MCP Observatory
1m ago Tracked 39,516 Last 1m ago 24h 3,135
npm JavaScript analyzed 3.38.9

@claude-flow/cli

v3.38.9
npm

Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code

maintainer
ruvnet
license
MIT
first seen
2026-05-22
last seen
2026-08-14
releases · 30d
61
short id

Drift inferred · capture-to-capture

  1. HIGH code analysis flagged hidden prompt content, dynamic code execution ×5 in @claude-flow/cli
  2. HIGH code analysis flagged committed secret ×2, dynamic code execution in @claude-flow/guidance
  3. HIGH code analysis flagged hidden prompt content, dynamic code execution ×5 in @claude-flow/cli
  4. HIGH code analysis flagged committed secret ×2, dynamic code execution in @claude-flow/guidance
  5. HIGH code analysis flagged hidden prompt content, committed secret ×2, dynamic code execution ×6 in claude-flow
  6. HIGH code analysis flagged committed secret ×2, dynamic code execution in @claude-flow/guidance
  7. HIGH code analysis flagged hidden prompt content, committed secret ×2, dynamic code execution ×6 in claude-flow
  8. HIGH code analysis flagged committed secret ×2, dynamic code execution in @claude-flow/guidance
  9. HIGH code analysis flagged hidden prompt content, dynamic code execution ×5 in @claude-flow/cli
  10. HIGH code analysis flagged committed secret ×2, dynamic code execution in @claude-flow/guidance
  11. HIGH code analysis flagged committed secret ×2, dynamic code execution in @claude-flow/guidance
  12. HIGH code analysis flagged committed secret ×2, dynamic code execution in @claude-flow/guidance
  13. HIGH code analysis flagged hidden prompt content, dynamic code execution ×5 in @claude-flow/cli
  14. HIGH code analysis flagged committed secret ×2, dynamic code execution in @claude-flow/guidance
  15. HIGH code analysis flagged hidden prompt content, committed secret ×2, dynamic code execution ×6 in claude-flow
  16. HIGH code analysis flagged committed secret ×2, dynamic code execution in @claude-flow/guidance
  17. HIGH code analysis flagged hidden prompt content, committed secret ×2, dynamic code execution ×6 in claude-flow
  18. HIGH code analysis flagged committed secret ×2, dynamic code execution in @claude-flow/guidance
  19. HIGH code analysis flagged hidden prompt content, dynamic code execution ×5 in @claude-flow/cli
  20. HIGH code analysis flagged committed secret ×2, dynamic code execution in @claude-flow/guidance
capabilities 0 tools
transport stdio · http verified reported listed in the official MCP registry counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals npm-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v3.38.9 · analyzer v32 · 13h ago

skills & prompt files 200

code evidence v3.38.9 · npm-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 807

