MCP Observatory
3m ago Tracked 59,936 Last 3m ago 24h 2,437
npm TypeScript analyzed 3.117.0 deep scan unknown

EtienneBBeaulac/workrail

v3.117.0
npm

MCP workflow enforcement server -- guides Claude and other AI agents through structured, step-by-step tasks without skipping steps or cutting corners

maintainer
EtienneBBeaulac
licence
MIT
first seen
2026-05-22
last seen
2026-09-15
releases · 30d
1
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools
transport stdio · streamable-http · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v3.117.0 · analyzer v33 · 4w ago

skills & prompt files 4

code evidence v3.117.0 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 1124

filesystem 219

  • fs (weak) EtienneBBeaulac-workrail-0298754/-issue-160/tests/integration/mcp-http-transport.test.ts :14 import * as fs from 'fs/promises';
  • fs (weak) EtienneBBeaulac-workrail-0298754/-issue-160/tests/unit/mcp/v2-inspect-workflow-references.test.ts :7 import * as fs from 'fs/promises';
  • fs (weak) EtienneBBeaulac-workrail-0298754/scripts/backfill-timestamps.ts :31 import * as fs from 'fs/promises';
  • fs (weak) EtienneBBeaulac-workrail-0298754/scripts/backlog-priority.ts :14 import * as fs from 'fs';
  • fs (weak) EtienneBBeaulac-workrail-0298754/scripts/benchmark-token-size.ts :14 import { writeFile } from 'fs/promises';
  • fs (weak) EtienneBBeaulac-workrail-0298754/scripts/ci-policy-check.js :10 const fs = require('fs');
  • fs (weak) EtienneBBeaulac-workrail-0298754/scripts/create-from-template.js :16 import { writeFile } from 'fs/promises';
  • fs (weak) EtienneBBeaulac-workrail-0298754/scripts/dist-manifest.js :9 const fs = require('fs');
  • fs (weak) EtienneBBeaulac-workrail-0298754/scripts/generate-authoring-docs.js :1 const fs = require('fs');
  • fs (weak) EtienneBBeaulac-workrail-0298754/scripts/generate-golden-tokens.ts :9 import * as fs from 'fs';
  • fs (weak) EtienneBBeaulac-workrail-0298754/scripts/generate-lock-coverage.ts :29 import * as fs from 'fs';
  • fs (weak) EtienneBBeaulac-workrail-0298754/scripts/generate-workflow-docs.js :20 const fs = require('fs');
show 28 more
  • fs (weak) EtienneBBeaulac-workrail-0298754/scripts/stamp-workflow.ts :17 import * as fs from 'fs';
  • fs (weak) EtienneBBeaulac-workrail-0298754/scripts/validate-authoring-coverage.js :18 const fs = require('fs');
  • fs (weak) EtienneBBeaulac-workrail-0298754/scripts/validate-authoring-spec.js :1 const fs = require('fs');
  • fs (weak) EtienneBBeaulac-workrail-0298754/scripts/validate-dashboard.js :16 import { readFile } from 'fs/promises';
  • fs (weak) EtienneBBeaulac-workrail-0298754/scripts/validate-feature-coverage.js :19 const fs = require('fs');
