MCP Observatory
3m ago Tracked 59,459 Last 3m ago 24h 2,459
npm JavaScript analyzed 0.2.39

@hasna/machines

v0.2.39
npm

Machine fleet management CLI + MCP for developers

maintainer
andreihasna2
licence
Apache-2.0
first seen
2026-06-22
last seen
2026-08-28
releases · 30d
8
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 70 tools
transport stdio · streamable-http · http counts 70 tools · 0 res · 0 prompts permission surface via code analysis

tools

  • machines_agent_status
  • machines_apps_apply
  • machines_apps_diff
  • machines_apps_list
  • machines_apps_plan
  • machines_apps_status
  • machines_backup_apply
  • machines_backup_preview
  • machines_browserplan_fleet
  • machines_cert_apply
  • machines_cert_preview
  • machines_command_matrix
  • machines_compatibility
  • machines_daemon_service_plan
  • machines_daemon_status
  • machines_details
  • machines_diff
  • machines_dispatch_fleet_smoke
  • machines_dns_add
  • machines_dns_list
  • machines_dns_render
  • machines_doctor
  • machines_events_emit
  • machines_events_list
  • machines_events_replay
  • machines_friendly_name_clear
  • machines_friendly_name_get
  • machines_friendly_name_set
  • machines_install_claude_apply
  • machines_install_claude_diff
  • machines_install_claude_preview
  • machines_install_claude_status
  • machines_install_tailscale_apply
  • machines_install_tailscale_preview
  • machines_loop_preflight
  • machines_machine_health
  • machines_manifest
  • machines_manifest_bootstrap
  • machines_manifest_get
  • machines_manifest_remove
  • machines_manifest_validate
  • machines_notes_context
  • machines_notes_trash_policies
  • machines_notifications_add
  • machines_notifications_dispatch
  • machines_notifications_list
  • machines_notifications_remove
  • machines_notifications_test
  • machines_ports
  • machines_route_resolve
  • machines_routing
  • machines_self_test
  • machines_serve_dashboard
  • machines_serve_info
  • machines_setup_apply
  • machines_setup_preview
  • machines_ssh_resolve
  • machines_status
  • machines_sync_apply
  • machines_sync_preview
  • machines_topology
  • machines_webhooks_add
  • machines_webhooks_list
  • machines_webhooks_remove
  • machines_webhooks_test
  • machines_workspace_resolve
  • storage_pull
  • storage_push
  • storage_status
  • storage_sync
skills & danger signals npm-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v0.2.39 · analyzer v33 · 3w ago

danger signals3

  • suspicious endpoint 169.254.169.254 (cloud metadata) package/dist/cli/index.js :12118 runcmd.push("( TOKEN=$(curl -sX PUT http://169.254.169.254/latest/api/token -H 'X-aws-ec2-metadata-token-ttl-seconds: 300') && " + 'REGION=$(curl -sH "X-aws-ec2-metadata-token: $TOKEN" http://169.254.
  • suspicious endpoint 1.1.1.1 package/dist/cli/index.js :22999 internetUrl: "https://1.1.1.1",
  • credential in logs credential in log package/dist/cli/index.js :25547 console.log(`${result.machineId.padEnd(14)} user=${result.user ?? "(missing)"} passwordSecret=${result.passwordSecretKey} (${secret})`);
code evidence v0.2.39 · npm-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 118

filesystem 11

  • fs package/dist/agent/index.js :5524 var st = fs.createReadStream(file);
  • fs package/dist/cli/index.js :2153 import { existsSync as existsSync2, mkdirSync } from "fs";
  • fs package/dist/consumer.js :18 import { existsSync as existsSync4 } from "fs";
  • fs package/dist/exact-bun-bootstrap.js :34 } from "fs";
  • fs package/dist/index.js :22 import { existsSync, mkdirSync } from "fs";
  • fs package/dist/mcp/index.js :22 import { existsSync, readFileSync, realpathSync } from "fs";
  • fs package/dist/server/index.js :20 import { existsSync, readFileSync, realpathSync } from "fs";
  • fs package/dist/storage.js :22 import { existsSync, mkdirSync } from "fs";
  • fs (weak) package/dist/test-profile.js :19 import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync, renameSync, rmSync, writeFileSync } from "fs";
  • fs package/postinstall.js :8 import { existsSync, mkdirSync } from "node:fs";
  • fs (weak) package/scripts/consumer-conformance.mjs :13 } from "node:fs";

shell / exec 8

  • shell package/dist/agent/index.js :7753 import { spawnSync } from "child_process";
  • shell package/dist/cli/index.js :3302 import { execFileSync as execFileSync4 } from "child_process";
  • shell package/dist/consumer.js :20 import { spawnSync } from "child_process";
  • shell package/dist/exact-bun-bootstrap.js :18 import { spawnSync } from "child_process";
  • shell package/dist/index.js :1517 import { spawnSync } from "child_process";
  • shell package/dist/mcp/index.js :4245 const result = Bun.spawnSync(["bash", "-lc", step.command], {
  • shell (weak) package/dist/test-profile.js :18 import { execFileSync } from "child_process";
  • shell (weak) package/scripts/consumer-conformance.mjs :3 import { spawnSync } from "node:child_process";

