MCP Observatory
1m ago Tracked 59,457 Last 1m ago 24h 2,463
npm JavaScript analyzed 2.7.3 deep scan · partial (255/2,079 files)

agent-nuvira

v2.7.3
npm

Agent-Nuvira: Multi-agent AI coding CLI — plan, write, review, test, and publish code with local models (Ollama) or cloud APIs (Groq, NVIDIA NIM, Google Gemini, OpenRouter)

maintainer
imdheerajsharma
licence
MIT
first seen
2026-08-13
last seen
2026-09-17
releases · 30d
93
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools
transport stdio · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals npm-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v2.7.3 · analyzer v33 · 2d ago

skills & prompt files 40

danger signals4

code evidence v2.7.3 · npm-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 912

filesystem 187

  • fs package/dist/agent-sdk/src/register.js :23 import { readFileSync, writeFileSync, existsSync } from 'node:fs';
  • fs package/dist/agent-sdk/src/scaffold.js :12 import { mkdirSync, writeFileSync, existsSync } from 'node:fs';
  • fs package/dist/agents/agents/branch-automation-agent.js :16 import { existsSync, writeFileSync, openSync } from 'node:fs';
  • fs package/dist/agents/agents/branch-automation-hooks.js :11 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
  • fs package/dist/agents/agents/context-gatherer.js :16 import { existsSync, readFileSync, statSync, readdirSync } from 'node:fs';
  • fs package/dist/agents/agents/debugger.js :16 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
  • fs package/dist/agents/agents/git-agent.js :27 import { writeFileSync, unlinkSync, mkdtempSync } from 'node:fs';
  • fs package/dist/agents/agents/github-release-agent.js :18 import { existsSync, readFileSync, writeFileSync, unlinkSync, mkdtempSync } from 'node:fs';
  • fs package/dist/agents/agents/package-agent.js :17 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
  • fs package/dist/agents/agents/runner.js :23 import { existsSync, readFileSync } from 'node:fs';
  • fs package/dist/agents/agents/tester.js :9 import { existsSync, readFileSync, writeFileSync, mkdirSync, cpSync, rmSync, readdirSync } from 'node:fs';
  • fs package/dist/agents/agents/writer.js :12 import { existsSync, readFileSync } from 'node:fs';
show 28 more
  • fs package/dist/agents/checkpoint-store.js :18 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
  • fs package/dist/agents/credential-store.js :19 import { existsSync, readFileSync, writeFileSync, unlinkSync } from 'node:fs';
  • fs package/dist/agents/edit-module.js :12 import { existsSync, readFileSync } from 'node:fs';
  • fs package/dist/agents/execute-module.js :11 import { existsSync, readFileSync } from 'node:fs';
  • fs package/dist/agents/inspect-module.js :9 import { existsSync, readFileSync, statSync, readdirSync } from 'node:fs';
  • fs package/dist/agents/nvda-addon.js :2 import * as fs from 'fs';
  • fs package/dist/agents/orchestrator.js :19 import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync, statSync } from 'node:fs';
  • fs package/dist/agents/phase-engine.js :4 import { existsSync, readFileSync, writeFileSync, mkdirSync, unlinkSync, readdirSync } from 'node:fs';
  • fs package/dist/agents/prompt-assembly.js :18 import { existsSync, readFileSync, readdirSync } from 'node:fs';
  • fs package/dist/agents/safe-execution-layer.js :11 import { existsSync } from 'node:fs';
  • fs package/dist/agents/task-execution-pipeline.js :19 import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'node:fs';
  • fs (weak) package/dist/agents/test-module.js :12 import { existsSync, readFileSync, writeFileSync, mkdirSync, cpSync, rmSync, readdirSync, mkdtempSync } from 'node:fs';
  • fs package/dist/agents/tool-calling-agent.js :20 import { existsSync, readFileSync, readdirSync } from 'node:fs';
  • fs package/dist/agents/tools/delegation.js :24 import { readFileSync } from 'node:fs';
  • fs package/dist/agents/utils/file-tree.js :16 import { readdir } from 'node:fs/promises';
  • fs package/dist/cli/agent.js :18 import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
  • fs package/dist/cli/audit.js :19 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
  • fs package/dist/cli/ci.js :20 import { readFileSync, existsSync } from 'node:fs';
  • fs package/dist/cli/code-map.js :19 import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
  • fs package/dist/cli/doctor.js :23 import { existsSync, mkdirSync, readFileSync } from 'node:fs';
  • fs package/dist/cli/duties.js :19 */ import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
  • fs package/dist/cli/edit.js :2 import { readFileSync, writeFileSync, existsSync } from 'node:fs';
  • fs package/dist/cli/execute.js :19 import { readFileSync, writeFileSync, existsSync, mkdirSync, readdirSync } from 'node:fs';
  • fs package/dist/cli/federation.js :23 import { existsSync, writeFileSync, readFileSync, mkdirSync } from 'node:fs';
  • fs package/dist/cli/gateway.js :14 import { readFileSync } from 'node:fs';
  • fs package/dist/cli/init.js :15 import { existsSync, mkdirSync, writeFileSync, readFileSync, readdirSync } from 'node:fs';
  • fs package/dist/cli/memory.js :28 import * as fs from 'fs';
  • fs package/dist/cli/model.js :21 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';

