github TypeScript analyzed 3543e92 no deep scan

xopcai/xopc

Name: xopcai/xopc
Author: xopcai

Personal AI for the one-person company. Open-source and local-first—it remembers your context, acts across your tools, and picks up where you left off.

maintainer: xopcai
licence: MIT
first seen: 2026-06-07
last seen: 2026-09-18
releases · 30d: 174
short id

xopcai/xopc is an MCP server distributed on github, maintained by xopcai, tracked here since June 2026. It has shipped 295 releases and exposes 9 tools. Tools include attachments_fetch, conversation_get, conversations_list, events_poll, events_wait, messages_read, and 3 more. Its composite risk grade is C — an inferred review prompt computed from observed signals, not a verdict.

what we found

Reading the source raised 2 review prompts — dangerous code and toxic flow (lethal trifecta) — each a pattern worth a human look rather than a finding of fault.

Its 9 tools appear to reach filesystem, shell / exec, network, secrets and untrusted content, inferred from tool names, descriptions and input schemas rather than from observed behaviour.

full security breakdown →

tools 9

attachments_fetch
conversation_get
conversations_list
events_poll
events_wait
messages_read
messages_send
permissions_list_open
permissions_respond

release cadence · 90d 246 releases

06-21 00:00 08-04 00:00 now

recent releases last 10

version	date	src
v0.0.302	2026-09-18	github
v0.0.301	2026-09-18	github
v0.0.299	2026-09-18	github
v0.0.298	2026-09-18	github
mobile-expo-v0.0.70	2026-09-18	github
v0.0.297	2026-09-18	github
mobile-expo-v0.0.69	2026-09-17	github
v0.0.296	2026-09-17	github
mobile-expo-v0.0.68	2026-09-17	github
v0.0.295	2026-09-17	github

view all →

xopcai/xopc

Navigate

Stream

Features

Display