Authenticated HTTPS attachment clients and PostgreSQL-backed service
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport stdio · streamable-http · http counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed v1.2.2 · analyzer v33 · 15h ago
skills & prompt files 1
- agent-rules package/AGENTS.md
danger signals2
- dynamic code execution new Function() package/dist/mcp/server.js :2895
const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); - suspicious endpoint 169.254.169.254 (cloud metadata) package/dist/serve/index.js :32257
Endpoint2["IPv4"] = "http://169.254.169.254";
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 84
filesystem 5
- fs package/dist/cli/index.js :11638
import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs"; - fs package/dist/index.js :9432
import { createWriteStream, existsSync, statSync as statSync2 } from "fs"; - fs package/dist/mcp/server.js :16519
import { closeSync as closeSync2, fstatSync as fstatSync2, openSync as openSync2, readFileSync as readFileSync2 } from "fs"; - fs package/dist/sdk/index.js :236
import { closeSync as closeSync2, fstatSync as fstatSync2, openSync as openSync2, readFileSync as readFileSync2 } from "fs"; - fs package/dist/serve/index.js :3491
var st = fs.createReadStream(file);
shell / exec 4
- shell package/dist/cli/index.js :11634
import { execSync } from "child_process"; - shell package/dist/index.js :9509
import { spawnSync } from "child_process"; - shell package/dist/mcp/server.js :16518
import { spawnSync } from "child_process"; - shell package/dist/sdk/index.js :235
import { spawnSync } from "child_process";
network 5
- net package/dist/cli/index.js :11949
import { isIP } from "net"; - net package/dist/index.js :9508
import { isIP } from "net"; - net package/dist/mcp/server.js :16517
import { isIP } from "net"; - net package/dist/sdk/index.js :234
import { isIP } from "net"; - net package/dist/serve/index.js :32116
import node_http from "http";
install hooks 3
- prepare package/package.json :38
bun run build:js - prepack package/package.json :43
bun run verify:release - prepublishOnly package/package.json :44
bun run verify:release
declared dependencies 21
- @modelcontextprotocol/sdk@^1.27.1
- @hasna/secrets@0.4.2
- @aws-sdk/client-s3@^3.1007.0
- @aws-sdk/lib-storage@3.1007.0
- @aws-sdk/s3-request-presigner@^3.1007.0
- @aws-sdk/credential-provider-ini@^3.972.60
- @types/mime-types@^3.0.1
- commander@^14.0.3
- date-fns@^4.1.0
- hono@4.13.3
- mime-types@^3.0.2
- nanoid@^5.1.6
show 9 more
- pg@^8.20.0
- @hono/node-server@^1.19.14
- @hasna/paths@0.2.2
- @hasna/contracts@1.1.0
- @types/bun@1.3.14
- @types/pg@^8.15.6
- typescript@^5.9.3
- bun-types@1.3.14
- @types/node@26.1.0
clipboard 1
- clipboard shell call package/dist/cli/index.js :13462
const cmd = process.platform === "darwin" ? "pbcopy" : "xclip -selection clipboard";