MCP Observatory
3m ago Tracked 59,469 Last 3m ago 24h 2,466
github TypeScript re-analysis due

verax-ai/verax

github

Verax: the accountable agent body. Gate, decision record, receipt, reconciliation. Apache-2.0.

maintainer
verax-ai
licence
Apache-2.0
first seen
2026-09-14
last seen
2026-09-17
releases · 30d
1
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 6 tools
transport stdio · streamable-http · http verified reported listed in the official MCP registry counts 6 tools · 0 res · 0 prompts permission surface via code analysis

tools

  • audit.explain
  • memory.get
  • memory.put
  • message.read
  • message.send
  • spend
skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 5a747d7 · analyzer v33 · 1d ago

danger signals2

code evidence vHEAD · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 225

filesystem 125

  • fs verax-ai-verax-5a747d7/apps/panel/perf/check-baseline.mjs :2 import { readFileSync, writeFileSync } from "node:fs";
  • fs verax-ai-verax-5a747d7/apps/panel/perf/measure.mjs :5 import { writeFileSync } from "node:fs";
  • fs (weak) verax-ai-verax-5a747d7/apps/panel/tests/Observatory.test.tsx :1 import { readFileSync } from "node:fs";
  • fs (weak) verax-ai-verax-5a747d7/apps/panel/tests/app-ledger.test.tsx :5 import { readFileSync } from "node:fs";
  • fs (weak) verax-ai-verax-5a747d7/apps/panel/tests/black-box.test.tsx :2 import { readFileSync } from "node:fs";
  • fs (weak) verax-ai-verax-5a747d7/apps/panel/tests/canvas-traps.test.ts :2 import { readdirSync, readFileSync, statSync } from "node:fs";
  • fs (weak) verax-ai-verax-5a747d7/apps/panel/tests/check-baseline.test.ts :3 import { mkdtempSync, writeFileSync } from "node:fs";
  • fs (weak) verax-ai-verax-5a747d7/apps/panel/tests/copy-keys.test.ts :2 import { readFileSync } from "node:fs";
  • fs (weak) verax-ai-verax-5a747d7/apps/panel/tests/coverage-line.test.ts :2 import { readFileSync } from "node:fs";
  • fs (weak) verax-ai-verax-5a747d7/apps/panel/tests/dependencies.test.ts :2 import { globSync, readFileSync } from "node:fs";
  • fs (weak) verax-ai-verax-5a747d7/apps/panel/tests/layout.test.ts :2 import { mkdirSync, readFileSync } from "node:fs";
  • fs (weak) verax-ai-verax-5a747d7/apps/panel/tests/perf-doc.test.ts :2 import { readFileSync } from "node:fs";
show 28 more
  • fs (weak) verax-ai-verax-5a747d7/apps/panel/tests/preview-token.test.ts :3 import { mkdtempSync } from "node:fs";
  • fs (weak) verax-ai-verax-5a747d7/apps/panel/tests/records-consistency.test.ts :2 import { readFileSync } from "node:fs";
  • fs (weak) verax-ai-verax-5a747d7/apps/panel/tests/records-line.test.ts :2 import { readFileSync } from "node:fs";
  • fs (weak) verax-ai-verax-5a747d7/apps/panel/tests/records-money.test.ts :2 import { globSync, readFileSync } from "node:fs";
  • fs (weak) verax-ai-verax-5a747d7/apps/panel/tests/records-scope.test.ts :2 import { readFileSync } from "node:fs";
