773b/build_nozzle.mjs :7 const r = await fetch(`${BASE}${path}`, {
  • net varun29ankuS-Roshera-CAD-f71773b/build_rao.mjs :6 const r = await fetch(`${BASE}${p}`, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(b) });
  • net varun29ankuS-Roshera-CAD-f71773b/build_rao_revolve.mjs :6 const api = async (p, b) => { const r = await fetch(`${BASE}${p}`, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(b) }); const t = await r.text(); let j; try {
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-app/src/components/CommandPalette.tsx :105 const resp = await fetch(`${API_BASE}/api/timeline/${action}`, {
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-app/src/components/demo-gallery/DemoGallery.tsx :52 const response = await fetch('/demos/manifest.json', { cache: 'no-store' })
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-app/src/components/layout/ToolBar.tsx :112 const resp = await fetch(`${API_BASE}/geometry`, {
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-app/src/components/layout/TopBar.tsx :41 const resp = await fetch(`${API_BASE}/api/timeline/${action}`, {
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-app/src/components/panels/Blackboard.tsx :149 const resp = await fetch('/api/timeline/checkpoints')
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-app/src/components/panels/CreateDatumDialog.tsx :180 const resp = await fetch(`${API_BASE}/api/datums`, {
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-app/src/components/panels/FeatureTree.tsx :173 const resp = await fetch(
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-app/src/components/panels/ModelTree.tsx :609 const resp = await fetch(`/api/hierarchy/${sid}`)
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-app/src/components/panels/SketchPanel.tsx :235 const resp = await fetch(
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-app/src/components/panels/Timeline.tsx :925 const resp = await fetch('/api/branches/active', {
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-app/src/components/viewport/AgentEyePanel.tsx :87 const r = await fetch(url)
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-app/src/components/viewport/CADMesh.tsx :26 void fetch(`${API_BASE}/agent/pointer`, {
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-app/src/components/viewport/Datums.tsx :92 const res = await fetch(`${API_BASE}/api/datums`)
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-app/src/components/viewport/ExtrudeGizmo.tsx :184 // clears the debounce timer, aborts the in-flight fetch (which
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-app/src/components/viewport/StepImportDropzone.tsx :127 const r = await fetch(`${API_HOST}/api/geometry/import_step`, {
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-app/src/components/viewport/ViewportContextMenu.tsx :36 const resp = await fetch(`${API_BASE}/api/geometry/${menu.objectId}`, {
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-app/src/components/viewport/use-gdt.ts :132 fetch(`${API_BASE}/agent/parts/${partId}/gdt`, {
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-app/src/components/viewport/use-part-dimensions.ts :79 fetch(`${API_BASE}/agent/parts/${partId}/dimensions`, {
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-app/src/lib/acp-client.ts :252 const res = await fetch(input, init)
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-app/src/lib/agent-activity.ts :149 const resp = await fetch('/api/acp/activity')
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-app/src/lib/assembly-api.ts :217 const r = await fetch(`${API_HOST}/api/assemblies`)
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-app/src/lib/blackboard-api.ts :99 const res = await fetch(`${API_BASE}/blackboard`)
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-app/src/lib/csketch-api.ts :595 const resp = await fetch(`${API_BASE}${path}`, {
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-app/src/lib/documents-api.ts :51 const resp = await fetch(`${API_BASE}/documents`, {
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-app/src/lib/drawings-api.ts :145 const r = await fetch(`${API_HOST}/api/drawings`)
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-app/src/lib/export-api.ts :71 const exportResp = await fetch(`${API_HOST}/api/export`, {
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-app/src/lib/labels-api.ts :236 const r = await fetch(`${API_HOST}/api/agent/parts/0/labels`)
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-app/src/lib/measure-api.ts :125 const resp = await fetch(`${API_BASE}/agent/measure`, {
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-app/src/lib/parts-api.ts :38 const r = await fetch(`${API_HOST}/api/parts`)
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-app/src/lib/provider-api.ts :196 res = await fetch(`${API_BASE}${path}`, {
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-app/src/lib/section-api.ts :84 const resp = await fetch(`${API_HOST}/api/section/preview`, {
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-app/src/lib/shortcuts.ts :29 const resp = await fetch(`${API_BASE}/api/timeline/${action}`, {
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-app/src/lib/sketch-api.ts :86 const resp = await fetch(`${API_BASE}${path}`, {
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-app/src/lib/stl-loader.ts :20 const response = await fetch(url)
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-app/src/lib/timeline-events.ts :333 const resp = await fetch(`/api/timeline/lineage/${branchId}?limit=${limit}`)
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-app/src/lib/tool-registry-api.ts :65 const resp = await fetch(`${API_BASE}/agent/tool-registry`, {
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-app/src/lib/units-api.ts :50 const resp = await fetch(`${API_BASE}/document/units`, {
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-app/src/lib/ws-bridge.ts :564 const res = await fetch(`${API_BASE}/scene/snapshot`)
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-eval/lib/client.mjs :45 res = await fetch(`${BASE}${path}`, {
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-eval/scenarios/07-step-roundtrip.mjs :55 const res = await fetch(BASE + ex.download_url, { headers: { ...authHeader() } });
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-mcp/src/core.ts :108 * fetch (never `api()` — `api()` itself calls `documentHeaders()`, so
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-mcp/src/index.ts :156 const res = await fetch(`${BASE}/api/agent/tool-registry`, {
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-mcp/src/tools/gdt.ts :177 const res = await fetch(
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-mcp/src/tools/inspect.ts :263 const res = await fetch(`${BASE}/api/agent/parts/${part_id}/select-face`, {
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-mcp/src/tools/labels.ts :57 const res = await fetch(`${BASE}/api/agent/parts/${part_id}/labels`, {
  • net (weak) varun29ankuS-Roshera-CAD-f71773b/roshera-mcp/test/auto_feedback.mjs :87 const r = await fetch(`${BASE}${p}`, {
  • net (weak) varun29ankuS-Roshera-CAD-f71773b/roshera-mcp/test/cad_program_chaining.test.mjs :29 import http from "node:http";
  • net (weak) varun29ankuS-Roshera-CAD-f71773b/roshera-mcp/test/constraint_gates.test.mjs :27 import http from "node:http";
  • net (weak) varun29ankuS-Roshera-CAD-f71773b/roshera-mcp/test/document_pin.test.mjs :14 import http from "node:http";
  • net (weak) varun29ankuS-Roshera-CAD-f71773b/roshera-mcp/test/drawing_gates.test.mjs :34 import http from "node:http";
  • net (weak) varun29ankuS-Roshera-CAD-f71773b/roshera-mcp/test/durability_disclosure.test.mjs :41 import http from "node:http";
  • net (weak) varun29ankuS-Roshera-CAD-f71773b/roshera-mcp/test/intent_header.test.mjs :22 import http from "node:http";
  • net (weak) varun29ankuS-Roshera-CAD-f71773b/roshera-mcp/test/part_pin.test.mjs :28 import http from "node:http";
  • net (weak) varun29ankuS-Roshera-CAD-f71773b/roshera-mcp/test/perception_fidelity.test.mjs :48 import http from "node:http";
  • net (weak) varun29ankuS-Roshera-CAD-f71773b/roshera-mcp/test/single_point_gate.test.mjs :33 import http from "node:http";
  • net (weak) varun29ankuS-Roshera-CAD-f71773b/roshera-mcp/test/structured_errors.test.mjs :37 import http from "node:http";
  • net (weak) varun29ankuS-Roshera-CAD-f71773b/roshera-mcp/test/unsound_forwarding.test.mjs :48 import http from "node:http";
  • net (weak) varun29ankuS-Roshera-CAD-f71773b/roshera-mcp/test/verification_scope_gate.test.mjs :41 import http from "node:http";
  • net varun29ankuS-Roshera-CAD-f71773b/roshera-rl/lib/episode.mjs :138 const res = await fetch(`${baseUrl}/api/parts/${partId}`, {
  • net (weak) varun29ankuS-Roshera-CAD-f71773b/roshera-rl/test/episode.test.mjs :15 import http from "node:http";
  • net (weak) varun29ankuS-Roshera-CAD-f71773b/roshera-rl/test/part_isolation.test.mjs :21 import http from "node:http";
  • net (weak) varun29ankuS-Roshera-CAD-f71773b/roshera-rl/test/runner.test.mjs :14 import http from "node:http";
  • net (weak) varun29ankuS-Roshera-CAD-f71773b/roshera-rl/test/wiring.test.mjs :10 import http from "node:http";
  • net varun29ankuS-Roshera-CAD-f71773b/shoot.mjs :5 const r = await fetch(`${BASE}/api/agent/scene/orbit?az=${az}&el=${el}&mode=${mode}&size=900`);