filesystem 184

  • fs package/.claude/helpers/auto-memory-hook.mjs :14 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
  • fs package/.claude/helpers/github-safe.js :23 import { writeFileSync, unlinkSync } from 'fs';
  • fs package/.claude/helpers/hook-handler.cjs :17 const fs = require('fs');
  • fs package/.claude/helpers/intelligence.cjs :17 const fs = require('fs');
  • fs package/.claude/helpers/learning-service.mjs :21 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
  • fs package/.claude/helpers/memory.js :7 const fs = require('fs');
  • fs package/.claude/helpers/metrics-db.mjs :9 import { readFileSync, writeFileSync, existsSync, mkdirSync, readdirSync, statSync, openSync, writeSync, fsyncSync, closeSync, renameSync, rmSync } from 'fs';
  • fs package/.claude/helpers/session.js :7 const fs = require('fs');
  • fs package/.claude/helpers/statusline.cjs :23 const fs = require('fs');
  • fs package/.claude/helpers/statusline.js :12 const fs = require('fs');
  • fs package/bin/cli.js :12 import { readFileSync } from 'fs';
  • fs package/dist/src/agenticow/speculative-exploration.js :24 import { existsSync, rmSync } from 'node:fs';
  • fs package/dist/src/appliance/gguf-engine.js :14 import { open, readFile, writeFile, stat as fsStat } from 'node:fs/promises';
  • fs package/dist/src/appliance/ruvllm-bridge.js :15 import { readdir, stat } from 'node:fs/promises';
  • fs package/dist/src/appliance/rvfa-builder.js :8 import { readFileSync, existsSync, writeFileSync, mkdirSync } from 'node:fs';
  • fs package/dist/src/appliance/rvfa-distribution.js :11 import { readFile, writeFile, rename, unlink, copyFile, mkdir } from 'node:fs/promises';
  • fs package/dist/src/appliance/rvfa-format.js :11 import { readFile } from 'node:fs/promises';
  • fs package/dist/src/appliance/rvfa-runner.js :9 import { writeFile, mkdir, rm } from 'node:fs/promises';
  • fs package/dist/src/appliance/rvfa-signing.js :10 import { readFile, writeFile, stat, chmod, mkdir } from 'node:fs/promises';
  • fs package/dist/src/auth/client.js :13 import { existsSync } from 'node:fs';
  • fs package/dist/src/autopilot-state.js :11 import { existsSync, readFileSync, mkdirSync, readdirSync } from 'node:fs';
  • fs (weak) package/dist/src/benchmarks/gaia-agent.js :45 import * as fs from 'node:fs';
  • fs (weak) package/dist/src/benchmarks/gaia-causal-memory.js :29 import * as fs from 'node:fs';
  • fs (weak) package/dist/src/benchmarks/gaia-causal-memory.smoke.js :21 import * as fs from 'node:fs';
  • fs (weak) package/dist/src/benchmarks/gaia-hardness/train-data-loader.js :40 import * as fs from 'node:fs';
  • fs (weak) package/dist/src/benchmarks/gaia-judge.js :27 import * as fs from 'node:fs';
  • fs (weak) package/dist/src/benchmarks/gaia-loader.js :20 import * as fs from 'node:fs';
  • fs (weak) package/dist/src/benchmarks/gaia-tools/file_read.js :28 import * as fs from 'node:fs';
  • fs package/dist/src/commands/agent.js :10 import * as fs from 'fs';
  • fs package/dist/src/commands/agntcy/publish.js :22 import { readFile } from 'fs/promises';
  • fs package/dist/src/commands/analyze.js :19 import * as fs from 'fs/promises';
  • fs package/dist/src/commands/appliance.js :5 import { existsSync, mkdirSync, statSync } from 'node:fs';
  • fs package/dist/src/commands/benchmark.js :8 import { writeFileSync, existsSync, mkdirSync } from 'node:fs';
  • fs package/dist/src/commands/claims.js :7 import { existsSync, readFileSync, writeFileSync, mkdirSync, renameSync } from 'node:fs';
  • fs package/dist/src/commands/cleanup.js :8 import { existsSync, statSync, rmSync, readdirSync, readFileSync, writeFileSync } from 'fs';
  • fs package/dist/src/commands/daemon.js :12 import * as fs from 'fs';
  • fs package/dist/src/commands/deployment.js :8 import * as fs from 'fs';
  • fs package/dist/src/commands/doctor.js :8 import { existsSync, readFileSync, statSync, openSync, readSync, closeSync } from 'fs';
  • fs package/dist/src/commands/eject.js :32 import { existsSync } from 'fs';
  • fs package/dist/src/commands/funnel.js :16 import * as fs from 'node:fs';
  • fs package/dist/src/commands/guidance.js :5 import { existsSync } from 'node:fs';
  • fs package/dist/src/commands/hive-mind.js :12 import { mkdir, writeFile } from 'fs/promises';
  • fs package/dist/src/commands/hooks.js :9 import { existsSync, readFileSync, statSync } from 'node:fs';
  • fs package/dist/src/commands/init.js :7 import * as fs from 'fs';
  • fs package/dist/src/commands/memory-distill.js :27 import * as fs from 'fs';
  • fs package/dist/src/commands/metaharness.js :38 import { existsSync, readFileSync } from 'fs';
  • fs package/dist/src/commands/migrate-agent-detection.js :12 import * as fs from 'fs';
