MCP Observatory
4m ago Tracked 47,878 Last 4m ago 24h 2,633
npm JavaScript analyzed 0.141.0

@noodleseed/one

v0.141.0
npm

Noodle CLI by Noodle Seed — author, run, and deploy declarative MCP servers. Embedding the assistant in your own web app is @noodleseed/assistant.

maintainer
asadatnoodle
license
Apache-2.0
first seen
2026-07-28
last seen
2026-08-26
releases · 30d
102
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 11 tools
transport stdio · http counts 11 tools · 0 res · 0 prompts permission surface via code analysis

tools

  • cancel_build_run
  • deploy_build
  • get_build_readiness
  • get_local_context
  • link_cloud_project
  • preview_product_feedback
  • run_build_gate
  • set_cloud_secret_from_env
  • set_cloud_variable
  • setup_project
  • submit_product_feedback
skills & danger signals npm-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v0.141.0 · analyzer v33 · 32m ago

danger signals1

code evidence v0.141.0 · npm-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 440

filesystem 53

  • fs package/dist/agent-command-context.js :1 import { existsSync } from 'node:fs';
  • fs package/dist/agent-product-skill-doctor.js :1 import { existsSync, readFileSync } from 'node:fs';
  • fs package/dist/agent-product-skill-reconcile.js :1 import { existsSync, readFileSync } from 'node:fs';
  • fs package/dist/agent-product-skill-state.js :1 import { existsSync, lstatSync, readdirSync, readFileSync, rmdirSync, rmSync } from 'node:fs';
  • fs package/dist/agent-skills-state.js :2 import { existsSync, lstatSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync, } from 'node:fs';
  • fs package/dist/agents-doctor.js :1 import { existsSync, readFileSync } from 'node:fs';
  • fs package/dist/agents.js :1 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
  • fs package/dist/cli.js :13 import { realpathSync } from 'node:fs';
  • fs package/dist/commands/assistant-embed-ops.js :8 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
  • fs package/dist/commands/assistant-ops.js :1 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
  • fs package/dist/commands/auth-service-principals.js :1 import { readFileSync } from 'node:fs';
  • fs package/dist/commands/billing-enforcement-activation-files.js :1 import { readFile } from 'node:fs/promises';
  • fs package/dist/commands/billing-migration-files.js :1 import { readFile } from 'node:fs/promises';
  • fs package/dist/commands/config-values.js :5 import { readFileSync, statSync } from 'node:fs';
  • fs package/dist/commands/deploy-github-hint.js :1 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
  • fs package/dist/commands/deploy-preflight.js :2 import { readFileSync } from 'node:fs';
  • fs package/dist/commands/deploy-resume.js :2 import { chmodSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
  • fs package/dist/commands/deploy-target.js :1 import { existsSync } from 'node:fs';
  • fs package/dist/commands/docs-mcp.js :8 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
  • fs package/dist/commands/platform-account-reset-files.js :1 import { constants, open } from 'node:fs/promises';
  • fs package/dist/commands/platform-auth-rollout-acceleration-files.js :1 import { constants, open } from 'node:fs/promises';
  • fs package/dist/commands/policy-ops.js :1 import { readFile } from 'node:fs/promises';
  • fs package/dist/commands/project-setup.js :4 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
  • fs package/dist/commands/service-ops.js :2 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
  • fs package/dist/commands/update-ops.js :20 import { unlinkSync } from 'node:fs';
  • fs package/dist/config.js :1 import { chmodSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
  • fs package/dist/deploy.js :1 import { readFileSync } from 'node:fs';
  • fs package/dist/dev.js :2 import { readFileSync, watch } from 'node:fs';
  • fs package/dist/devtools-delegated-exchange-authority.js :2 import { constants } from 'node:fs';
  • fs package/dist/devtools-design-store.js :2 import { chmodSync, closeSync, existsSync, fsyncSync, linkSync, mkdirSync, openSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync, } from 'node:fs';
  • fs package/dist/devtools-env.js :1 import { existsSync, readFileSync } from 'node:fs';
  • fs package/dist/doctor.js :1 import { existsSync, readFileSync } from 'node:fs';
  • fs package/dist/local-compile.js :1 import { readFileSync } from 'node:fs';
  • fs package/dist/local-config.js :1 import { chmodSync, existsSync, readFileSync, writeFileSync } from 'node:fs';
  • fs package/dist/mcp-import.js :1 import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
  • fs package/dist/openapi-import.js :1 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
  • fs package/dist/platform-support.js :1 import { existsSync } from 'node:fs';
  • fs package/dist/plugin-mode/build-readiness-fingerprint.js :2 import { readdir, readFile, realpath } from 'node:fs/promises';
  • fs package/dist/plugin-mode/build-readiness-store.js :2 import { chmod, mkdir, readFile, rename, stat, unlink, writeFile } from 'node:fs/promises';
  • fs package/dist/plugin-mode/compatibility.js :1 import { readFileSync } from 'node:fs';
  • fs package/dist/plugin-mode/plugin-mcp-bootstrap.js :2 import { chmod, mkdir, rename, writeFile } from 'node:fs/promises';
  • fs package/dist/plugin-mode/profile.js :1 import { existsSync, lstatSync } from 'node:fs';
  • fs package/dist/preview-session.js :1 import { watch } from 'node:fs';
  • fs package/dist/project-dotenv.js :1 import { existsSync, readFileSync } from 'node:fs';
  • fs package/dist/project-entrypoint.js :1 import { existsSync } from 'node:fs';
  • fs package/dist/project.js :1 import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSync, } from 'node:fs';
  • fs package/dist/react-widget-build.js :1 import { existsSync, mkdirSync, mkdtempSync, writeFileSync } from 'node:fs';
  • fs package/dist/sdk-version-skew.js :1 import { existsSync, readFileSync } from 'node:fs';
  • fs package/dist/self-host-init.js :2 import { chmodSync, closeSync, existsSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, writeFileSync, } from 'node:fs';
  • fs package/dist/skills-update.js :2 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
  • fs package/dist/update-binary.js :18 import { lstatSync, readFileSync, readlinkSync, realpathSync } from 'node:fs';
  • fs package/dist/update.js :11 import { readFileSync } from 'node:fs';
  • fs package/dist/validate.js :1 import { existsSync } from 'node:fs';

