MCP Observatory
4m ago Tracked 39,541 Last 4m ago 24h 3,153
npm JavaScript analyzed 2.1.2

agentic-flow

v2.1.2
npm

The agentic meta-harness — freeze the model, evolve the harness. An open runtime that routes each query to the cost-optimal model, evolves its own harness (planner/context/reviewer/retry/tool/memory/score policy) and autonomously repairs code, then orches

maintainer
ruvnet
license
MIT
first seen
2026-05-22
last seen
2026-08-14
releases · 30d
2
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools
transport stdio · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals npm-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v2.1.2 · analyzer v32 · 14h ago

skills & prompt files 200

danger signals1

code evidence v2.1.2 · npm-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 593

filesystem 59

  • fs package/.claude/helpers/github-safe.js :13 import { writeFileSync, unlinkSync } from 'fs';
  • fs package/dist/agentdb/validate-frontier.cjs :13 const fs = require('fs');
  • fs package/dist/cli-proxy.js :7 import { existsSync, readFileSync } from 'fs';
  • fs package/dist/cli/agent-manager.js :7 import { readFileSync, writeFileSync, existsSync, mkdirSync, readdirSync, statSync } from 'fs';
  • fs package/dist/cli/commands/hooks.js :423 import { readFileSync, statSync, existsSync } from 'fs';
  • fs package/dist/cli/commands/init.js :7 import * as fs from 'fs';
  • fs package/dist/cli/commands/sona-train.js :8 import { readFileSync, writeFileSync, readdirSync, statSync, mkdirSync } from 'fs';
  • fs package/dist/cli/commands/sona.js :26 const data = await fs.readFile(options.embedding, 'utf-8');
  • fs package/dist/cli/commands/workers.js :548 await fs.writeFile(options.output, config);
  • fs package/dist/cli/config-wizard.js :6 import { readFileSync, writeFileSync, existsSync } from 'fs';
  • fs package/dist/cli/federation-cli.js :6 import { existsSync } from 'fs';
  • fs package/dist/cli/mcp-manager.js :11 import fs from 'fs';
  • fs package/dist/config/quic.js :131 const fs = require('fs');
  • fs package/dist/embeddings/optimized-embedder.js :12 import { existsSync, mkdirSync, writeFileSync } from 'fs';
  • fs package/dist/federation/debug/debug-stream.js :17 import { createWriteStream } from 'fs';
  • fs (weak) package/dist/harness/provenance.js :17 import { readFileSync } from 'node:fs';
  • fs package/dist/index.js :4 import { realpathSync } from 'node:fs';
  • fs package/dist/intelligence/EmbeddingCache.js :14 import { existsSync, mkdirSync, statSync, readFileSync, writeFileSync } from 'fs';
  • fs package/dist/intelligence/IntelligenceStore.js :7 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
  • fs package/dist/intelligence/agent-booster-enhanced.js :21 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs';
  • fs package/dist/mcp/claudeFlowSdkServer.js :4 import { readFileSync, writeFileSync } from 'fs';
  • fs package/dist/mcp/fastmcp/tools/agent/add-agent.js :2 import { writeFileSync, existsSync, mkdirSync } from 'fs';
  • fs package/dist/mcp/fastmcp/tools/agent/add-command.js :2 import { writeFileSync, existsSync, mkdirSync } from 'fs';
  • fs package/dist/mcp/fastmcp/tools/hooks/build-agents.js :7 import * as fs from 'fs';
  • fs package/dist/mcp/fastmcp/tools/hooks/pretrain.js :7 import * as fs from 'fs';
  • fs package/dist/mcp/fastmcp/tools/hooks/shared.js :5 import * as fs from 'fs';
  • fs package/dist/mcp/fastmcp/tools/hooks/transfer.js :7 import * as fs from 'fs';
  • fs package/dist/mcp/tools/agent-booster-tools.js :7 import * as fs from 'node:fs/promises';
  • fs package/dist/memory/SharedMemoryPool.js :20 import { mkdirSync } from 'node:fs';
  • fs package/dist/optimizations/agent-booster-migration.js :11 import { writeFileSync } from 'fs';
  • fs package/dist/proxy/http2-proxy.js :14 import { readFileSync, existsSync } from 'fs';
  • fs package/dist/reasoningbank/core/distill.js :5 import { readFileSync } from 'fs';
  • fs package/dist/reasoningbank/core/judge.js :5 import { readFileSync } from 'fs';
  • fs package/dist/reasoningbank/core/matts.js :9 import { readFileSync } from 'fs';
  • fs package/dist/reasoningbank/db/queries.js :6 import { existsSync, mkdirSync } from 'fs';
  • fs package/dist/reasoningbank/hooks/post-task.js :8 import { readFileSync } from 'fs';
  • fs package/dist/reasoningbank/utils/config.js :2 import { readFileSync, existsSync } from 'fs';
  • fs package/dist/router/router.js :2 import { readFileSync, existsSync } from 'fs';
  • fs package/dist/sdk/permission-handler.js :8 import { existsSync, appendFileSync } from "fs";
  • fs package/dist/sdk/plugins.js :11 import { existsSync, readFileSync } from "fs";
  • fs package/dist/sdk/security.js :13 import { existsSync, appendFileSync, mkdirSync } from "fs";
  • fs package/dist/services/sona-agentdb-integration.js :234 await fs.writeFile(path, JSON.stringify({
  • fs package/dist/transport/quic-loader.js :26 import { readFileSync } from 'node:fs';
  • fs package/dist/utils/agentBoosterPreprocessor.js :8 import { existsSync, readFileSync, writeFileSync } from 'fs';
  • fs package/dist/utils/agentLoader.js :2 import { readFileSync, readdirSync, statSync, existsSync } from 'fs';
  • fs package/dist/utils/agentdb-runtime-patch.js :10 import { readFileSync, writeFileSync, existsSync } from 'fs';
  • fs package/dist/utils/model-downloader.js :6 import { createWriteStream, existsSync, mkdirSync } from 'fs';
  • fs package/dist/workers/consolidated-phases.js :92 const content = await fs.readFile(file, 'utf-8');
  • fs package/dist/workers/custom-worker-factory.js :8 import * as fs from 'fs/promises';
  • fs package/dist/workers/dispatch-service.js :819 const content = await fs.readFile(path.join(process.cwd(), file), 'utf-8');
  • fs package/dist/workers/phase-executors.js :37 const content = await fs.readFile(path.join(process.cwd(), file), 'utf-8');
  • fs package/dist/workers/worker-registry.js :8 import * as fs from 'fs';
  • fs (weak) package/scripts/postinstall.js :10 import { readFileSync, writeFileSync, existsSync } from 'fs';
  • fs (weak) package/validation/docker/test-reasoningbank-npx.mjs :14 import { writeFileSync, mkdirSync } from 'fs';
  • fs package/validation/quic-deep-validation.ts :7 import { existsSync } from 'fs';
  • fs (weak) package/validation/test-quic-wasm.ts :8 import { existsSync } from 'fs';
  • fs (weak) package/validation/test-regression.mjs :13 import { existsSync } from 'fs';
  • fs (weak) package/validation/test-wasm-e2e.ts :9 import { existsSync, statSync } from 'fs';
  • fs package/wasm/quic/agentic_flow_quic.js :776 const wasmBytes = require('fs').readFileSync(wasmPath);