  • fs package/dist/src/commands/migrate-agent-restore.js :26 import * as fs from 'fs';
  • fs package/dist/src/commands/migrate.js :6 import * as fs from 'fs';
  • fs package/dist/src/commands/performance.js :8 import * as fs from 'node:fs';
  • fs package/dist/src/commands/process.js :5 import { readdirSync, writeFileSync, readFileSync, unlinkSync, existsSync, mkdirSync } from 'fs';
  • fs package/dist/src/commands/proxy.js :18 import * as fs from 'fs';
  • fs package/dist/src/commands/route.js :476 await fs.writeFile(filePath, JSON.stringify(data, null, 2));
  • fs package/dist/src/commands/ruvector/import.js :13 import * as fs from 'fs';
  • fs package/dist/src/commands/ruvector/setup.js :13 import * as fs from 'fs';
  • fs package/dist/src/commands/security.js :9 import { existsSync, statSync } from 'node:fs';
  • fs package/dist/src/commands/session.js :8 import * as fs from 'fs';
  • fs package/dist/src/commands/spinner.js :13 import * as fs from 'node:fs';
  • fs package/dist/src/commands/start.js :8 import * as fs from 'fs';
  • fs package/dist/src/commands/status.js :7 import * as fs from 'fs';
  • fs package/dist/src/commands/swarm.js :9 import * as fs from 'fs';
  • fs package/dist/src/commands/verify.js :17 import { existsSync, readFileSync } from 'fs';
  • fs package/dist/src/commands/version.js :2 import { existsSync, readFileSync } from 'fs';
  • fs package/dist/src/config/harness-feedback-applier.js :13 import * as fs from 'fs';
  • fs package/dist/src/config/proven-config-refresh.js :16 import * as fs from 'fs';
  • fs package/dist/src/fs-secure.js :19 import { chmodSync, closeSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, writeSync, } from 'node:fs';
  • fs package/dist/src/funnel/event-transport.js :22 import * as fs from 'fs';
  • fs package/dist/src/funnel/events.js :15 import * as fs from 'fs';
  • fs package/dist/src/funnel/local-signals.js :10 import * as fs from 'fs';
  • fs package/dist/src/funnel/precedence.js :14 import * as fs from 'fs';
  • fs package/dist/src/funnel/state.js :8 import * as fs from 'fs';
  • fs package/dist/src/index.js :14 import { readFileSync } from 'fs';
  • fs package/dist/src/init/executor.js :5 import * as fs from 'fs';
  • fs package/dist/src/init/helper-refresh.js :16 import * as fs from 'fs';
  • fs package/dist/src/init/helpers-generator.js :128 const fs = require('fs');
  • fs package/dist/src/init/memory-package-resolver.js :20 import * as fs from 'fs';
  • fs package/dist/src/init/settings-generator.js :229 // const fs = require('fs'); const p = require('path');
  • fs package/dist/src/init/statusline-generator.js :12 import * as fs from 'fs';
  • fs package/dist/src/mcp-server.js :24 import * as fs from 'fs';
  • fs package/dist/src/mcp-tools/agent-execute-core.js :10 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
  • fs package/dist/src/mcp-tools/agent-tools.js :7 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
  • fs package/dist/src/mcp-tools/agentbbs-tools.js :26 import { existsSync, mkdirSync, readFileSync, writeFileSync, appendFileSync } from 'node:fs';
  • fs package/dist/src/mcp-tools/agenticow-loader.js :17 import { existsSync } from 'node:fs';
  • fs package/dist/src/mcp-tools/browser-intent-tools.js :89 import { readFileSync, existsSync } from 'node:fs';
  • fs package/dist/src/mcp-tools/browser-tools.js :7 import { readFileSync, existsSync } from 'node:fs';
  • fs package/dist/src/mcp-tools/business-pod-tools.js :18 import { readFileSync, existsSync } from 'node:fs';
  • fs package/dist/src/mcp-tools/claims-tools.js :11 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs';
  • fs package/dist/src/mcp-tools/config-tools.js :6 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
  • fs package/dist/src/mcp-tools/coordination-tools.js :13 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
  • fs package/dist/src/mcp-tools/daa-tools.js :13 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
  • fs package/dist/src/mcp-tools/embeddings-tools.js :7 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs';
  • fs package/dist/src/mcp-tools/github-tools.js :9 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
  • fs package/dist/src/mcp-tools/guidance-tools.js :11 import { existsSync, readFileSync, readdirSync } from 'node:fs';
  • fs package/dist/src/mcp-tools/hive-mind-tools.js :6 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
  • fs package/dist/src/mcp-tools/hooks-tools.js :5 import { mkdirSync, writeFileSync, existsSync, readFileSync, statSync, unlinkSync, readdirSync } from 'fs';
  • fs package/dist/src/mcp-tools/memory-tools.js :12 import { existsSync, mkdirSync, readdirSync, readFileSync, unlinkSync, writeFileSync } from 'fs';
  • fs package/dist/src/mcp-tools/metaharness-tools.js :51 import { existsSync, readFileSync } from 'node:fs';