  • fs (weak) verax-ai-verax-5a747d7/apps/panel/tests/records-summary.test.ts :2 import { readFileSync } from "node:fs";
  • fs (weak) verax-ai-verax-5a747d7/apps/panel/tests/session-source.test.ts :2 import { readFileSync } from "node:fs";
  • fs (weak) verax-ai-verax-5a747d7/apps/panel/tests/turkish-screen.ts :1 import { readFileSync } from "node:fs";
  • fs verax-ai-verax-5a747d7/packages/body/src/atomic-write.ts :2 import { chmodSync, mkdirSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
  • fs verax-ai-verax-5a747d7/packages/body/src/cli.ts :2 import { readFileSync } from "node:fs";
  • fs verax-ai-verax-5a747d7/packages/body/src/desktop.ts :2 import { existsSync, mkdirSync, readdirSync, readFileSync, statSync } from "node:fs";
  • fs verax-ai-verax-5a747d7/packages/body/src/doctor.ts :1 import { existsSync, readFileSync, statSync } from "node:fs";
  • fs verax-ai-verax-5a747d7/packages/body/src/halt.ts :1 import { mkdirSync, writeFileSync } from "node:fs";
  • fs verax-ai-verax-5a747d7/packages/body/src/health-extras.ts :1 import { existsSync, readFileSync } from "node:fs";
  • fs verax-ai-verax-5a747d7/packages/body/src/inputs-read.ts :2 import { readFile } from "node:fs/promises";
  • fs verax-ai-verax-5a747d7/packages/body/src/inventory-file.ts :1 import { existsSync, readFileSync } from "node:fs";
  • fs verax-ai-verax-5a747d7/packages/body/src/keys.ts :2 import { mkdirSync, readFileSync, renameSync, writeFileSync, existsSync } from "node:fs";
  • fs verax-ai-verax-5a747d7/packages/body/src/metrics.ts :1 import { mkdir, readFile, writeFile } from "node:fs/promises";
  • fs verax-ai-verax-5a747d7/packages/body/src/no-bypass-scan.ts :1 import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
  • fs verax-ai-verax-5a747d7/packages/body/src/operator-credentials.ts :1 import { existsSync, readFileSync } from "node:fs";
  • fs verax-ai-verax-5a747d7/packages/body/src/operator-pairing.ts :2 import { existsSync, readFileSync } from "node:fs";
  • fs verax-ai-verax-5a747d7/packages/body/src/policy-store.ts :1 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
  • fs verax-ai-verax-5a747d7/packages/body/src/reconcile-cli.ts :1 import { readdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
  • fs verax-ai-verax-5a747d7/packages/body/src/revoke.ts :1 import { existsSync, readFileSync } from "node:fs";
  • fs verax-ai-verax-5a747d7/packages/body/src/tools/memory.ts :2 import { existsSync, readdirSync } from "node:fs";
  • fs verax-ai-verax-5a747d7/packages/body/src/tools/message.ts :1 import { appendFileSync, mkdirSync } from "node:fs";
  • fs verax-ai-verax-5a747d7/packages/body/src/unlock.ts :1 import { appendFileSync, existsSync, readFileSync, unlinkSync } from "node:fs";
  • fs verax-ai-verax-5a747d7/packages/body/src/wiring.ts :13 import { readFileSync } from "node:fs";

