MCP Observatory
4m ago Tracked 26,753 Last 4m ago 24h 1,621
npm JavaScript analyzed 1.0.2-alpha

@aionlabsai/aion

v1.0.2-alpha
npm

The project gateway for code-aware AI agents — cuts tokens, kills hallucinations, sits between your IDE and your codebase.

maintainer
halgorn
license
MIT
first seen
2026-07-01
last seen
2026-07-08
releases · 30d
2
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools
transport stdio counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

code evidence v1.0.2-alpha · npm-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 220

filesystem 86

  • fs package/dist/agents/base-agent.js :1 import { writeFileSync, mkdirSync } from 'fs';
  • fs package/dist/agents/scanner.js :1 import { readFileSync } from 'fs';
  • fs package/dist/cli/commands/chat.js :4 import { existsSync, mkdirSync, readFileSync, appendFileSync, writeFileSync } from 'fs';
  • fs package/dist/cli/commands/context.js :2 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
  • fs package/dist/cli/commands/diff.js :2 import { readFileSync, readdirSync, existsSync } from 'fs';
  • fs package/dist/cli/commands/doctor.js :4 import { existsSync, readFileSync } from 'fs';
  • fs package/dist/cli/commands/eval.js :3 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
  • fs package/dist/cli/commands/graph.js :1 import { mkdirSync, writeFileSync, existsSync, readFileSync, copyFileSync } from 'fs';
  • fs package/dist/cli/commands/health.js :2 import { mkdirSync, writeFileSync } from 'fs';
  • fs package/dist/cli/commands/init.js :2 import { existsSync } from 'fs';
  • fs package/dist/cli/commands/mcp.js :2 import { existsSync, readFileSync } from 'fs';
  • fs package/dist/cli/commands/memory.js :3 import { writeFileSync, mkdirSync } from 'fs';
  • fs package/dist/cli/commands/next.js :2 import { existsSync } from 'fs';
  • fs package/dist/cli/commands/report.js :2 import { copyFileSync, mkdirSync } from 'fs';
  • fs package/dist/cli/commands/scan.js :2 import { mkdirSync, writeFileSync } from 'fs';
  • fs package/dist/cli/commands/setup.js :1 import { existsSync, mkdirSync, writeFileSync } from 'fs';
  • fs package/dist/cli/commands/sync.js :2 import { readFileSync } from 'fs';
  • fs package/dist/cli/commands/tree.js :2 import { existsSync, readFileSync } from 'fs';
  • fs package/dist/cli/commands/wiki.js :1 import { mkdirSync, writeFileSync } from 'fs';
  • fs package/dist/cli/commands/workspace-search.js :1 import { writeFileSync, mkdirSync } from 'fs';
  • fs package/dist/cli/commands/workspace.js :2 import { existsSync } from 'fs';
  • fs package/dist/cli/menu-prefs.js :1 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
  • fs package/dist/core/cost-tracker.js :1 import { mkdirSync, readFileSync, writeFileSync } from 'fs';
  • fs package/dist/core/pipelines/audit-file-scanner.js :1 import { readdirSync, statSync } from 'fs';
  • fs package/dist/core/pipelines/audit-pipeline.js :2 import { mkdtempSync, rmSync } from 'fs';
  • fs package/dist/core/pipelines/review-pipeline.js :2 import { readFileSync } from 'fs';
  • fs package/dist/index.js :5 import { existsSync, statSync } from 'fs';
  • fs package/dist/infra/aion-config.js :1 import { readFileSync, writeFileSync, existsSync } from 'fs';
  • fs package/dist/infra/aion-ignore.js :1 import { readFileSync, existsSync } from 'fs';
  • fs package/dist/infra/assist/apply-artifacts.js :1 import { chmodSync, existsSync, mkdirSync, writeFileSync } from 'fs';
  • fs package/dist/infra/assist/assist-plan.js :1 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
  • fs package/dist/infra/assist/project-detector.js :1 import { existsSync, readFileSync } from 'fs';
  • fs package/dist/infra/audit-cache.js :2 import { readFileSync, writeFileSync, statSync, mkdirSync } from 'fs';
  • fs package/dist/infra/audit-report-writer.js :1 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
  • fs package/dist/infra/audit-trend.js :1 import { readFileSync, writeFileSync, mkdirSync, existsSync } from 'fs';
  • fs package/dist/infra/chunker.js :1 import { readFileSync } from 'fs';
  • fs package/dist/infra/cloud-analyzer.js :2 import { existsSync, readFileSync } from 'fs';
  • fs package/dist/infra/code-metrics.js :1 import { readdirSync, readFileSync, statSync } from 'fs';
  • fs package/dist/infra/db-analyzer.js :1 import { existsSync, readdirSync, readFileSync, statSync } from 'fs';
  • fs package/dist/infra/db/migrations.js :1 import { mkdirSync } from 'fs';
  • fs package/dist/infra/db/store.js :1 import { mkdirSync, readFileSync, writeFileSync, readdirSync, existsSync, appendFileSync, renameSync } from 'fs';
  • fs package/dist/infra/dep-graph-cache.js :1 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs';
