MCP Observatory
2m ago Tracked 59,480 Last 2m ago 24h 2,586
npm JavaScript retry queued deep scan unknown

@juspay/neurolink

v12.14.16
npm

retry queued — source fetch failed — will retry

TypeScript AI SDK with 24+ LLM providers behind one consistent API. MCP-native (connect any MCP server), voice TTS/STT/realtime, RAG, agents, memory, context compaction. OpenAI · Anthropic · Gemini · Bedrock · Azure · Ollama · DeepSeek · NVIDIA NIM and mo

maintainer
balaganesh_juspay
licence
MIT
first seen
2026-05-22
last seen
2026-09-17
releases · 30d
343
short id

Drift inferred · capture-to-capture

  1. HIGH code analysis flagged committed secret ×2, dynamic code execution ×4 in @juspay/neurolink
  2. HIGH code analysis flagged committed secret, dynamic code execution ×4 in juspay/neurolink
  3. HIGH code analysis flagged committed secret ×2, dynamic code execution ×4 in @juspay/neurolink
  4. HIGH code analysis flagged committed secret, dynamic code execution ×4 in juspay/neurolink
  5. HIGH code analysis flagged committed secret ×2, dynamic code execution ×4 in @juspay/neurolink
  6. HIGH code analysis flagged committed secret, dynamic code execution ×4 in juspay/neurolink
  7. HIGH code analysis flagged committed secret ×2, dynamic code execution ×4 in @juspay/neurolink
  8. HIGH code analysis flagged committed secret, dynamic code execution ×4 in juspay/neurolink
  9. HIGH code analysis flagged committed secret ×2, dynamic code execution ×4 in @juspay/neurolink
  10. HIGH code analysis flagged committed secret, dynamic code execution ×4 in juspay/neurolink
  11. HIGH code analysis flagged committed secret ×2, dynamic code execution ×4 in @juspay/neurolink
  12. HIGH code analysis flagged committed secret, dynamic code execution ×4 in juspay/neurolink
  13. HIGH code analysis flagged committed secret ×2, dynamic code execution ×4 in @juspay/neurolink
  14. HIGH code analysis flagged committed secret, dynamic code execution ×4 in juspay/neurolink
  15. HIGH code analysis flagged committed secret ×2, dynamic code execution ×4 in @juspay/neurolink
  16. HIGH code analysis flagged committed secret, dynamic code execution ×4 in juspay/neurolink
  17. HIGH code analysis flagged committed secret ×2, dynamic code execution ×4 in @juspay/neurolink
  18. HIGH code analysis flagged committed secret, dynamic code execution ×4 in juspay/neurolink
  19. HIGH code analysis flagged committed secret ×2 in @juspay/neurolink
  20. HIGH code analysis flagged committed secret ×2, dynamic code execution ×8 in @juspay/neurolink
capabilities 2 tools
transport stdio · streamable-http · http counts 2 tools · 0 res · 0 prompts permission surface via code analysis

tools

  • hello
  • retrieve_context
skills & danger signals npm-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v12.14.16 · analyzer v33 · 18m ago

danger signals9

code evidence v12.14.16 · npm-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

last analysis: fetch-failed · showing evidence from the last successful analysis (4h ago)

