Agent-native TypeScript framework for MCP servers. Includes runtime infrastructure and agent skills for building, testing, and shipping servers.
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport stdio · streamable-http · http
verified
reported
listed in the official MCP registry counts 1 tools · 0 res
· 0 prompts
permission surface via code analysis
tools
-
template_echo_message
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed v0.12.8 · analyzer v33 · 2d ago
skills & prompt files 39
- agent-rules package/AGENTS.md
- agent-rules package/CLAUDE.md
- skill package/skills/add-app-tool/SKILL.md
- skill package/skills/add-export/SKILL.md
- skill package/skills/add-prompt/SKILL.md
- skill package/skills/add-provider/SKILL.md
- skill package/skills/add-resource/SKILL.md
- skill package/skills/add-service/SKILL.md
- skill package/skills/add-test/SKILL.md
- skill package/skills/add-tool/SKILL.md
- skill package/skills/api-auth/SKILL.md
- skill package/skills/api-canvas/SKILL.md
- skill package/skills/api-config/SKILL.md
- skill package/skills/api-context/SKILL.md
- skill package/skills/api-errors/SKILL.md
- skill package/skills/api-linter/SKILL.md
- skill package/skills/api-mirror/SKILL.md
- skill package/skills/api-services/SKILL.md
- skill package/skills/api-telemetry/SKILL.md
- skill package/skills/api-testing/SKILL.md
- skill package/skills/api-utils/SKILL.md
- skill package/skills/api-workers/SKILL.md
- skill package/skills/code-simplifier/SKILL.md
- skill package/skills/design-mcp-server/SKILL.md
- skill package/skills/field-test/SKILL.md
- skill package/skills/git-wrapup/SKILL.md
- skill package/skills/maintenance/SKILL.md
- skill package/skills/orchestrations/SKILL.md
- skill package/skills/polish-docs-meta/SKILL.md
- skill package/skills/release-and-publish/SKILL.md
- skill package/skills/release-pr-review/SKILL.md
- skill package/skills/report-issue-framework/SKILL.md
- skill package/skills/report-issue-local/SKILL.md
- skill package/skills/security-pass/SKILL.md
- skill package/skills/setup/SKILL.md
- skill package/skills/techniques/SKILL.md
- skill package/skills/tool-defs-analysis/SKILL.md
- agent-rules package/templates/AGENTS.md
- agent-rules package/templates/CLAUDE.md
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 403
filesystem 22
- fs package/dist/cli/init.js :7
import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs'; - fs package/dist/config/appRoot.js :9
import { readFileSync, realpathSync, statSync } from 'node:fs'; - fs package/dist/services/canvas/providers/duckdb/DuckdbProvider.js :9
import { mkdir, unlink } from 'node:fs/promises'; - fs package/dist/services/canvas/providers/duckdb/exportWriter.js :8
import { lstat, mkdir, open, realpath, stat, unlink } from 'node:fs/promises'; - fs package/dist/services/mirror/sqlite/handle.js :12
import { mkdir } from 'node:fs/promises'; - fs package/dist/storage/providers/fileSystem/fileSystemProvider.js :12
import { existsSync, mkdirSync } from 'node:fs'; - fs package/dist/utils/parsing/pdfParser.js :81
* import { readFile } from 'node:fs/promises'; - fs (weak) package/scripts/build-changelog.ts :32
import { existsSync, readdirSync, readFileSync, writeFileSync } from 'node:fs'; - fs (weak) package/scripts/build.ts :17
import { readFileSync } from 'node:fs'; - fs (weak) package/scripts/check-dependency-specifiers.ts :38
import { existsSync, readFileSync } from 'node:fs'; - fs (weak) package/scripts/check-docs-sync.ts :22
import { existsSync, readFileSync } from 'node:fs'; - fs (weak) package/scripts/check-framework-antipatterns.ts :42
import { existsSync } from 'node:fs';
show 10 more
- fs (weak) package/scripts/check-skill-versions.ts :33
import { existsSync, readFileSync } from 'node:fs'; - fs (weak) package/scripts/check-skills-sync.ts :37
import { existsSync, readdirSync, readFileSync } from 'node:fs'; - fs (weak) package/scripts/clean-mcpb.ts :29
import { existsSync, statSync } from 'node:fs'; - fs (weak) package/scripts/clean.ts :15
