npm JavaScript analyzed 1.74.0

@agentprojectcontext/apx

v1.74.0

npm

APX — unified CLI + daemon for the Agent Project Context (APC) standard.

maintainer: tecnomanu
licence: MIT
first seen: 2026-07-08
last seen: 2026-07-29
releases · 30d: 0
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 9 tools

transport stdio · http counts 9 tools · 0 res · 0 prompts permission surface via code analysis

tools

agent_exec
agent_list
agent_run
mcp_call
mcp_list
memory_append
memory_read
messages_tail
session_list

skills & danger signals npm-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v1.74.0 · analyzer v33 · 4w ago

skills & prompt files 22

danger signals4

dynamic code execution new Function() package/src/core/http-tools/browser.js :402 result = await page.evaluate(new Function(code));
suspicious endpoint api.telegram.org package/src/core/channels/telegram/media.js :12 export const API_BASE = "https://api.telegram.org";
suspicious endpoint api.telegram.org package/src/host/daemon/wakeup.js :54 const url = `https://api.telegram.org/bot${token}/sendMessage`;
suspicious endpoint t.me package/src/interfaces/cli/commands/setup.js :193 console.log(di(" Create a bot at https://t.me/BotFather → get the token."));

code evidence v1.74.0 · npm-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 744

filesystem 125

fs package/src/core/agent/a2a/reply.js :5 import fs from "node:fs";
fs package/src/core/agent/build-agent-system.js :9 import fs from "node:fs";
fs package/src/core/agent/memory.js :1 import fs from "node:fs";
fs package/src/core/agent/prompt-builder.js :16 import fs from "node:fs";
fs package/src/core/agent/prompts/modes/index.js :7 import fs from "node:fs";
fs package/src/core/agent/self-memory.js :16 import fs from "node:fs";
fs package/src/core/agent/skills/index-store.js :37 import fs from "node:fs";
fs package/src/core/agent/skills/loader.js :31 import fs from "node:fs";
fs package/src/core/agent/tools/handlers/add-project.js :1 import fs from "node:fs";
fs package/src/core/agent/tools/handlers/call-runtime.js :1 import fs from "node:fs";
fs package/src/core/agent/tools/handlers/edit-file.js :1 import fs from "node:fs";
fs package/src/core/agent/tools/handlers/import-agent.js :1 import fs from "node:fs";

show 28 more

fs package/src/core/agent/tools/handlers/list-files.js :1 import fs from "node:fs";
fs package/src/core/agent/tools/handlers/read-agent-memory.js :1 import fs from "node:fs";
fs package/src/core/agent/tools/handlers/read-file.js :1 import fs from "node:fs";
fs package/src/core/agent/tools/handlers/search-sessions.js :1 import fs from "node:fs";
fs package/src/core/agent/tools/handlers/transcribe-audio.js :1 import fs from "node:fs";
fs package/src/core/agent/tools/handlers/write-file.js :1 import fs from "node:fs";
fs package/src/core/agent/tools/registry-bridge.js :20 import fs from "node:fs";
fs package/src/core/apc/context-copy.js :4 import fs from "node:fs/promises";
fs package/src/core/apc/notes.js :4 import fs from "node:fs/promises";
fs package/src/core/apc/parser.js :2 import fs from "node:fs";
fs package/src/core/apc/paths.js :8 import fs from "node:fs";
fs package/src/core/apc/scaffold.js :1 import fs from "node:fs";
fs package/src/core/apc/skill-sync.js :2 import fs from "node:fs";
fs package/src/core/artifacts/preview.js :19 import fs from "node:fs";
fs package/src/core/channels/telegram/helpers.js :4 import fs from "node:fs";
fs package/src/core/channels/telegram/media.js :9 import fs from "node:fs";
fs package/src/core/config/index.js :5 import fs from "node:fs";
fs package/src/core/config/paths.js :3 import fs from "node:fs";
fs package/src/core/desktop/autostart.js :16 import fs from "node:fs";
fs package/src/core/desktop/process.js :10 import fs from "node:fs";
fs package/src/core/git-baseline.js :14 import fs from "node:fs";
fs package/src/core/http-tools/glob.js :10 import fs from "node:fs";
fs package/src/core/http-tools/grep.js :7 import fs from "node:fs";
fs package/src/core/identity/self.js :1 import fs from "node:fs";
fs package/src/core/integrations/obsidian-memory.js :6 import fs from "node:fs";
fs package/src/core/integrations/plugins/obsidian.js :12 import fs from "node:fs";
fs package/src/core/integrations/sources.js :13 import fs from "node:fs";
fs package/src/core/logging.js :1 import fs from "node:fs";