  • fs package/dist/infra/dep-graph-db.js :1 import { mkdirSync, readFileSync, writeFileSync } from 'fs';
  • fs package/dist/infra/dep-graph.js :3 import { existsSync, readdirSync, readFileSync, statSync } from 'fs';
  • fs package/dist/infra/docs-analyzer.js :1 import { existsSync, readFileSync, readdirSync, statSync } from 'fs';
  • fs package/dist/infra/embeddings.js :1 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from 'fs';
  • fs package/dist/infra/git-hooks.js :1 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
  • fs package/dist/infra/gitignore-guard.js :1 import { existsSync, readFileSync, writeFileSync } from 'fs';
  • fs package/dist/infra/knowledge.js :2 import { mkdirSync, readdirSync, readFileSync, writeFileSync, existsSync } from 'fs';
  • fs package/dist/infra/lang-detect.js :1 import { existsSync, readdirSync } from 'fs';
  • fs package/dist/infra/line-size-analyzer.js :1 import { readdirSync, readFileSync } from 'fs';
  • fs package/dist/infra/network-analyzer.js :1 import { readdirSync, readFileSync } from 'fs';
  • fs package/dist/infra/package-guard.js :2 import { mkdtempSync, mkdirSync, readdirSync, rmSync, statSync } from 'fs';
  • fs package/dist/infra/pattern-detect.js :1 import { existsSync, readdirSync, readFileSync } from 'fs';
  • fs package/dist/infra/performance-analyzer.js :1 import { existsSync, readdirSync, readFileSync, statSync } from 'fs';
  • fs package/dist/infra/persona-presets.js :1 import { existsSync, readFileSync } from 'fs';
  • fs package/dist/infra/policy.js :1 import { existsSync, readFileSync, writeFileSync, mkdirSync, appendFileSync } from 'fs';
  • fs package/dist/infra/project-audit-dashboard.js :1 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from 'fs';
  • fs package/dist/infra/project-identity.js :1 import { existsSync, readFileSync } from 'fs';
  • fs package/dist/infra/project-migrate.js :2 import { existsSync, readFileSync } from 'fs';
  • fs package/dist/infra/project-report.js :1 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from 'fs';
  • fs package/dist/infra/project-store.js :2 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
  • fs package/dist/infra/project-trend.js :1 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
  • fs package/dist/infra/repo-index.js :1 import { mkdirSync, readdirSync, readFileSync, statSync, writeFileSync } from 'fs';
  • fs package/dist/infra/repo-query.js :1 import { existsSync, readFileSync } from 'fs';
  • fs package/dist/infra/repo-vectors.js :2 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
  • fs package/dist/infra/sbom.js :1 import { readFileSync, existsSync } from 'fs';
  • fs package/dist/infra/security-scanner.js :1 import { readdirSync, readFileSync } from 'fs';
  • fs package/dist/infra/semgrep.js :2 import { readFileSync } from 'fs';
  • fs package/dist/infra/seo-analyzer.js :1 import { existsSync, readdirSync, readFileSync } from 'fs';
  • fs package/dist/infra/seo-next-analyzer.js :1 import { existsSync, readdirSync, readFileSync } from 'fs';
  • fs package/dist/infra/setup/project-setup.js :1 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'fs';
  • fs package/dist/infra/tracer.js :1 import { appendFileSync, existsSync, mkdirSync, readFileSync } from 'fs';
  • fs package/dist/infra/update-check.js :1 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
  • fs package/dist/infra/vector-store.js :1 import { mkdirSync, readFileSync, writeFileSync } from 'fs';
  • fs package/dist/infra/workspace.js :1 import { existsSync, mkdirSync, readFileSync, writeFileSync, readdirSync, statSync } from 'fs';
  • fs package/dist/infra/worktree.js :3 import { existsSync, rmSync } from 'fs';
  • fs package/dist/infrastructure/rag/embedding-cache.js :2 import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs';
  • fs package/dist/infrastructure/rag/engine.js :1 import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'fs';
  • fs package/dist/infrastructure/rag/migrator.js :1 import { readFileSync, writeFileSync, existsSync, mkdirSync, renameSync } from 'fs';
  • fs package/dist/infrastructure/rag/pil-reader.js :4 import { readFileSync, existsSync, mkdirSync, rmSync } from 'fs';
  • fs package/dist/mcp/install.js :1 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
  • fs package/dist/mcp/log-file.js :1 import { existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync, appendFileSync } from 'fs';
  • fs package/dist/mcp/server.js :4 import { readFileSync } from 'fs';
  • fs package/dist/mcp/watcher.js :1 import { watch, existsSync, statSync } from 'fs';
  • fs package/dist/providers/cli-provider.js :1 import { mkdtempSync, readFileSync, rmSync } from 'fs';

