MCP Observatory
1m ago Tracked 55,861 Last 1m ago 24h 2,736
npm Rust analyzed 3.9.12 deep scan unknown unconfirmed MCP

yvgude/lean-ctx

v3.9.12
npm

LeanCTX — Context Intelligence for AI systems.

maintainer
yvgude
licence
Apache-2.0
first seen
2026-06-01
last seen
2026-09-10
releases · 30d
4
short id

Drift inferred · capture-to-capture

  1. HIGH code analysis flagged committed secret ×2 in yvgude/lean-ctx
  2. HIGH code analysis flagged committed secret ×2 in yvgude/lean-ctx
  3. HIGH code analysis flagged committed secret ×2 in yvgude/lean-ctx
  4. HIGH code analysis flagged committed secret ×4, dynamic code execution ×3 in yvgude/lean-ctx
  5. HIGH code analysis flagged committed secret ×4, dynamic code execution ×3 in yvgude/lean-ctx
  6. HIGH code analysis flagged dynamic code execution in pi-lean-ctx
  7. HIGH code analysis flagged committed secret ×2 in yvgude/lean-ctx
  8. HIGH code analysis flagged committed secret ×2 in yvgude/lean-ctx
  9. HIGH code analysis flagged committed secret ×2 in yvgude/lean-ctx
  10. HIGH code analysis flagged committed secret ×2 in yvgude/lean-ctx
  11. HIGH code analysis flagged committed secret ×2 in yvgude/lean-ctx
  12. HIGH code analysis flagged committed secret ×2 in yvgude/lean-ctx
  13. HIGH code analysis flagged committed secret ×2 in yvgude/lean-ctx
  14. HIGH code analysis flagged committed secret in yvgude/lean-ctx
  15. HIGH code analysis flagged committed secret in yvgude/lean-ctx
  16. HIGH code analysis flagged committed secret in yvgude/lean-ctx
  17. HIGH code analysis flagged committed secret in yvgude/lean-ctx
  18. HIGH code analysis flagged committed secret ×3 in yvgude/lean-ctx
  19. HIGH code analysis flagged committed secret ×3 in yvgude/lean-ctx
  20. HIGH code analysis flagged committed secret ×8 in yvgude/lean-ctx
capabilities 0 tools
transport stdio · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v3.9.12 · analyzer v33 · 3w ago

skills & prompt files 13

danger signals8

code evidence v3.9.12 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 2624

filesystem 18

  • fs (weak) yvgude-lean-ctx-8c9c8dd/.github/scripts/post-release-tweet.mjs :19 import { readFileSync } from "node:fs";
  • fs yvgude-lean-ctx-8c9c8dd/bench/agent-task/r2/preflight.mjs :28 import { existsSync, readFileSync } from "node:fs";
  • fs (weak) yvgude-lean-ctx-8c9c8dd/cookbook/sdk/src/client.e2e.test.ts :2 import fs from "node:fs";
  • fs (weak) yvgude-lean-ctx-8c9c8dd/cookbook/sdk/src/conformance.e2e.test.ts :1 import fs from "node:fs";
  • fs yvgude-lean-ctx-8c9c8dd/packages/lean-ctx-bin/postinstall.js :5 const fs = require("fs");
  • fs yvgude-lean-ctx-8c9c8dd/packages/node-lean-ctx/src/discovery.ts :9 import { readFileSync } from "node:fs";
  • fs (weak) yvgude-lean-ctx-8c9c8dd/packages/node-lean-ctx/test/discovery.test.ts :1 import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
  • fs yvgude-lean-ctx-8c9c8dd/packages/pi-lean-ctx/extensions/config.ts :1 import { existsSync, readFileSync } from "node:fs";
  • fs yvgude-lean-ctx-8c9c8dd/packages/pi-lean-ctx/extensions/index.ts :23 import { existsSync, readFileSync } from "node:fs";
  • fs (weak) yvgude-lean-ctx-8c9c8dd/packages/pi-lean-ctx/scripts/build-vendor.mjs :15 import { mkdirSync } from "node:fs";
  • fs (weak) yvgude-lean-ctx-8c9c8dd/packages/pi-lean-ctx/test/security-lock.test.ts :1 import { readFileSync } from "node:fs";
  • fs (weak) yvgude-lean-ctx-8c9c8dd/packages/pi-lean-ctx/test/vendor-bundle.test.ts :2 import { readFileSync } from "node:fs";
show 6 more
  • fs (weak) yvgude-lean-ctx-8c9c8dd/rust/src/dashboard/static/tests/cockpit-commander.test.js :9 const fs = require('node:fs');
  • fs (weak) yvgude-lean-ctx-8c9c8dd/rust/src/dashboard/static/tests/cockpit-context.test.js :7 const fs = require('node:fs');
  • fs (weak) yvgude-lean-ctx-8c9c8dd/rust/src/dashboard/static/tests/cockpit-overview.test.js :7 const fs = require('node:fs');
  • fs (weak) yvgude-lean-ctx-8c9c8dd/rust/src/dashboard/static/tests/dashboard-refresh.test.js :7 const fs = require('node:fs');
  • fs yvgude-lean-ctx-8c9c8dd/vscode-extension/src/cli-commands.ts :2 import * as fs from "fs";
  • fs yvgude-lean-ctx-8c9c8dd/vscode-extension/src/sidebar/provider.ts :4 import * as fs from "fs";