filesystem 112

  • fs package/dist/action/actionExecutor.js :8 import * as fs from "fs";
  • fs package/dist/adapters/video/ffmpegAdapter.js :13 import { readdirSync, rmdirSync, unlinkSync } from "node:fs";
  • fs package/dist/adapters/video/vertexVideoHandler.js :12 import { readFile } from "node:fs/promises";
  • fs package/dist/adapters/video/videoAnalyzer.js :11 import { readFile } from "node:fs/promises";
  • fs package/dist/agent/backgroundCommands.js :32 import { createWriteStream } from "node:fs";
  • fs package/dist/agent/directTools.js :2 import * as fs from "fs";
  • fs package/dist/artifacts/artifactStore.js :22 import { mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
  • fs package/dist/auth/codexOAuth.js :12 import { readFile } from "node:fs/promises";
  • fs package/dist/auth/tokenStore.js :15 import { promises as fs } from "fs";
  • fs package/dist/autoresearch/config.js :4 import { existsSync, statSync } from "node:fs";
  • fs package/dist/autoresearch/promptCompiler.js :7 import { readFileSync, statSync } from "node:fs";
  • fs package/dist/autoresearch/resultRecorder.js :4 import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync, } from "node:fs";
show 28 more
  • fs package/dist/autoresearch/runner.js :5 import { writeFileSync } from "node:fs";
  • fs package/dist/autoresearch/stateStore.js :4 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync, } from "node:fs";
  • fs package/dist/autoresearch/tools.js :11 import { existsSync, readFileSync, writeFileSync } from "node:fs";
  • fs package/dist/cli/commands/agent.js :16 import fs from "fs";
  • fs package/dist/cli/commands/auth.js :20 import fs from "fs";
  • fs package/dist/cli/commands/autoresearch.js :14 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync, } from "node:fs";
  • fs package/dist/cli/commands/config.js :9 import fs from "fs";
  • fs package/dist/cli/commands/evaluate.js :10 import fs from "node:fs";
  • fs package/dist/cli/commands/mcp.js :18 import fs from "fs";
  • fs package/dist/cli/commands/proxyReplay.js :1 import { readFile, stat } from "node:fs/promises";
  • fs package/dist/cli/commands/proxyRestart.js :1 import { readFile, lstat } from "node:fs/promises";
  • fs package/dist/cli/commands/rag.js :10 import { existsSync } from "fs";
  • fs package/dist/cli/commands/serve.js :12 import fs from "fs";
  • fs package/dist/cli/commands/server.js :7 import fs from "fs";
  • fs package/dist/cli/commands/setup-anthropic.js :11 import fs from "fs";
  • fs package/dist/cli/commands/setup-bedrock.js :8 import * as fs from "fs";
  • fs package/dist/cli/commands/setup-gcp.js :13 import fs from "fs";
  • fs package/dist/cli/commands/setup-mistral.js :4 import fs from "fs";
  • fs package/dist/cli/commands/setup-openai.js :11 import fs from "fs";
  • fs package/dist/cli/commands/task.js :19 import { mkdirSync, openSync } from "node:fs";
  • fs package/dist/cli/factories/commandFactory.js :1 import fs from "node:fs";
  • fs package/dist/cli/proxy-clients/grok.js :22 import { readFileSync } from "fs";
  • fs package/dist/cli/utils/audioFileUtils.js :9 import fs from "fs";
  • fs package/dist/cli/utils/audioPlayer.js :11 import fs from "node:fs";
  • fs package/dist/cli/utils/classifierRouterFlags.js :7 import fs from "node:fs";
  • fs package/dist/cli/utils/envManager.js :6 import fs from "fs";
  • fs package/dist/cli/utils/inputValidation.js :12 import fs from "node:fs";
  • fs package/dist/cli/utils/serverUtils.js :5 import fs from "fs";

72 more not shown — this panel samples each group; the count above is the real total.

shell / exec 19

  • shell package/dist/adapters/video/ffmpegAdapter.js :161 * Run an FFmpeg command via `child_process.execFile`.
  • shell package/dist/agent/backgroundCommands.js :30 import { spawn } from "node:child_process";
  • shell package/dist/agent/directTools.js :4 import { execFile } from "child_process";
  • shell package/dist/autoresearch/repoPolicy.js :7 import { execFileSync } from "node:child_process";
  • shell package/dist/autoresearch/runner.js :4 import { spawn } from "node:child_process";
  • shell package/dist/autoresearch/tools.js :10 import { execFileSync } from "node:child_process";
  • shell package/dist/autoresearch/worker.js :10 import { execFileSync } from "node:child_process";
  • shell package/dist/cli/commands/auth.js :22 import { execFile } from "child_process";
  • shell package/dist/cli/commands/proxy.js :3 import { spawn } from "node:child_process";
  • shell package/dist/cli/commands/proxyExpose.js :20 import { spawn } from "node:child_process";
  • shell package/dist/cli/commands/task.js :18 import { spawn } from "node:child_process";
  • shell package/dist/cli/factories/ollamaCommandFactory.js :1 import { spawnSync, } from "child_process";
show 7 more
  • shell package/dist/cli/utils/audioPlayer.js :9 import { execFile } from "node:child_process";
  • shell package/dist/cli/utils/ollamaUtils.js :1 import { spawnSync, spawn, } from "child_process";
  • shell package/dist/mcp/mcpClientFactory.js :282 * is deliberately no `spawn()` here. An earlier "startup probe" launched
  • shell package/dist/processors/archive/ArchiveProcessor.js :1186 const { execFile } = await import("node:child_process");
  • shell package/dist/proxy/globalInstaller.js :1 import { execFileSync as nodeExecFileSync } from "node:child_process";
  • shell package/dist/proxy/rollingWorkerProcess.js :1 import { spawn } from "node:child_process";
  • shell package/dist/proxy/updateChecker.js :9 import { execFile as execFileCb } from "node:child_process";