  • fs (weak) EtienneBBeaulac-workrail-0298754/scripts/validate-workflow-discovery.js :12 const fs = require('fs');
  • fs (weak) EtienneBBeaulac-workrail-0298754/scripts/validate-workflows-registry.ts :30 import * as fs from 'fs';
  • fs EtienneBBeaulac-workrail-0298754/src/application/services/compiler/binding-registry.ts :25 import { readFileSync } from 'fs';
  • fs EtienneBBeaulac-workrail-0298754/src/application/services/compiler/routine-loader.ts :15 import { readFileSync, readdirSync, existsSync } from 'fs';
  • fs EtienneBBeaulac-workrail-0298754/src/application/use-cases/raw-workflow-file-scanner.ts :1 import fs from 'fs/promises';
  • fs EtienneBBeaulac-workrail-0298754/src/application/validation.ts :1 import fs from 'fs';
  • fs EtienneBBeaulac-workrail-0298754/src/cli-worktrain.ts :21 import fs from 'fs';
  • fs EtienneBBeaulac-workrail-0298754/src/cli.ts :14 import fs from 'fs';
  • fs EtienneBBeaulac-workrail-0298754/src/cli/commands/worktrain-report.ts :21 import * as fs from 'node:fs/promises';
  • fs EtienneBBeaulac-workrail-0298754/src/cli/commands/worktrain-tell.ts :14 * Concurrency note: fs.appendFile is used for writes. POSIX guarantees atomicity
  • fs EtienneBBeaulac-workrail-0298754/src/config/config-file.ts :18 import * as fs from 'fs';
  • fs EtienneBBeaulac-workrail-0298754/src/console/standalone-console.ts :28 import * as fs from 'node:fs/promises';
  • fs EtienneBBeaulac-workrail-0298754/src/context-assembly/infra.ts :1 import * as fs from 'node:fs/promises';
  • fs EtienneBBeaulac-workrail-0298754/src/daemon/cortex/session-cortex.ts :1 import * as fs from 'node:fs/promises';
  • fs EtienneBBeaulac-workrail-0298754/src/daemon/daemon-env.ts :18 import fs from 'fs';
  • fs EtienneBBeaulac-workrail-0298754/src/daemon/daemon-events.ts :23 import * as fs from 'node:fs/promises';
  • fs EtienneBBeaulac-workrail-0298754/src/daemon/gate-resume.ts :23 import * as fs from 'node:fs/promises';
  • fs EtienneBBeaulac-workrail-0298754/src/daemon/io/conversation-log.ts :15 import * as fs from 'node:fs/promises';
  • fs EtienneBBeaulac-workrail-0298754/src/daemon/io/execution-stats.ts :13 import * as fs from 'node:fs/promises';
  • fs EtienneBBeaulac-workrail-0298754/src/daemon/io/soul-loader.ts :13 import * as fs from 'node:fs/promises';
  • fs EtienneBBeaulac-workrail-0298754/src/daemon/io/workspace-context-loader.ts :13 import * as fs from 'node:fs/promises';
  • fs EtienneBBeaulac-workrail-0298754/src/daemon/runner/finalize-session.ts :13 import * as fs from 'node:fs/promises';
  • fs EtienneBBeaulac-workrail-0298754/src/daemon/runner/pre-agent-session.ts :10 import * as fs from 'node:fs/promises';

