github analyzed d14e23b

giantclam/mcphubs

github

maintainer: giantclam
licence: —
first seen: 2026-05-22
last seen: 2026-07-09
releases · 30d: 0
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 3 tools

transport stdio counts 3 tools · 0 res · 0 prompts permission surface via code analysis

tools

calculate
get_time
read-file

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit d14e23b · analyzer v33 · 2w ago

danger signals4

dynamic code execution eval() GiantClam-mcphubs-d14e23b/src/app/concepts/page.tsx :428 const result = eval(args.expression);
dynamic code execution eval() GiantClam-mcphubs-d14e23b/src/app/development-guides/page.tsx :384 const result = eval(expression);
dynamic code execution eval() GiantClam-mcphubs-d14e23b/src/app/troubleshooting/page.tsx :309 const result = eval(args.expression);
suspicious endpoint sentry.io (telemetry) GiantClam-mcphubs-d14e23b/src/app/api/admin/seed/route.ts :33 { name: 'Sentry', description: 'Error tracking and performance monitoring.', auth_type: 'oauth', homepage: 'https://sentry.io', category: 'DevOps' },

code evidence vHEAD · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 158

filesystem 3

fs GiantClam-mcphubs-d14e23b/src/app/api/vertex/route.ts :2 import fs from 'fs';
fs GiantClam-mcphubs-d14e23b/src/app/concepts/page.tsx :1345 const content = await fs.readFile(args.path, 'utf8');
fs GiantClam-mcphubs-d14e23b/src/lib/claude-skills-sync.ts :4 import fs from 'fs';

shell / exec 1

shell GiantClam-mcphubs-d14e23b/src/app/concepts/page.tsx :1470 const { spawn } = await import('child_process');

network 22

net GiantClam-mcphubs-d14e23b/src/app/admin/community-servers/page.tsx :40 const response = await fetch('/api/admin/curation');
net GiantClam-mcphubs-d14e23b/src/app/admin/sync/page.tsx :66 const response = await fetch(`/api/sync?key=${apiKey}`);
net (weak) GiantClam-mcphubs-d14e23b/src/app/api/cron-test/route.ts :30 const syncResponse = await fetch(`${process.env.VERCEL_URL || 'http://localhost:3000'}/api/sync`, {
net GiantClam-mcphubs-d14e23b/src/app/api/diagnose/route.ts :49 const response = await fetch('https://api.github.com/user', {
net GiantClam-mcphubs-d14e23b/src/app/api/ping-mcp/route.ts :34 const fetchPromise = fetch(url, {
net GiantClam-mcphubs-d14e23b/src/app/api/vertex/route.ts :4 import axios, { AxiosError } from 'axios';
net GiantClam-mcphubs-d14e23b/src/app/claude-skills/ClaudeSkillsClient.tsx :53 const response = await fetch('/api/github/skills');
net GiantClam-mcphubs-d14e23b/src/app/servers/page.tsx :27 const response = await fetch(`${process.env.NEXT_PUBLIC_SITE_URL || 'http://localhost:3000'}/api/community/approved-servers`, {
net GiantClam-mcphubs-d14e23b/src/app/servers/submit/page.tsx :49 const res = await fetch('/api/community/submit-server', {
net GiantClam-mcphubs-d14e23b/src/components/CurationDashboard.tsx :64 const response = await fetch('/api/admin/curation');
net GiantClam-mcphubs-d14e23b/src/components/DataQualityDashboard.tsx :39 const response = await fetch('/api/ai/process-projects', {
net GiantClam-mcphubs-d14e23b/src/components/EnhancedFeaturedProjects.tsx :84 const response = await fetch('/api/admin/curation');

show 10 more

net GiantClam-mcphubs-d14e23b/src/components/FeaturedProjects.tsx :26 const response = await fetch('/api/admin/curation');
net GiantClam-mcphubs-d14e23b/src/components/Hero.tsx :30 const response = await fetch('/api/projects');
net GiantClam-mcphubs-d14e23b/src/components/MCPConnector.tsx :27 const res = await fetch(`/api/ping-mcp?url=${encodeURIComponent(endpoint)}`);
net GiantClam-mcphubs-d14e23b/src/components/ProjectCard.tsx :83 // const response = await fetch(`/api/projects/${id}/like`, {
net GiantClam-mcphubs-d14e23b/src/components/ProjectShowcase.tsx :23 fetch('/api/projects')
net GiantClam-mcphubs-d14e23b/src/components/RemoteServersDirectory.tsx :57 const res = await fetch('/api/remote-servers');
net GiantClam-mcphubs-d14e23b/src/components/TutorialGuide.tsx :188 : `class MCPAPIClient {\n constructor(baseUrl, apiKey) {\n this.baseUrl = baseUrl;\n this.headers = {\n 'Authorization': \`Bearer \${apiKey}\`,\n 'Content-Type': 'application/json'\n
net GiantClam-mcphubs-d14e23b/src/lib/claude-skills-sync.ts :1 import axios, { AxiosInstance } from 'axios';
net GiantClam-mcphubs-d14e23b/src/lib/github.ts :1 import axios, { AxiosInstance } from 'axios';
net GiantClam-mcphubs-d14e23b/src/lib/search.ts :51 const response = await fetch(`/api/search/suggestions?q=${encodeURIComponent(query)}`);