147 more not shown — this panel samples each group; the count above is the real total.

shell / exec 51

  • shell package/dist/agents/agents/branch-automation-agent.js :20 import { execSync, spawn } from 'node:child_process';
  • shell package/dist/agents/agents/branch-automation-hooks.js :14 import { execSync } from 'node:child_process';
  • shell package/dist/agents/agents/debugger.js :18 import { execSync } from 'node:child_process';
  • shell package/dist/agents/agents/git-agent.js :26 import { execSync } from 'node:child_process';
  • shell package/dist/agents/agents/github-release-agent.js :21 import { execSync } from 'node:child_process';
  • shell package/dist/agents/agents/gitlab-agent.js :143 const { execSync } = await import('node:child_process');
  • shell package/dist/agents/agents/issue-triage-agent.js :29 import { execSync } from 'node:child_process';
  • shell package/dist/agents/agents/package-agent.js :19 import { execSync } from 'node:child_process';
  • shell package/dist/agents/agents/pr-review-agent.js :23 import { execSync } from 'node:child_process';
  • shell package/dist/agents/credential-store.js :23 import { execSync } from 'node:child_process';
  • shell package/dist/agents/orchestrator.js :21 import { spawnSync } from 'node:child_process';
  • shell package/dist/agents/tool-calling-agent.js :22 import { spawnSync } from 'node:child_process';
show 28 more
  • shell package/dist/cli/dashboard-restart.js :15 import { execSync } from 'node:child_process';
  • shell package/dist/cli/dashboard.js :25 import { spawn, execSync } from 'node:child_process';
  • shell package/dist/cli/doctor.js :22 import { execSync } from 'node:child_process';
  • shell package/dist/cli/process-control.js :25 import { execSync, execFileSync } from 'node:child_process';
  • shell package/dist/config/workspace.js :29 import { execSync } from 'node:child_process';
  • shell package/dist/enterprise/vault.js :58 import { execFileSync } from 'node:child_process';
  • shell package/dist/inference/local-adapter.js :2 import { spawn } from 'node:child_process';
  • shell package/dist/learning/eval-framework.js :33 import { execSync } from 'node:child_process';
  • shell package/dist/learning/skills-registry.js :28 import { execFileSync } from 'node:child_process';
  • shell package/dist/memory/embedder.js :16 import { spawn } from 'node:child_process';
  • shell (weak) package/dist/sandbox/manager.js :33 import { spawn } from 'node:child_process';
  • shell package/dist/skills/daytona-executor.js :17 import { spawn } from 'node:child_process';
  • shell package/dist/skills/modal-executor.js :18 import { spawn } from 'node:child_process';
  • shell package/dist/skills/sandbox-executor.js :18 import { spawn } from 'node:child_process';
  • shell package/dist/skills/skill-executor.js :14 import { spawn } from 'node:child_process';
  • shell package/dist/team/memory.js :24 import { execSync } from 'node:child_process';
  • shell package/dist/tools/browser-tool.js :26 import { spawn } from 'node:child_process';
  • shell package/dist/tools/clone-repo.js :26 import { execFileSync } from 'node:child_process';
  • shell package/dist/tools/code-execution.js :12 import { spawn } from 'node:child_process';
  • shell package/dist/tools/computer-use-tool.js :12 import { execSync, spawn } from 'child_process';
  • shell package/dist/tools/cronjob-tools.js :220 const { spawn } = await import('node:child_process');
  • shell package/dist/tools/daemon-pool.js :11 import { spawn } from 'node:child_process';
  • shell package/dist/tools/desktop-ui.js :20 import { spawn } from 'node:child_process';
  • shell package/dist/tools/docker-tool.js :15 import { spawn } from 'node:child_process';
  • shell package/dist/tools/git-tool.js :28 * - argv-array exec (execFileSync, NO shell) — the message/files are
  • shell package/dist/tools/loop-project-context.js :30 import { spawnSync } from 'node:child_process';
  • shell package/dist/tools/modality/shared.js :10 import { execFileSync } from 'node:child_process';
  • shell package/dist/tools/modality/voice.js :12 import { execFileSync } from 'node:child_process';

