MCP Observatory
1m ago Tracked 59,457 Last 1m ago 24h 2,463
github TypeScript analyzed b51208e no deep scan

xopcai/xopc

github

Open-source, local-first personal AI assistant that lives on your computer, gets to know you over time, and keeps what matters moving.

maintainer
xopcai
licence
MIT
first seen
2026-06-07
last seen
2026-09-17
releases · 30d
170
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 9 tools
transport stdio · http counts 9 tools · 0 res · 0 prompts permission surface via code analysis

tools

  • attachments_fetch
  • conversation_get
  • conversations_list
  • events_poll
  • events_wait
  • messages_read
  • messages_send
  • permissions_list_open
  • permissions_respond
skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit b51208e · analyzer v33 · 30m ago

skills & prompt files 26

danger signals16

code evidence vmobile-expo-v0.0.68 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 5114

filesystem 400

  • fs xopcai-xopc-b51208e/apps/mobile-expo/plugins/with-android-proguard-rules.js :14 const fs = require('fs/promises');
  • fs xopcai-xopc-b51208e/apps/mobile-expo/plugins/with-ios-share-intake.js :1 const fs = require('fs');
  • fs (weak) xopcai-xopc-b51208e/apps/mobile-expo/scripts/verify-google-services.mjs :1 import { copyFileSync, existsSync, readFileSync } from 'node:fs';
  • fs (weak) xopcai-xopc-b51208e/apps/mobile-expo/src/features/chat/__tests__/markdown-render-safety.test.ts :1 import { existsSync, readFileSync } from 'node:fs';
  • fs xopcai-xopc-b51208e/apps/mobile-harmony/hvigorfile.ts :1 import { readFileSync } from 'node:fs';
  • fs (weak) xopcai-xopc-b51208e/apps/mobile-harmony/scripts/build-ci.mjs :3 import { copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
  • fs (weak) xopcai-xopc-b51208e/apps/mobile-harmony/scripts/decrypt-test-hap.mjs :2 import { readFileSync, writeFileSync } from 'node:fs';
  • fs (weak) xopcai-xopc-b51208e/apps/mobile-harmony/scripts/export-contracts.mts :2 import { mkdir, readFile, writeFile } from 'node:fs/promises';
  • fs (weak) xopcai-xopc-b51208e/apps/mobile-harmony/scripts/export-welcome.mts :1 import { mkdir, readFile, writeFile } from 'node:fs/promises';
  • fs (weak) xopcai-xopc-b51208e/apps/mobile-harmony/scripts/native-test-server.mts :2 import { copyFileSync, mkdirSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
  • fs (weak) xopcai-xopc-b51208e/apps/mobile-harmony/scripts/sign-test-hap.mjs :3 import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
  • fs (weak) xopcai-xopc-b51208e/apps/mobile-harmony/scripts/verify-chat-keyboard.mts :3 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
show 28 more
  • fs (weak) xopcai-xopc-b51208e/apps/mobile-harmony/scripts/verify-chat-navigation.mts :3 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
  • fs (weak) xopcai-xopc-b51208e/apps/mobile-harmony/scripts/verify-chat-ui.mts :2 import { readFileSync, mkdirSync, writeFileSync } from 'node:fs';
  • fs (weak) xopcai-xopc-b51208e/apps/mobile-harmony/scripts/verify-pairing-ui.mts :2 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
  • fs (weak) xopcai-xopc-b51208e/apps/mobile-harmony/scripts/verify.mts :2 import { existsSync, mkdirSync, readFileSync } from 'node:fs';