network 81

  • net package/dist/adapters/replicate/predictionLifecycle.js :55 const response = await fetch(endpoint, {
  • net package/dist/adapters/video/directorPipeline.js :122 const response = await fetch(url, { signal: controller.signal });
  • net package/dist/adapters/video/klingVideoHandler.js :257 return await fetch(url, { ...init, signal: controller.signal });
  • net package/dist/adapters/video/runwayVideoHandler.js :249 return await fetch(url, { ...init, signal: controller.signal });
  • net package/dist/adapters/video/vertexVideoHandler.js :359 response = await fetch(endpoint, {
  • net package/dist/auth/anthropicOAuth.js :18 import { createServer } from "http";
  • net package/dist/auth/codexOAuth.js :151 const response = await fetch(CODEX_TOKEN_URL, {
  • net package/dist/auth/providers/CognitoProvider.js :212 const response = await fetch(this.jwksUri, {
  • net package/dist/auth/providers/KeycloakProvider.js :212 const response = await fetch(this.jwksUri, {
  • net package/dist/avatar/providers/DIDAvatar.js :452 return await fetch(url, { ...init, signal: controller.signal });
  • net package/dist/avatar/providers/HeyGenAvatar.js :295 return await fetch(url, { ...init, signal: controller.signal });
  • net package/dist/avatar/providers/ReplicateAvatar.js :151 r = await fetch(input, { signal: controller.signal });
show 28 more
  • net package/dist/cli/commands/auth.js :447 const response = await fetch(`http://${host}:${proxyState.port}/limits`, {
  • net package/dist/cli/commands/proxy.js :428 const response = await fetch(`http://${host}:${port}/health`, {
  • net package/dist/cli/commands/proxyExpose.js :39 const response = await fetch(`${scheme}://${host}:${port}/v1/messages`, {
  • net package/dist/cli/commands/proxyPeer.js :123 const handshake = await fetch(`${peer.url}/peer/handshake`, {
  • net package/dist/client/auth.js :111 const response = await fetch(this.config.tokenUrl, {
  • net package/dist/client/httpClient.js :238 const response = await this.config.fetch(url, {
  • net package/dist/client/reactHooks.js :895 const res = await fetch(api, {
  • net package/dist/client/reactHooks.tsx :1162 const res = await fetch(api, {
  • net package/dist/client/sseClient.js :131 const response = await fetch(url, {
  • net package/dist/client/streamingClient.js :87 const response = await fetch(this.url, {
  • net package/dist/constants/networkErrorCodes.js :9 * undici's native `fetch()` wraps the real transport failure in
  • net package/dist/core/baseProvider.js :581 * which is bypassed by providers that stream via raw HTTP fetch (Ollama
  • net package/dist/core/dynamicModels.js :87 const response = await fetch(source, {
  • net package/dist/features/ppt/slideGenerator.js :82 const response = await withTimeout(fetch(image), USER_IMAGE_IO_TIMEOUT_MS, ErrorFactory.toolTimeout("userImageFetch", USER_IMAGE_IO_TIMEOUT_MS));
  • net package/dist/mcp/auth/oauthClientProvider.js :154 const response = await withTimeout(fetch(this.config.tokenUrl, {
  • net package/dist/mcp/httpRetryHandler.js :117 * const response = await fetch(url);
  • net package/dist/mcp/mcpClientFactory.js :426 return await fetch(input, { ...init, signal: controller.signal });
  • net package/dist/music/providers/BeatovenMusic.js :129 response = await fetch(`${this.baseUrl}/api/v1/tracks/compose`, {
  • net package/dist/music/providers/ElevenLabsMusic.js :91 response = await fetch(`${this.baseUrl}/sound-generation`, {
  • net package/dist/music/providers/LyriaMusic.js :91 response = await fetch(`${this.baseUrl}/models/${this.model}:generateContent?key=${this.apiKey}`, {
  • net package/dist/music/providers/ReplicateMusic.js :175 r = await fetch(input, { signal: controller.signal });
  • net package/dist/neurolink.js :2305 const response = await fetch("http://localhost:11434/api/tags", {
  • net package/dist/observability/exporters/arizeExporter.js :34 const response = await fetch(`${this.endpoint}/log`, {
  • net package/dist/observability/exporters/braintrustExporter.js :27 const response = await fetch(`${this.endpoint}/v1/project`, {
  • net package/dist/observability/exporters/datadogExporter.js :38 const response = await fetch(validateUrl, {
  • net package/dist/observability/exporters/laminarExporter.js :29 const response = await fetch(`${this.baseUrl}/v1/health`, {
  • net package/dist/observability/exporters/langfuseExporter.js :103 const response = await fetch(`${this.baseUrl}/api/public/health`, {
  • net package/dist/observability/exporters/langsmithExporter.js :41 const response = await fetch(`${this.endpoint}/api/v1/info`, {