11 more not shown — this panel samples each group; the count above is the real total.

network 57

  • net package/.agents/skills/api-call/call.js :16 const https = require('https');
  • net package/.agents/skills/api-call/call.mjs :16 import https from 'https';
  • net package/dist/agents/agents/github-release-agent.js :373 const response = await fetch(`https://api.github.com/repos/${repo}/releases`, {
  • net package/dist/agents/agents/gitlab-api-client.js :267 const response = await fetch(`${this.baseUrl}${path}`, {
  • net package/dist/agents/agents/issue-triage-agent.js :280 const response = await fetch(`https://api.github.com${path}`, {
  • net package/dist/agents/agents/pr-review-agent.js :150 const response = await fetch(`https://api.github.com${path}`, {
  • net package/dist/cli/bedrock.js :327 const res = await fetch(`${runtimeBase}/openai/v1/chat/completions`, {
  • net package/dist/cli/dashboard-restart.js :21 const res = await fetch(url, { signal: controller.signal });
  • net package/dist/cli/doctor.js :110 const modelsRes = await fetch(`${base}/models`, {
  • net package/dist/cli/federation.js :397 const response = await fetch(`http://${config.host}:${config.port}/federation/health`);
  • net package/dist/cli/gateway.js :566 const res = await fetch(`https://api.telegram.org/bot${token}/getMe`, { signal: AbortSignal.timeout(10_000) });
  • net package/dist/federation/a2a-client.js :13 import { request as httpRequest } from 'node:http';
show 28 more
  • net package/dist/federation/a2a-server.js :15 import { createServer } from 'node:http';
  • net package/dist/federation/client.js :13 import { request as httpRequest } from 'node:http';
  • net package/dist/federation/server.js :12 import { createServer } from 'node:http';
  • net package/dist/gateway/adapters.js :15 import { createServer } from 'node:http';
  • net package/dist/inference/anthropic-adapter.js :110 const response = await fetch(`${this.baseUrl}/v1/messages`, {
  • net package/dist/inference/gemini-adapter.js :53 const response = await fetch(url, {
  • net package/dist/inference/groq-adapter.js :80 const response = await fetch(`${GROQ_BASE_URL}/chat/completions`, {
  • net package/dist/inference/local-adapter.js :16 return await fetch(url, { ...init, signal: controller.signal });
  • net package/dist/inference/nim-adapter.js :50 const response = await fetch(url, {
  • net package/dist/inference/openai-compat-adapter.js :163 const response = await fetch(chatUrl(this.baseUrl, model, this.meta), {
  • net package/dist/inference/openrouter-adapter.js :46 const response = await fetch(`${OPENROUTER_BASE_URL}/chat/completions`, {
  • net package/dist/inference/sse.js :58 const response = await fetch(url, {
  • net package/dist/inference/tools.js :62 const response = await fetch(url, {
  • net package/dist/learning/skills-hub.js :143 // ─── Index fetch (with TTL cache) ───────────────────────────────────────────
  • net package/dist/learning/skills-registry.js :87 const res = await fetch(`${base.replace(/\/$/, '')}/index.json`, {
  • net package/dist/mcp/mcp-oauth.js :138 const response = await fetch(state.config.tokenEndpoint, {
  • net package/dist/tools/browser-camofox.js :87 const response = await fetch(`${this.baseUrl}/health`, {
  • net package/dist/tools/browser-tool.js :528 const response = await fetch(`http://localhost:${this.cdpPort}/json/version`);
  • net package/dist/tools/delegation-system.js :392 const response = await fetch(config.endpoint, {
  • net package/dist/tools/discord-tool.js :34 const response = await fetch(url, options);
  • net package/dist/tools/feishu-tools.js :31 const response = await fetch(`${this.baseUrl}/auth/v3/tenant_access_token/internal`, {
  • net package/dist/tools/homeassistant-tool.js :35 const response = await fetch(url, options);
  • net package/dist/tools/image-video-tool.js :29 const response = await fetch('https://api.openai.com/v1/images/generations', {
  • net package/dist/tools/managed-gateway.js :67 const response = await fetch(this.config.endpoint, {
  • net package/dist/tools/messaging-tool.js :45 const response = await fetch(url, {
  • net package/dist/tools/microsoft-graph.js :27 const response = await fetch(`https://login.microsoftonline.com/${this.config.tenantId}/oauth2/v2.0/token`, {
  • net package/dist/tools/modality/generic-caller.js :115 const response = await fetch(provider.baseUrl + endpoint, {
  • net package/dist/tools/modality/image-gen.js :19 const res = await fetch(url);

