Machine fleet management CLI + MCP for developers
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport stdio · streamable-http · http counts 67 tools · 0 res
· 0 prompts
permission surface via code analysis
tools
-
machines_agent_status
-
machines_apps_apply
-
machines_apps_diff
-
machines_apps_list
-
machines_apps_plan
-
machines_apps_status
-
machines_backup_apply
-
machines_backup_preview
-
machines_browserplan_fleet
-
machines_cert_apply
-
machines_cert_preview
-
machines_command_matrix
-
machines_compatibility
-
machines_daemon_service_plan
-
machines_daemon_status
-
machines_details
-
machines_diff
-
machines_dispatch_fleet_smoke
-
machines_dns_add
-
machines_dns_list
-
machines_dns_render
-
machines_doctor
-
machines_events_emit
-
machines_events_list
-
machines_events_replay
-
machines_friendly_name_clear
-
machines_friendly_name_get
-
machines_friendly_name_set
-
machines_install_claude_apply
-
machines_install_claude_diff
-
machines_install_claude_preview
-
machines_install_claude_status
-
machines_install_tailscale_apply
-
machines_install_tailscale_preview
-
machines_loop_preflight
-
machines_machine_health
-
machines_manifest
-
machines_manifest_bootstrap
-
machines_manifest_get
-
machines_manifest_remove
-
machines_manifest_validate
-
machines_notes_context
-
machines_notes_trash_policies
-
machines_notifications_add
-
machines_notifications_dispatch
-
machines_notifications_list
-
machines_notifications_remove
-
machines_notifications_test
-
machines_ports
-
machines_route_resolve
-
machines_routing
-
machines_self_test
-
machines_serve_dashboard
-
machines_serve_info
-
machines_setup_apply
-
machines_setup_preview
-
machines_ssh_resolve
-
machines_status
-
machines_sync_apply
-
machines_sync_preview
-
machines_topology
-
machines_webhooks_add
-
machines_webhooks_list
-
machines_webhooks_remove
-
machines_webhooks_test
-
machines_workspace_resolve
-
storage_status
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed v0.1.4 · analyzer v28 · 3d ago
danger signals2
- suspicious endpoint 1.1.1.1 package/dist/cli/index.js :18673
internetUrl: "https://1.1.1.1", - credential in logs credential in log package/dist/cli/index.js :20898
console.log(`${result.machineId.padEnd(14)} user=${result.user ?? "(missing)"} passwordSecret=${result.passwordSecretKey} (${secret})`);
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 9
filesystem 7
- fs package/dist/agent/index.js :2100
import { existsSync, readFileSync, realpathSync } from "fs"; - fs package/dist/cli/index.js :2085
import { existsSync as existsSync2, mkdirSync } from "fs"; - fs package/dist/consumer.js :18
import { existsSync as existsSync4 } from "fs"; - fs package/dist/index.js :22
import { existsSync, mkdirSync } from "fs"; - fs package/dist/mcp/index.js :22
import { existsSync, readFileSync, realpathSync } from "fs"; - fs package/dist/server/index.js :20
import { existsSync, readFileSync, realpathSync } from "fs"; - fs package/dist/storage.js :22
import { existsSync, mkdirSync } from "fs";
shell / exec 5
- shell package/dist/agent/index.js :756
var childProcess = __require("child_process"); - shell package/dist/cli/index.js :757
var childProcess = __require("child_process"); - shell package/dist/consumer.js :20
import { spawnSync } from "child_process"; - shell package/dist/index.js :1192
import { spawnSync } from "child_process"; - shell package/dist/mcp/index.js :1177
var _emojiRegex = `^(\\p{Extended_Pictographic}|\\p{Emoji_Component})+$`;
network 6
- net package/dist/agent/index.js :6818
const fetchImpl = options.fetchImpl ?? ((input, init) => fetch(input, init)); - net package/dist/cli/index.js :2530
const fetchImpl = options.fetchImpl ?? ((input, init) => fetch(input, init)); - net package/dist/consumer.js :485
const fetchImpl = options.fetchImpl ?? ((input, init) => fetch(input, init)); - net package/dist/index.js :480
const fetchImpl = options.fetchImpl ?? ((input, init) => fetch(input, init)); - net package/dist/mcp/index.js :41
import { createServer as createServer2 } from "http"; - net package/dist/storage.js :480
const fetchImpl = options.fetchImpl ?? ((input, init) => fetch(input, init));
secrets 1
- secrets package/dist/server/index.js :1050
const secret = process.env["HASNA_MACHINES_API_SIGNING_KEY"] || process.env["API_KEY_SIGNING_SECRET"] || process.env["HASNA_API_SIGNING_KEY"];
database 2
- db package/dist/cli/index.js :3788
import pg from "pg"; - db package/dist/server/index.js :254
import pg from "pg";
tool registrations 67
- machines_status package/dist/mcp/index.js :11745