85 more not shown — this panel samples each group; the count above is the real total.

shell / exec 31

  • shell verax-ai-verax-5a747d7/apps/panel/perf/measure.mjs :4 import { spawn, spawnSync } from "node:child_process";
  • shell (weak) verax-ai-verax-5a747d7/apps/panel/tests/check-baseline.test.ts :2 import { spawnSync } from "node:child_process";
  • shell (weak) verax-ai-verax-5a747d7/apps/panel/tests/preview-token.test.ts :2 import { spawnSync } from "node:child_process";
  • shell verax-ai-verax-5a747d7/packages/body/src/desktop.ts :1 import { spawn, spawnSync, type ChildProcess } from "node:child_process";
  • shell verax-ai-verax-5a747d7/packages/proxy/perf/check.mjs :6 import { spawnSync } from "node:child_process";
  • shell (weak) verax-ai-verax-5a747d7/packages/proxy/tests/exports.test.ts :2 import { spawnSync } from "node:child_process";
  • shell (weak) verax-ai-verax-5a747d7/packages/proxy/tests/ledger-lock.test.ts :2 import { spawn, spawnSync, type ChildProcess } from "node:child_process";
  • shell (weak) verax-ai-verax-5a747d7/packages/proxy/tests/ledger-perf.test.ts :2 import { spawnSync } from "node:child_process";
  • shell (weak) verax-ai-verax-5a747d7/scripts/crlf-guard.ts :15 import { execFileSync } from "node:child_process";
  • shell (weak) verax-ai-verax-5a747d7/scripts/pack-smoke.ts :9 import { spawnSync } from "node:child_process";
  • shell (weak) verax-ai-verax-5a747d7/scripts/run-unit-tests.ts :15 import { spawnSync } from "node:child_process";
  • shell (weak) verax-ai-verax-5a747d7/scripts/test-preview.ts :23 import { spawn } from "node:child_process";
show 19 more
  • shell (weak) verax-ai-verax-5a747d7/tests/agent-token-no-approve.test.ts :3 import { spawn } from "node:child_process";
  • shell (weak) verax-ai-verax-5a747d7/tests/approve-cli.test.ts :2 import { spawn } from "node:child_process";
  • shell (weak) verax-ai-verax-5a747d7/tests/body-closed-by-default.test.ts :2 import { spawn } from "node:child_process";
  • shell (weak) verax-ai-verax-5a747d7/tests/browser-cleanup.test.ts :2 import { spawnSync } from "node:child_process";
  • shell (weak) verax-ai-verax-5a747d7/tests/checkpoint-window.test.ts :2 import { spawn } from "node:child_process";
  • shell (weak) verax-ai-verax-5a747d7/tests/claim-guard.test.ts :2 import { execFileSync } from "node:child_process";
  • shell (weak) verax-ai-verax-5a747d7/tests/cli-entry.test.ts :2 import { spawnSync } from "node:child_process";
  • shell (weak) verax-ai-verax-5a747d7/tests/crlf-guard.test.ts :2 import { execFileSync } from "node:child_process";
  • shell (weak) verax-ai-verax-5a747d7/tests/desktop-cli.test.ts :2 import { spawn, spawnSync, type ChildProcess } from "node:child_process";
  • shell (weak) verax-ai-verax-5a747d7/tests/dev-issuer.test.ts :3 import { spawn } from "node:child_process";
  • shell (weak) verax-ai-verax-5a747d7/tests/halt-cli.test.ts :2 import { spawn } from "node:child_process";
  • shell (weak) verax-ai-verax-5a747d7/tests/operator-cli.test.ts :2 import { spawnSync } from "node:child_process";
  • shell (weak) verax-ai-verax-5a747d7/tests/operator-passkey.test.ts :3 import { spawn } from "node:child_process";
  • shell (weak) verax-ai-verax-5a747d7/tests/panel-perf.test.ts :3 import { spawn } from "node:child_process";
  • shell (weak) verax-ai-verax-5a747d7/tests/perf-harness-agreement.test.ts :2 import { spawn } from "node:child_process";
  • shell (weak) verax-ai-verax-5a747d7/tests/reconcile-cli.test.ts :2 import { spawn } from "node:child_process";
  • shell (weak) verax-ai-verax-5a747d7/tests/unlock-cli.test.ts :2 import { spawn } from "node:child_process";
  • shell (weak) verax-ai-verax-5a747d7/tests/witness-listen-atomic.test.ts :2 import { spawn } from "node:child_process";
  • shell (weak) verax-ai-verax-5a747d7/tests/witness-process.test.ts :2 import { spawn } from "node:child_process";