  • fs package/dist/src/mcp-tools/neural-tools.js :16 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
  • fs package/dist/src/mcp-tools/performance-tools.js :16 import { existsSync, readFileSync, writeFileSync, mkdirSync, unlinkSync, readdirSync } from 'node:fs';
  • fs package/dist/src/mcp-tools/progress-tools.js :8 import { existsSync, readdirSync, readFileSync, writeFileSync, mkdirSync } from 'fs';
  • fs package/dist/src/mcp-tools/session-tools.js :6 import { existsSync, readFileSync, readdirSync, unlinkSync, statSync, writeFileSync } from 'node:fs';
  • fs package/dist/src/mcp-tools/swarm-tools.js :7 import { closeSync, existsSync, mkdirSync, openSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync, } from 'node:fs';
  • fs package/dist/src/mcp-tools/system-tools.js :13 import { existsSync, readFileSync, writeFileSync, mkdirSync, statfsSync } from 'node:fs';
  • fs package/dist/src/mcp-tools/task-tools.js :6 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
  • fs package/dist/src/mcp-tools/terminal-tools.js :7 import { existsSync } from 'node:fs';
  • fs package/dist/src/mcp-tools/testgen-tools.js :25 import { existsSync } from 'node:fs';
  • fs package/dist/src/mcp-tools/wasm-agent-tools.js :11 import { readFileSync, existsSync } from 'node:fs';
  • fs package/dist/src/mcp-tools/workflow-tools.js :6 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
  • fs package/dist/src/memory/ewc-consolidation.js :33 import * as fs from 'fs';
  • fs package/dist/src/memory/graph-edge-writer.js :33 import * as fs from 'fs';
  • fs package/dist/src/memory/intelligence.js :13 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
  • fs package/dist/src/memory/memory-initializer.js :11 import * as fs from 'fs';
  • fs package/dist/src/memory/rabitq-index.js :13 import * as fs from 'fs';
  • fs package/dist/src/memory/sona-optimizer.js :16 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
  • fs package/dist/src/permission/permission-audit.js :10 import * as fs from 'node:fs';
  • fs package/dist/src/plugins/manager.js :6 import * as fs from 'fs';
  • fs package/dist/src/proxy/install.js :11 import * as fs from 'node:fs';
  • fs package/dist/src/proxy/lifecycle.js :32 import * as fs from 'node:fs';
  • fs package/dist/src/proxy/token-bridge.js :2 import * as fs from 'node:fs';
  • fs package/dist/src/ruvector/agent-wasm.js :13 import { readFileSync } from 'node:fs';
  • fs package/dist/src/ruvector/coverage-router.js :10 import { existsSync } from 'node:fs';
  • fs package/dist/src/ruvector/enhanced-model-router.js :11 import { existsSync, readFileSync, writeFileSync } from 'fs';
  • fs package/dist/src/ruvector/graph-analyzer.js :14 import { readFile, readdir, stat } from 'fs/promises';
  • fs package/dist/src/ruvector/lora-adapter.js :20 import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'fs';
  • fs package/dist/src/ruvector/model-router.js :39 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
  • fs package/dist/src/ruvector/neural-router.js :29 import { existsSync, readFileSync } from 'node:fs';
  • fs package/dist/src/ruvector/q-learning-router.js :16 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
  • fs package/dist/src/ruvector/router-parallel-recorder.js :48 import { appendFileSync, mkdirSync, existsSync, statSync, renameSync, unlinkSync } from 'node:fs';
  • fs package/dist/src/ruvector/router-trajectory.js :31 import { appendFileSync, mkdirSync, existsSync, statSync, renameSync, unlinkSync } from 'node:fs';
  • fs package/dist/src/ruvector/run-transcript-recorder.js :53 import { appendFileSync, mkdirSync, existsSync, statSync, renameSync, unlinkSync, readFileSync } from 'node:fs';
  • fs package/dist/src/ruvector/ruvllm-wasm.js :23 import { readFileSync } from 'node:fs';
  • fs package/dist/src/ruvector/trajectory-tree.js :41 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
  • fs package/dist/src/ruvector/wasm-embedder.js :17 import { readFileSync } from 'fs';
  • fs package/dist/src/services/ai-job-dedup.js :24 import * as fs from 'fs';
  • fs package/dist/src/services/claim-service.js :16 import * as fs from 'fs';
  • fs package/dist/src/services/config-file-manager.js :5 import * as fs from 'fs';
  • fs package/dist/src/services/container-worker-pool.js :21 import { existsSync, mkdirSync } from 'fs';
  • fs package/dist/src/services/daemon-autostart.js :31 import * as fs from 'fs';
  • fs package/dist/src/services/distill-tuning.js :39 import * as fs from 'fs';
  • fs package/dist/src/services/fable-harness.js :36 import { mkdtemp, rm } from 'fs/promises';
  • fs package/dist/src/services/flywheel-transaction.js :9 import * as fs from 'node:fs';
  • fs package/dist/src/services/git-workspace-identity.js :27 import * as fs from 'fs';
