MCP Observatory
5m ago Tracked 59,479 Last 5m ago 24h 2,575
github TypeScript analyzed 2a35c25

xcodethink/pixelcheck

github

MCP-first browser primitives for AI agents — real eyes and hands on the web. Local-first. Vendor-agnostic.

maintainer
xcodethink
licence
MIT
first seen
2026-06-09
last seen
2026-08-04
releases · 30d
0
short id

Drift inferred · capture-to-capture

  1. HIGH code analysis flagged committed secret, dynamic code execution in xcodethink/pixelcheck
  2. HIGH code analysis flagged committed secret in xcodethink/pixelcheck
  3. HIGH code analysis flagged committed secret in xcodethink/pixelcheck
  4. HIGH code analysis flagged committed secret in xcodethink/pixelcheck
capabilities 0 tools
transport stdio · http verified reported listed in the official MCP registry counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 2a35c25 · analyzer v33 · 20h ago

danger signals7

code evidence vv2.1.0 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 291

filesystem 134

  • fs xcodethink-pixelcheck-2a35c25/scenarios/handlers/install-extension.js :34 import * as fs from "node:fs";
  • fs (weak) xcodethink-pixelcheck-2a35c25/scripts/check-english-only.ts :26 import * as fs from "node:fs";
  • fs (weak) xcodethink-pixelcheck-2a35c25/scripts/check-no-console.ts :23 import * as fs from "node:fs";
  • fs (weak) xcodethink-pixelcheck-2a35c25/scripts/check-no-internal-refs.ts :50 import * as fs from "node:fs";
  • fs (weak) xcodethink-pixelcheck-2a35c25/scripts/check-perf.ts :21 import * as fs from "node:fs";
  • fs (weak) xcodethink-pixelcheck-2a35c25/scripts/check-report-a11y.ts :36 import * as fs from "node:fs";
  • fs (weak) xcodethink-pixelcheck-2a35c25/scripts/check-vendor-drift.ts :33 import * as fs from "node:fs";
  • fs (weak) xcodethink-pixelcheck-2a35c25/scripts/check-vendor-integrity.ts :37 import * as fs from "node:fs";
  • fs (weak) xcodethink-pixelcheck-2a35c25/scripts/chmod-bins.mjs :23 import * as fs from "node:fs";
  • fs (weak) xcodethink-pixelcheck-2a35c25/scripts/export-result-schemas.ts :16 import * as fs from "node:fs";
  • fs (weak) xcodethink-pixelcheck-2a35c25/scripts/gen-diff-fixture.ts :17 import * as fs from "node:fs";
  • fs (weak) xcodethink-pixelcheck-2a35c25/scripts/gen-history-fixture.ts :18 import * as fs from "node:fs";
show 28 more
  • fs (weak) xcodethink-pixelcheck-2a35c25/scripts/gen-sarif-fixture.ts :21 import * as fs from "node:fs";
  • fs (weak) xcodethink-pixelcheck-2a35c25/scripts/measure-injection-asr.ts :30 import * as fs from "node:fs";
  • fs (weak) xcodethink-pixelcheck-2a35c25/scripts/measure-memory.ts :27 import * as fs from "node:fs";
  • fs (weak) xcodethink-pixelcheck-2a35c25/src/benchmark/executor.ts :10 import * as fs from "node:fs";
  • fs (weak) xcodethink-pixelcheck-2a35c25/src/benchmark/loader.ts :10 import * as fs from "node:fs";
  • fs (weak) xcodethink-pixelcheck-2a35c25/src/benchmark/runner.ts :11 import * as fs from "node:fs";
  • fs xcodethink-pixelcheck-2a35c25/src/calibration/runner.ts :19 import * as fs from "node:fs";
  • fs xcodethink-pixelcheck-2a35c25/src/cli.ts :6 import * as fs from "node:fs";
  • fs xcodethink-pixelcheck-2a35c25/src/commands/doctor.ts :23 import * as fs from "node:fs";
  • fs xcodethink-pixelcheck-2a35c25/src/commands/explain.ts :19 import * as fs from "node:fs";
  • fs xcodethink-pixelcheck-2a35c25/src/commands/init-interactive.ts :25 import * as fs from "node:fs";
  • fs xcodethink-pixelcheck-2a35c25/src/core/artifacts-prune.ts :43 import * as fs from "node:fs";
  • fs xcodethink-pixelcheck-2a35c25/src/core/browser-install.ts :24 import * as fs from "node:fs";
  • fs xcodethink-pixelcheck-2a35c25/src/core/checkpoint.ts :15 import * as fs from "node:fs";
  • fs xcodethink-pixelcheck-2a35c25/src/core/ci-reporters.ts :29 import * as fs from "node:fs";
  • fs xcodethink-pixelcheck-2a35c25/src/core/config.ts :1 import * as fs from "node:fs";
  • fs xcodethink-pixelcheck-2a35c25/src/core/consent.ts :35 import * as fs from "node:fs";
  • fs xcodethink-pixelcheck-2a35c25/src/core/cost-guard.ts :48 import * as fs from "node:fs";
  • fs xcodethink-pixelcheck-2a35c25/src/core/db-migrate.ts :41 import * as fs from "node:fs";
  • fs xcodethink-pixelcheck-2a35c25/src/core/debug-log.ts :21 import * as fs from "node:fs";
  • fs xcodethink-pixelcheck-2a35c25/src/core/file-lock.ts :39 import * as fs from "node:fs";
  • fs xcodethink-pixelcheck-2a35c25/src/core/history.ts :16 import * as fs from "node:fs";
  • fs xcodethink-pixelcheck-2a35c25/src/core/min-repro.ts :9 import * as fs from "node:fs";
  • fs xcodethink-pixelcheck-2a35c25/src/core/persona.ts :1 import * as fs from "node:fs";
  • fs xcodethink-pixelcheck-2a35c25/src/core/plugin.ts :23 import * as fs from "node:fs";
  • fs xcodethink-pixelcheck-2a35c25/src/core/primitives/act.ts :34 import * as fs from "node:fs";
  • fs xcodethink-pixelcheck-2a35c25/src/core/primitives/compare.ts :29 import * as fs from "node:fs";
  • fs xcodethink-pixelcheck-2a35c25/src/core/primitives/diagnose.ts :42 import * as fs from "node:fs";

