npm analyzed 3.0.0-alpha.9

@claude-flow/mcp

v3.0.0-alpha.9

npm

Standalone MCP (Model Context Protocol) server - stdio/http/websocket transports, connection pooling, tool registry

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities0 tools

transport http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

no tools enumerated yet for this server.

skills & danger signalsnpm-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v3.0.0-alpha.9 · analyzer v17 · 2d ago

code evidencev3.0.0-alpha.9 · npm-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

fs package/.claude/helpers/github-safe.js :13 import { writeFileSync, unlinkSync } from 'fs';
fs package/.claude/helpers/learning-service.mjs :21 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
fs package/.claude/helpers/memory.js :7 const fs = require('fs');
fs package/.claude/helpers/metrics-db.mjs :9 import { readFileSync, writeFileSync, existsSync, mkdirSync, readdirSync, statSync } from 'fs';
fs package/.claude/helpers/session.js :7 const fs = require('fs');
fs package/.claude/helpers/statusline.cjs :26 const fs = require('fs');
fs package/.claude/helpers/statusline.js :9 const fs = require('fs');
fs package/dist/resource-registry.js :394 const content = await fs.readFile(normalizedPath);
fs package/src/resource-registry.ts :519 const content = await fs.readFile(normalizedPath);

shell package/.claude/helpers/github-safe.js :12 import { execSync } from 'child_process';
shell package/.claude/helpers/learning-service.mjs :24 import { execSync, spawn } from 'child_process';
shell package/.claude/helpers/metrics-db.mjs :12 import { execSync } from 'child_process';
shell package/.claude/helpers/statusline.cjs :28 const { execSync } = require('child_process');
shell package/.claude/helpers/statusline.js :11 const { execSync } = require('child_process');

net package/dist/oauth.js :99 const response = await fetch(this.config.tokenEndpoint, {
net package/dist/sampling.js :231 const response = await fetch('https://api.anthropic.com/v1/messages', {
net package/dist/transport/http.js :8 import { createServer } from 'http';
net package/dist/transport/websocket.js :8 import { createServer } from 'http';
net package/src/oauth.ts :188 const response = await fetch(this.config.tokenEndpoint, {
net package/src/sampling.ts :324 const response = await fetch('https://api.anthropic.com/v1/messages', {
net package/src/transport/http.ts :9 import { createServer, Server } from 'http';
net package/src/transport/websocket.ts :9 import { createServer, Server } from 'http';

db package/.claude/helpers/learning-service.mjs :25 import Database from 'better-sqlite3';