  • fs (weak) xopcai-xopc-b51208e/apps/mobile-harmony/tests/brand-assets.test.ts :1 import { existsSync, readFileSync } from 'node:fs';
  • fs (weak) xopcai-xopc-b51208e/apps/mobile-harmony/tests/buildConfig.test.ts :1 import { readFileSync } from 'node:fs';
  • fs (weak) xopcai-xopc-b51208e/apps/mobile-harmony/tests/chatWelcome.test.ts :7 import { readFileSync } from 'node:fs';
  • fs (weak) xopcai-xopc-b51208e/apps/mobile-harmony/tests/fixtures.test.ts :1 import { readFileSync } from 'node:fs';
  • fs (weak) xopcai-xopc-b51208e/apps/mobile-harmony/tests/gatewaySession.test.ts :2 import { mkdtempSync, rmSync } from 'node:fs';
  • fs (weak) xopcai-xopc-b51208e/electron/__tests__/chromium-bookmarks.test.ts :1 import { mkdtemp, mkdir, rm, writeFile } from 'node:fs/promises';
  • fs (weak) xopcai-xopc-b51208e/electron/__tests__/gateway-process-diagnostics.test.ts :2 import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
  • fs (weak) xopcai-xopc-b51208e/electron/__tests__/main-bundle-size.test.ts :1 import { readFileSync, readdirSync } from 'node:fs';
  • fs (weak) xopcai-xopc-b51208e/electron/__tests__/recent-files.test.ts :1 import { mkdtemp, mkdir, rm, writeFile } from 'node:fs/promises';
  • fs (weak) xopcai-xopc-b51208e/electron/__tests__/temporary-preview-file.test.ts :1 import { mkdtemp, readFile, rm, stat, utimes } from 'node:fs/promises';
  • fs (weak) xopcai-xopc-b51208e/electron/computer/__tests__/control-preferences.test.ts :1 import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
  • fs xopcai-xopc-b51208e/electron/computer/control-preferences.ts :1 import { readFileSync, rmSync } from 'node:fs';
  • fs xopcai-xopc-b51208e/electron/computer/cua-driver.ts :3 import { mkdtemp, access, rm, rmdir } from 'node:fs/promises';
  • fs xopcai-xopc-b51208e/electron/computer/desktop-host.ts :2 import { readFile, writeFile, stat } from 'node:fs/promises';
  • fs xopcai-xopc-b51208e/electron/desktop-pet/prefs.ts :1 import { mkdir, readFile, readdir, writeFile } from "node:fs/promises";
  • fs xopcai-xopc-b51208e/electron/desktop-pet/relationship-store.ts :1 import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
  • fs xopcai-xopc-b51208e/electron/desktop-pet/window.ts :1 import { mkdir } from "node:fs/promises";
  • fs xopcai-xopc-b51208e/electron/devtools.ts :1 import { appendFileSync, mkdirSync } from 'node:fs';
  • fs xopcai-xopc-b51208e/electron/ensure-gateway-config.ts :1 import { mkdirSync, writeFileSync } from 'node:fs';
  • fs xopcai-xopc-b51208e/electron/gateway-process.ts :2 import { existsSync } from 'node:fs';
  • fs xopcai-xopc-b51208e/electron/ipc/file-ipc.ts :1 import { mkdir, readdir, readFile, rm, stat, writeFile } from 'node:fs/promises';
  • fs xopcai-xopc-b51208e/electron/ipc/system-settings-ipc.ts :8 import { constants as fsConstants, access, readFile, writeFile } from 'node:fs/promises';
  • fs xopcai-xopc-b51208e/electron/ipc/temporary-preview-file.ts :1 import { lstat, mkdir, mkdtemp, readdir, rm, writeFile } from 'node:fs/promises';
  • fs xopcai-xopc-b51208e/electron/ipc/terminal-ipc.ts :2 import { constants } from 'node:fs';

360 more not shown — this panel samples each group; the count above is the real total.

