TypeScript AI SDK with 24+ LLM providers behind one consistent API. MCP-native (connect any MCP server), voice TTS/STT/realtime, RAG, agents, memory, context compaction. OpenAI · Anthropic · Gemini · Bedrock · Azure · Ollama · DeepSeek · NVIDIA NIM and mo
- capability exposure inferred + 35
- recent drift inferred + 20
- inherited (deps) attested + 15
- tool safety inferred + 12
- trust mitigators mixed − 14
attested inferred mixed
The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.
graded 2m ago · see ecosystem CVEs →
- D · 70 → D · 68
- D · 62 → D · 70
- D · 72 → D · 62
No known CVEs for this server.
inherited (deps) · grade factor +15
- high dangerous code
committed secret: Anthropic key · dynamic exec: new Function() · obfuscated payload: dynamic require()/import()
analyzed v10.8.5 · analyzer v28 · 2h ago
danger signals17
- dynamic code execution new Function() package/dist/agent/directTools.js :224
const result = new Function(`'use strict'; return (${expression})`)(); - dynamic code execution new Function() package/dist/lib/agent/directTools.js :224
const result = new Function(`'use strict'; return (${expression})`)(); - dynamic code execution new Function() package/dist/lib/utils/schemaConversion.js :623
const createZodSchema = new Function("z", `return ${schemaExpression}`); - dynamic code execution new Function() package/dist/utils/schemaConversion.js :623
const createZodSchema = new Function("z", `return ${schemaExpression}`); - suspicious endpoint app.posthog.com (telemetry) package/dist/cli/commands/telemetry.js :683
POSTHOG_HOST: "https://app.posthog.com (optional)", - suspicious endpoint api.datadoghq.com (telemetry) package/dist/lib/observability/exporters/datadogExporter.js :36
? "https://api.datadoghq.com/api/v1/validate" - suspicious endpoint app.posthog.com (telemetry) package/dist/lib/observability/exporters/posthogExporter.js :20
this.host = config.host ?? "https://app.posthog.com"; - suspicious endpoint api.datadoghq.com (telemetry) package/dist/observability/exporters/datadogExporter.js :36
? "https://api.datadoghq.com/api/v1/validate" - suspicious endpoint app.posthog.com (telemetry) package/dist/observability/exporters/posthogExporter.js :20
this.host = config.host ?? "https://app.posthog.com"; - over-broad OAuth scope https://www.googleapis.com/auth/cloud-platform
expected for this server's purpose
package/dist/adapters/video/vertexVideoHandler.js :160
scopes: ["https://www.googleapis.com/auth/cloud-platform"], - over-broad OAuth scope https://www.googleapis.com/auth/cloud-platform
expected for this server's purpose
package/dist/lib/adapters/video/vertexVideoHandler.js :160
scopes: ["https://www.googleapis.com/auth/cloud-platform"], - over-broad OAuth scope https://www.googleapis.com/auth/cloud-platform
expected for this server's purpose
package/dist/lib/providers/googleVertex/client.js :6885
scopes: ["https://www.googleapis.com/auth/cloud-platform"], - over-broad OAuth scope https://www.googleapis.com/auth/cloud-platform
expected for this server's purpose
package/dist/lib/voice/providers/GoogleSTT.js :432
scopes: ["https://www.googleapis.com/auth/cloud-platform"], - over-broad OAuth scope https://www.googleapis.com/auth/cloud-platform
expected for this server's purpose
package/dist/providers/googleVertex/client.js :6885
scopes: ["https://www.googleapis.com/auth/cloud-platform"], - over-broad OAuth scope https://www.googleapis.com/auth/cloud-platform
expected for this server's purpose
package/dist/voice/providers/GoogleSTT.js :432
scopes: ["https://www.googleapis.com/auth/cloud-platform"], - committed secret Anthropic key package/dist/lib/utils/providerSetupMessages.js :23
sk-ant…(31 chars, redacted) - committed secret Anthropic key package/dist/utils/providerSetupMessages.js :23
sk-ant…(31 chars, redacted)
- recent drift +20 capability drift →
[](https://mcpobservatory.com/servers/npm:@juspay/neurolink/security) Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of balaganesh_juspay.