85 more not shown — this panel samples each group; the count above is the real total.

shell / exec 32

shell package/src/core/agent/tools/handlers/_git.js :4 import { spawn } from "node:child_process";
shell package/src/core/agent/tools/handlers/run-shell.js :1 import { spawn } from "node:child_process";
shell package/src/core/agent/tools/handlers/search-files.js :1 import { execFile } from "node:child_process";
shell package/src/core/artifacts/tunnel.js :13 import { spawn, spawnSync } from "node:child_process";
shell package/src/core/desktop/autostart.js :19 import { execFileSync } from "node:child_process";
shell package/src/core/desktop/process.js :13 import { spawn, execFileSync } from "node:child_process";
shell package/src/core/git-baseline.js :11 import { execFileSync } from "node:child_process";
shell package/src/core/http-tools/grep.js :9 import { execFile } from "node:child_process";
shell package/src/core/mcp/runner.js :8 import { spawn } from "node:child_process";
shell package/src/core/routines/runner.js :12 import { spawn } from "node:child_process";
shell package/src/core/stores/messages.js :598 // exec (telegram, web quick-chat, desktop, deck …). A "thread" is one
shell package/src/core/voice/engines/piper.js :18 import { spawn, execFile } from "node:child_process";

show 20 more

shell package/src/core/voice/stt-hardware.js :15 import { spawnSync } from "node:child_process";
shell package/src/host/daemon/api/admin.js :7 import { execFile } from "node:child_process";
shell package/src/host/daemon/api/artifacts.js :8 import { spawn } from "node:child_process";
shell package/src/host/daemon/api/run.js :5 import { execFile } from "node:child_process";
shell package/src/host/daemon/api/skills.js :24 import { spawnSync } from "node:child_process";
shell package/src/host/daemon/deck-exec.js :10 import { spawn } from "node:child_process";
shell package/src/host/daemon/runtimes/_spawn.js :3 import { spawn } from "node:child_process";
shell package/src/host/daemon/stt-venv.js :11 import { spawn } from "node:child_process";
shell package/src/host/daemon/whisper-server.js :11 import { spawn, exec } from "node:child_process";
shell package/src/interfaces/cli/commands/artifact.js :2 import { spawn } from "node:child_process";
shell package/src/interfaces/cli/commands/code.js :7 import { spawnSync } from "node:child_process";
shell package/src/interfaces/cli/commands/desktop.js :5 import { spawn, execFileSync } from "node:child_process";
shell package/src/interfaces/cli/commands/project-config.js :15 import { spawnSync } from "node:child_process";
shell package/src/interfaces/cli/commands/session.js :3 import { spawn } from "node:child_process";
shell package/src/interfaces/cli/commands/setup.js :9 import { spawnSync } from "node:child_process";
shell package/src/interfaces/cli/commands/update.js :1 import { spawnSync } from "node:child_process";
shell package/src/interfaces/cli/commands/voice.js :15 import { spawn, spawnSync, execFileSync } from "node:child_process";
shell package/src/interfaces/cli/http.js :5 import { spawn } from "node:child_process";
shell package/src/interfaces/tui/_shims/util-process.ts :1 import { exec, spawn as nodeSpawn } from "node:child_process"
shell package/src/interfaces/tui/context/sdk-apx.tsx :7 import { spawn, execSync } from "node:child_process"