shell / exec 114

  • shell (weak) xopcai-xopc-b51208e/apps/mobile-harmony/scripts/build-ci.mjs :1 import { spawnSync } from 'node:child_process';
  • shell (weak) xopcai-xopc-b51208e/apps/mobile-harmony/scripts/native-test-server.mts :1 import { execFileSync } from 'node:child_process';
  • shell (weak) xopcai-xopc-b51208e/apps/mobile-harmony/scripts/sign-test-hap.mjs :1 import { spawnSync } from 'node:child_process';
  • shell (weak) xopcai-xopc-b51208e/apps/mobile-harmony/scripts/verify-chat-keyboard.mts :2 import { execFileSync } from 'node:child_process';
  • shell (weak) xopcai-xopc-b51208e/apps/mobile-harmony/scripts/verify-chat-navigation.mts :2 import { execFileSync } from 'node:child_process';
  • shell (weak) xopcai-xopc-b51208e/apps/mobile-harmony/scripts/verify-chat-ui.mts :1 import { execFileSync } from 'node:child_process';
  • shell (weak) xopcai-xopc-b51208e/apps/mobile-harmony/scripts/verify-pairing-ui.mts :1 import { execFileSync } from 'node:child_process';
  • shell (weak) xopcai-xopc-b51208e/apps/mobile-harmony/scripts/verify.mts :1 import { spawnSync } from 'node:child_process';
  • shell xopcai-xopc-b51208e/electron.vite.config.ts :1 import { execSync } from 'node:child_process';
  • shell (weak) xopcai-xopc-b51208e/electron/__tests__/gateway-process-stop.test.ts :2 import type { ChildProcess } from 'node:child_process';
  • shell (weak) xopcai-xopc-b51208e/electron/computer/__tests__/cua-driver.test.ts :5 vi.mock('node:child_process', async (original) => ({ ...await original<typeof import('node:child_process')>(), spawn: io.spawn }));
  • shell xopcai-xopc-b51208e/electron/computer/cua-driver.ts :1 import { spawn, execFile, type ChildProcess } from 'node:child_process';
show 28 more
  • shell xopcai-xopc-b51208e/electron/gateway-process.ts :1 import { type ChildProcess, spawn, spawnSync } from 'node:child_process';
  • shell xopcai-xopc-b51208e/electron/ipc/file-ipc.ts :4 import { spawn } from 'node:child_process';
  • shell xopcai-xopc-b51208e/electron/ipc/search-ipc.ts :1 import { spawn } from 'node:child_process';
  • shell xopcai-xopc-b51208e/electron/ipc/system-settings-ipc.ts :7 import { execFile } from 'node:child_process';
  • shell xopcai-xopc-b51208e/electron/ipc/understanding-sources-ipc.ts :1 import { execFile } from 'node:child_process';
  • shell xopcai-xopc-b51208e/electron/uninstall/dir-size.ts :1 import { execFile } from 'node:child_process';
  • shell xopcai-xopc-b51208e/electron/uninstall/paths.ts :29 const { execFile } = await import('node:child_process');
  • shell xopcai-xopc-b51208e/electron/uninstall/uninstall-win32.ts :1 import { spawn } from 'node:child_process';
  • shell xopcai-xopc-b51208e/electron/voice-input-hotkey.ts :1 import { spawn, type ChildProcessByStdio } from 'node:child_process';
  • shell xopcai-xopc-b51208e/extensions/tts-local-cli/index.ts :32 import { spawn } from 'node:child_process';
  • shell (weak) xopcai-xopc-b51208e/packages/browser-ext/scripts/render-icons.mjs :2 import { spawnSync } from 'node:child_process';
  • shell (weak) xopcai-xopc-b51208e/scripts/__tests__/build-electron-with-retry.test.ts :1 import { spawnSync } from 'node:child_process';
  • shell (weak) xopcai-xopc-b51208e/scripts/__tests__/list-electron-release-upload-files.test.ts :1 import { execFileSync } from 'node:child_process';
  • shell (weak) xopcai-xopc-b51208e/scripts/__tests__/merge-macos-electron-latest-yml.test.ts :1 import { execFileSync, spawnSync } from 'node:child_process';
  • shell (weak) xopcai-xopc-b51208e/scripts/__tests__/setup-computer-driver.test.ts :1 import { spawnSync } from 'node:child_process';
  • shell (weak) xopcai-xopc-b51208e/scripts/bench-cli-startup.ts :1 import { spawn } from 'node:child_process';
  • shell (weak) xopcai-xopc-b51208e/scripts/bench-gateway-startup.ts :1 import { spawn } from 'node:child_process';
  • shell (weak) xopcai-xopc-b51208e/scripts/build-extensions-ui.mjs :5 import { execSync } from 'node:child_process';
  • shell (weak) xopcai-xopc-b51208e/scripts/build-voice-hotkey-helper.mjs :4 import { spawnSync } from 'node:child_process';
  • shell (weak) xopcai-xopc-b51208e/scripts/check-docs.mjs :3 import { execFileSync } from 'node:child_process';
  • shell (weak) xopcai-xopc-b51208e/scripts/electron-builder.mjs :22 import { spawnSync } from 'node:child_process';
  • shell (weak) xopcai-xopc-b51208e/scripts/electron-sign-local.mjs :25 import { spawnSync } from 'node:child_process';
  • shell (weak) xopcai-xopc-b51208e/scripts/prepare-electron-pack-dir.mjs :2 import { spawnSync } from 'node:child_process';
  • shell (weak) xopcai-xopc-b51208e/scripts/security/gateway-session-smoke.mjs :2 import { spawn } from 'node:child_process';
  • shell (weak) xopcai-xopc-b51208e/scripts/security/native-upload-redirect-smoke.mjs :2 import { execFileSync, spawn } from 'node:child_process';
  • shell (weak) xopcai-xopc-b51208e/scripts/setup-computer-driver.mjs :6 import { execFileSync } from 'node:child_process';
  • shell (weak) xopcai-xopc-b51208e/scripts/tsdown-build.mjs :2 import { spawnSync } from 'node:child_process';
  • shell (weak) xopcai-xopc-b51208e/scripts/verify-electron-gateway-compatibility.mjs :4 import { spawn } from 'node:child_process';