  • fs package/dist/src/services/global-ai-budget.js :30 import * as fs from 'fs';
  • fs package/dist/src/services/harness-flywheel-generations.js :21 import * as fs from 'fs';
  • fs package/dist/src/services/harness-frozen-eval.js :17 import * as fs from 'fs';
  • fs package/dist/src/services/harness-improvement-ledger.js :14 import * as fs from 'fs';
  • fs package/dist/src/services/harness-project-anchor.js :9 import { existsSync, readFileSync, realpathSync, } from 'node:fs';
  • fs package/dist/src/services/harness-qualification.js :19 import * as fs from 'fs';
  • fs package/dist/src/services/harness-replay.js :11 import * as fs from 'fs';
  • fs package/dist/src/services/harness-worker.js :18 import * as fs from 'fs';
  • fs package/dist/src/services/headless-worker-executor.js :23 import { existsSync, readFileSync, readdirSync, mkdirSync, writeFileSync } from 'fs';
  • fs package/dist/src/services/memory-backup.js :15 import * as fs from 'fs';
  • fs package/dist/src/services/memory-distillation.js :27 import * as fs from 'fs';
  • fs package/dist/src/services/native-training.js :20 import { mkdirSync, existsSync } from 'fs';
  • fs package/dist/src/services/policy-runtime.js :4 import { closeSync, existsSync, mkdirSync, openSync, readFileSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync, } from 'node:fs';
  • fs package/dist/src/services/repo-supervisor.js :30 import * as fs from 'fs';
  • fs package/dist/src/services/swarm-memory-branches.js :43 import { existsSync, mkdirSync, readFileSync, writeFileSync, rmSync } from 'node:fs';
  • fs package/dist/src/services/worker-daemon.js :14 import { existsSync, mkdirSync, writeFileSync, readFileSync, appendFileSync, unlinkSync } from 'fs';
  • fs package/dist/src/services/workspace-lease.js :22 import * as fs from 'fs';
  • fs package/dist/src/transfer/export.js :5 import * as fs from 'fs';
  • fs package/dist/src/transfer/storage/gcs.js :9 import * as fs from 'fs';
  • fs package/dist/src/transfer/store/download.js :5 import * as fs from 'fs';
  • fs package/dist/src/transfer/store/publish.js :5 import * as fs from 'fs';
  • fs (weak) package/dist/src/transfer/test-seraphine.js :5 import * as fs from 'fs';
  • fs package/dist/src/update/executor.js :6 import * as fs from 'fs';
  • fs package/dist/src/update/rate-limiter.js :5 import * as fs from 'fs';
  • fs (weak) package/plugins/ruflo-metaharness/scripts/_harness.mjs :43 import { existsSync, readFileSync } from 'node:fs';
  • fs (weak) package/plugins/ruflo-metaharness/scripts/_invoke.mjs :39 import { existsSync, mkdirSync, readFileSync } from 'node:fs';
  • fs (weak) package/plugins/ruflo-metaharness/scripts/audit-trend.mjs :27 import { readFileSync, existsSync } from 'node:fs';
  • fs (weak) package/plugins/ruflo-metaharness/scripts/bench.mjs :22 import { existsSync } from 'node:fs';
  • fs (weak) package/plugins/ruflo-metaharness/scripts/drift-from-history.mjs :38 import { mkdtempSync, writeFileSync, rmSync } from 'node:fs';
  • fs (weak) package/plugins/ruflo-metaharness/scripts/evolve.mjs :52 import { existsSync, readdirSync, readFileSync } from 'node:fs';
  • fs (weak) package/plugins/ruflo-metaharness/scripts/gepa.mjs :38 import { readFileSync, existsSync } from 'node:fs';
  • fs (weak) package/plugins/ruflo-metaharness/scripts/learn.mjs :29 import { existsSync } from 'node:fs';
  • fs (weak) package/plugins/ruflo-metaharness/scripts/mint.mjs :19 import { existsSync, mkdirSync } from 'node:fs';
  • fs (weak) package/plugins/ruflo-metaharness/scripts/redblue.mjs :36 import { existsSync, readFileSync, mkdtempSync, unlinkSync } from 'node:fs';
  • fs (weak) package/plugins/ruflo-metaharness/scripts/router-parallel-analyze.mjs :36 import { readFileSync, existsSync } from 'node:fs';
  • fs (weak) package/plugins/ruflo-metaharness/scripts/similarity.mjs :26 import { readFileSync, existsSync } from 'node:fs';
  • fs (weak) package/plugins/ruflo-metaharness/scripts/test-graceful-degradation.mjs :34 import { mkdtempSync, rmSync } from 'node:fs';
  • fs (weak) package/plugins/ruflo-metaharness/scripts/test-mcp-tools.mjs :24 import { existsSync } from 'node:fs';
  • fs (weak) package/plugins/ruflo-metaharness/scripts/test-parallel-pipeline.mjs :27 import { mkdtempSync, rmSync, mkdirSync, existsSync, readFileSync, writeFileSync } from 'node:fs';
  • fs (weak) package/plugins/ruflo-metaharness/scripts/test-pipeline-roundtrip.mjs :40 import { mkdtempSync, writeFileSync, readFileSync, rmSync } from 'node:fs';
  • fs (weak) package/plugins/ruflo-metaharness/scripts/test-with-openrouter.mjs :40 import { mkdtempSync, rmSync, mkdirSync, existsSync } from 'node:fs';
  • fs (weak) package/scripts/postinstall.cjs :29 const fs = require('node:fs');