import { readdir, rm } from 'node:fs/promises'; - fs (weak) package/scripts/devcheck.ts :3
import { existsSync, readFileSync } from 'node:fs'; - fs (weak) package/scripts/lint-mcp.ts :19
import { existsSync, readdirSync, readFileSync } from 'node:fs'; - fs (weak) package/scripts/lint-packaging.ts :55
import { existsSync, readdirSync, readFileSync } from 'node:fs'; - fs (weak) package/scripts/list-skills.ts :21
import { existsSync } from 'node:fs'; - fs (weak) package/scripts/release-github.ts :33
import { existsSync, readFileSync } from 'node:fs'; - fs (weak) package/scripts/tree.ts :24
import type { Dirent } from 'node:fs';
shell / exec 7
- shell (weak) package/scripts/build.ts :16
import { execFile } from 'node:child_process'; - shell (weak) package/scripts/check-framework-antipatterns.ts :41
import { spawnSync } from 'node:child_process'; - shell (weak) package/scripts/check-skill-versions.ts :32
import { spawnSync } from 'node:child_process'; - shell (weak) package/scripts/clean-mcpb.ts :28
import { execFileSync } from 'node:child_process'; - shell (weak) package/scripts/devcheck.ts :2
import { type ChildProcess, spawn, spawnSync } from 'node:child_process'; - shell (weak) package/scripts/lint-packaging.ts :54
import { execFileSync } from 'node:child_process'; - shell (weak) package/scripts/release-github.ts :32
import { spawnSync } from 'node:child_process';
network 7
- net package/dist/core/worker.js :160
async fetch(request, env, ctx) { - net package/dist/mcp-server/transports/http/httpServer.js :8
import http from 'node:http'; - net package/dist/mcp-server/transports/http/httpTransport.js :505
return await handler.fetch(c.req.raw, { ...(authInfo && { authInfo }) }); - net package/dist/utils/network/fetchWithTimeout.js :397
* @param url - The URL to fetch (string or `URL` instance). - net package/dist/utils/network/httpError.js :106
* const response = await fetch(url); - net package/dist/utils/parsing/htmlExtractor.js :58
* const html = await fetch('https://example.com/article').then((r) => r.text()); - net package/dist/utils/telemetry/trace.js :23
* fetch(url, { headers: { traceparent } });
secrets 1
- secrets package/dist/services/speech/core/SpeechService.js :23
* const tts = createSpeechProvider({ provider: 'elevenlabs', apiKey: process.env.ELEVEN_KEY });
tool registrations 1
- template_echo_message package/templates/src/mcp-server/tools/definitions/echo.tool.ts :11
install hooks 1
- prepare package/package.json :148
git config core.hooksPath .husky || exit 0
declared dependencies 62
- @modelcontextprotocol/client@^2.0.0
- @modelcontextprotocol/ext-apps@^1.7.5
- @modelcontextprotocol/server@^2.0.0
- @hono/node-server@^2.1.1
- @opentelemetry/api@^1.9.1
- dotenv@^17.4.2
- hono@^4.13.7
- jose@^6.2.12
- pino@^10.3.1
- zod@^4.5.4
- @biomejs/biome@2.5.12
- @cloudflare/vitest-pool-workers@^0.22.0
show 28 more
- @cloudflare/workers-types@5.20260905.1
- @duckdb/node-api@^1.5.5-r.4
- @hono/otel@^1.1.2
- @opentelemetry/exporter-metrics-otlp-http@^0.222.0
- @opentelemetry/exporter-trace-otlp-http@^0.222.0
- @opentelemetry/instrumentation-http@^0.222.0
- @opentelemetry/instrumentation-pino@^0.68.0
- @opentelemetry/resources@^2.11.0
- @opentelemetry/sdk-metrics@^2.11.0
- @opentelemetry/sdk-node@^0.222.0
- @opentelemetry/sdk-trace-node@^2.11.0
- @opentelemetry/semantic-conventions@^1.43.0
- @socketsecurity/bun-security-scanner@^1.1.2
- @supabase/supabase-js@^2.115.0
- @types/bun@^1.4.1
- @types/node@26.4.0
- @types/papaparse@^5.5.2
- @types/sanitize-html@^2.16.1
- @types/validator@^13.15.10
- @vitest/coverage-istanbul@4.1.11
- @vitest/ui@4.1.11
- better-sqlite3@^13.0.3
- bun-types@^1.4.2
- chrono-node@^2.10.1
- clipboardy@^5.3.2
- defuddle@^0.19.3
- depcheck@^1.4.7
- diff@^9.0.0
22 more not shown — this panel samples each group; the count above is the real total.
perm:untrusted 1
- untrusted package/dist/utils/parsing/htmlExtractor.js :58
* const html = await fetch('https://example.com/article').then((r) => r.text());