npm JavaScript analyzed 0.12.8

@cyanheads/mcp-ts-core

v0.12.8
npm

Agent-native TypeScript framework for MCP servers. Includes runtime infrastructure and agent skills for building, testing, and shipping servers.

maintainer
cyanheads
licence
Apache-2.0
first seen
2026-05-22
last seen
2026-09-11
releases · 30d
20
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 1 tools
transport stdio · streamable-http · http verified reported listed in the official MCP registry counts 1 tools · 0 res · 0 prompts permission surface via code analysis

tools

  • template_echo_message
skills & danger signals npm-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v0.12.8 · analyzer v33 · 2d ago

skills & prompt files 39

code evidence v0.12.8 · npm-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 403

filesystem 22

  • fs package/dist/cli/init.js :7 import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
  • fs package/dist/config/appRoot.js :9 import { readFileSync, realpathSync, statSync } from 'node:fs';
  • fs package/dist/services/canvas/providers/duckdb/DuckdbProvider.js :9 import { mkdir, unlink } from 'node:fs/promises';
  • fs package/dist/services/canvas/providers/duckdb/exportWriter.js :8 import { lstat, mkdir, open, realpath, stat, unlink } from 'node:fs/promises';
  • fs package/dist/services/mirror/sqlite/handle.js :12 import { mkdir } from 'node:fs/promises';
  • fs package/dist/storage/providers/fileSystem/fileSystemProvider.js :12 import { existsSync, mkdirSync } from 'node:fs';
  • fs package/dist/utils/parsing/pdfParser.js :81 * import { readFile } from 'node:fs/promises';
  • fs (weak) package/scripts/build-changelog.ts :32 import { existsSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
  • fs (weak) package/scripts/build.ts :17 import { readFileSync } from 'node:fs';
  • fs (weak) package/scripts/check-dependency-specifiers.ts :38 import { existsSync, readFileSync } from 'node:fs';
  • fs (weak) package/scripts/check-docs-sync.ts :22 import { existsSync, readFileSync } from 'node:fs';
  • fs (weak) package/scripts/check-framework-antipatterns.ts :42 import { existsSync } from 'node:fs';
show 10 more
  • fs (weak) package/scripts/check-skill-versions.ts :33 import { existsSync, readFileSync } from 'node:fs';
  • fs (weak) package/scripts/check-skills-sync.ts :37 import { existsSync, readdirSync, readFileSync } from 'node:fs';
  • fs (weak) package/scripts/clean-mcpb.ts :29 import { existsSync, statSync } from 'node:fs';
  • fs (weak) package/scripts/clean.ts :15 import { readdir, rm } from 'node:fs/promises';
  • fs (weak) package/scripts/devcheck.ts :3 import { existsSync, readFileSync } from 'node:fs';
  • fs (weak) package/scripts/lint-mcp.ts :19 import { existsSync, readdirSync, readFileSync } from 'node:fs';
  • fs (weak) package/scripts/lint-packaging.ts :55 import { existsSync, readdirSync, readFileSync } from 'node:fs';
  • fs (weak) package/scripts/list-skills.ts :21 import { existsSync } from 'node:fs';
  • fs (weak) package/scripts/release-github.ts :33 import { existsSync, readFileSync } from 'node:fs';
  • fs (weak) package/scripts/tree.ts :24 import type { Dirent } from 'node:fs';

shell / exec 7

  • shell (weak) package/scripts/build.ts :16 import { execFile } from 'node:child_process';
  • shell (weak) package/scripts/check-framework-antipatterns.ts :41 import { spawnSync } from 'node:child_process';
  • shell (weak) package/scripts/check-skill-versions.ts :32 import { spawnSync } from 'node:child_process';
  • shell (weak) package/scripts/clean-mcpb.ts :28 import { execFileSync } from 'node:child_process';
  • shell (weak) package/scripts/devcheck.ts :2 import { type ChildProcess, spawn, spawnSync } from 'node:child_process';
  • shell (weak) package/scripts/lint-packaging.ts :54 import { execFileSync } from 'node:child_process';
  • shell (weak) package/scripts/release-github.ts :32 import { spawnSync } from 'node:child_process';

network 7

  • net package/dist/core/worker.js :160 async fetch(request, env, ctx) {
  • net package/dist/mcp-server/transports/http/httpServer.js :8 import http from 'node:http';
  • net package/dist/mcp-server/transports/http/httpTransport.js :505 return await handler.fetch(c.req.raw, { ...(authInfo && { authInfo }) });
  • net package/dist/utils/network/fetchWithTimeout.js :397 * @param url - The URL to fetch (string or `URL` instance).
  • net package/dist/utils/network/httpError.js :106 * const response = await fetch(url);
  • net package/dist/utils/parsing/htmlExtractor.js :58 * const html = await fetch('https://example.com/article').then((r) => r.text());
  • net package/dist/utils/telemetry/trace.js :23 * fetch(url, { headers: { traceparent } });

secrets 1

  • secrets package/dist/services/speech/core/SpeechService.js :23 * const tts = createSpeechProvider({ provider: 'elevenlabs', apiKey: process.env.ELEVEN_KEY });

tool registrations 1

  • template_echo_message package/templates/src/mcp-server/tools/definitions/echo.tool.ts :11

install hooks 1

  • prepare package/package.json :148 git config core.hooksPath .husky || exit 0

declared dependencies 62

  • @modelcontextprotocol/client@^2.0.0
  • @modelcontextprotocol/ext-apps@^1.7.5
  • @modelcontextprotocol/server@^2.0.0
  • @hono/node-server@^2.1.1
  • @opentelemetry/api@^1.9.1
  • dotenv@^17.4.2
  • hono@^4.13.7
  • jose@^6.2.12
  • pino@^10.3.1
  • zod@^4.5.4
  • @biomejs/biome@2.5.12
  • @cloudflare/vitest-pool-workers@^0.22.0
show 28 more
  • @cloudflare/workers-types@5.20260905.1
  • @duckdb/node-api@^1.5.5-r.4
  • @hono/otel@^1.1.2
  • @opentelemetry/exporter-metrics-otlp-http@^0.222.0
  • @opentelemetry/exporter-trace-otlp-http@^0.222.0
  • @opentelemetry/instrumentation-http@^0.222.0
  • @opentelemetry/instrumentation-pino@^0.68.0
  • @opentelemetry/resources@^2.11.0
  • @opentelemetry/sdk-metrics@^2.11.0
  • @opentelemetry/sdk-node@^0.222.0
  • @opentelemetry/sdk-trace-node@^2.11.0
  • @opentelemetry/semantic-conventions@^1.43.0
  • @socketsecurity/bun-security-scanner@^1.1.2
  • @supabase/supabase-js@^2.115.0
  • @types/bun@^1.4.1
  • @types/node@26.4.0
  • @types/papaparse@^5.5.2
  • @types/sanitize-html@^2.16.1
  • @types/validator@^13.15.10
  • @vitest/coverage-istanbul@4.1.11
  • @vitest/ui@4.1.11
  • better-sqlite3@^13.0.3
  • bun-types@^1.4.2
  • chrono-node@^2.10.1
  • clipboardy@^5.3.2
  • defuddle@^0.19.3
  • depcheck@^1.4.7
  • diff@^9.0.0

22 more not shown — this panel samples each group; the count above is the real total.

perm:untrusted 1

  • untrusted package/dist/utils/parsing/htmlExtractor.js :58 * const html = await fetch('https://example.com/article').then((r) => r.text());