shell / exec 70

  • shell package/.claude/helpers/github-safe.js :22 import { execSync, execFileSync } from 'child_process';
  • shell package/.claude/helpers/hook-handler.cjs :82 const { spawn } = require('child_process');
  • shell package/.claude/helpers/learning-service.mjs :24 import { execSync, spawn } from 'child_process';
  • shell package/.claude/helpers/metrics-db.mjs :12 import { execSync } from 'child_process';
  • shell package/.claude/helpers/statusline.cjs :25 const { execSync } = require('child_process');
  • shell package/.claude/helpers/statusline.js :14 const { execSync, execFileSync } = require('child_process');
  • shell package/dist/src/appliance/rvfa-builder.js :10 import { execSync } from 'node:child_process';
  • shell package/dist/src/appliance/rvfa-runner.js :11 import { spawn } from 'node:child_process';
  • shell (weak) package/dist/src/benchmarks/gaia-agent.js :44 import { execSync } from 'node:child_process';
  • shell (weak) package/dist/src/benchmarks/gaia-critic.js :35 import { execSync } from 'node:child_process';
  • shell (weak) package/dist/src/benchmarks/gaia-decomposer.js :36 import { execSync } from 'node:child_process';
  • shell (weak) package/dist/src/benchmarks/gaia-judge.js :30 import { execSync } from 'node:child_process';
  • shell (weak) package/dist/src/benchmarks/gaia-loader.js :19 import { execSync } from 'node:child_process';
  • shell (weak) package/dist/src/benchmarks/gaia-tools/file_read.js :30 import { execFileSync } from 'node:child_process';
  • shell (weak) package/dist/src/benchmarks/gaia-tools/grounded_query.js :55 const { execSync } = await import('node:child_process');
  • shell package/dist/src/business-pods/bbs-budget-tracker.js :98 // Ensure schema is present. exec() is a no-op for tables that already
  • shell package/dist/src/commands/analyze.js :22 import { execSync } from 'child_process';
  • shell package/dist/src/commands/daemon.js :8 import { fork } from 'child_process';
  • shell package/dist/src/commands/doctor.js :12 import { execSync, exec } from 'child_process';
  • shell package/dist/src/commands/eject.js :31 import { spawnSync } from 'child_process';
  • shell package/dist/src/commands/funnel.js :15 import { execFile } from 'node:child_process';
  • shell package/dist/src/commands/hive-mind.js :11 import { spawn as childSpawn, execSync } from 'child_process';
  • shell package/dist/src/commands/hooks.js :3597 const { execSync } = await import('child_process');
  • shell package/dist/src/commands/init.js :9 import { spawnSync } from 'node:child_process';
  • shell package/dist/src/commands/metaharness.js :37 import { spawnSync } from 'child_process';
  • shell package/dist/src/commands/neural.js :1445 'eval(', 'Function(', 'exec(', 'spawn(',
  • shell package/dist/src/commands/ruvector/import.js :307 const { execFileSync } = await import('child_process');
  • shell package/dist/src/commands/security.js :8 import { execSync } from 'node:child_process';
  • shell package/dist/src/funnel/local-signals.js :12 import { execSync } from 'child_process';
  • shell package/dist/src/init/executor.js :302 const gitRootResolver = "var c=require('child_process'),p=require('path'),u=require('url'),r;"
  • shell package/dist/src/init/helpers-generator.js :452 "const { spawn } = require('child_process');",
  • shell package/dist/src/mcp-client.js :42 import { execFileSync } from 'node:child_process';
  • shell package/dist/src/mcp-server.js :20 import { execFileSync } from 'child_process';
  • shell package/dist/src/mcp-tools/auto-install.js :7 import { spawnSync } from 'child_process';
  • shell package/dist/src/mcp-tools/browser-session-tools.js :32 const { execFile } = await import('node:child_process');
  • shell package/dist/src/mcp-tools/browser-tools.js :19 const { execFileSync } = await import('child_process');
  • shell package/dist/src/mcp-tools/github-tools.js :11 import { execFileSync, execSync } from 'node:child_process';
  • shell package/dist/src/mcp-tools/hive-mind-tools.js :151 count: { type: 'number', description: 'Number of workers to spawn (default: 1)', default: 1 },
  • shell package/dist/src/mcp-tools/metaharness-tools.js :50 import { spawn } from 'node:child_process';
  • shell package/dist/src/mcp-tools/terminal-tools.js :11 import { execSync } from 'node:child_process';
  • shell package/dist/src/mcp-tools/testgen-tools.js :24 import { spawn } from 'node:child_process';
  • shell package/dist/src/plugins/manager.js :8 import { execFile } from 'child_process';
  • shell package/dist/src/proxy/lifecycle.js :6 * native binary instead of a forked Node process. `spawn()` here passes zero
  • shell package/dist/src/ruvector/diff-classifier.js :4 import { execFileSync, execFile } from 'node:child_process';
  • shell package/dist/src/services/claim-service.js :18 import { execFileSync } from 'child_process';
  • shell package/dist/src/services/container-worker-pool.js :19 import { spawn, exec } from 'child_process';
  • shell package/dist/src/services/daemon-autostart.js :33 import { spawn } from 'child_process';
  • shell package/dist/src/services/distill-oracle.js :37 import { spawn } from 'child_process';
  • shell package/dist/src/services/fable-harness.js :35 import { spawn } from 'child_process';
  • shell package/dist/src/services/git-workspace-identity.js :24 import { execFileSync } from 'child_process';
  • shell package/dist/src/services/harness-hosts.js :13 import { execFileSync } from 'child_process';
  • shell package/dist/src/services/headless-worker-executor.js :21 import { spawn, execSync } from 'child_process';
  • shell package/dist/src/services/memory-backup.js :85 const { execFileSync } = await import('child_process');
  • shell package/dist/src/services/policy-runtime.js :3 import { execFileSync } from 'node:child_process';
  • shell package/dist/src/services/weight-eft.js :36 import { spawnSync } from 'node:child_process';
  • shell package/dist/src/transfer/storage/gcs.js :11 import { execFileSync } from 'child_process';
  • shell package/dist/src/update/executor.js :5 import { execFileSync } from 'child_process';
  • shell (weak) package/plugins/ruflo-metaharness/scripts/_darwin.mjs :35 import { spawnSync, spawn } from 'node:child_process';
  • shell (weak) package/plugins/ruflo-metaharness/scripts/_harness.mjs :42 import { spawnSync, spawn } from 'node:child_process';
  • shell (weak) package/plugins/ruflo-metaharness/scripts/_invoke.mjs :38 import { spawnSync } from 'node:child_process';
  • shell (weak) package/plugins/ruflo-metaharness/scripts/_redblue.mjs :49 import { spawnSync } from 'node:child_process';
  • shell (weak) package/plugins/ruflo-metaharness/scripts/audit-list.mjs :19 import { spawnSync } from 'node:child_process';
  • shell (weak) package/plugins/ruflo-metaharness/scripts/audit-trend.mjs :28 import { spawnSync } from 'node:child_process';
  • shell (weak) package/plugins/ruflo-metaharness/scripts/drift-from-history.mjs :35 import { spawnSync, spawn } from 'node:child_process';
  • shell (weak) package/plugins/ruflo-metaharness/scripts/oia-audit.mjs :27 import { spawnSync } from 'node:child_process';
  • shell (weak) package/plugins/ruflo-metaharness/scripts/similarity.mjs :27 import { spawnSync } from 'node:child_process';
  • shell (weak) package/plugins/ruflo-metaharness/scripts/test-graceful-degradation.mjs :33 import { spawnSync } from 'node:child_process';
  • shell (weak) package/plugins/ruflo-metaharness/scripts/test-parallel-pipeline.mjs :26 import { spawnSync } from 'node:child_process';
  • shell (weak) package/plugins/ruflo-metaharness/scripts/test-pipeline-roundtrip.mjs :39 import { spawnSync } from 'node:child_process';
  • shell (weak) package/plugins/ruflo-metaharness/scripts/test-with-openrouter.mjs :39 import { spawnSync, execSync } from 'node:child_process';

