Local-first AI developer toolkit — knowledge base, code analysis, context management, and developer tools for LLM agents
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport stdio counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed v0.1.474 · analyzer v33 · 4w ago
danger signals5
- dynamic code execution new Function() package/scaffold/dist/definitions/bodies.mjs :497
- [ ] **eval/Function prevention**: No dynamic code execution from user input (\`eval()\`, \`new Function()\`, \`vm.runInNewContext()\`) - dynamic code execution vm exec package/scaffold/dist/definitions/bodies.mjs :497
- [ ] **eval/Function prevention**: No dynamic code execution from user input (\`eval()\`, \`new Function()\`, \`vm.runInNewContext()\`) - dynamic code execution eval() package/scaffold/dist/definitions/bodies.mjs :497
- [ ] **eval/Function prevention**: No dynamic code execution from user input (\`eval()\`, \`new Function()\`, \`vm.runInNewContext()\`) - dynamic code execution new Function() package/scaffold/dist/definitions/skills/typescript.mjs :353
- Avoid \`eval()\`, \`new Function()\`, and dynamic \`require()\`. - dynamic code execution eval() package/scaffold/dist/definitions/skills/typescript.mjs :353
- Avoid \`eval()\`, \`new Function()\`, and dynamic \`require()\`.
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 827
filesystem 6
- fs package/bin/aikit.mjs :2
import { existsSync, readFileSync } from 'node:fs'; - fs package/bin/postinstall-managed-launcher.mjs :15
import { existsSync } from 'node:fs'; - fs package/packages/cli/dist/verify-tool-contract-CUnDsrkJ.js :22
')`,`const{existsSync:e,readFileSync:r}=require('fs')`,`const{join:j}=require('path')`,`const{homedir:h}=require('os')`,`const n=process.env.NODE_OPTIONS||'';if(!n.includes('ExperimentalWarning'))proc - fs package/scaffold/dist/definitions/skills/_shared-viewer-inject.mjs :2
import { mkdirSync, readFileSync, writeFileSync } from 'node:fs'; - fs package/scaffold/dist/definitions/skills/adr-skill.mjs :480
const fs=require('node:fs'); - fs package/scaffold/dist/definitions/skills/session-handoff.mjs :2
nt:e([`#!/usr/bin/env node`,`const fs = require('node:fs');`,...t,``,`function formatTimestamp(date) {`,` const iso = date.toISOString();`,` return iso.slice(0, 10) + '-' + iso.slice(11, 13) + iso.s
shell / exec 5
- shell package/packages/browser/dist/index.js :1
estamp:new Date().toISOString()})}async exec(t,...n){if(!this.binaryPath)throw Error(`agent-browser not launched. Call launch() first, or use getEngine() singleton.`);try{return await this.execWithBin - shell package/packages/cli/dist/verify-tool-contract-CUnDsrkJ.js :22
rted`?[e]:[])}const dt=[`const{spawn:s}=require('child_process')`,`const{existsSync:e,readFileSync:r}=require('fs')`,`const{join:j}=require('path')`,`const{homedir:h}=require('os')`,`const n=process.e - shell package/packages/store/dist/index.js :114
to load; vector search disabled`,o(e))}}exec(e){try{this.getDb().exec(e)}catch(t){if(this.isCorruptionError(t)){this.recover(),this.getDb().exec(e);return}throw t}}pragma(e){this.getDb().pragma(e)}que - shell package/scaffold/dist/adapters/skills.mjs :2
`),e(`pnpm build`,{cwd:h,stdio:`inherit`})}catch{process.stderr.write(`Warning: could not build viewer assets. Viewer HTML files will be missing from skill output. - shell (weak) package/scaffold/dist/general/hooks/scripts/scope-guard.mjs :2
import{execSync as l}from"node:child_process";import c from"node:fs";import a from"node:path";import{createHook as g}from"./_runtime.mjs";var f=5,u=n=>{try{return c.existsSync(n)}catch{return!1}};func
network 12
- net package/packages/browser/dist/index.js :2
dy=i);let o=JSON.stringify(a);return n?`fetch(${JSON.stringify(e)}, ${o}).then(async r => { - net package/packages/cli/dist/index.js :3
}}async function Vn(e){try{return(await fetch(`http: - net package/packages/dashboard/dist/assets/index-Bu2386Hw.js :1