94 more not shown — this panel samples each group; the count above is the real total.

shell / exec 8

  • shell (weak) xcodethink-pixelcheck-2a35c25/scripts/check-english-only.ts :25 import { execFileSync } from "node:child_process";
  • shell (weak) xcodethink-pixelcheck-2a35c25/scripts/check-no-internal-refs.ts :49 import { execFileSync } from "node:child_process";
  • shell xcodethink-pixelcheck-2a35c25/src/core/browser-install.ts :28 import { execFileSync } from "node:child_process";
  • shell (weak) xcodethink-pixelcheck-2a35c25/tests/cost-guard-concurrency.test.ts :5 import { spawn } from "node:child_process";
  • shell (weak) xcodethink-pixelcheck-2a35c25/tests/integration/file-lock-race.test.ts :31 import { spawnSync } from "node:child_process";
  • shell (weak) xcodethink-pixelcheck-2a35c25/tests/mcp-concurrency-e2e.test.ts :22 import { spawn } from "node:child_process";
  • shell (weak) xcodethink-pixelcheck-2a35c25/tests/memory.test.ts :132 const { spawn } = await import("node:child_process");
  • shell (weak) xcodethink-pixelcheck-2a35c25/tests/perf.bench.ts :7 * validation / i18n lookup. NOT covered: real Chromium spawn (would