74 more not shown — this panel samples each group; the count above is the real total.

network 159

  • net xopcai-xopc-b51208e/apps/mobile-expo/src/api/client.ts :70 return await fetch(url, { ...init, redirect: 'error', signal: controller.signal });
  • net xopcai-xopc-b51208e/apps/mobile-expo/src/api/gateway-assets.ts :21 return fetch(uri, { ...init, headers: undefined, credentials: 'omit', redirect: 'error' });
  • net xopcai-xopc-b51208e/apps/mobile-expo/src/features/chat/attachment-file-io.ts :74 res = await fetch(uri);
  • net xopcai-xopc-b51208e/apps/mobile-expo/src/features/endpoint-tools/tools.ts :83 const response = await fetch(asset.uri);
  • net xopcai-xopc-b51208e/apps/mobile-expo/src/features/gateway/device-auth-session.ts :49 const response = await fetch(`${route.url}/api/device-auth/refresh`, {
  • net xopcai-xopc-b51208e/apps/mobile-expo/src/features/gateway/network-info.ts :124 const state = await mod.fetch();
  • net xopcai-xopc-b51208e/apps/mobile-expo/src/features/gateway/pair-gateway.ts :58 response = await fetch(`${origin}${path}`, {
  • net xopcai-xopc-b51208e/apps/mobile-expo/src/features/gateway/route-identity.ts :24 const response = await fetch(`${routeUrl}/api/gateway-identity/challenge`, {
  • net xopcai-xopc-b51208e/apps/mobile-expo/src/query/notes.ts :205 const blob = await fetch(`data:${attachment.mimeType};base64,${attachment.data.replace(/\s/g, '')}`).then((res) => res.blob());
  • net (weak) xopcai-xopc-b51208e/apps/mobile-expo/src/test/expo-fetch.ts :2 export const fetch: typeof globalThis.fetch = (input, init) => globalThis.fetch(input, init);
  • net (weak) xopcai-xopc-b51208e/apps/mobile-harmony/scripts/native-test-server.mts :5 import { createServer } from 'node:https';
  • net (weak) xopcai-xopc-b51208e/electron/__tests__/gateway-process.test.ts :1 import { createServer, type Server } from 'node:http';
show 28 more
  • net xopcai-xopc-b51208e/electron/computer/desktop-host.ts :178 const result = await fetch(base + path, { method: 'POST', headers, body: JSON.stringify(body), redirect: 'error',
  • net xopcai-xopc-b51208e/electron/computer/frame-upload.ts :44 response = await fetch(`${options.base}${grant.path}?name=${encodeURIComponent(file.name)}`, {
  • net xopcai-xopc-b51208e/electron/gateway-compatibility.ts :18 const response = await fetch(`http://127.0.0.1:${connection.port}/api/endpoint-tools/compatibility`, {
  • net xopcai-xopc-b51208e/electron/gateway-process.ts :3 import { createServer } from 'node:net';
  • net xopcai-xopc-b51208e/electron/ipc/file-resource-path.ts :18 const response = await fetch(
  • net xopcai-xopc-b51208e/electron/ipc/terminal-ipc.ts :110 const response = await fetch(url, {
  • net xopcai-xopc-b51208e/electron/tunnel-main.ts :38 const res = await fetch(`http://127.0.0.1:${embeddedGatewayPort}/api/tunnel/status`, {