n(e){if(e.ep)return;e.ep=!0;let n=t(e);fetch(e.href,n)}})();var l=o((e=>{function t(e,t){var n=e.length;e.push(t);a:for(;0<n;){var r=n-1>>>1,a=e[r];if(0<i(a,t))e[r]=t,e[n]=a,n=r;else break a}}functio - net package/packages/enterprise-bridge/dist/index.js :1
))}async search(e,t=5){let n=await this.fetch(`/api/v1/search`,{method:`POST`,body:JSON.stringify({query:e,maxResults:t,generateResponse:!1})});if(!n.ok)throw Error(`ER search failed: ${n.status} ${n. - net package/packages/server/dist/browser-CXe3trQn.js :136
await fetch(READY_URL, { - net package/packages/server/dist/version-check-DDIPvO3a.js :4
f-8`),{version:t}=JSON.parse(e),n=await fetch(C,{signal:AbortSignal.timeout(1e4)});if(!n.ok)return;let r=(await n.json()).version;if(!r||r===t||!F(r,t))return;if(u(y(A,`v${r}`))){let e=`${k}.tmp`;_(e, - net package/packages/settings-ui/dist/assets/index-DAfM-g64.js :1
n(e){if(e.ep)return;e.ep=!0;let n=t(e);fetch(e.href,n)}})();var t=e((e=>{var t=Symbol.for(`react.transitional.element`),n=Symbol.for(`react.portal`),r=Symbol.for(`react.fragment`),i=Symbol.for(`react - net package/packages/tools/dist/index.js :78
.now();try{for(let e=0;;e++){if(f=await fetch(l,{method:u,headers:{"User-Agent":`aikit-http/1.0`,...r},body:u!==`GET`&&u!==`HEAD`?d:void 0,signal:s.signal,redirect:`manual`}),f.status>=300&&f.status<4 - net package/scaffold/dist/definitions/skills/browser-use.mjs :286
Step 4: Replay with fetch (using page session) - net package/scaffold/dist/definitions/skills/c4-architecture.mjs :319
n(e){if(e.ep)return;e.ep=!0;let n=t(e);fetch(e.href,n)}})();var u=o((e=>{function t(e,t){var n=e.length;e.push(t);a:for(;0<n;){var r=n-1>>>1,a=e[r];if(0<i(a,t))e[r]=t,e[n]=a,n=r;else break a}}functio - net package/scaffold/dist/definitions/skills/docs.mjs :3610
n(e){if(e.ep)return;e.ep=!0;let n=t(e);fetch(e.href,n)}})();var f=s((e=>{function t(e,t){var n=e.length;e.push(t);a:for(;0<n;){var r=n-1>>>1,a=e[r];if(0<i(a,t))e[r]=t,e[n]=a,n=r;else break a}}functio - net package/scaffold/dist/definitions/skills/typescript.mjs :325
try { return await fetch(url, { signal: controller.signal }); }
secrets 2
- secrets package/packages/server/dist/server-BF6sMRPf.js :57
ction Zs(e){if(!e?.enabled)return;let t=process.env.AIKIT_ER_API_KEY;if(!t){Xs.warn(`ER bridge enabled but AIKIT_ER_API_KEY not set; disabling`);return}return{enabled:!0,baseUrl:e.baseUrl,apiKey:t,tim - secrets package/packages/tools/dist/index.js :141
issing SEARXNG_URL`;case`google`:return process.env.GOOGLE_API_KEY?process.env.GOOGLE_CSE_ID?null:`missing GOOGLE_CSE_ID`:`missing GOOGLE_API_KEY`;case`brave`:return process.env.BRAVE_API_KEY?null:`mi
database 1
- db package/scaffold/dist/definitions/skills/adr-skill.mjs :306
- [ ] \`grep -r "from 'pg'" src/ --include='*.ts' | grep -v 'src/db/'\` returns no results
install hooks 2
- postinstall package/package.json :134
node ./bin/postinstall-managed-launcher.mjs - postinstall package/packages/chunker/package.json :19
node scripts/vendor-wasm.mjs || echo WASM vendoring skipped (deps not available)
declared dependencies 38
- @modelcontextprotocol/ext-apps@^1.x
- @modelcontextprotocol/sdk@^1.x
- @huggingface/transformers@^4.x
- @lancedb/lancedb@^0.x
- @mcp-ui/server@^6.x
- @mixmark-io/domino@^2.x
- ajv@^8.x
- diff@^9.x
- express@^5.x
- gpt-tokenizer@^3.x
- linkedom@^0.x
- lru-cache@^11.x
show 26 more
- marked@^18.x
- mermaid@^11
- minimatch@^10.x
- onnxruntime-common@^1.x
- sql.js@^1.x
- sqlite-vec@^0.x
- tree-sitter-wasms@~0.1.13
- turndown@^7.x
- web-tree-sitter@~0.24.7
- yaml@^2.x
- zod@^4.x
- @biomejs/biome@^2.x
- @types/better-sqlite3@^7.x
- @types/express@^5.x
- @typescript/typescript-win32-x64@^7.x
- @types/node@^24.x
- rimraf@^6.x
- tsdown@^0.x
- turbo@^2.x
- typescript@^7.x
- vite@^8.x
- vite-plugin-singlefile@^2.x
- vitest@^4.x
- ws@^8.x
- better-sqlite3@^12.x
- playwright-core@^1.x