Domain portfolio, registrar, marketplace, and DNS management for AI agents — CLI + MCP + HTTP API + SDK, shared account API and PostgreSQL
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport stdio counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed v0.1.0 · analyzer v33 · 1w ago
danger signals3
- suspicious endpoint 169.254.169.254 (cloud metadata) package/dist/cli/index.js :18194
Endpoint2["IPv4"] = "http://169.254.169.254"; - suspicious endpoint 169.254.169.254 (cloud metadata) package/dist/index.js :12357
Endpoint2["IPv4"] = "http://169.254.169.254"; - suspicious endpoint 169.254.169.254 (cloud metadata) package/dist/mcp/index.js :11839
Endpoint2["IPv4"] = "http://169.254.169.254";
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 112
filesystem 7
- fs package/dist/cli/index.js :2087
import { closeSync, fstatSync, openSync, readFileSync } from "fs"; - fs package/dist/index.js :346
import { mkdirSync } from "fs"; - fs package/dist/lib/registrar.js :1534
import { readFileSync } from "node:fs"; - fs package/dist/mcp/index.js :13007
import fs from "fs/promises"; - fs package/dist/sdk/index.js :5
import { closeSync, fstatSync, openSync, readFileSync } from "fs"; - fs package/dist/server/index.js :687
import { readFileSync } from "fs"; - fs package/postinstall.js :10
import { chmodSync, existsSync, mkdirSync } from "node:fs";
shell / exec 4
- shell package/dist/cli/index.js :2086
import { spawnSync } from "child_process"; - shell package/dist/index.js :23155
import { exec } from "child_process"; - shell package/dist/mcp/index.js :22637
import { exec } from "child_process"; - shell package/dist/sdk/index.js :4
import { spawnSync } from "child_process";
network 6
- net package/dist/cli/index.js :2085
import { isIP } from "net"; - net package/dist/index.js :12216
import node_http from "http"; - net package/dist/lib/cloudflare.js :148
const res = await fetch(`${CF_BASE}${path}`, { - net package/dist/lib/registrar.js :148
const res = await fetch(`${CF_BASE}${path}`, { - net package/dist/mcp/index.js :11698
import node_http from "http"; - net package/dist/sdk/index.js :3
import { isIP } from "net";
secrets 4
- secrets package/dist/cli/index.js :6123
const apiKey = process.env["GODADDY_API_KEY"]; - secrets package/dist/index.js :26172
const apiKey = process.env["NAMECHEAP_API_KEY"]; - secrets package/dist/lib/registrar.js :485
secretAccessKey: process.env["ROUTE53_SECRET_ACCESS_KEY"] || process.env["AWS_SECRET_ACCESS_KEY"], - secrets package/dist/lib/route53.js :30
secretAccessKey: process.env["ROUTE53_SECRET_ACCESS_KEY"] || process.env["AWS_SECRET_ACCESS_KEY"],
database 1
- db package/dist/server/index.js :871
import pg from "pg";
install hooks 3
- prepublishOnly package/package.json :63
bun run build - postinstall package/package.json :64
node postinstall.js - prepack package/package.json :65
bun run build && bun run artifact-scan
declared dependencies 20
- @modelcontextprotocol/sdk@^1.29.0
- @aws-sdk/client-route-53@^3.1067.0
- @aws-sdk/client-route-53-domains@^3.1067.0
- @aws-sdk/credential-provider-ini@3.972.53
- chalk@^5.4.1
- commander@^13.1.0
- ink@^5.2.0
- ink-text-input@^6.0.0
- pg@^8.21.0
- react@^18.3.1
- zod@^3.24.2
- @hasna/contracts@1.0.2
show 8 more
- @types/bun@1.3.14
- @types/pg@^8.20.0
- @types/react@^18.3.18
- bun-types@1.3.14
- ink-testing-library@^4.0.0
- typescript@^5.7.3
- @hasna/contacts@^0.6.19
- @hasna/events@^0.1.7