network 14

  • net xcodethink-pixelcheck-2a35c25/src/commands/doctor.ts :26 import { request } from "node:https";
  • net xcodethink-pixelcheck-2a35c25/src/core/browser-install.ts :27 import * as https from "node:https";
  • net xcodethink-pixelcheck-2a35c25/src/core/email.ts :45 const res = await fetch(`${BASE}${path}`, {
  • net xcodethink-pixelcheck-2a35c25/src/core/llm-provider.ts :303 response = await fetch(url, {
  • net xcodethink-pixelcheck-2a35c25/src/core/notify.ts :29 await fetch(webhook, {
  • net xcodethink-pixelcheck-2a35c25/src/core/stagehand-wrapper.ts :3 import * as net from "node:net";
  • net xcodethink-pixelcheck-2a35c25/src/core/url-preflight.ts :101 const res = await fetch(target.url, {
  • net xcodethink-pixelcheck-2a35c25/src/observer/dashboard.ts :576 fetch(auth('/api/timeline')),
  • net xcodethink-pixelcheck-2a35c25/src/observer/grid-dashboard.ts :159 const res = await fetch(auth('/api/grid'));
  • net xcodethink-pixelcheck-2a35c25/src/observer/server.ts :8 import { createServer, type Server, type IncomingMessage, type ServerResponse } from "node:http";
  • net (weak) xcodethink-pixelcheck-2a35c25/tests/fixtures/test-site/server.ts :13 import * as http from "node:http";
  • net (weak) xcodethink-pixelcheck-2a35c25/tests/observer-auth.test.ts :2 import type { Server } from "node:http";
show 2 more
  • net (weak) xcodethink-pixelcheck-2a35c25/tests/observer-server.test.ts :3 import type { Server } from "node:http";
  • net (weak) xcodethink-pixelcheck-2a35c25/tests/url-preflight.test.ts :3 * Mocks global fetch (test-scoped) so no real network is touched.

secrets 22

  • secrets (weak) xcodethink-pixelcheck-2a35c25/scripts/compare-critic-models.ts :77 if (!process.env.ANTHROPIC_API_KEY) {
  • secrets (weak) xcodethink-pixelcheck-2a35c25/scripts/measure-injection-asr.ts :99 if (!process.env.ANTHROPIC_API_KEY) {
  • secrets xcodethink-pixelcheck-2a35c25/src/cli.ts :1489 if (!process.env.ANTHROPIC_API_KEY) {
  • secrets xcodethink-pixelcheck-2a35c25/src/commands/doctor.ts :141 const key = process.env.ANTHROPIC_API_KEY;
  • secrets xcodethink-pixelcheck-2a35c25/src/commands/init-interactive.ts :131 if (!process.env.ANTHROPIC_API_KEY) {
  • secrets xcodethink-pixelcheck-2a35c25/src/core/llm.ts :21 const key = process.env.ANTHROPIC_API_KEY;
  • secrets xcodethink-pixelcheck-2a35c25/src/core/notify.ts :46 const token = process.env.TELEGRAM_BOT_TOKEN;
  • secrets xcodethink-pixelcheck-2a35c25/src/core/primitives/act.ts :756 apiKey: process.env.ANTHROPIC_API_KEY,
  • secrets xcodethink-pixelcheck-2a35c25/src/core/primitives/extract.ts :919 apiKey: process.env.ANTHROPIC_API_KEY,
  • secrets xcodethink-pixelcheck-2a35c25/src/core/runner.ts :402 apiKey: process.env.ANTHROPIC_API_KEY,
  • secrets (weak) xcodethink-pixelcheck-2a35c25/tests/computer-use.test.ts :125 process.env.ANTHROPIC_API_KEY = "sk-ant-test-key";
  • secrets (weak) xcodethink-pixelcheck-2a35c25/tests/doctor.test.ts :27 delete process.env.ANTHROPIC_API_KEY;
show 10 more
  • secrets (weak) xcodethink-pixelcheck-2a35c25/tests/instruction-mutator-extended.test.ts :84 process.env.ANTHROPIC_API_KEY = "sk-test-x";
  • secrets (weak) xcodethink-pixelcheck-2a35c25/tests/integration/llm-cassettes.test.ts :73 if (MODE === "replay" && !process.env.ANTHROPIC_API_KEY) {
  • secrets (weak) xcodethink-pixelcheck-2a35c25/tests/integration/playwright/stagehand-smoke.test.ts :49 const SHOULD_RUN = Boolean(process.env.ANTHROPIC_API_KEY);
  • secrets (weak) xcodethink-pixelcheck-2a35c25/tests/integration/prompt-injection-live.test.ts :32 const SHOULD_RUN = Boolean(process.env.ANTHROPIC_API_KEY);
  • secrets (weak) xcodethink-pixelcheck-2a35c25/tests/list-capabilities.test.ts :206 const prev = process.env.ANTHROPIC_API_KEY;
  • secrets (weak) xcodethink-pixelcheck-2a35c25/tests/llm-provider.test.ts :74 process.env.ANTHROPIC_API_KEY = "sk-test-provider";
  • secrets (weak) xcodethink-pixelcheck-2a35c25/tests/llm.test.ts :97 delete process.env.ANTHROPIC_API_KEY;
  • secrets (weak) xcodethink-pixelcheck-2a35c25/tests/notify.test.ts :40 delete process.env.TELEGRAM_BOT_TOKEN;
  • secrets (weak) xcodethink-pixelcheck-2a35c25/tests/persona.test.ts :224 process.env.TEST_USER_PASSWORD = "swordfish";
  • secrets (weak) xcodethink-pixelcheck-2a35c25/tests/secrets.test.ts :112 delete process.env.ANTHROPIC_API_KEY;

