github TypeScript analyzed · update queued d89a57b (3 behind)

zyx1121/keel

github

git-driven CD orchestrator for LXC-as-service on Proxmox, MCP-driven, Vercel-like

maintainer
zyx1121
license
MIT
first seen
2026-07-21
last seen
2026-07-21
releases · 30d
0
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 12 tools
transport streamable-http counts 12 tools · 0 res · 0 prompts permission surface via README inference

tools

  • bind_repo

    Bind a GitHub repo for webhook auto-deploy (V2)

  • bind_service

    Wire DNS + Caddy routes

  • deploy

    Manual deploy: clone → build → health poll

  • destroy_service

    Cascade destroy (requires confirm: true)

  • list_secret_keys

    List key names for a service

  • list_services

    Enumerate managed services

  • logs

    Per-deployment log stream

  • provision_ct

    Provision a new LXC for a service

  • rollback

    Revert to a previous SHA

  • set_secret

    Register a secret key=value (value → LXC env_file, never DB)

  • status

    Current/previous SHA, health, deploy log tail

  • unbind_service

    Remove Caddy + DNS routes (LXC stays)

code evidence vHEAD · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 23

shell / exec 3

  • shell (weak) zyx1121-keel-d89a57b/src/__tests__/contract.test.ts :178 // `^[a-z0-9][a-z0-9-]{0,62}$` regex and break downstream hostname/systemd
  • shell zyx1121-keel-d89a57b/src/deploy-engine.ts :91 const proc = Bun.spawn(["ssh", "-o", "BatchMode=yes", lxc, remoteCmd], {
  • shell zyx1121-keel-d89a57b/src/pve.ts :89 const proc = Bun.spawn(["ssh", "-o", "BatchMode=yes", this.alias, remoteCmd], {

network 4

  • net zyx1121-keel-d89a57b/src/deploy-engine.ts :168 * WHY curl-in-LXC instead of fetch() from keel:
  • net zyx1121-keel-d89a57b/src/deployments.ts :50 const resp = await fetch(`https://api.github.com/repos/${repo}/deployments`, {
  • net zyx1121-keel-d89a57b/src/github-app.ts :130 const resp = await fetch(
  • net zyx1121-keel-d89a57b/src/server.ts :20 async fetch(req) {

secrets 6

  • secrets (weak) zyx1121-keel-d89a57b/src/__tests__/auth.test.ts :10 if (!process.env["MCP_WRITE_TOKEN"]) {
  • secrets (weak) zyx1121-keel-d89a57b/src/__tests__/mcp-dispatch.test.ts :8 if (!process.env["MCP_WRITE_TOKEN"]) {
  • secrets (weak) zyx1121-keel-d89a57b/src/__tests__/mcp-tools.test.ts :11 if (!process.env["MCP_WRITE_TOKEN"]) {
  • secrets (weak) zyx1121-keel-d89a57b/src/__tests__/v2-webhook.test.ts :10 if (!process.env["MCP_WRITE_TOKEN"]) {
  • secrets zyx1121-keel-d89a57b/src/config.ts :19 const rawToken = process.env["MCP_WRITE_TOKEN"] ?? ""
  • secrets zyx1121-keel-d89a57b/src/webhook.ts :45 const secret = process.env["WEBHOOK_SECRET"] ?? config.webhookSecret

declared dependencies 3

  • yaml@^2.9.0
  • @types/bun@latest
  • typescript@^5