179 more not shown — this panel samples each group; the count above is the real total.

shell / exec 38

  • shell (weak) EtienneBBeaulac-workrail-0298754/scripts/codemods/mods/test-platform-guard.ts :93 // Identifier form: exec(...), execSync(...), execAsync(...)
  • shell (weak) EtienneBBeaulac-workrail-0298754/scripts/validate-authoring-spec.js :3 const { execSync } = require('child_process');
  • shell EtienneBBeaulac-workrail-0298754/src/cli-worktrain.ts :24 import { execFile } from 'child_process';
  • shell EtienneBBeaulac-workrail-0298754/src/cli/commands/worktrain-daemon-install.ts :76 * The callee MUST use execFile (not exec) to avoid shell injection.
  • shell EtienneBBeaulac-workrail-0298754/src/cli/commands/worktrain-daemon.ts :25 * - All I/O is injected via WorktrainDaemonCommandDeps. No direct fs/child_process.
  • shell EtienneBBeaulac-workrail-0298754/src/context-assembly/infra.ts :4 import { execFile } from 'node:child_process';
  • shell EtienneBBeaulac-workrail-0298754/src/coordinators/pr-review.ts :928 // Drain before any spawn (never mid-agent-run). Acts on stop/skip-pr/add-pr
  • shell EtienneBBeaulac-workrail-0298754/src/daemon/runner/pre-agent-session.ts :12 import { execFile } from 'node:child_process';
  • shell EtienneBBeaulac-workrail-0298754/src/daemon/startup-recovery.ts :19 import { execFile } from 'node:child_process';
  • shell EtienneBBeaulac-workrail-0298754/src/daemon/tools/bash.ts :7 import { exec } from 'node:child_process';
  • shell EtienneBBeaulac-workrail-0298754/src/daemon/tools/glob-grep.ts :9 import { execFile } from 'node:child_process';
  • shell EtienneBBeaulac-workrail-0298754/src/daemon/tools/spawn-agent.ts :29 * Used in both single-spawn (top-level) and parallel (agents array element) forms.
show 26 more
  • shell EtienneBBeaulac-workrail-0298754/src/daemon/workflow-enricher.ts :1 import { execFile } from 'node:child_process';
  • shell EtienneBBeaulac-workrail-0298754/src/daemon/workflow-runner.ts :28 import { execFile } from 'node:child_process';
  • shell EtienneBBeaulac-workrail-0298754/src/infrastructure/session/SessionManager.ts :5 import { execSync } from 'child_process';
  • shell EtienneBBeaulac-workrail-0298754/src/infrastructure/storage/git-workflow-storage.ts :11 import { exec, execFile } from 'child_process';
  • shell EtienneBBeaulac-workrail-0298754/src/mcp/git-metrics/reader.ts :5 * - All functions use execFile (not exec) -- repoRoot is user-controlled input.
  • shell EtienneBBeaulac-workrail-0298754/src/mcp/handlers/session.ts :12 import { spawn } from 'child_process';
  • shell EtienneBBeaulac-workrail-0298754/src/trigger/delivery-action.ts :8 * - Scripts over agent (backlog.md): all delivery runs as child_process.execFile calls.
  • shell EtienneBBeaulac-workrail-0298754/src/trigger/notification-service.ts :26 import * as childProcess from 'node:child_process';
  • shell EtienneBBeaulac-workrail-0298754/src/trigger/trigger-listener.ts :24 import { execFile } from 'node:child_process';
  • shell EtienneBBeaulac-workrail-0298754/src/trigger/trigger-router.ts :26 import { execFile } from 'node:child_process';
  • shell EtienneBBeaulac-workrail-0298754/src/utils/workspace-path-utils.ts :3 import { execFile } from 'child_process';
  • shell EtienneBBeaulac-workrail-0298754/src/v2/infra/local/git-snapshot/index.ts :1 import { execFile } from 'node:child_process';
  • shell EtienneBBeaulac-workrail-0298754/src/v2/infra/local/workspace-anchor/index.ts :8 import { exec } from 'child_process';
  • shell EtienneBBeaulac-workrail-0298754/src/v2/usecases/console-routes.ts :16 import { execFile } from 'child_process';
  • shell EtienneBBeaulac-workrail-0298754/src/v2/usecases/worktree-service.ts :22 import { execFile } from 'child_process';
  • shell (weak) EtienneBBeaulac-workrail-0298754/tests/architecture/v2-workflow-schema-compatibility.test.ts :3 import { execFileSync } from 'node:child_process';
  • shell (weak) EtienneBBeaulac-workrail-0298754/tests/helpers/git-test-utils.ts :7 import { execFile, execFileSync } from 'child_process';
  • shell (weak) EtienneBBeaulac-workrail-0298754/tests/unit/cli-validate.test.js :4 var child_process_1 = require("child_process");
  • shell (weak) EtienneBBeaulac-workrail-0298754/tests/unit/cli-validate.test.ts :2 import { execSync } from 'child_process';
  • shell (weak) EtienneBBeaulac-workrail-0298754/tests/unit/cli-version.test.ts :41 const { execSync } = require('child_process');
  • shell (weak) EtienneBBeaulac-workrail-0298754/tests/unit/coordinator-pr-review.test.ts :689 // Find the fix agent spawn (wr.coding-task)
  • shell (weak) EtienneBBeaulac-workrail-0298754/tests/unit/git-metrics-reader.test.ts :14 // Mock child_process.execFile
  • shell (weak) EtienneBBeaulac-workrail-0298754/tests/unit/open-dashboard.test.ts :8 import { spawn } from 'child_process';
  • shell (weak) EtienneBBeaulac-workrail-0298754/tests/unit/validate-workflow-registry.test.ts :694 const { execSync } = await import('child_process');
  • shell (weak) EtienneBBeaulac-workrail-0298754/tests/unit/workflow-runner-file-tools.test.ts :19 import { execFileSync } from 'node:child_process';
  • shell (weak) EtienneBBeaulac-workrail-0298754/tests/unit/workflow-runner-spawn-agent.test.ts :500 describe('makeSpawnAgentTool() parallel spawn (agents[])', () => {