  • net xopcai-xopc-b51208e/extensions/demo-skill-hub/index.ts :71 const res = await fetch(`${base}${path}`, { headers: { Accept: 'application/json' } });
  • net xopcai-xopc-b51208e/extensions/feishu/src/auth/app-registration.ts :26 const response = await fetch(`${baseUrl}${REGISTRATION_PATH}`, {
  • net xopcai-xopc-b51208e/extensions/feishu/src/outbound/media-load.ts :41 const res = await fetch(input, { redirect: 'follow' });
  • net (weak) xopcai-xopc-b51208e/extensions/feishu/src/transport/webhook/__tests__/webhook-security.test.ts :40 const res = await fetch(url, { method: 'GET' });
  • net xopcai-xopc-b51208e/extensions/feishu/src/transport/webhook/monitor.ts :2 import * as http from 'node:http';
  • net xopcai-xopc-b51208e/extensions/telegram/src/inbound-processor.ts :180 const response = await fetch(downloadUrl);
  • net xopcai-xopc-b51208e/extensions/telegram/src/outbound-sender.ts :241 const response = await fetch(mediaUrl);
  • net xopcai-xopc-b51208e/extensions/telegram/src/proxy-fetch.ts :1 import { ProxyAgent, fetch as undiciFetch } from 'undici';
  • net xopcai-xopc-b51208e/extensions/weixin/src/api/api.ts :6 import { Agent, EnvHttpProxyAgent, type Dispatcher, fetch as undiciFetch } from "undici";
  • net xopcai-xopc-b51208e/extensions/weixin/src/cdn/cdn-upload.ts :42 const res = await fetch(cdnUrl, {
  • net xopcai-xopc-b51208e/extensions/weixin/src/cdn/pic-decrypt.ts :11 res = await fetch(url);
  • net xopcai-xopc-b51208e/extensions/weixin/src/cdn/upload.ts :33 const res = await fetch(url);
  • net xopcai-xopc-b51208e/packages/browser-ext/src/i18n.ts :76 const response = await fetch(chrome.runtime.getURL(LOCALE_PATHS[locale]));
  • net xopcai-xopc-b51208e/packages/browser-ext/src/sidepanel/auth.ts :267 response = await fetch(`${origin}${path}`, {
  • net (weak) xopcai-xopc-b51208e/scripts/bench-gateway-startup.ts :3 import { request } from 'node:http';
  • net (weak) xopcai-xopc-b51208e/scripts/growth-github-community.mjs :324 const res = await fetch(`${API}${path}`, {
  • net (weak) xopcai-xopc-b51208e/scripts/growth-snapshot.mjs :10 const res = await fetch(url, {
  • net (weak) xopcai-xopc-b51208e/scripts/proactive-smoke.mts :33 const response = await fetch(origin + path, { method, headers, ...(body ? { body: JSON.stringify(body) } : {}) });
  • net (weak) xopcai-xopc-b51208e/scripts/security/gateway-session-smoke.mjs :5 import { createServer } from 'node:net';
  • net (weak) xopcai-xopc-b51208e/scripts/security/native-upload-redirect-smoke.mjs :5 import { createServer } from 'node:http';
  • net (weak) xopcai-xopc-b51208e/scripts/setup-computer-driver.mjs :22 const response = await fetch('https://api.github.com/repos/trycua/cua/releases/assets/566587560', {