shell / exec 7

  • shell yvgude-lean-ctx-8c9c8dd/bench/agent-task/r2/preflight.mjs :27 import { execFileSync } from "node:child_process";
  • shell (weak) yvgude-lean-ctx-8c9c8dd/cookbook/sdk/src/client.e2e.test.ts :1 import { type ChildProcess, spawn } from "node:child_process";
  • shell yvgude-lean-ctx-8c9c8dd/packages/lean-ctx-bin/bin/lean-ctx.js :4 const { spawnSync } = require("child_process");
  • shell yvgude-lean-ctx-8c9c8dd/packages/lean-ctx-bin/postinstall.js :4 const { execSync } = require("child_process");
  • shell yvgude-lean-ctx-8c9c8dd/packages/node-lean-ctx/src/client.ts :1 import { execFileSync } from "child_process";
  • shell yvgude-lean-ctx-8c9c8dd/vscode-extension/src/dashboard-panel.ts :2 import { spawn, ChildProcess } from "child_process";
  • shell yvgude-lean-ctx-8c9c8dd/vscode-extension/src/leanctx.ts :1 import { spawn, execFile } from "child_process";

network 10

  • net (weak) yvgude-lean-ctx-8c9c8dd/.github/scripts/post-release-tweet.mjs :18 import https from "node:https";
  • net (weak) yvgude-lean-ctx-8c9c8dd/cookbook/sdk/src/client.e2e.test.ts :3 import net from "node:net";
  • net yvgude-lean-ctx-8c9c8dd/packages/lean-ctx-bin/postinstall.js :7 const https = require("https");
  • net yvgude-lean-ctx-8c9c8dd/packages/node-lean-ctx/src/proxy.ts :128 response = await fetch(url, { ...init, headers, signal: controller.signal });
  • net (weak) yvgude-lean-ctx-8c9c8dd/packages/node-lean-ctx/test/proxy.test.ts :1 import { createServer, type Server } from "node:http";
  • net (weak) yvgude-lean-ctx-8c9c8dd/packages/node-lean-ctx/test/vercel.test.ts :1 import { createServer, type Server } from "node:http";
  • net yvgude-lean-ctx-8c9c8dd/rust/src/dashboard/static/components/cockpit-value-gate.js :14 const response = await fetch('/api/value-gate/summary');
  • net yvgude-lean-ctx-8c9c8dd/rust/src/dashboard/static/lib/api.js :83 const res = await fetch(path, reqInit);
  • net yvgude-lean-ctx-8c9c8dd/ts-sdk/src/client.ts :72 const resp = await fetch(`${this.baseUrl}/v1/events`, {
  • net yvgude-lean-ctx-8c9c8dd/vscode-extension/src/dashboard-panel.ts :4 import * as net from "net";

secrets 4

  • secrets (weak) yvgude-lean-ctx-8c9c8dd/cookbook/sdk/src/conformance.e2e.test.ts :23 bearerToken: process.env.LEANCTX_CONFORMANCE_TOKEN?.trim() || undefined,
  • secrets yvgude-lean-ctx-8c9c8dd/packages/node-lean-ctx/src/discovery.ts :127 const env = (process.env.LEAN_CTX_PROXY_TOKEN ?? "").trim();
  • secrets yvgude-lean-ctx-8c9c8dd/packages/node-lean-ctx/src/proxy.ts :50 const envToken = process.env.LEAN_CTX_PROXY_TOKEN?.trim();
  • secrets (weak) yvgude-lean-ctx-8c9c8dd/packages/node-lean-ctx/test/discovery.test.ts :74 process.env.LEAN_CTX_PROXY_TOKEN = "envtok";

install hooks 3

  • postinstall yvgude-lean-ctx-8c9c8dd/packages/lean-ctx-bin/package.json :30 node postinstall.js
  • prepublishOnly yvgude-lean-ctx-8c9c8dd/packages/node-lean-ctx/package.json :13 npm run build
  • prepack yvgude-lean-ctx-8c9c8dd/packages/pi-lean-ctx/package.json :26 npm run build:vendor

declared dependencies 110

  • @biomejs/biome@^2.4.13
  • @types/node@^25.6.0
  • tsx@^4.22.4
  • typescript@^6.0.3
  • vitest@^4.1.0
  • lean-ctx-ocla@1.0.0
  • lean-ctx-protocol@0.1.0
  • http@1.4
  • tiktoken-rs@0.12
  • serde@1.0
  • serde_json@1.0
  • clap@4.5
show 28 more
  • subtle@2.6
  • md-5@0.11
  • anyhow@1.0
  • regex@1.12
  • walkdir@2.5
  • ignore@0.4
  • lru@0.18.1
  • tracing@0.1
  • tracing-subscriber@0.3
  • thiserror@2.0
  • futures@0.3
  • tokio-util@0.7
  • dirs@6.0
  • chrono@0.4
  • toml@1.1
  • toml_edit@0.25
  • similar@3.1
  • flate2@1.1
  • rusqlite@0.39
  • tree-sitter@0.26
  • tree-sitter-rust@0.24
  • tree-sitter-typescript@0.23
  • tree-sitter-javascript@0.25
  • tree-sitter-python@0.25
  • tree-sitter-go@0.25
  • tree-sitter-java@0.23
  • tree-sitter-c@0.24
  • tree-sitter-cpp@0.23

70 more not shown — this panel samples each group; the count above is the real total.

cursor-plugin 1

  • opaque (low) yvgude-lean-ctx-8c9c8dd/.cursor/rules/compression-safety.mdc bundled .cursor/ plugin descriptor (yvgude-lean-ctx-8c9c8dd/.cursor/rules/compression-safety.mdc) — presence-detected; review the descriptor

jetbrains-plugin 1

  • opaque (low) yvgude-lean-ctx-8c9c8dd/packages/jetbrains-lean-ctx/src/main/resources/META-INF/plugin.xml bundled JetBrains plugin "lean-ctx" (yvgude-lean-ctx-8c9c8dd/packages/jetbrains-lean-ctx/src/main/resources/META-INF/plugin.xml) — presence-detected; review the plugin descriptor