network 31

  • net (weak) EtienneBBeaulac-workrail-0298754/-issue-160/tests/integration/mcp-http-transport.test.ts :11 import fetch from 'node-fetch';
  • net EtienneBBeaulac-workrail-0298754/console/src/api/hooks.ts :17 const res = await fetch(url);
  • net EtienneBBeaulac-workrail-0298754/console/src/hooks/useSessionDetailRepository.ts :20 /** Session detail data. Undefined only during the initial fetch (no cached data). */
  • net EtienneBBeaulac-workrail-0298754/console/src/hooks/useSessionListRepository.ts :30 * Session list data. Undefined only during the initial fetch (no cached data).
  • net EtienneBBeaulac-workrail-0298754/console/src/hooks/useWorkflowsRepository.ts :20 * Undefined only during the initial fetch (no cached data).
  • net EtienneBBeaulac-workrail-0298754/console/src/hooks/useWorkspaceRepository.ts :26 /** Session list data. Undefined only during the initial fetch (no cached data). */
  • net EtienneBBeaulac-workrail-0298754/src/cli-worktrain.ts :153 const response = await globalThis.fetch(url, {
  • net EtienneBBeaulac-workrail-0298754/src/cli/commands/worktrain-await.ts :226 const response = await deps.fetch(url);
  • net EtienneBBeaulac-workrail-0298754/src/cli/commands/worktrain-dispatch.ts :235 const response = await deps.fetch(url, {
  • net EtienneBBeaulac-workrail-0298754/src/cli/commands/worktrain-spawn.ts :172 const response = await deps.fetch(url, {
  • net EtienneBBeaulac-workrail-0298754/src/console/standalone-console.ts :27 import * as http from 'node:http';
  • net EtienneBBeaulac-workrail-0298754/src/infrastructure/storage/remote-workflow-storage.ts :183 const response = await fetch(url, {
show 19 more
  • net EtienneBBeaulac-workrail-0298754/src/mcp/handlers/session.ts :13 import { request } from 'http';
  • net EtienneBBeaulac-workrail-0298754/src/mcp/transports/http-listener.ts :16 import { createServer, type Server as HttpServerType } from 'http';
  • net EtienneBBeaulac-workrail-0298754/src/trigger/adapters/github-poller.ts :118 * Default: globalThis.fetch (Node 18+).
  • net EtienneBBeaulac-workrail-0298754/src/trigger/adapters/github-queue-poller.ts :78 * Default: globalThis.fetch (Node 18+).
  • net EtienneBBeaulac-workrail-0298754/src/trigger/adapters/gitlab-poller.ts :58 * Default: globalThis.fetch (Node 18+).
  • net EtienneBBeaulac-workrail-0298754/src/trigger/delivery-client.ts :7 * - post() uses the global fetch() (available since Node 18; this project
  • net EtienneBBeaulac-workrail-0298754/src/trigger/notification-service.ts :229 this._fetchFn = config.fetchFn ?? ((url, init) => globalThis.fetch(url, init));
  • net EtienneBBeaulac-workrail-0298754/src/trigger/review-approval-adapter.ts :400 return fetch(url, init as RequestInit) as Promise<{ ok: boolean; status: number; json(): Promise<unknown> }>;
  • net EtienneBBeaulac-workrail-0298754/src/trigger/trigger-listener.ts :23 import * as http from 'node:http';
  • net (weak) EtienneBBeaulac-workrail-0298754/tests/integration/mcp-http-transport.test.ts :11 import fetch from 'node-fetch';
  • net (weak) EtienneBBeaulac-workrail-0298754/tests/unit/cli-worktrain-console.test.ts :17 import * as http from 'node:http';
  • net (weak) EtienneBBeaulac-workrail-0298754/tests/unit/mcp/http-listener.test.ts :2 import * as net from 'net';
  • net (weak) EtienneBBeaulac-workrail-0298754/tests/unit/open-dashboard.test.ts :11 import { request } from 'http';
  • net (weak) EtienneBBeaulac-workrail-0298754/tests/unit/standalone-console.test.ts :13 import * as http from 'node:http';
  • net (weak) EtienneBBeaulac-workrail-0298754/tests/unit/trigger-router.test.ts :855 const res = await fetch(`http://localhost:${port}/health`);
  • net (weak) EtienneBBeaulac-workrail-0298754/tests/unit/v2/console-routes-perf.test.ts :9 import http from 'http';
  • net EtienneBBeaulac-workrail-0298754/web/assets/scaffolds/dashboard.js :1195 const response = await fetch(dataSource);
  • net EtienneBBeaulac-workrail-0298754/web/workflows/bug-investigation/dashboard-v2.js :91 const response = await fetch(`${API_BASE}/api/sessions/${workflowId}/${sessionId}`);
  • net EtienneBBeaulac-workrail-0298754/web/workflows/bug-investigation/dashboard.js :32 const response = await fetch(`${API_BASE}/api/sessions/${workflowId}/${sessionId}`);