17 more not shown — this panel samples each group; the count above is the real total.

secrets 33

  • secrets package/.agents/skills/api-call/call.js :149 const apiKey = process.env.API_KEY;
  • secrets package/.agents/skills/api-call/call.mjs :149 const apiKey = process.env.API_KEY;
  • secrets package/dist/agents/agents/github-release-agent.js :346 const token = process.env.GITHUB_API_KEY ||
  • secrets package/dist/agents/agents/gitlab-api-client.js :14 return process.env.GITLAB_TOKEN || process.env.GITLAB_ACCESS_TOKEN || '';
  • secrets package/dist/agents/agents/issue-triage-agent.js :85 this.ghToken = process.env.GH_TOKEN || process.env.GITHUB_TOKEN || '';
  • secrets package/dist/agents/agents/package-agent.js :158 if (process.env.NPM_TOKEN) {
  • secrets package/dist/agents/agents/pr-review-agent.js :39 this.token = process.env.GH_TOKEN || process.env.GITHUB_TOKEN || '';
  • secrets package/dist/agents/credential-store.js :70 if (process.env.NPM_TOKEN) {
  • secrets package/dist/agents/phase-engine.js :138 const hasGitCreds = !!(process.env.GITHUB_TOKEN || process.env.GH_TOKEN);
  • secrets package/dist/cli/bedrock.js :115 const currentKey = process.env.AWS_BEARER_TOKEN || '';
  • secrets package/dist/cli/federation.js :213 const secret = options.secret || config.secret || process.env.FEDERATION_SECRET || '';
  • secrets package/dist/cli/publish.js :70 if (creds.git.token || process.env.GITHUB_API_KEY || process.env.GH_TOKEN) {
show 21 more
  • secrets package/dist/config/auth.js :16 secret: process.env.JWT_SECRET ?? 'supersecret',
  • secrets package/dist/config/jwt.js :21 secret: process.env.JWT_SECRET ?? 'dev-secret-key',
  • secrets package/dist/config/keys.js :14 exports.JWT_SECRET = process.env.JWT_SECRET ?? 'dev-secret-key';
  • secrets package/dist/federation/server.js :419 resolvedConfig.secret = process.env.FEDERATION_SECRET || '';
  • secrets package/dist/gateway/adapters.js :995 this.authToken = authToken ?? process.env.TWILIO_AUTH_TOKEN ?? '';
  • secrets package/dist/passport.js :12 secretOrKey: process.env.JWT_SECRET || 'default_secret', // Replace with a strong secret in production
  • secrets package/dist/routes/auth.js :10 const JWT_SECRET = process.env.JWT_SECRET;
  • secrets package/dist/skills/bundled-skills.js :815 ' const decoded = jwt.verify(token, process.env.JWT_SECRET);',
  • secrets package/dist/tools/child-agent-worker.js :74 this.apiKey = process.env.OPENAI_API_KEY || process.env.ANTHROPIC_API_KEY || '';
