Agent-first file management — index local folders and S3 buckets, sync Google Drive, tag, search, and retrieve files via CLI + MCP
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport stdio · streamable-http · http counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed v0.4.1 · analyzer v33 · 6d ago
danger signals18
- over-broad OAuth scope gmail.modify package/dist/index.js :31501
"https://www.googleapis.com/auth/gmail.modify", - over-broad OAuth scope https://mail.google.com/ package/dist/index.js :31503
"https://mail.google.com/" - over-broad OAuth scope https://www.googleapis.com/auth/drive package/dist/index.js :31510
"https://www.googleapis.com/auth/drive", - over-broad OAuth scope https://www.googleapis.com/auth/documents package/dist/index.js :31514
"https://www.googleapis.com/auth/documents", - over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets package/dist/index.js :31518
"https://www.googleapis.com/auth/spreadsheets", - over-broad OAuth scope https://www.googleapis.com/auth/cloud-platform package/dist/index.js :31534
"https://www.googleapis.com/auth/cloud-platform", - over-broad OAuth scope gmail.modify package/dist/mcp/index.js :34945
"https://www.googleapis.com/auth/gmail.modify", - over-broad OAuth scope https://mail.google.com/ package/dist/mcp/index.js :34947
"https://mail.google.com/" - over-broad OAuth scope https://www.googleapis.com/auth/drive package/dist/mcp/index.js :34954
"https://www.googleapis.com/auth/drive", - over-broad OAuth scope https://www.googleapis.com/auth/documents package/dist/mcp/index.js :34958
"https://www.googleapis.com/auth/documents", - over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets package/dist/mcp/index.js :34962
"https://www.googleapis.com/auth/spreadsheets", - over-broad OAuth scope https://www.googleapis.com/auth/cloud-platform package/dist/mcp/index.js :34978
"https://www.googleapis.com/auth/cloud-platform", - over-broad OAuth scope gmail.modify package/dist/server/index.js :29180
"https://www.googleapis.com/auth/gmail.modify", - over-broad OAuth scope https://mail.google.com/ package/dist/server/index.js :29182
"https://mail.google.com/" - over-broad OAuth scope https://www.googleapis.com/auth/drive package/dist/server/index.js :29189
"https://www.googleapis.com/auth/drive", - over-broad OAuth scope https://www.googleapis.com/auth/documents package/dist/server/index.js :29193
"https://www.googleapis.com/auth/documents", - over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets package/dist/server/index.js :29197
"https://www.googleapis.com/auth/spreadsheets", - over-broad OAuth scope https://www.googleapis.com/auth/cloud-platform package/dist/server/index.js :29213
"https://www.googleapis.com/auth/cloud-platform",
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 97
filesystem 10
- fs package/dist/cli/index.js :2085
import { cpSync, existsSync as existsSync2, mkdirSync } from "fs"; - fs package/dist/index.js :9392
import { cpSync, existsSync, mkdirSync } from "fs"; - fs package/dist/mcp/index.js :10079
import { readFileSync } from "fs"; - fs package/dist/sdk/index.js :936
import { closeSync, fstatSync, openSync, readFileSync } from "fs"; - fs package/dist/server/file-content-worker.js :55
import { cpSync, existsSync, mkdirSync } from "fs"; - fs package/dist/server/index.js :22
import { cpSync, existsSync, mkdirSync } from "fs"; - fs package/dist/server/migrate.js :25
import { readFileSync } from "fs"; - fs (weak) package/scripts/ensure-data-dir.mjs :17
import { existsSync, mkdirSync } from "node:fs"; - fs (weak) package/scripts/generate-sdk.ts :8
import { mkdirSync, writeFileSync } from "node:fs"; - fs (weak) package/scripts/knowledge-installed-smoke.ts :2
import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
shell / exec 6
- shell package/dist/cli/index.js :30564
import { spawn } from "child_process"; - shell package/dist/index.js :15429
import { spawn } from "child_process"; - shell package/dist/mcp/index.js :18873
import { spawn } from "child_process"; - shell package/dist/sdk/index.js :935
import { spawnSync } from "child_process"; - shell package/dist/server/index.js :13108
import { spawn } from "child_process"; - shell (weak) package/scripts/knowledge-installed-smoke.ts :157
const proc = Bun.spawnSync({
network 5
- net package/dist/cli/index.js :28845
const resp = await fetch(`${peerUrl}/machines/current`); - net package/dist/index.js :20602
response = await fetch(url, { - net package/dist/mcp/index.js :22
import { createServer } from "http"; - net package/dist/sdk/index.js :934
import { isIP } from "net"; - net package/dist/server/index.js :11475
const resp = await fetch(`${peerUrl}/machines/current`);
secrets 3
- secrets package/dist/index.js :19773
const token = context.token ?? process.env.GITHUB_TOKEN ?? profileConfig.token; - secrets package/dist/mcp/index.js :23217
const token = context.token ?? process.env.GITHUB_TOKEN ?? profileConfig.token; - secrets package/dist/server/index.js :17452
const token = context.token ?? process.env.GITHUB_TOKEN ?? profileConfig.token;
database 2
- db package/dist/server/index.js :31897
import pg from "pg"; - db package/dist/server/migrate.js :126
import pg from "pg";
install hooks 3
- prepack package/package.json :54
bun run build - prepublishOnly package/package.json :55
bun run typecheck && bun test && bun run contracts:conformance && bun run clean && contracts no-cloud-scan . - postinstall package/package.json :63
bun ./scripts/ensure-data-dir.mjs
declared dependencies 24
- @modelcontextprotocol/sdk@1.29.0
- @aws-sdk/client-s3@^3.744.0
- @aws-sdk/credential-providers@^3.744.0
- @aws-sdk/lib-storage@^3.744.0
- @aws-sdk/s3-request-presigner@^3.1009.0
- @hasna/connectors@1.4.3
- @hasna/events@0.1.16
- @noble/hashes@^1.7.2
- chalk@^5.4.1
- chokidar@^4.0.3
- commander@^13.1.0
- ink@^5.2.1
show 12 more
- mime-types@^3.0.1
- nanoid@^5.1.5
- pg@^8.13.3
- react@^18.3.1
- zod@^3.25.76
- @hasna/contracts@1.0.2
- @types/mime-types@^2.1.4
- @types/pg@^8.11.11
- @types/react@^18.3.20
- bun-types@latest
- typescript@^5.8.2
- @smithy/types@^4.16.1