shell / exec 25

  • shell package/dist/cli/auto-setup.js :2 import { spawnSync } from 'child_process';
  • shell package/dist/cli/commands/audit.js :1 import { execFileSync } from 'child_process';
  • shell package/dist/cli/commands/copilot.js :1 import { spawnSync } from 'child_process';
  • shell package/dist/cli/commands/docs.js :93 const { spawnSync } = await import('child_process');
  • shell package/dist/cli/commands/graph.js :4 import { spawnSync } from 'child_process';
  • shell package/dist/cli/commands/release-check.js :1 import { spawnSync } from 'child_process';
  • shell package/dist/cli/commands/setup.js :3 import { spawnSync } from 'child_process';
  • shell package/dist/cli/commands/watch.js :1 import { spawnSync, execFileSync } from 'child_process';
  • shell package/dist/cli/menu.js :1 import { spawnSync } from 'child_process';
  • shell package/dist/core/pipelines/audit-file-scanner.js :3 import { spawnSync } from 'child_process';
  • shell package/dist/infra/assist/remote-executor.js :1 import { spawnSync } from 'child_process';
  • shell package/dist/infra/audit-trend.js :3 import { execFileSync } from 'child_process';
  • shell package/dist/infra/cloud-analyzer.js :1 import { spawnSync } from 'child_process';
  • shell package/dist/infra/code-metrics.js :3 import { spawnSync } from 'child_process';
  • shell package/dist/infra/finding-reclassifier.js :7 matchText: /\bexec\b|execSync|spawnSync|\bspawn\b|child_process/i,
  • shell package/dist/infra/git-analysis.js :1 import { spawnSync } from 'child_process';
  • shell package/dist/infra/local-qa.js :1 import { spawnSync } from 'child_process';
  • shell package/dist/infra/package-guard.js :1 import { spawnSync } from 'child_process';
  • shell package/dist/infra/pattern-detect.js :3 import { spawnSync } from 'child_process';
  • shell package/dist/infra/report-refresh.js :1 import { spawn } from 'child_process';
  • shell package/dist/infra/semgrep.js :1 import { spawnSync } from 'child_process';
  • shell package/dist/infra/update-check.js :2 import { spawnSync } from 'child_process';
  • shell package/dist/infra/worktree.js :1 import { spawnSync } from 'child_process';
  • shell package/dist/prompts/scanner.js :60 'eval(', 'exec(', 'execSync(', 'spawn(',
  • shell package/dist/providers/cli-provider.js :4 import { spawn, spawnSync } from 'child_process';