119 more not shown — this panel samples each group; the count above is the real total.

secrets 32

  • secrets (weak) xopcai-xopc-b51208e/apps/mobile-harmony/scripts/decrypt-test-hap.mjs :7 const key = process.env.HARMONY_TEST_ARTIFACT_KEY
  • secrets (weak) xopcai-xopc-b51208e/apps/mobile-harmony/scripts/sign-test-hap.mjs :11 const artifactKey = process.env.HARMONY_TEST_ARTIFACT_KEY;
  • secrets xopcai-xopc-b51208e/extensions/demo-provider/index.ts :110 : (process.env.DEMO_API_KEY ?? '');
  • secrets xopcai-xopc-b51208e/extensions/telegram/src/adapters/onboard-cli.ts :29 return process.env.TELEGRAM_BOT_TOKEN?.trim() || null;
  • secrets xopcai-xopc-b51208e/extensions/telegram/src/adapters/setup-wizard.ts :12 return (fromAcc as string | undefined) || process.env.TELEGRAM_BOT_TOKEN;
  • secrets (weak) xopcai-xopc-b51208e/scripts/electron-sign-local.mjs :64 const cscKeyPassword = process.env['XOPC_CSC_KEY_PASSWORD'];
  • secrets (weak) xopcai-xopc-b51208e/scripts/growth-github-community.mjs :321 const token = process.env.GITHUB_TOKEN;
  • secrets (weak) xopcai-xopc-b51208e/scripts/setup-computer-driver.mjs :21 const token = process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
  • secrets (weak) xopcai-xopc-b51208e/scripts/tunnel-broker-tls-verify.mjs :19 const token = process.env.GATEWAY_TOKEN?.trim();
  • secrets (weak) xopcai-xopc-b51208e/scripts/verify-managed-computer.mts :13 if (!helper || !process.env.XOPC_SERVER || !process.env.DASHSCOPE_API_KEY) throw new Error('Provisioning prerequisites unavailable');
  • secrets (weak) xopcai-xopc-b51208e/src/agent/commands/__tests__/command-isolation.integration.test.ts :25 assert.equal(process.env.OPENAI_API_KEY, undefined);
  • secrets (weak) xopcai-xopc-b51208e/src/agent/fallback/__tests__/index.test.ts :72 process.env.ANTHROPIC_API_KEY = 'test';
show 20 more
  • secrets xopcai-xopc-b51208e/src/agent/skills/hub-pull.ts :83 const token = process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
  • secrets (weak) xopcai-xopc-b51208e/src/browser/__tests__/readiness.test.ts :22 delete process.env.BROWSERBASE_API_KEY;
  • secrets xopcai-xopc-b51208e/src/browser/providers/browser-use.ts :32 const apiKey = this.config.apiKey || process.env.BROWSER_USE_API_KEY;
  • secrets xopcai-xopc-b51208e/src/browser/providers/browserbase.ts :32 const apiKey = this.config.apiKey || process.env.BROWSERBASE_API_KEY;
  • secrets xopcai-xopc-b51208e/src/browser/readiness.ts :80 ? process.env.BROWSERBASE_API_KEY
  • secrets xopcai-xopc-b51208e/src/cli/commands/gateway/run-foreground.ts :120 process.env.XOPC_GATEWAY_TOKEN = auth.token;