  • secrets package/dist/tools/discord-tool.js :166 const botToken = token || process.env.DISCORD_BOT_TOKEN || '';
  • secrets package/dist/tools/feishu-tools.js :200 appSecret: process.env.FEISHU_APP_SECRET || '',
  • secrets package/dist/tools/homeassistant-tool.js :137 const haToken = token || process.env.HASS_TOKEN || '';
  • secrets package/dist/tools/microsoft-graph.js :198 clientSecret: process.env.MICROSOFT_CLIENT_SECRET || '',
  • secrets package/dist/tools/modality/modality-catalog.js :62 available: !!process.env.OPENAI_API_KEY,
  • secrets package/dist/tools/neutts-synth.js :23 apiKey: config.apiKey || process.env.NEUTTS_API_KEY || '',
  • secrets package/dist/tools/openrouter-client.js :22 this.apiKey = config?.apiKey || process.env.OPENROUTER_API_KEY || '';
  • secrets package/dist/tools/send-message-tool.js :81 const token = process.env.TELEGRAM_BOT_TOKEN;
  • secrets package/dist/tools/tts-streaming.js :122 if (process.env.ELEVENLABS_API_KEY) {
  • secrets package/dist/tools/video-generation.js :20 apiKey: config.apiKey || process.env.FAL_KEY || '',
  • secrets package/dist/tools/web-research.js :163 const jinaKey = process.env.JINA_API_KEY;
  • secrets package/dist/web-dashboard/server.js :994 const apiKey = process.env.GROQ_API_KEY;

database 1

  • db package/dist/tools/delegation-state.js :31 const Database = require('better-sqlite3');

install hooks 2

  • prepack package/package.json :31 npm run build
  • prepublishOnly package/package.json :32 npm run build && npm test

declared dependencies 26

  • @modelcontextprotocol/sdk@^1.30.0
  • @microsoft/recognizers-text-date-time@^1.3.2
  • @vscode/ripgrep@^1.18.0
  • baileys@7.0.0-rc14
  • chalk@^5.3.0
  • commander@^12.0.0
  • execa@^8.0.1
  • ink@^5.2.1
  • inquirer@^9.3.0
  • node-cron@^4.6.0
  • ora@^8.0.0
  • qrcode@^1.5.4
show 14 more
  • react@^18.3.1
  • typescript@^5.3.0
  • zod@^4.4.3
  • @types/inquirer@^9.0.10
  • @types/node@^20.11.0
  • @types/qrcode@^1.5.6
  • @types/react@^18.3.31
  • @types/ws@^8.18.1
  • ink-testing-library@^4.0.0
  • tsx@^4.7.0
  • vitest@^4.1.10
  • @faiss-node/native@^0.1.11
  • @huggingface/transformers@^4.2.0
  • @napi-rs/keyring@^1.3.0

clipboard 1

  • clipboard shell call package/dist/tools/desktop-ui.js :374 content = await runCommand('pbpaste', []);

perm:untrusted 1

  • untrusted package/src/web-dashboard/public/assets/index-C4frng1Q.js :67 tplaceSearch(t){try{const r=await(await fetch(`${this.baseUrl}/api/skills/marketplace?q=${encodeURIComponent(t)}`,{headers:wa()})).json();return Array.isArray(r.results)?r.results:[]}catch{return[]}}a