network 37

net package/src/core/agent/tools/registry-bridge.js :96 res = await fetch(url, opts);
net package/src/core/artifacts/preview.js :18 import http from "node:http";
net package/src/core/channels/telegram/api.js :18 const res = await fetch(`${API_BASE}/bot${token}/${method}`, {
net package/src/core/channels/telegram/media.js :41 const res = await fetch(url, { method: "POST", body: form });
net package/src/core/engines/_health.js :14 fetch(url, { signal: ctrl.signal, headers }),
net package/src/core/engines/anthropic.js :63 const res = await fetch(API_BASE, {
net package/src/core/engines/gemini.js :134 const res = await fetch(url, {
net package/src/core/engines/ollama.js :96 const res = await fetch(url, {
net package/src/core/engines/openai-compatible.js :113 const res = await fetch(`${getBaseUrl(config)}/chat/completions`, {
net package/src/core/http-tools/fetch.js :19 import net from "node:net";
net package/src/core/http-tools/registry.js :293 // ── fetch (native HTTP, no browser) ───────────────────────────────────────
net package/src/core/http-tools/search.js :34 return fetch(url, opts);

show 25 more

net package/src/core/integrations/plugins/asana.js :46 res = await fetch(url, {
net package/src/core/integrations/plugins/github.js :32 res = await fetch(url, {
net package/src/core/mcp/runner.js :324 res = await fetch(this.url, {
net package/src/core/memory/embed-engines/gemini.js :35 const res = await fetch(
net package/src/core/memory/embed-engines/ollama.js :37 const res = await fetch(`${base}/api/embeddings`, {
net package/src/core/memory/embed-engines/openai.js :43 const res = await fetch(`${base}/embeddings`, {
net package/src/core/net/ipv4-first.js :16 import net from "node:net";
net package/src/core/update-check.js :8 import https from "node:https";
net package/src/core/voice/engines/elevenlabs.js :65 const res = await fetch(url, {
net package/src/core/voice/engines/gemini.js :69 const res = await fetch(url, {
net package/src/core/voice/engines/openai.js :95 const res = await fetch(url, {
net package/src/core/voice/transcription.js :209 const res = await fetch(`http://127.0.0.1:${WHISPER_LOCAL_PORT}/transcribe`, {
net package/src/host/daemon/wakeup.js :2 import fetch from "node-fetch";
net package/src/host/daemon/whisper-server.js :35 const res = await fetch(`http://127.0.0.1:${WHISPER_LOCAL_PORT}/health`, {
net package/src/interfaces/acp/session.js :27 const res = await fetch(`${baseUrl}${p}`, {
net package/src/interfaces/cli/commands/setup.js :6 import https from "node:https";
net package/src/interfaces/cli/http.js :28 const res = await fetch(`${baseUrl()}/health`, { signal: ctrl.signal });
net package/src/interfaces/desktop/main.js :16 const http = require("http");
net package/src/interfaces/tui/component/dialog-workspace-create.tsx :65 .fetch(url)
net package/src/interfaces/tui/context/sdk-apx.tsx :106 const res = await fetch(`${props.url}/projects/${props.pid}/super-agent/chat/stream`, {
net package/src/interfaces/tui/worker.ts :51 async fetch(input: { url: string; method: string; headers: Record<string, string>; body?: string }) {
net package/src/interfaces/web/dist/assets/index-BxYXJEtf.js :1 (l){if(l.ep)return;l.ep=!0;const i=a(l);fetch(l.href,i)}})();function sb(e){return e&&e.__esModule&&Object.prototype.hasOwnProperty.call(e,"default")?e.default:e}var Vg={exports:{}},uc={};/**
net package/src/interfaces/web/src/hooks/useTokenBootstrap.ts :47 const probe = await fetch("/health");
net package/src/interfaces/web/src/lib/api/voice.ts :223 const res = await fetch(`/voice/tts?path=${encodeURIComponent(audioPath)}`, {
net package/src/interfaces/web/src/lib/http.ts :34 const res = await fetch(path, {