network 7

  • net package/dist/cli/commands/audit.js :290 await fetch(validatedUrl.toString(), {
  • net package/dist/infra/embeddings.js :101 const res = await fetch('https://api.voyageai.com/v1/embeddings', {
  • net package/dist/infra/update-check.js :42 const res = await fetch(`https://registry.npmjs.org/${PACKAGE_NAME}/latest`, {
  • net package/dist/infra/vector-store.js :64 const check = await fetch(`${this.url}/collections/${this.collection}`);
  • net package/dist/infrastructure/rag/embeddings/providers.js :12 const res = await fetch('https://api.voyageai.com/v1/embeddings', {
  • net package/dist/prompts/scanner-domains-infra.js :39 'requests.get(', 'requests.post(', 'fetch(', 'axios.',
  • net package/dist/providers/sse-completion.js :9 const res = await fetch(url, {

secrets 14

  • secrets package/dist/cli/commands/chat.js :63 ?? (process.env['OPENROUTER_API_KEY'] ? 'openrouter' : process.env['MOONSHOT_API_KEY'] ? 'kimi' : process.env['MINIMAX_API_KEY'] ? 'minimax' : 'claude');
  • secrets package/dist/cli/commands/doctor.js :14 { name: 'claude', envVar: 'ANTHROPIC_API_KEY', active: Boolean(process.env['ANTHROPIC_API_KEY']) },
  • secrets package/dist/cli/commands/setup.js :28 const hadRemoteEmbeddingEnv = Boolean(process.env['OPENAI_API_KEY'] || process.env['VOYAGE_API_KEY']);
  • secrets package/dist/infra/aion-config.js :33 if (process.env['ANTHROPIC_API_KEY'])
  • secrets package/dist/infra/cloud-analyzer.js :12 if (process.env['GOOGLE_APPLICATION_CREDENTIALS'] || process.env['GOOGLE_CLOUD_PROJECT'])
  • secrets package/dist/infra/embeddings.js :72 if (process.env.VOYAGE_API_KEY)
  • secrets package/dist/infra/langfuse.js :3 return Boolean(process.env['LANGFUSE_PUBLIC_KEY'] && process.env['LANGFUSE_SECRET_KEY']);
  • secrets package/dist/infra/reranker.js :15 const apiKey = process.env.ANTHROPIC_API_KEY;
  • secrets package/dist/infrastructure/rag/embeddings/providers.js :6 return !!process.env['VOYAGE_API_KEY'];
  • secrets package/dist/providers/cli-provider.js :197 if (process.env['ANTHROPIC_API_KEY'])
  • secrets package/dist/providers/kimi-provider.js :10 const apiKey = process.env['MOONSHOT_API_KEY'];
  • secrets package/dist/providers/minimax-provider.js :10 const apiKey = process.env['MINIMAX_API_KEY'];
  • secrets package/dist/providers/openrouter-provider.js :14 const apiKey = process.env['OPENROUTER_API_KEY'];
  • secrets package/dist/providers/sdk-provider.js :13 _client = _clientFactoryForTest?.() ?? new Anthropic({ apiKey: process.env['ANTHROPIC_API_KEY'] });

install hooks 2

  • prepublishOnly package/package.json :28 npm run build
  • postinstall (suspicious) package/package.json :31 node -e "const pkg=require('./package.json');if(pkg.name!=='@aionlabsai/aion')process.exit(0);process.exit(0)"

declared dependencies 26

  • @modelcontextprotocol/sdk@1.29.0
  • @aionlabsai/aion@^1.0.0-alpha
  • @anthropic-ai/sdk@0.100.1
  • @langchain/langgraph@^1.3.6
  • @langfuse/client@^5.4.1
  • @langfuse/tracing@^5.4.1
  • @xenova/transformers@^2.17.2
  • chalk@5.6.2
  • commander@13.1.0
  • dotenv@16.6.1
  • langfuse@^3.38.20
  • ora@8.2.0
  • tree-sitter@0.21.1
  • tree-sitter-typescript@0.23.2
  • ts-morph@28.0.0
  • web-tree-sitter@0.26.9
  • zod@3.25.76
  • @types/node@22.19.19
  • @typescript-eslint/eslint-plugin@^7.18.0
  • @typescript-eslint/parser@^7.18.0
  • c8@^9.1.0
  • eslint@^8.57.1
  • eslint-config-prettier@^9.1.0
  • prettier@^3.3.3
  • tsx@4.22.4
  • typescript@5.9.3