network 28

  • net package/dist/src/appliance/rvfa-distribution.js :13 import { request as httpsRequest } from 'node:https';
  • net (weak) package/dist/src/benchmarks/gaia-agent.js :235 res = await fetch(ANTHROPIC_API_URL, {
  • net (weak) package/dist/src/benchmarks/gaia-critic.js :193 const response = await fetch(ANTHROPIC_API_URL, {
  • net (weak) package/dist/src/benchmarks/gaia-decomposer.js :87 const response = await fetch(ANTHROPIC_API_URL, {
  • net (weak) package/dist/src/benchmarks/gaia-judge.js :21 * API pattern: raw fetch() against https://api.anthropic.com/v1/messages —
  • net (weak) package/dist/src/benchmarks/gaia-loader.js :23 import * as https from 'node:https';
  • net (weak) package/dist/src/benchmarks/gaia-tools/grounded_query.js :89 const resp = await fetch(url, {
  • net (weak) package/dist/src/benchmarks/gaia-tools/web_search.js :18 import * as https from 'node:https';
  • net package/dist/src/commands/doctor.js :1493 const resp = await fetch(`http://${bind}/status`, {
  • net package/dist/src/commands/neural.js :1153 const response = await fetch('https://api.pinata.cloud/pinning/pinJSONToIPFS', {
  • net package/dist/src/commands/providers.js :82 const res = await fetch(endpointConfig.url, {
  • net package/dist/src/commands/verify.js :26 const res = await fetch(url, { signal: AbortSignal.timeout(30000) });
  • net package/dist/src/funnel/event-transport.js :23 import * as https from 'https';
  • net package/dist/src/funnel/message-transport.js :33 import * as https from 'https';
  • net package/dist/src/mcp-server.js :21 import { request as httpRequestFn } from 'http';
  • net package/dist/src/mcp-tools/agent-execute-core.js :166 const res = await fetch('https://api.anthropic.com/v1/messages', {
  • net package/dist/src/mcp-tools/browser-intent-tools.js :88 import { createServer } from 'node:http';
  • net package/dist/src/mcp-tools/http-fetch-tools.js :205 const response = await fetch(parsed.toString(), {
  • net package/dist/src/mcp-tools/managed-agent-tools.js :47 res = await fetch(`${API_BASE}/v1${path}`, {
  • net package/dist/src/plugins/store/discovery.js :15 const downloadsRes = await fetch(downloadsUrl, { signal: AbortSignal.timeout(3000) });
  • net package/dist/src/proxy/release.js :52 const response = await fetch(url, { redirect: 'follow', signal: AbortSignal.timeout(120_000) });
  • net package/dist/src/services/registry-api.js :35 const response = await fetch(`${REGISTRY_API_URL}?action=rate`, {
  • net package/dist/src/transfer/ipfs/client.js :48 const response = await fetch(`${gateway}/api/v0/name/resolve?arg=/ipns/${ipnsName}`, {
  • net package/dist/src/transfer/ipfs/upload.js :56 const response = await fetch(`${endpoint}/upload`, {
  • net package/dist/src/transfer/store/discovery.js :104 const response = await fetch(`${gateway}/api/v0/name/resolve?arg=${ipnsName}`, {
  • net package/dist/src/transfer/store/download.js :132 const response = await fetch(url);
  • net package/dist/src/update/checker.js :35 const response = await fetch(`https://registry.npmjs.org/${encodeURIComponent(packageName)}`, {
  • net (weak) package/plugins/ruflo-metaharness/scripts/test-with-openrouter.mjs :76 const resp = await fetch('https://openrouter.ai/api/v1/models', {