secrets 11

secrets package/src/core/agent/tools/registry-bridge.js :34 process.env.APX_TOKEN ||
secrets package/src/core/channels/telegram/helpers.js :96 process.env.BOT_TELEGRAM_TOKEN ||
secrets package/src/core/engines/anthropic.js :9 return config.api_key || process.env.ANTHROPIC_API_KEY || "";
secrets package/src/core/engines/gemini.js :9 return config.api_key || process.env.GEMINI_API_KEY || process.env.GOOGLE_API_KEY || "";
secrets package/src/core/http-tools/search.js :158 const apiKey = process.env.BRAVE_API_KEY;
secrets package/src/core/memory/embed-engines/gemini.js :13 process.env.GEMINI_API_KEY ||
secrets package/src/core/memory/embed-engines/openai.js :15 process.env.OPENAI_API_KEY ||
secrets package/src/core/voice/engines/elevenlabs.js :26 return config.api_key || process.env.ELEVENLABS_API_KEY || "";
secrets package/src/core/voice/engines/gemini.js :30 process.env.GEMINI_API_KEY ||
secrets package/src/core/voice/engines/openai.js :30 process.env.OPENAI_API_KEY ||
secrets package/src/core/voice/transcription.js :132 openai.api_key = t.openai?.api_key || cfg.engines?.openai?.api_key || process.env.OPENAI_API_KEY || "";

tool registrations 9

agent_list package/src/interfaces/mcp-server/index.js :59
agent_exec package/src/interfaces/mcp-server/index.js :74
agent_run package/src/interfaces/mcp-server/index.js :92
memory_read package/src/interfaces/mcp-server/index.js :109
memory_append package/src/interfaces/mcp-server/index.js :123
messages_tail package/src/interfaces/mcp-server/index.js :138
session_list package/src/interfaces/mcp-server/index.js :161
mcp_list package/src/interfaces/mcp-server/index.js :180
mcp_call package/src/interfaces/mcp-server/index.js :195

install hooks 3

prepare package/package.json :41 node scripts/install-githooks.js
prepack package/package.json :42 node scripts/sync-apc-skill.js && node scripts/build-web.js
postinstall package/package.json :43 node src/interfaces/cli/postinstall.js

declared dependencies 36

@modelcontextprotocol/sdk@^1.29.0
@opentui/core@^0.2.16
@opentui/keymap@^0.2.16
@opentui/solid@^0.2.16
@solid-primitives/event-bus@^1.1.3
@solid-primitives/scheduled@^1.5.2
chalk@^5.6.2
cli-cursor@^5.0.0
cli-sound@^1.1.3
clipboardy@^4.0.0
cron-parser@^5.5.0
effect@^3.21.2

show 24 more

esbuild-plugin-solid@^0.6.0
express@^4.21.0
fuzzysort@^3.1.0
iconv-lite@^0.6.3
node-fetch@^3.3.2
open@^10.1.2
opentui-spinner@^0.0.6
qrcode-terminal@^0.12.0
raw-body@^3.0.0
react@^19.2.0
remeda@^2.21.0
safer-buffer@^2.1.2
solid-js@^1.9.13
@semantic-release/changelog@^6.0.3
@semantic-release/git@^10.0.1
@types/node@^25.7.0
conventional-changelog-conventionalcommits@^9.3.1
electron@^33.4.11
esbuild@^0.28.0
typescript@^6.0.3
better-sqlite3@^11.3.0
fast-glob@^3.3.2
puppeteer@^22.0.0
sqlite-vec@^0.1.6

clipboard 2

clipboard shell call package/src/host/daemon/deck-exec.js :53 platform === "darwin" ? "pbcopy" :
clipboard shell call package/src/interfaces/tui/util/clipboard.ts :106 const wayland = await Process.run(["wl-paste", "-t", "image/png"], { nothrow: true })