  • secrets xopcai-xopc-b51208e/src/cli/commands/gateway/token.ts :68 const environmentToken = process.env.XOPC_GATEWAY_TOKEN?.trim();
  • secrets xopcai-xopc-b51208e/src/cli/commands/platform.ts :30 const fromEnv = process.env.XOPC_PLATFORM_RUNTIME_TOKEN?.trim();
  • secrets xopcai-xopc-b51208e/src/cli/commands/tunnel.ts :38 const fromEnv = process.env.XOPC_GATEWAY_TOKEN?.trim();
  • secrets xopcai-xopc-b51208e/src/cli/utils/gateway-client.ts :78 const envToken = process.env.XOPC_GATEWAY_TOKEN;
  • secrets (weak) xopcai-xopc-b51208e/src/computer/__tests__/model-live.test.ts :12 baseUrl: 'https://dashscope.aliyuncs.com/compatible-mode/v1', apiKey: process.env.DASHSCOPE_API_KEY ?? '' });
  • secrets (weak) xopcai-xopc-b51208e/src/connectors/__tests__/connectors.test.ts :27 delete process.env.XOPC_COMPOSIO_API_KEY;
  • secrets xopcai-xopc-b51208e/src/connectors/composio-sessions.ts :35 return stored?.trim() || process.env.XOPC_COMPOSIO_API_KEY?.trim() || process.env.COMPOSIO_API_KEY?.trim() || null;
  • secrets (weak) xopcai-xopc-b51208e/src/extensions/__tests__/activation-context.test.ts :79 const prev = process.env.DASHSCOPE_API_KEY;
  • secrets xopcai-xopc-b51208e/src/gateway/hono/routes/public-gateway.ts :52 const secret = process.env.COMPOSIO_WEBHOOK_SECRET?.trim();
  • secrets xopcai-xopc-b51208e/src/gateway/security/audit.ts :172 const envToken = process.env.XOPC_GATEWAY_TOKEN;
  • secrets xopcai-xopc-b51208e/src/mcp/gateway-http-client.ts :20 return createGatewayCredential('token', auth.token ?? process.env.XOPC_GATEWAY_TOKEN);
  • secrets (weak) xopcai-xopc-b51208e/src/voice/realtime/__tests__/omniEngine.live.test.ts :7 const enabled = process.env.XOPC_LIVE_OMNI === '1' && Boolean(process.env.DASHSCOPE_API_KEY);
  • secrets xopcai-xopc-b51208e/src/voice/realtime/runtime.ts :115 const apiKey = input?.apiKey || (selection.provider === 'alibaba' ? process.env.DASHSCOPE_API_KEY : undefined) || slice.apiKey;
  • secrets (weak) xopcai-xopc-b51208e/src/voice/tts/__tests__/merge-config.test.ts :51 const prevOpenai = process.env.OPENAI_API_KEY;

tool registrations 9

  • conversations_list xopcai-xopc-b51208e/src/mcp/channel-tools.ts :24
  • conversation_get xopcai-xopc-b51208e/src/mcp/channel-tools.ts :43
  • messages_read xopcai-xopc-b51208e/src/mcp/channel-tools.ts :62
  • attachments_fetch xopcai-xopc-b51208e/src/mcp/channel-tools.ts :78
  • events_poll xopcai-xopc-b51208e/src/mcp/channel-tools.ts :103
  • events_wait xopcai-xopc-b51208e/src/mcp/channel-tools.ts :123
  • messages_send xopcai-xopc-b51208e/src/mcp/channel-tools.ts :143
  • permissions_list_open xopcai-xopc-b51208e/src/mcp/channel-tools.ts :159
  • permissions_respond xopcai-xopc-b51208e/src/mcp/channel-tools.ts :172