41 more not shown — this panel samples each group; the count above is the real total.

secrets 76

  • secrets package/dist/action/actionInputs.js :182 githubToken: core.getInput("github_token") || process.env.GITHUB_TOKEN,
  • secrets package/dist/adapters/replicate/auth.js :21 process.env.REPLICATE_API_TOKEN ??
  • secrets package/dist/adapters/tts/cartesiaHandler.js :19 const apiKey = process.env.CARTESIA_API_KEY;
  • secrets package/dist/adapters/tts/googleTTSHandler.js :33 credentialsPath ?? process.env.GOOGLE_APPLICATION_CREDENTIALS;
  • secrets package/dist/adapters/video/klingVideoHandler.js :43 const resolved = (apiKey ?? process.env.KLING_API_KEY ?? "").trim();
  • secrets package/dist/adapters/video/runwayVideoHandler.js :40 const resolved = (apiKey ?? process.env.RUNWAY_API_KEY ?? "").trim();
  • secrets package/dist/adapters/video/vertexVideoHandler.js :79 return !!(process.env.GOOGLE_APPLICATION_CREDENTIALS ||
  • secrets package/dist/adapters/video/videoAnalyzer.js :151 const apiKey = options.apiKey || process.env.GOOGLE_AI_API_KEY;
  • secrets package/dist/agent/directTools.js :657 const hasCredentials = process.env.GOOGLE_APPLICATION_CREDENTIALS;
  • secrets package/dist/artifacts/artifactStoreFactory.js :36 password: process.env.REDIS_PASSWORD,
  • secrets package/dist/auth/anthropicOAuth.js :296 config.clientSecret || process.env.ANTHROPIC_OAUTH_CLIENT_SECRET;
  • secrets package/dist/auth/providers/auth0.js :160 const managementToken = process.env.AUTH0_MANAGEMENT_TOKEN;
show 28 more
  • secrets package/dist/avatar/providers/DIDAvatar.js :36 process.env.DID_API_KEY ??
  • secrets package/dist/avatar/providers/HeyGenAvatar.js :33 const resolved = (apiKey ?? process.env.HEYGEN_API_KEY ?? "").trim();
  • secrets package/dist/cli/commands/auth.js :1838 const envKey = process.env.ANTHROPIC_API_KEY?.trim();
  • secrets package/dist/cli/commands/authProviders.js :271 const secretKey = argv.secretKey || process.env.CLERK_SECRET_KEY;
  • secrets package/dist/cli/commands/proxy.js :75 const PROXY_UPDATE_CONTROL_TOKEN = process.env.NEUROLINK_PROXY_UPDATE_CONTROL_TOKEN?.trim() ||
  • secrets package/dist/cli/commands/setup-anthropic.js :28 const hasApiKey = !!process.env.ANTHROPIC_API_KEY;
  • secrets package/dist/cli/commands/setup-azure.js :28 const hasApiKey = !!process.env.AZURE_OPENAI_API_KEY;
  • secrets package/dist/cli/commands/setup-bedrock.js :148 hasSecretKey: !!process.env.AWS_SECRET_ACCESS_KEY,
  • secrets package/dist/cli/commands/setup-gcp.js :115 const hasCredentials = !!process.env.GOOGLE_APPLICATION_CREDENTIALS;
  • secrets package/dist/cli/commands/setup-google-ai.js :35 const hasApiKey = !!(process.env.GOOGLE_AI_API_KEY || process.env.GOOGLE_GENERATIVE_AI_API_KEY);
  • secrets package/dist/cli/commands/setup-huggingface.js :17 const apiKey = process.env.HUGGINGFACE_API_KEY || process.env.HF_TOKEN;
  • secrets package/dist/cli/commands/setup-mistral.js :61 const apiKey = process.env.MISTRAL_API_KEY;
  • secrets package/dist/cli/commands/setup-openai.js :28 const hasApiKey = !!process.env.OPENAI_API_KEY;
  • secrets package/dist/cli/factories/commandFactory.js :789 const envValue = process.env.NEUROLINK_PDF_PASSWORD;
  • secrets package/dist/client/aiSdkAdapter.js :331 * apiKey: process.env.NEUROLINK_API_KEY,
  • secrets package/dist/client/auth.js :313 * apiKey: process.env.API_KEY,
  • secrets package/dist/client/httpClient.js :843 * apiKey: process.env.NEUROLINK_API_KEY,
  • secrets package/dist/client/index.js :17 * apiKey: process.env.NEUROLINK_API_KEY,
  • secrets package/dist/client/reactHooks.js :41 * apiKey: process.env.NEUROLINK_API_KEY,
  • secrets package/dist/client/reactHooks.tsx :82 * apiKey: process.env.NEUROLINK_API_KEY,
  • secrets package/dist/core/conversationMemoryFactory.js :105 REDIS_PASSWORD: process.env.REDIS_PASSWORD ? "******" : "(not set)",
  • secrets package/dist/core/conversationMemoryInitializer.js :110 hasPassword: !!process.env.REDIS_PASSWORD,
  • secrets package/dist/music/providers/BeatovenMusic.js :46 const resolved = (apiKey ?? process.env.BEATOVEN_API_KEY ?? "").trim();
  • secrets package/dist/music/providers/ElevenLabsMusic.js :39 const resolved = (apiKey ?? process.env.ELEVENLABS_API_KEY ?? "").trim();
  • secrets package/dist/music/providers/LyriaMusic.js :44 process.env.GOOGLE_AI_LYRIA_API_KEY ??
  • secrets package/dist/processors/media/AudioProcessor.js :314 const apiKey = process.env.OPENAI_API_KEY;
  • secrets package/dist/providers/amazonBedrock/client.js :59 logger.debug(`[AmazonBedrockProvider] Environment check: AWS_REGION=${process.env.AWS_REGION || "undefined"}, AWS_ACCESS_KEY_ID=${process.env.AWS_ACCESS_KEY_ID ? "SET" : "undefined"}, AWS_SECRET_ACCES
  • secrets package/dist/providers/anthropic/client.js :84 const tokenString = process.env.ANTHROPIC_OAUTH_TOKEN || process.env.CLAUDE_OAUTH_TOKEN;