shell / exec 4

  • shell package/dist/commands/update-ops.js :19 import { spawn } from 'node:child_process';
  • shell package/dist/plugin-mode/plugin-command-runner.js :1 import { spawn } from 'node:child_process';
  • shell package/dist/skills-update.js :1 import { spawn } from 'node:child_process';
  • shell package/dist/tunnel.js :1 import { spawn as nodeSpawn } from 'node:child_process';

network 13

  • net package/dist/commands/auth-live-doctor.js :38 response = await fetch(url, {
  • net package/dist/commands/auth-metadata-readiness.js :41 response = await fetch(candidate.url, requestInit());
  • net package/dist/commands/service-ops.js :200 const uploaded = await fetch(upload.uploadUrl, {
  • net package/dist/control-plane.js :2 import { createServer } from 'node:http';
  • net package/dist/devtools-auth-ui.js :117 'function authRequest(path,options){ var init=options||{}; init.headers=hostHeaders(Boolean(init.body)); return fetch(path,init); }',
  • net package/dist/devtools-delegated-exchange-ui.js :144 'function refreshLocalDelegatedExchangeStatus(){ return fetch("/delegated-exchange/status",{headers:{"x-noodle-devtools-capability":RPC_CAPABILITY}}).then(function(r){if(!r.ok)throw new Error("status
  • net package/dist/devtools-design-preview.js :66 return fetch(url,options).then(function(response){
  • net package/dist/devtools-harness.js :62 ' return fetch("/rpc", { method: "POST", headers: { "content-type": "application/json" },' +
  • net package/dist/devtools-microsoft-auth.js :149 response = await this.#fetch(this.#tokenEndpoint, {
  • net package/dist/devtools-preview.js :2 import { createServer } from 'node:http';
  • net package/dist/devtools-rpc-forwarder.js :49 return fetch(options.mcpUrl, {
  • net package/dist/doctor.js :248 const res = await fetch(latest.url, { method: 'HEAD' });
  • net package/dist/self-host-init.js :300 ' - "fetch(\'http://127.0.0.1:8787/readyz\').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"',