install hooks 1

  • prepublishOnly xopcai-xopc-b51208e/package.json :91 npm test && npm run test:skills:all && npm run build && npm run release:check-package

declared dependencies 91

  • @modelcontextprotocol/sdk@1.29.0
  • @composio/core@0.18.1
  • @earendil-works/pi-agent-core@0.85.1
  • @earendil-works/pi-ai@0.85.1
  • @earendil-works/pi-coding-agent@0.85.1
  • @earendil-works/pi-tui@0.85.1
  • @grammyjs/runner@^2.0.3
  • @hono/node-server@^2.0.4
  • @inquirer/prompts@^8.5.0
  • @mozilla/readability@^0.6.0
  • @sinclair/typebox@^0.34.49
  • @vscode/ripgrep@^1.18.0
show 28 more
  • abort-controller@^3.0.0
  • adm-zip@^0.6.0
  • ajv@^8.20.0
  • chalk@^5.6.2
  • chokidar@^5.0.0
  • cli-table3@^0.6.5
  • commander@^14.0.3
  • cron-parser@^5.5.0
  • dotenv@^17.4.2
  • glob@^13.0.6
  • grammy@^1.43.0
  • hono@^4.12.25
  • jiti@^2.7.0
  • js-yaml@^4.3.2
  • linkedom@0.18.13
  • markdown-it@^14.2.0
  • node-edge-tts@^1.2.10
  • openai@^6.48.0
  • pino@^10.3.1
  • pino-pretty@^13.1.3
  • proper-lockfile@^4.1.2
  • semver@^7.8.1
  • sharp@0.35.4
  • silk-wasm@^3.7.1
  • smol-toml@^1.8.0
  • thread-stream@^4.2.0
  • undici@^8.9.0
  • uuid@^14.0.0

51 more not shown — this panel samples each group; the count above is the real total.

clipboard 2

  • clipboard shell call xopcai-xopc-b51208e/src/tui/clipboard-image.ts :64 const list = runCommand('wl-paste', ['--list-types'], { timeoutMs: 1000 });
  • clipboard shell call xopcai-xopc-b51208e/src/tui/clipboard-text.ts :22 if (tryWrite('pbcopy', [], text)) return;

cursor-plugin 1

  • opaque (low) xopcai-xopc-b51208e/.cursor/rules/deveco-flow.mdc bundled .cursor/ plugin descriptor (xopcai-xopc-b51208e/.cursor/rules/deveco-flow.mdc) — presence-detected; review the descriptor

perm:untrusted 3

  • untrusted (weak) xopcai-xopc-b51208e/src/discussions/__tests__/service.test.ts :216 expect(await (await fetch(jobUrl, { headers: { authorization: 'Bearer meeting-test' } })).json()).toMatchObject({ id: job.id, state: 'queued' });
  • untrusted (weak) xopcai-xopc-b51208e/src/gateway/hono/routes/__tests__/voice-catalog.test.ts :24 const catalog = await (await fetch(`${url}/api/voice/catalog`,{headers})).json();
  • untrusted xopcai-xopc-b51208e/web/src/features/settings/models-hub/connected-providers-grid.tsx :67 const { payload } = await (await fetch(url, { credentials: 'same-origin', redirect: 'error' })).json();

transport_posture 2

  • network-listening, binds all interfaces, no auth detected xopcai-xopc-b51208e/src/gateway/__tests__/ports.test.ts :92 server.listen(0, '0.0.0.0', () => {
  • network-listening, binds all interfaces, no auth detected xopcai-xopc-b51208e/src/gateway/ports.ts :302 export async function checkPortAvailable(port: number, host = "0.0.0.0"): Promise<boolean> {