github TypeScript analyzed 4548707

withvibe/withvibe

Self-hosted shared AI environment for R&D teams. Spin up isolated envs, vibe-code with AI, share with the team, ship with automated agent gates.

maintainer: withvibe
licence: AGPL-3.0
first seen: 2026-06-06
last seen: 2026-08-09
releases · 30d: 0
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools

transport streamable-http · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 4548707 · analyzer v33 · 4w ago

danger signals1

dynamic code execution new Function() withvibe-withvibe-4548707/apps/qa-browser-extension/src/page-driver.ts :367 const fn = new Function(

code evidence vv0.4.9 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 370

filesystem 33

fs withvibe-withvibe-4548707/apps/api/src/agents/agent-chat.service.ts :2 import { mkdir, rm, writeFile } from "fs/promises";
fs withvibe-withvibe-4548707/apps/api/src/agents/agent-seed.service.ts :2 import { access } from "fs/promises";
fs withvibe-withvibe-4548707/apps/api/src/chat/attachments.controller.ts :9 import { createReadStream } from "fs";
fs withvibe-withvibe-4548707/apps/api/src/chat/bench/bench.service.ts :2 import { mkdir, writeFile } from "fs/promises";
fs withvibe-withvibe-4548707/apps/api/src/chat/bench/run-bench.ts :3 import { readFile } from "fs/promises";
fs withvibe-withvibe-4548707/apps/api/src/chat/chat-context.service.ts :2 import { mkdir } from "fs/promises";
fs withvibe-withvibe-4548707/apps/api/src/chat/chat-stream.service.ts :2 import { mkdir } from "fs/promises";
fs withvibe-withvibe-4548707/apps/api/src/chat/claude-code-engine.service.ts :3 import { mkdir, rm, writeFile } from "fs/promises";
fs withvibe-withvibe-4548707/apps/api/src/chat/external-context-mcp.service.ts :8 import { mkdir, readFile, writeFile, access } from "fs/promises";
fs withvibe-withvibe-4548707/apps/api/src/chat/memory-mirror.service.ts :2 import { mkdir, rm, writeFile } from "fs/promises";
fs withvibe-withvibe-4548707/apps/api/src/chat/messages.service.ts :2 import { mkdir, writeFile } from "fs/promises";
fs withvibe-withvibe-4548707/apps/api/src/common/repo-base-dir.ts :1 import { chmod, chown, mkdir } from "fs/promises";

show 21 more

fs withvibe-withvibe-4548707/apps/api/src/common/version.ts :1 import { promises as fs } from "node:fs";
fs withvibe-withvibe-4548707/apps/api/src/docker/code-server.service.ts :5 import { existsSync } from "fs";
fs withvibe-withvibe-4548707/apps/api/src/docker/code-tunnel.service.ts :4 import { existsSync } from "fs";
fs withvibe-withvibe-4548707/apps/api/src/docker/compose-security.check.ts :21 import { mkdtemp, mkdir, symlink, writeFile } from "fs/promises";
fs withvibe-withvibe-4548707/apps/api/src/docker/compose-security.ts :33 import { realpath } from "fs/promises";
fs withvibe-withvibe-4548707/apps/api/src/docker/database-detection.ts :1 import { readFile } from "fs/promises";
fs withvibe-withvibe-4548707/apps/api/src/docker/docker.service.ts :4 import { access, readdir, readFile } from "fs/promises";
fs withvibe-withvibe-4548707/apps/api/src/docker/playwright-mcp.service.ts :2 import fs from "node:fs/promises";
fs withvibe-withvibe-4548707/apps/api/src/docker/sidecar-net.ts :3 import { access } from "node:fs/promises";
fs withvibe-withvibe-4548707/apps/api/src/env-clones/code-workspace.service.ts :2 import { mkdir, readdir, writeFile } from "fs/promises";
fs withvibe-withvibe-4548707/apps/api/src/env-clones/env-clone.service.ts :4 import { access, chmod, mkdir, rm, writeFile } from "fs/promises";
fs withvibe-withvibe-4548707/apps/api/src/envs/env-context.controller.ts :18 import { createReadStream } from "fs";
fs withvibe-withvibe-4548707/apps/api/src/envs/env-context.service.ts :6 import * as fs from "fs/promises";
fs withvibe-withvibe-4548707/apps/api/src/main.ts :21 // umask to 002 makes every subsequent fs.mkdir/fs.writeFile leave its
fs withvibe-withvibe-4548707/apps/api/src/repos/repos.service.ts :9 import { access, mkdir, rm } from "fs/promises";
fs withvibe-withvibe-4548707/apps/api/src/slack/slack-mcp.service.ts :3 import { promises as fs } from "node:fs";
fs withvibe-withvibe-4548707/apps/api/src/storage/storage.service.ts :3 import { promises as fs } from "node:fs";
fs withvibe-withvibe-4548707/apps/api/src/templates/template-materializer.service.ts :6 import { readFile } from "fs/promises";
fs withvibe-withvibe-4548707/apps/api/src/workspaces/workspaces.service.ts :14 import { promises as fs } from "node:fs";
fs withvibe-withvibe-4548707/apps/qa-browser-extension/build.mjs :2 import { copyFile, mkdir, rm, readdir } from "node:fs/promises";
fs (weak) withvibe-withvibe-4548707/apps/web/next.config.ts :3 import { readFileSync } from "node:fs";