network 28

  • net verax-ai-verax-5a747d7/apps/panel/perf/measure.mjs :6 import { createServer } from "node:net";
  • net verax-ai-verax-5a747d7/apps/panel/src/App.tsx :171 const r = await fetch("/reconcile-report.json");
  • net verax-ai-verax-5a747d7/apps/panel/src/session.ts :58 const res = await fetch(PRM_PATH);
  • net (weak) verax-ai-verax-5a747d7/apps/panel/tests/preview-token.test.ts :4 import { createServer } from "node:net";
  • net verax-ai-verax-5a747d7/packages/body/src/desktop.ts :3 import { createConnection } from "node:net";
  • net verax-ai-verax-5a747d7/packages/body/src/server.ts :2 import { createServer, type IncomingMessage, type Server, type ServerResponse } from "node:http";
  • net verax-ai-verax-5a747d7/packages/body/src/witness.ts :3 import { createServer, type IncomingMessage, type ServerResponse } from "node:http";
  • net (weak) verax-ai-verax-5a747d7/scripts/dev-issuer.mjs :6 import { createServer } from "node:http";
  • net (weak) verax-ai-verax-5a747d7/tests/agent-token-no-approve.test.ts :125 const authorized = await fetch(
  • net (weak) verax-ai-verax-5a747d7/tests/approve-over-http.test.ts :38 await fetch(url, {
  • net (weak) verax-ai-verax-5a747d7/tests/auth-exp.test.ts :15 const res = await fetch(url, {
  • net (weak) verax-ai-verax-5a747d7/tests/body-api.test.ts :21 const res = await fetch(url, {
show 16 more
  • net (weak) verax-ai-verax-5a747d7/tests/body-client-e2e.test.ts :71 const get = await fetch(`http://127.0.0.1:${port}/mcp`, {
  • net (weak) verax-ai-verax-5a747d7/tests/body-closed-by-default.test.ts :3 import { createConnection } from "node:net";
  • net (weak) verax-ai-verax-5a747d7/tests/body-http.test.ts :9 import { createConnection } from "node:net";
  • net (weak) verax-ai-verax-5a747d7/tests/body-inventory.test.ts :46 const anon = await fetch(`${base}/api/inventory`);
  • net (weak) verax-ai-verax-5a747d7/tests/body-size.test.ts :2 import { request as httpRequest } from "node:http";
  • net (weak) verax-ai-verax-5a747d7/tests/contest-errors.test.ts :40 const res = await fetch(`http://127.0.0.1:${port}/api/contest/yok`, {
  • net (weak) verax-ai-verax-5a747d7/tests/desktop-cli.test.ts :4 import { createServer } from "node:net";
  • net (weak) verax-ai-verax-5a747d7/tests/dev-issuer.test.ts :90 const jwksRes = await fetch(jwks, { signal: AbortSignal.timeout(LOCAL_FETCH_MS) });
  • net (weak) verax-ai-verax-5a747d7/tests/disk-unrecorded.test.ts :38 const res = await fetch(mcp, {
  • net (weak) verax-ai-verax-5a747d7/tests/issuer-helper.ts :3 import { createServer, type Server } from "node:http";
  • net (weak) verax-ai-verax-5a747d7/tests/operator-passkey.test.ts :5 import { createServer } from "node:net";
  • net (weak) verax-ai-verax-5a747d7/tests/p3-hygiene.test.ts :75 const res = await fetch(`http://127.0.0.1:${port}/healthz`);
  • net (weak) verax-ai-verax-5a747d7/tests/panel-perf.test.ts :2 import { createServer } from "node:http";
  • net (weak) verax-ai-verax-5a747d7/tests/pilot-drills.test.ts :49 const mcp = await fetch(`http://127.0.0.1:${port}/mcp`, {
  • net (weak) verax-ai-verax-5a747d7/tests/prm-path.test.ts :31 const challenge = await fetch(`http://127.0.0.1:${port}/mcp`, { method: "POST" });
  • net (weak) verax-ai-verax-5a747d7/tests/revoke-jti.test.ts :15 const res = await fetch(url, {

tool registrations 6

  • memory.get verax-ai-verax-5a747d7/packages/body/src/server.ts :26
  • memory.put verax-ai-verax-5a747d7/packages/body/src/server.ts :36
  • audit.explain verax-ai-verax-5a747d7/packages/body/src/server.ts :52
  • message.read verax-ai-verax-5a747d7/packages/body/src/server.ts :62
  • message.send verax-ai-verax-5a747d7/packages/body/src/server.ts :71
  • spend verax-ai-verax-5a747d7/packages/body/src/server.ts :84

install hooks 3

  • prepack verax-ai-verax-5a747d7/packages/body/package.json :33 npm run build
  • prepack verax-ai-verax-5a747d7/packages/inventory/package.json :23 npm run build
  • prepack verax-ai-verax-5a747d7/packages/proxy/package.json :30 npm run build

declared dependencies 10

  • @cedulon/audit@0.13.1
  • @cedulon/checkpoint@0.13.1
  • @cedulon/core@0.13.1
  • @cedulon/cose@0.13.1
  • @cedulon/effect-extract@0.13.1
  • @cedulon/x402-adapter@0.13.1
  • @simplewebauthn/browser@^14.0.0
  • @simplewebauthn/server@^14.0.2
  • @types/node@^22.15.3
  • typescript@^5.8.3