secrets 16

secrets (weak) GiantClam-mcphubs-d14e23b/scripts/sync-claude-skills.ts :91 console.log(` SUPABASE_SERVICE_ROLE_KEY: ${process.env.SUPABASE_SERVICE_ROLE_KEY ? 'SET' : 'NOT SET'}`);
secrets GiantClam-mcphubs-d14e23b/src/app/api/auth/[...nextauth]/route.ts :7 const hasGitHubConfig = process.env.GITHUB_ID && process.env.GITHUB_SECRET;
secrets (weak) GiantClam-mcphubs-d14e23b/src/app/api/cron-test/route.ts :17 hasSyncApiKey: !!process.env.SYNC_API_KEY,
secrets GiantClam-mcphubs-d14e23b/src/app/api/diagnose/route.ts :37 const token = process.env.GITHUB_TOKEN;
secrets GiantClam-mcphubs-d14e23b/src/app/api/security-check/route.ts :10 SYNC_API_KEY: !!process.env.SYNC_API_KEY,
secrets GiantClam-mcphubs-d14e23b/src/app/api/startup-sync/route.ts :39 const expectedApiKey = process.env.SYNC_API_KEY;
secrets GiantClam-mcphubs-d14e23b/src/app/api/sync-simple/route.ts :27 hasGitHubToken: !!process.env.GITHUB_TOKEN,
secrets GiantClam-mcphubs-d14e23b/src/app/api/sync/claude-skills/route.ts :8 const expectedKey = process.env.SYNC_API_KEY;
secrets GiantClam-mcphubs-d14e23b/src/app/api/sync/route.ts :15 const validKey = process.env.SYNC_API_KEY;
secrets GiantClam-mcphubs-d14e23b/src/app/api/vertex/route.ts :22 const credentialsPath = process.env.GOOGLE_APPLICATION_CREDENTIALS;
secrets GiantClam-mcphubs-d14e23b/src/components/ProjectUsageExamples.tsx :46 apiKey: process.env.API_KEY,
secrets GiantClam-mcphubs-d14e23b/src/data/blogContent.ts :187 jwt.verify(token, process.env.ACCESS_TOKEN_SECRET, (err, user) => {

show 4 more

secrets GiantClam-mcphubs-d14e23b/src/lib/analysis.ts :36 if (process.env.GOOGLE_APPLICATION_CREDENTIALS) {
secrets GiantClam-mcphubs-d14e23b/src/lib/claude-skills-sync.ts :60 const GITHUB_TOKEN = process.env.GITHUB_TOKEN;
secrets GiantClam-mcphubs-d14e23b/src/lib/github.ts :69 const GITHUB_TOKEN = process.env.GITHUB_TOKEN;
secrets GiantClam-mcphubs-d14e23b/src/lib/supabase.ts :57 const supabaseServiceKey = process.env.SUPABASE_SERVICE_ROLE_KEY;

tool registrations 5

calculate GiantClam-mcphubs-d14e23b/src/app/concepts/page.tsx :411
read-file GiantClam-mcphubs-d14e23b/src/app/concepts/page.tsx :1326
calculate GiantClam-mcphubs-d14e23b/src/app/development-guides/page.tsx :350
get_time GiantClam-mcphubs-d14e23b/src/app/development-guides/page.tsx :364
calculate GiantClam-mcphubs-d14e23b/src/app/troubleshooting/page.tsx :287

declared dependencies 34

@google-cloud/vertexai@^1.9.3
@google/generative-ai@^0.24.1
@langchain/google-vertexai@^0.2.2
@langchain/openai@^0.4.4
@supabase/supabase-js@^2.51.0
axios@^1.8.3
framer-motion@^12.23.24
https-proxy-agent@^7.0.6
langchain@^0.3.19
next@15.2.6
next-auth@^4.24.11
next-intl@^4.3.4

show 22 more

node-fetch@^3.3.2
octokit@^4.1.2
react@^19.2.4
react-dom@^19.2.4
react-icons@^5.5.0
react-markdown@^10.1.0
rehype-highlight@^7.0.2
rehype-raw@^7.0.0
rehype-sanitize@^6.0.0
remark-gfm@^4.0.1
@eslint/eslintrc@^3
@tailwindcss/postcss@^4
@tailwindcss/typography@^0.5.16
@types/node@^20
@types/react@^19
@types/react-dom@^19
dotenv@^17.2.3
eslint@^9
eslint-config-next@15.2.6
tailwindcss@^4
tsx@^4.20.6
typescript@^5