shell / exec 20

shell withvibe-withvibe-4548707/apps/api/src/agents/_seed-data.ts :872 exec(\`convert \${userFile} out.png\`)
shell withvibe-withvibe-4548707/apps/api/src/chat/bench/cc-direct-runner.ts :1 import { spawn } from "child_process";
shell withvibe-withvibe-4548707/apps/api/src/chat/claude-code-engine.service.ts :2 import { spawn } from "child_process";
shell withvibe-withvibe-4548707/apps/api/src/common/startup-cleanup.service.ts :2 import { execFile } from "child_process";
shell withvibe-withvibe-4548707/apps/api/src/docker/browser-sidecar.service.ts :2 import { execFile } from "child_process";
shell withvibe-withvibe-4548707/apps/api/src/docker/code-server.service.ts :2 import { execFile, spawn } from "child_process";
shell withvibe-withvibe-4548707/apps/api/src/docker/code-tunnel.service.ts :2 import { execFile, spawn, type ChildProcess } from "child_process";
shell withvibe-withvibe-4548707/apps/api/src/docker/compose-security.ts :31 import { execFile } from "child_process";
shell withvibe-withvibe-4548707/apps/api/src/docker/db-viewer.service.ts :2 import { execFile } from "child_process";
shell withvibe-withvibe-4548707/apps/api/src/docker/docker.controller.ts :112 let child: import("child_process").ChildProcess | null = null;
shell withvibe-withvibe-4548707/apps/api/src/docker/docker.service.ts :2 import { execFile, spawn, type ChildProcess } from "child_process";
shell withvibe-withvibe-4548707/apps/api/src/docker/sidecar-net.ts :1 import { execFile } from "child_process";

show 8 more

shell withvibe-withvibe-4548707/apps/api/src/env-clones/env-clone.service.ts :2 import { execFile } from "child_process";
shell withvibe-withvibe-4548707/apps/api/src/envs/envs.service.ts :7 import { execFile } from "child_process";
shell withvibe-withvibe-4548707/apps/api/src/git/git.service.ts :7 import { execFile } from "child_process";
shell withvibe-withvibe-4548707/apps/api/src/plugins/plugins.service.ts :7 import { execFile } from "child_process";
shell withvibe-withvibe-4548707/apps/api/src/repos/repos.service.ts :7 import { execFile } from "child_process";
shell withvibe-withvibe-4548707/apps/api/src/runner/claude-runner.service.ts :2 import { execFile } from "child_process";
shell withvibe-withvibe-4548707/apps/api/src/terminal/terminal.service.ts :5 import { execFile } from "child_process";
shell withvibe-withvibe-4548707/apps/qa-browser-extension/build.mjs :4 import { execFileSync } from "node:child_process";