- machines_doctor package/dist/mcp/index.js :11750
- machines_self_test package/dist/mcp/index.js :11751
- machines_apps_list package/dist/mcp/index.js :11754
- machines_apps_status package/dist/mcp/index.js :11755
- machines_apps_diff package/dist/mcp/index.js :11756
- machines_apps_plan package/dist/mcp/index.js :11757
- machines_apps_apply package/dist/mcp/index.js :11758
- machines_manifest package/dist/mcp/index.js :11768
- machines_manifest_validate package/dist/mcp/index.js :11771
- machines_manifest_bootstrap package/dist/mcp/index.js :11774
- machines_manifest_get package/dist/mcp/index.js :11778
- machines_friendly_name_get package/dist/mcp/index.js :11779
- machines_friendly_name_set package/dist/mcp/index.js :11780
- machines_friendly_name_clear package/dist/mcp/index.js :11793
- machines_details package/dist/mcp/index.js :11805
- machines_browserplan_fleet package/dist/mcp/index.js :11816
- machines_notes_context package/dist/mcp/index.js :11830
- machines_notes_trash_policies package/dist/mcp/index.js :11874
- machines_manifest_remove package/dist/mcp/index.js :11890
- machines_agent_status package/dist/mcp/index.js :11894
- machines_daemon_status package/dist/mcp/index.js :11902
- machines_daemon_service_plan package/dist/mcp/index.js :11916
- machines_setup_preview package/dist/mcp/index.js :11942
- machines_setup_apply package/dist/mcp/index.js :11943
- machines_sync_preview package/dist/mcp/index.js :11953
- machines_sync_apply package/dist/mcp/index.js :11954
- machines_topology package/dist/mcp/index.js :11964
- machines_machine_health package/dist/mcp/index.js :12016
- machines_routing package/dist/mcp/index.js :12055
- machines_command_matrix package/dist/mcp/index.js :12070
- machines_loop_preflight package/dist/mcp/index.js :12089
- machines_dispatch_fleet_smoke package/dist/mcp/index.js :12134
- machines_compatibility package/dist/mcp/index.js :12172
- machines_diff package/dist/mcp/index.js :12196
- machines_install_claude_status package/dist/mcp/index.js :12202
- machines_install_claude_diff package/dist/mcp/index.js :12206
- machines_install_claude_preview package/dist/mcp/index.js :12210
- machines_install_claude_apply package/dist/mcp/index.js :12214
- machines_install_tailscale_preview package/dist/mcp/index.js :12231
- machines_install_tailscale_apply package/dist/mcp/index.js :12232
- machines_route_resolve package/dist/mcp/index.js :12242
- machines_workspace_resolve package/dist/mcp/index.js :12252
- machines_ssh_resolve package/dist/mcp/index.js :12288
- machines_ports package/dist/mcp/index.js :12305
- machines_backup_preview package/dist/mcp/index.js :12308
- machines_backup_apply package/dist/mcp/index.js :12309
- machines_cert_preview package/dist/mcp/index.js :12313
- machines_cert_apply package/dist/mcp/index.js :12314
- machines_dns_add package/dist/mcp/index.js :12318
- machines_dns_list package/dist/mcp/index.js :12323
- machines_dns_render package/dist/mcp/index.js :12324
- machines_notifications_add package/dist/mcp/index.js :12325
- machines_notifications_list package/dist/mcp/index.js :12342
- machines_notifications_test package/dist/mcp/index.js :12345
- machines_notifications_dispatch package/dist/mcp/index.js :12352
- machines_notifications_remove package/dist/mcp/index.js :12356
- machines_webhooks_add package/dist/mcp/index.js :12360
- machines_webhooks_list package/dist/mcp/index.js :12383
- machines_webhooks_test package/dist/mcp/index.js :12386
- machines_webhooks_remove package/dist/mcp/index.js :12392
- machines_events_emit package/dist/mcp/index.js :12396
- machines_events_list package/dist/mcp/index.js :12424
- machines_events_replay package/dist/mcp/index.js :12441
- machines_serve_info package/dist/mcp/index.js :12448
- machines_serve_dashboard package/dist/mcp/index.js :12449
- storage_status package/dist/mcp/index.js :12452
install hooks 2
- prepublishOnly package/package.json :57
bun run verify:release - postinstall package/package.json :58
mkdir -p $HOME/.hasna/machines 2>/dev/null || true
declared dependencies 12
- @modelcontextprotocol/sdk@^1.26.0
- @hasna/contracts@^0.4.2
- @hasna/events@^0.1.7
- chalk@^5.6.2
- commander@^13.1.0
- pg@^8.16.3
- zod@^3.24.2
- @hasna/mcp-harness@file:../open-mcp
- @types/bun@latest
- @types/node@^20.14.0
- @types/pg@^8.15.6
- typescript@^5.7.3
clipboard 1
- clipboard shell call package/dist/cli/index.js :18338
const result = Bun.spawnSync(["pbpaste"], { stdout: "pipe", stderr: "pipe" });
transport_posture 1
- binds all interfaces (0.0.0.0) package/dist/cli/index.js :18426
server.listen(port, "0.0.0.0", () => {});