secrets 24

  • secrets (weak) package/dist/src/benchmarks/gaia-agent.js :104 const envKey = process.env.ANTHROPIC_API_KEY;
  • secrets (weak) package/dist/src/benchmarks/gaia-critic.js :57 const fromEnv = process.env['ANTHROPIC_API_KEY'];
  • secrets (weak) package/dist/src/benchmarks/gaia-decomposer.js :66 const envKey = process.env.ANTHROPIC_API_KEY;
  • secrets (weak) package/dist/src/benchmarks/gaia-decomposer.smoke.js :78 process.env.ANTHROPIC_API_KEY = 'sk-ant-test-key';
  • secrets (weak) package/dist/src/benchmarks/gaia-e2e-smoke.js :49 const hasKey = !!(process.env.ANTHROPIC_API_KEY?.trim());
  • secrets (weak) package/dist/src/benchmarks/gaia-judge.js :155 const envKey = process.env.ANTHROPIC_API_KEY;
  • secrets (weak) package/dist/src/benchmarks/gaia-loader.js :36 const envToken = process.env.HF_TOKEN;
  • secrets (weak) package/dist/src/benchmarks/gaia-tools/grounded_query.js :15 * 1. process.env.GOOGLE_AI_API_KEY
  • secrets package/dist/src/commands/doctor.js :1964 const rawKey = process.env.CLAUDE_FLOW_ENCRYPTION_KEY;
  • secrets package/dist/src/commands/neural.js :1146 const pinataKey = process.env.PINATA_API_KEY;
  • secrets package/dist/src/commands/ruvector/backup.js :17 password: ctx.flags.password || process.env.PGPASSWORD || '',
  • secrets package/dist/src/commands/ruvector/benchmark.js :17 password: ctx.flags.password || process.env.PGPASSWORD || '',
  • secrets package/dist/src/commands/ruvector/init.js :17 password: ctx.flags.password || process.env.PGPASSWORD || '',
  • secrets package/dist/src/commands/ruvector/migrate.js :143 password: ctx.flags.password || process.env.PGPASSWORD || '',
  • secrets package/dist/src/commands/ruvector/optimize.js :17 password: ctx.flags.password || process.env.PGPASSWORD || '',
  • secrets package/dist/src/commands/ruvector/status.js :16 password: ctx.flags.password || process.env.PGPASSWORD || '',
  • secrets package/dist/src/mcp-tools/agent-execute-core.js :103 const ollamaKey = process.env.OLLAMA_API_KEY;
  • secrets package/dist/src/mcp-tools/managed-agent-tools.js :27 return process.env.ANTHROPIC_API_KEY || process.env.CLAUDE_API_KEY || null;
  • secrets package/dist/src/ruvector/agent-wasm.js :103 const hasAny = !!(process.env.ANTHROPIC_API_KEY || process.env.OPENROUTER_API_KEY || process.env.OLLAMA_API_KEY);
  • secrets package/dist/src/ruvector/model-router.js :101 const hasOpenRouter = !!process.env.OPENROUTER_API_KEY;
  • secrets package/dist/src/services/container-worker-pool.js :283 ANTHROPIC_API_KEY: process.env.ANTHROPIC_API_KEY || '',
  • secrets package/dist/src/services/policy-runtime.js :196 signingKey: process.env.CLAUDE_FLOW_POLICY_SIGNING_KEY,
  • secrets package/dist/src/transfer/ipfs/upload.js :13 return process.env.WEB3_STORAGE_TOKEN ||
  • secrets package/dist/src/transfer/storage/gcs.js :22 keyFile: process.env.GOOGLE_APPLICATION_CREDENTIALS,

database 1

  • db package/.claude/helpers/learning-service.mjs :25 import Database from 'better-sqlite3';

install hooks 2

  • postinstall package/package.json :89 node ./scripts/postinstall.cjs
  • prepublishOnly package/package.json :90 node scripts/prepare-publish.mjs

declared dependencies 36

  • @claude-flow/cli-core@3.7.0-alpha.5
  • @claude-flow/codex@3.0.3
  • @claude-flow/mcp@3.0.0-alpha.8
  • @claude-flow/neural@3.0.0-alpha.9
  • @claude-flow/plugin-agent-federation@1.0.0-alpha.18
  • @claude-flow/security@3.0.0-alpha.14
  • @claude-flow/shared@3.0.0-alpha.7
  • @iarna/toml@^2.2.5
  • @noble/ed25519@2.3.0
  • @ruvector/rabitq-wasm@0.1.0
  • bcryptjs@^3.0.3
  • chalk@^5.3.0
  • commander@^12.0.0
  • fs-extra@^11.2.0
  • inquirer@^9.2.0
  • semver@7.7.3
  • sql.js@^1.13.0
  • toml@^3.0.0
  • ws@^8.21.0
  • yaml@^2.8.0
  • zod@^3.22.0
  • typescript@^5.3.0
  • vitest@^4.1.0
  • @metaharness/router@^0.4.0
  • metaharness@^0.4.1
  • @agntcy/slim-bindings@2.0.0-alpha.5
  • @napi-rs/keyring@1.3.0
  • @claude-flow/memory@^3.0.0-alpha.22
  • @metaharness/darwin@~0.9.0
  • @metaharness/flywheel@~0.1.10
  • @metaharness/radio@~0.1.0
  • @metaharness/turn-credit@~0.1.0
  • agentdb@^3.0.0-alpha.17
  • agentic-flow@^3.0.0-alpha.1
  • better-sqlite3@^12.9.0
  • ruvector@^0.2.27

obfuscation 6

  • dynamic require()/import() package/.claude/helpers/auto-memory-hook.mjs :178 return await import(`file://${rec.distPath}`);
  • dynamic require()/import() package/dist/src/commands/gaia-bench.js :231 const { loadGaia } = (await import(benchmarksBase + 'gaia-loader.js'));
  • dynamic require()/import() package/dist/src/commands/init.js :57 const mod = await import(`file://${projectPath}`);
  • dynamic require()/import() package/dist/src/init/helpers-generator.js :1043 return await import(\`file://\${rec.distPath}\`);
  • dynamic require()/import() package/dist/src/mcp-tools/auto-install.js :79 return await import(`${packageName}${cacheBuster}`);
  • dynamic require()/import() package/dist/src/mcp-tools/security-tools.js :96 const aidefence = await import(`file://${modulePath}${cacheBust}`);

perm:untrusted 1

  • untrusted package/dist/src/mcp-tools/http-fetch-tools.js :290 description: 'ADR-164 §5.1.8 — HTTP probe primitive for business-pod ops benches (synthetic 200/500 endpoint checks, third-party status pages). Default-secure: blocks file://, ftp://, RFC-1918 / loopb