database 7

  • db xcodethink-pixelcheck-2a35c25/src/agent/memory.ts :22 import type Database from "better-sqlite3";
  • db xcodethink-pixelcheck-2a35c25/src/agent/plan-cache.ts :27 import type Database from "better-sqlite3";
  • db xcodethink-pixelcheck-2a35c25/src/core/db-migrate.ts :43 import Database from "better-sqlite3";
  • db xcodethink-pixelcheck-2a35c25/src/core/history.ts :17 import type Database from "better-sqlite3";
  • db xcodethink-pixelcheck-2a35c25/src/core/result-cache.ts :59 import type Database from "better-sqlite3";
  • db (weak) xcodethink-pixelcheck-2a35c25/tests/db-migrate.test.ts :5 import Database from "better-sqlite3";
  • db (weak) xcodethink-pixelcheck-2a35c25/tests/result-cache.test.ts :223 const Database = require("better-sqlite3");

install hooks 2

  • postinstall xcodethink-pixelcheck-2a35c25/package.json :52 node scripts/postinstall.mjs
  • prepublishOnly xcodethink-pixelcheck-2a35c25/package.json :53 npm run build && npm test

declared dependencies 37

  • @modelcontextprotocol/sdk@^1.29.0
  • @anthropic-ai/sdk@^0.94.0
  • @browserbasehq/stagehand@^3.3.0
  • axe-core@^4.11.4
  • better-sqlite3@~12.11.1
  • chalk@^5.3.0
  • commander@^14.0.3
  • dotenv@^17.4.2
  • odiff-bin@^4.3.8
  • ora@^9.4.0
  • p-limit@^7.3.0
  • pino@^10.3.1
show 25 more
  • pino-pretty@^13.1.3
  • playwright@^1.49.0
  • playwright-core@^1.49.0
  • sharp@^0.35.3
  • ws@^8.20.0
  • yaml@^2.6.0
  • zod@^3.25.76
  • @cyclonedx/cyclonedx-npm@^6.0.0
  • @eslint/js@^10.0.1
  • @playwright/test@^1.59.1
  • @types/better-sqlite3@^7.6.13
  • @types/node@^22.19.17
  • @types/ws@^8.18.1
  • @vitest/coverage-v8@^4.1.5
  • ajv@^8.20.0
  • ajv-formats@^3.0.1
  • eslint@^10.3.0
  • license-checker@^25.0.1
  • nock@^14.0.14
  • tsx@^4.19.0
  • typedoc@^0.28.19
  • typescript@^6.0.3
  • typescript-eslint@^8.59.2
  • vitest@^4.1.4
  • zod-to-json-schema@^3.25.2

obfuscation 3

  • dynamic require()/import() xcodethink-pixelcheck-2a35c25/tests/cost-guard-concurrency.test.ts :193 const { CostGuard } = require(${JSON.stringify(
  • dynamic require()/import() xcodethink-pixelcheck-2a35c25/tests/integration/file-lock-race.test.ts :62 const { withFileLockSync } = require(${JSON.stringify(
  • dynamic require()/import() xcodethink-pixelcheck-2a35c25/tests/memory.test.ts :136 const { AgentMemory } = require(${JSON.stringify(

perm:untrusted 1

  • untrusted (weak) xcodethink-pixelcheck-2a35c25/tests/observer-auth.test.ts :102 const body = await (await fetch(`${base}/api/session/leaky-session`)).text();