network 53

net withvibe-withvibe-4548707/apps/api/src/app.module.ts :6 import type { IncomingMessage, ServerResponse } from "node:http";
net withvibe-withvibe-4548707/apps/api/src/docker/qa-view.gateway.ts :3 import { type IncomingMessage, type Server } from "http";
net withvibe-withvibe-4548707/apps/api/src/docker/qa-view.http-proxy.ts :215 upstream = await fetch(url);
net withvibe-withvibe-4548707/apps/api/src/docker/sidecar-proxy.ts :3 import * as http from "node:http";
net withvibe-withvibe-4548707/apps/api/src/docker/user-browser.gateway.ts :3 import { type IncomingMessage, type Server } from "http";
net withvibe-withvibe-4548707/apps/api/src/git/git.service.ts :1225 const res = await fetch(
net withvibe-withvibe-4548707/apps/api/src/plugins/plugin-mcp-bridge.service.ts :7 import type { IncomingHttpHeaders } from "node:http";
net withvibe-withvibe-4548707/apps/api/src/plugins/plugins-admin.controller.ts :102 const res = await fetch(url.toString(), {
net withvibe-withvibe-4548707/apps/api/src/plugins/plugins.service.ts :1238 const res = await fetch(url, { signal: AbortSignal.timeout(3_000) });
net withvibe-withvibe-4548707/apps/api/src/ports/port-allocator.service.ts :3 import net from "net";
net withvibe-withvibe-4548707/apps/api/src/repos/github.service.ts :43 const res = await fetch(
net withvibe-withvibe-4548707/apps/api/src/terminal/terminal.service.ts :3 import { createServer, type IncomingMessage, type Server } from "http";

show 28 more

net withvibe-withvibe-4548707/apps/api/src/workspaces/workspaces.service.ts :86 - "fetch('http://localhost:3000').then(()=>process.exit(0)).catch(()=>process.exit(1))"
net withvibe-withvibe-4548707/apps/web/src/app/account/page.tsx :52 fetch("/api/account")
net withvibe-withvibe-4548707/apps/web/src/app/cli-auth/[code]/confirm-button.tsx :14 const res = await fetch("/api/cli-auth/confirm", {
net withvibe-withvibe-4548707/apps/web/src/app/invite/[token]/page.tsx :56 fetch(`/api/invitations/${token}`).then(async (r) => {
net withvibe-withvibe-4548707/apps/web/src/app/register/page.tsx :33 const res = await fetch("/api/auth/register", {
net withvibe-withvibe-4548707/apps/web/src/app/workspaces/[id]/_active-runs.tsx :69 fetch(`/api/workspaces/${workspaceId}/envs`)
net withvibe-withvibe-4548707/apps/web/src/app/workspaces/[id]/_shell.tsx :87 fetch(`/api/workspaces/${workspace.id}/inbox/count`)
net withvibe-withvibe-4548707/apps/web/src/app/workspaces/[id]/admin/plugins/[pluginId]/edit/page.tsx :38 const res = await fetch(
net withvibe-withvibe-4548707/apps/web/src/app/workspaces/[id]/admin/plugins/marketplace/page.tsx :57 const res = await fetch(
net withvibe-withvibe-4548707/apps/web/src/app/workspaces/[id]/admin/plugins/new/page.tsx :68 const res = await fetch(
net withvibe-withvibe-4548707/apps/web/src/app/workspaces/[id]/admin/plugins/page.tsx :60 const res = await fetch(`/api/workspaces/${workspaceId}/admin/plugins`);
net withvibe-withvibe-4548707/apps/web/src/app/workspaces/[id]/environments/[envId]/_agents-panel.tsx :75 fetch(`/api/workspaces/${workspaceId}/envs/${envId}/agents`)
net withvibe-withvibe-4548707/apps/web/src/app/workspaces/[id]/environments/[envId]/_chat.tsx :377 fetch(`/api/workspaces/${workspaceId}/envs/${envId}/agents`)
net withvibe-withvibe-4548707/apps/web/src/app/workspaces/[id]/environments/[envId]/_compose-dialog.tsx :52 const res = await fetch(
net withvibe-withvibe-4548707/apps/web/src/app/workspaces/[id]/environments/[envId]/_context-panel.tsx :179 const res = await fetch(
net withvibe-withvibe-4548707/apps/web/src/app/workspaces/[id]/environments/[envId]/_database.tsx :61 const res = await fetch(
net withvibe-withvibe-4548707/apps/web/src/app/workspaces/[id]/environments/[envId]/_git-panel.tsx :205 const res = await fetch(
net withvibe-withvibe-4548707/apps/web/src/app/workspaces/[id]/environments/[envId]/_plugin-manage-dialog.tsx :62 const res = await fetch(
net withvibe-withvibe-4548707/apps/web/src/app/workspaces/[id]/environments/[envId]/_plugin-panel.tsx :218 const res = await fetch(
net withvibe-withvibe-4548707/apps/web/src/app/workspaces/[id]/environments/[envId]/_qa-browser.tsx :87 const res = await fetch(
net withvibe-withvibe-4548707/apps/web/src/app/workspaces/[id]/environments/[envId]/_runtime.tsx :243 const res = await fetch(
net withvibe-withvibe-4548707/apps/web/src/app/workspaces/[id]/environments/[envId]/_security-panel.tsx :249 const res = await fetch(
net withvibe-withvibe-4548707/apps/web/src/app/workspaces/[id]/environments/[envId]/_terminal.tsx :54 const res = await fetch(
net withvibe-withvibe-4548707/apps/web/src/app/workspaces/[id]/environments/[envId]/_vscode-menu.tsx :84 const res = await fetch(
net withvibe-withvibe-4548707/apps/web/src/app/workspaces/[id]/environments/[envId]/page.tsx :243 const res = await fetch(`/api/workspaces/${id}/envs/${envId}`);
net withvibe-withvibe-4548707/apps/web/src/app/workspaces/[id]/environments/new/page.tsx :112 fetch(`/api/workspaces/${id}/repos`)
net withvibe-withvibe-4548707/apps/web/src/app/workspaces/[id]/inbox/page.tsx :35 const res = await fetch(`/api/workspaces/${id}/inbox`);
net withvibe-withvibe-4548707/apps/web/src/app/workspaces/[id]/page.tsx :132 fetch(`/api/workspaces/${id}`),