36 more not shown — this panel samples each group; the count above is the real total.

database 2

  • db package/dist/tasks/store/redisTaskStore.js :10 import { createClient } from "redis";
  • db package/dist/utils/redis.js :6 import { createClient } from "redis";

tool registrations 2

  • hello package/dist/cli/commands/mcp.js :1571
  • retrieve_context package/dist/neurolink.js :1406

install hooks 2

  • prepare package/package.json :41 git rev-parse --git-dir > /dev/null 2>&1 && husky install || echo 'Skipping husky in non-git environment'
  • prepack package/package.json :42 svelte-kit sync && svelte-package && pnpm run build:react-hooks && pnpm run build:cli && pnpm run build:browser && publint

declared dependencies 143

  • @modelcontextprotocol/sdk@^1.27.1
  • @anthropic-ai/sdk@^0.102.0
  • @anthropic-ai/vertex-sdk@^0.16.0
  • @aws-sdk/types@^3.862.0
  • @cfworker/json-schema@^4.1.1
  • @google/genai@^1.43.0
  • @opentelemetry/api-logs@^0.214.0
  • @opentelemetry/context-async-hooks@^2.6.1
  • @opentelemetry/core@^2.8.0
  • @opentelemetry/exporter-logs-otlp-http@^0.214.0
  • @opentelemetry/exporter-metrics-otlp-http@^0.214.0
  • @opentelemetry/exporter-trace-otlp-http@^0.214.0
show 28 more
  • @opentelemetry/resources@^2.6.0
  • @opentelemetry/sdk-logs@^0.214.0
  • @opentelemetry/sdk-metrics@^2.6.1
  • @opentelemetry/sdk-trace-base@^2.6.0
  • @opentelemetry/semantic-conventions@^1.40.0
  • @types/json-schema@^7.0.15
  • adm-zip@^0.6.0
  • chalk@^5.6.2
  • chardet@2.1.1
  • croner@^9.1.0
  • csv-parser@^3.2.0
  • dotenv@^17.3.1
  • eventsource-parser@^3.0.8
  • fast-xml-parser@^5.7.0
  • google-auth-library@^10.6.1
  • hono@^4.13.5
  • iconv-lite@0.7.2
  • inquirer@^13.3.0
  • jose@^6.1.3
  • js-yaml@^4.3.2
  • json-schema-to-zod@^2.7.0
  • jsonrepair@^3.14.0
  • minisearch@^7.2.0
  • nanoid@^5.1.16
  • ora@^9.3.0
  • p-limit@^7.3.0
  • redis@^5.11.0
  • tar-stream@^3.1.8

103 more not shown — this panel samples each group; the count above is the real total.

obfuscation 1

  • dynamic require()/import() package/dist/cli/commands/serve.js :504 const { createServer: createNewServer, registerAllRoutes: registerNewRoutes, } = await import(`../../server/index.js?t=${timestamp}`);