secrets 11

  • secrets EtienneBBeaulac-workrail-0298754/.releaserc.cjs :7 repositoryUrl: `https://x-access-token:${process.env.GITHUB_TOKEN}@github.com/EtienneBBeaulac/workrail.git`,
  • secrets EtienneBBeaulac-workrail-0298754/src/cli-worktrain.ts :385 const apiKey = process.env['ANTHROPIC_API_KEY'];
  • secrets EtienneBBeaulac-workrail-0298754/src/cli.ts :246 const apiKey = process.env['ANTHROPIC_API_KEY'];
  • secrets EtienneBBeaulac-workrail-0298754/src/infrastructure/storage/enhanced-multi-source-workflow-storage.ts :610 apiKey: process.env['WORKFLOW_REGISTRY_API_KEY'],
  • secrets EtienneBBeaulac-workrail-0298754/src/trigger/index.ts :11 * apiKey: process.env.ANTHROPIC_API_KEY,
  • secrets EtienneBBeaulac-workrail-0298754/src/trigger/trigger-store.ts :615 // Example: "$MY_HMAC_SECRET" resolves to process.env.MY_HMAC_SECRET.
  • secrets EtienneBBeaulac-workrail-0298754/src/v2/usecases/console-routes.ts :892 const apiKey = process.env['ANTHROPIC_API_KEY'];
  • secrets (weak) EtienneBBeaulac-workrail-0298754/tests/integration/structured-output-tools-coexist.test.ts :95 const hasDirectCredentials = !!process.env['ANTHROPIC_API_KEY'];
  • secrets (weak) EtienneBBeaulac-workrail-0298754/tests/unit/enhanced-multi-source-workflow-storage.test.ts :503 authToken: process.env['GITHUB_TOKEN'],
  • secrets (weak) EtienneBBeaulac-workrail-0298754/tests/unit/external-workflow-auth.test.ts :27 process.env['GITHUB_TOKEN'] = 'ghp_test123';
  • secrets (weak) EtienneBBeaulac-workrail-0298754/tests/unit/worktrain-daemon.test.ts :687 delete process.env['WORKTRAIN_BOT_TOKEN'];

install hooks 3

  • prepack (suspicious) EtienneBBeaulac-workrail-0298754/package.json :34 node -e "require('fs').chmodSync('dist/mcp-server.js',0o755); require('fs').chmodSync('dist/cli-worktrain.js',0o755); require('fs').chmodSync('dist/cli-workrail.js',0o755);"
  • preinstall (suspicious) EtienneBBeaulac-workrail-0298754/package.json :55 node -e "const v=parseInt(process.versions.node.split('.')[0],10); if(v<20){console.error('WorkRail requires Node.js >=20. Current: '+process.versions.node+'\nPlease upgrade: https://nodejs.org/'); pr
  • prepare EtienneBBeaulac-workrail-0298754/package.json :92 bash scripts/setup-hooks.sh

declared dependencies 44

  • @modelcontextprotocol/sdk@^1.24.0
  • @anthropic-ai/bedrock-sdk@^0.32.0
  • @anthropic-ai/sdk@^0.115.0
  • @scure/base@2.2.0
  • ajv@^8.17.1
  • chalk@^5.3.0
  • commander@^14.0.0
  • cors@^2.8.5
  • dotenv@^17.2.0
  • express@^5.1.0
  • neverthrow@^8.2.0
  • open@^11.0.0
show 28 more
  • reflect-metadata@^0.2.0
  • semver@^7.7.2
  • tinyglobby@^0.2.15
  • tsconfig-paths@^4.2.0
  • tslib@^2.8.1
  • tsyringe@^4.8.0
  • zod@^3.22.4
  • @duckdb/node-api@^1.5.2-r.1
  • @playwright/test@^1.55.1
  • @semantic-release/changelog@^6.0.3
  • @semantic-release/exec@^7.1.0
  • @semantic-release/git@^10.0.1
  • @semantic-release/github@^12.0.2
  • @testing-library/react@^16.3.2
  • @testing-library/user-event@^14.6.1
  • @types/cors@^2.8.19
  • @types/express@^5.0.3
  • @types/node@^20.19.9
  • @types/semver@^7.7.0
  • @vitest/ui@^3.2.4
  • conventional-changelog-conventionalcommits@^9.1.0
  • fast-check@^4.6.0
  • happy-dom@^20.0.11
  • jsdom@^29.0.2
  • lit@^3.3.1
  • node-fetch@^3.3.2
  • nodemon@^3.0.0
  • semantic-release@^25.0.3

4 more not shown — this panel samples each group; the count above is the real total.

cursor-plugin 1

  • opaque (low) EtienneBBeaulac-workrail-0298754/.cursor/rules/workrail-executor.mdc bundled .cursor/ plugin descriptor (EtienneBBeaulac-workrail-0298754/.cursor/rules/workrail-executor.mdc) — presence-detected; review the descriptor