secrets 1

  • secrets package/dist/commands/assistant-ops.js :160 console.log(' clientId: process.env.NOODLE_ASSISTANT_CLIENT_ID!, clientSecret: process.env.NOODLE_ASSISTANT_CLIENT_SECRET!,');

tool registrations 11

  • get_local_context package/dist/plugin-mode/build-readiness-server.js :125
  • get_build_readiness package/dist/plugin-mode/build-readiness-server.js :136
  • run_build_gate package/dist/plugin-mode/build-readiness-server.js :147
  • deploy_build package/dist/plugin-mode/build-readiness-server.js :177
  • cancel_build_run package/dist/plugin-mode/build-readiness-server.js :222
  • setup_project package/dist/plugin-mode/plugin-operation-tools.js :5
  • link_cloud_project package/dist/plugin-mode/plugin-operation-tools.js :32
  • set_cloud_variable package/dist/plugin-mode/plugin-operation-tools.js :67
  • set_cloud_secret_from_env package/dist/plugin-mode/plugin-operation-tools.js :92
  • preview_product_feedback package/dist/plugin-mode/plugin-operation-tools.js :139
  • submit_product_feedback package/dist/plugin-mode/plugin-operation-tools.js :146

declared dependencies 57

  • @modelcontextprotocol/client@2.0.0
  • @modelcontextprotocol/server@2.0.0
  • @hono/node-server@1.19.14
  • @jitl/quickjs-ffi-types@0.32.0
  • @jitl/quickjs-wasmfile-debug-asyncify@0.32.0
  • @jitl/quickjs-wasmfile-debug-sync@0.32.0
  • @jitl/quickjs-wasmfile-release-asyncify@0.32.0
  • @jitl/quickjs-wasmfile-release-sync@0.32.0
  • @noodle-borg/admission-limits@0.0.0
  • @noodle-borg/agent-kit@0.84.1
  • @noodle-borg/app-audit@0.0.0
  • @noodle-borg/app-package@0.0.0
  • @noodle-borg/assistant-gateway@0.0.0
  • @noodle-borg/auth@0.0.0
  • @noodle-borg/authoring@0.0.0
  • @noodle-borg/capabilities@0.0.0
  • @noodle-borg/cli-catalog@0.0.0
  • @noodle-borg/compiler@0.0.0
  • @noodle-borg/compute@0.0.0
  • @noodle-borg/connector-defs@0.0.0
  • @noodle-borg/connector-http@0.0.0
  • @noodle-borg/deploy-client@0.0.0
  • @noodle-borg/devtools-ui@0.0.0
  • @noodle-borg/knowledge@0.0.0
  • @noodle-borg/knowledge-operations@0.0.0
  • @noodle-borg/module@0.0.0
  • @noodle-borg/openapi-import@0.0.0
  • @noodle-borg/plugin-distribution@0.0.0
  • @noodle-borg/protocol@0.0.0
  • @noodle-borg/runtime@0.0.0
  • @noodle-borg/service@0.0.0
  • @noodle-borg/transport-http@0.0.0
  • @noodle-borg/wire-contracts@0.0.0
  • ajv@8.20.0
  • ajv-formats@3.0.1
  • content-type@1.0.5
  • cors@2.8.6
  • cross-spawn@7.0.6
  • eventsource@3.0.7
  • eventsource-parser@3.1.0
  • hono@4.12.28
  • ipaddr.js@2.4.0
  • jose@6.2.3
  • json-schema-typed@8.0.2
  • open@11.0.0
  • pkce-challenge@5.0.1
  • quickjs-emscripten@0.32.0
  • quickjs-emscripten-core@0.32.0
  • raw-body@3.0.2
  • react@19.2.7
  • react-dom@19.2.7
  • typescript@6.0.3
  • undici@8.7.0
  • yaml@2.9.0
  • zod@4.4.3
  • zod-to-json-schema@3.25.2
  • @types/node@24.13.1

perm:untrusted 2

  • untrusted package/dist/devtools-design-preview.js :66 return fetch(url,options).then(function(response){
  • untrusted package/dist/self-host-init.js :300 ' - "fetch(\'http://127.0.0.1:8787/readyz\').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"',