13 more not shown — this panel samples each group; the count above is the real total.

secrets 13

secrets withvibe-withvibe-4548707/apps/api/src/agents/agent-greeting.service.ts :36 workspace?.anthropicApiKey || process.env.ANTHROPIC_API_KEY;
secrets withvibe-withvibe-4548707/apps/api/src/agents/clone-seed.service.ts :53 workspace?.anthropicApiKey || process.env.ANTHROPIC_API_KEY;
secrets withvibe-withvibe-4548707/apps/api/src/chat/chat-context.service.ts :537 process.env.ANTHROPIC_API_KEY ??
secrets withvibe-withvibe-4548707/apps/api/src/chat/chat-stream.service.ts :277 process.env.ANTHROPIC_API_KEY ||
secrets withvibe-withvibe-4548707/apps/api/src/chat/claude-code-engine.service.ts :205 process.env.ANTHROPIC_API_KEY ||
secrets withvibe-withvibe-4548707/apps/api/src/chat/model-router.service.ts :86 process.env.ANTHROPIC_API_KEY ||
secrets withvibe-withvibe-4548707/apps/api/src/chat/title-generator.service.ts :40 process.env.ANTHROPIC_API_KEY;
secrets withvibe-withvibe-4548707/apps/api/src/env-clones/env-clone.service.ts :59 const token = ws?.githubToken || process.env.GITHUB_TOKEN || null;
secrets withvibe-withvibe-4548707/apps/api/src/git/git.service.ts :1192 return ws?.githubToken || process.env.GITHUB_TOKEN || null;
secrets withvibe-withvibe-4548707/apps/api/src/repos/github.service.ts :35 const token = ws?.githubToken || process.env.GITHUB_TOKEN;
secrets withvibe-withvibe-4548707/apps/api/src/repos/repos.service.ts :50 const effective = token || process.env.GITHUB_TOKEN;
secrets withvibe-withvibe-4548707/apps/api/src/templates/agent-variable-binder.service.ts :57 process.env.ANTHROPIC_API_KEY ||

show 1 more

secrets withvibe-withvibe-4548707/apps/api/src/workspaces/workspaces.service.ts :344 workspace.anthropicApiKey || process.env.ANTHROPIC_API_KEY

database 2

db withvibe-withvibe-4548707/apps/api/src/plugins/plugin-postgres.service.ts :8 import { Client as PgClient } from "pg";
db withvibe-withvibe-4548707/packages/db/prisma/backfill-routing-mode.ts :1 import pg from "pg";

perm:untrusted 1

untrusted withvibe-withvibe-4548707/apps/api/src/workspaces/workspaces.service.ts :86 - "fetch('http://localhost:3000').then(()=>process.exit(0)).catch(()=>process.exit(1))"

transport_posture 1

network-listening, binds all interfaces, no auth detected withvibe-withvibe-4548707/apps/api/src/ports/port-allocator.service.ts :108 server.listen(port, "0.0.0.0");