secrets 4

  • secrets varun29ankuS-Roshera-CAD-f71773b/roshera-eval/lib/client.mjs :23 let authToken = process.env.ROSHERA_TOKEN ?? null;
  • secrets varun29ankuS-Roshera-CAD-f71773b/roshera-eval/run.mjs :78 if (!process.env.ROSHERA_TOKEN) {
  • secrets varun29ankuS-Roshera-CAD-f71773b/roshera-mcp/src/core.ts :30 const API_KEY = process.env.ROSHERA_API_KEY;
  • secrets varun29ankuS-Roshera-CAD-f71773b/roshera-rl/bin/run-batch.mjs :50 const key = process.env.ROSHERA_API_KEY;

declared dependencies 17

  • ws@^8.18.3
  • serde@1.0
  • serde_json@1.0
  • uuid@1.0
  • tokio@1.0
  • anyhow@1.0
  • thiserror@2.0.12
  • async-trait@0.1
  • tracing@0.1
  • tracing-subscriber@0.3
  • axum@0.8.4
  • tower@0.5.2
  • tower-http@0.6.6
  • dashmap@6.1.0
  • parking_lot@0.12
  • rayon@1.8
  • lru@0.16.0

obfuscation 2

  • dynamic require()/import() varun29ankuS-Roshera-CAD-f71773b/roshera-mcp/test/document_pin.test.mjs :53 return await import(`${coreUrl}?case=${checks.length}-${Date.now()}`);
  • dynamic require()/import() varun29ankuS-Roshera-CAD-f71773b/roshera-mcp/test/part_pin.test.mjs :165 return await import(`${coreUrl}?case=${instances}-${Date.now()}`);