network 3

  • net package/dist/cli/index.js :14058 const response = await fetch(url, { signal: AbortSignal.timeout(5000) });
  • net package/dist/index.js :13394 const response = await fetch(url, { signal: AbortSignal.timeout(5000) });
  • net package/dist/mcp/index.js :41 import { createServer } from "http";

secrets 1

  • secrets package/dist/server/index.js :975 const secret = process.env["HASNA_MACHINES_API_SIGNING_KEY"] || process.env["API_KEY_SIGNING_SECRET"] || process.env["HASNA_API_SIGNING_KEY"];

database 5

  • db package/dist/cli/index.js :2882 import pg2 from "pg";
  • db package/dist/index.js :522 import pg from "pg";
  • db package/dist/mcp/index.js :9191 import pg from "pg";
  • db package/dist/server/index.js :365 import pg from "pg";
  • db package/dist/storage.js :522 import pg from "pg";

tool registrations 70

  • machines_status package/dist/mcp/index.js :12959
  • machines_doctor package/dist/mcp/index.js :12964
  • machines_self_test package/dist/mcp/index.js :12965
  • machines_apps_list package/dist/mcp/index.js :12968
  • machines_apps_status package/dist/mcp/index.js :12969
  • machines_apps_diff package/dist/mcp/index.js :12970
  • machines_apps_plan package/dist/mcp/index.js :12971
  • machines_apps_apply package/dist/mcp/index.js :12972
  • machines_manifest package/dist/mcp/index.js :12987
  • machines_manifest_validate package/dist/mcp/index.js :12990
  • machines_manifest_bootstrap package/dist/mcp/index.js :12993
  • machines_manifest_get package/dist/mcp/index.js :12997
show 28 more
  • machines_friendly_name_get package/dist/mcp/index.js :12998
  • machines_friendly_name_set package/dist/mcp/index.js :12999
  • machines_friendly_name_clear package/dist/mcp/index.js :13012
  • machines_details package/dist/mcp/index.js :13024
  • machines_browserplan_fleet package/dist/mcp/index.js :13035
  • machines_notes_context package/dist/mcp/index.js :13049
  • machines_notes_trash_policies package/dist/mcp/index.js :13093
  • machines_manifest_remove package/dist/mcp/index.js :13109
  • machines_agent_status package/dist/mcp/index.js :13113
  • machines_daemon_status package/dist/mcp/index.js :13121
  • machines_daemon_service_plan package/dist/mcp/index.js :13135
  • machines_setup_preview package/dist/mcp/index.js :13163
  • machines_setup_apply package/dist/mcp/index.js :13164
  • machines_sync_preview package/dist/mcp/index.js :13174
  • machines_sync_apply package/dist/mcp/index.js :13175
  • machines_topology package/dist/mcp/index.js :13185
  • machines_machine_health package/dist/mcp/index.js :13237
  • machines_routing package/dist/mcp/index.js :13276
  • machines_command_matrix package/dist/mcp/index.js :13291
  • machines_loop_preflight package/dist/mcp/index.js :13310
  • machines_dispatch_fleet_smoke package/dist/mcp/index.js :13355
  • machines_compatibility package/dist/mcp/index.js :13393
  • machines_diff package/dist/mcp/index.js :13417
  • machines_install_claude_status package/dist/mcp/index.js :13423
  • machines_install_claude_diff package/dist/mcp/index.js :13427
  • machines_install_claude_preview package/dist/mcp/index.js :13431
  • machines_install_claude_apply package/dist/mcp/index.js :13435
  • machines_install_tailscale_preview package/dist/mcp/index.js :13452

30 more not shown — this panel samples each group; the count above is the real total.

install hooks 4

  • prepack package/package.json :67 bun run verify:pack
  • prepublishOnly package/package.json :68 bun run verify:release
  • postinstall package/package.json :69 node postinstall.js
  • prepare package/package.json :70 bun run build:js

declared dependencies 14

  • @modelcontextprotocol/sdk@^1.26.0
  • @hasna/contracts@0.14.1
  • @hasna/events@^0.1.7
  • @hasna/mcp-harness@^0.1.0
  • @hasna/paths@0.1.0
  • chalk@^5.6.2
  • commander@^13.1.0
  • pg@^8.16.3
  • zod@^3.24.2
  • @types/bun@latest
  • @types/node@^20.14.0
  • @types/pg@^8.15.6
show 2 more
  • bun-types@1.3.14
  • typescript@^5.7.3

clipboard 1

  • clipboard shell call package/dist/cli/index.js :22664 const result = Bun.spawnSync(["pbpaste"], { stdout: "pipe", stderr: "pipe" });

transport_posture 1

  • binds all interfaces (0.0.0.0) package/dist/cli/index.js :22752 server.listen(port, "0.0.0.0", () => {});