shell / exec 36

  • shell package/.claude/helpers/github-safe.js :12 import { execSync } from 'child_process';
  • shell package/.claude/statusline.mjs :6 import { execSync } from 'child_process';
  • shell package/dist/agents/directApiAgent.js :5 import { execFileSync } from 'child_process';
  • shell package/dist/cli-proxy.js :87 const { spawn } = await import('child_process');
  • shell package/dist/cli/claude-code-wrapper.js :20 import { spawn } from 'child_process';
  • shell package/dist/cli/commands/hooks.js :424 import { execSync } from 'child_process';
  • shell package/dist/cli/federation-cli.js :9 import { spawn } from 'child_process';
  • shell package/dist/cli/mcp-manager.js :287 const { spawnSync } = await import('child_process');
  • shell package/dist/cli/mcp.js :3 import { spawn } from 'child_process';
  • shell package/dist/config/claudeFlow.js :35 const { execSync } = await import('child_process');
  • shell package/dist/federation/EphemeralAgent.js :33 static async spawn(config) {
  • shell package/dist/hooks/parallel-validation.js :15 "await Promise.all([exec('agent1'), exec('agent2'), exec('agent3')])");
  • shell package/dist/intelligence/EmbeddingService.js :817 const { execFileSync } = await import('child_process');
  • shell package/dist/intelligence/IntelligenceStore.js :78 exec(sql) {
  • shell package/dist/intelligence/agent-booster-enhanced.js :20 import { exec } from 'child_process';
  • shell package/dist/mcp/fastmcp/servers/claude-flow-sdk.js :7 import { execFileSync } from 'child_process';
  • shell package/dist/mcp/fastmcp/servers/http-sse.js :8 import { execFileSync } from 'child_process';
  • shell package/dist/mcp/fastmcp/servers/http-streaming-updated.js :6 import { execFileSync } from 'child_process';
  • shell package/dist/mcp/fastmcp/servers/poc-stdio.js :6 import { execFileSync } from 'child_process';
  • shell package/dist/mcp/fastmcp/servers/stdio-full.js :6 import { execFileSync } from 'child_process';
  • shell package/dist/mcp/fastmcp/tools/agent/execute.js :3 import { execFileSync } from 'child_process';
  • shell package/dist/mcp/fastmcp/tools/agent/list.js :3 import { execFileSync } from 'child_process';
  • shell package/dist/mcp/fastmcp/tools/agent/parallel.js :3 import { execFileSync } from 'child_process';
  • shell package/dist/mcp/fastmcp/tools/hooks/pretrain.js :8 import { execSync, execFileSync } from 'child_process';
  • shell package/dist/mcp/fastmcp/tools/swarm/init.js :3 import { spawnSync } from 'child_process';
  • shell package/dist/mcp/fastmcp/tools/swarm/orchestrate.js :4 import { execFileSync } from 'child_process';
  • shell package/dist/mcp/fastmcp/tools/swarm/spawn.js :3 import { spawnSync } from 'child_process';
  • shell package/dist/mcp/standalone-stdio.js :6 import { execFileSync } from 'child_process';
  • shell package/dist/proxy/provider-instructions.js :241 exec('npx agentic-flow --agent researcher --task "analyze security"'),
  • shell package/dist/utils/agentBoosterPreprocessor.js :7 import { spawnSync } from 'child_process';
  • shell package/dist/utils/cli.js :338 exec('npx agentic-flow --agent researcher --task "domain1"'),
  • shell package/dist/utils/mcpCommands.js :2 import { spawn, exec } from 'child_process';
  • shell package/dist/utils/reasoningbankCommands.js :5 import { spawn } from 'child_process';
  • shell package/dist/utils/safe-exec.js :5 * 1. Using execFileSync instead of execSync (no shell interpretation)
  • shell package/dist/workers/consolidated-phases.js :195 { pattern: /child_process.*exec/g, type: 'command-injection-risk', severity: 'medium' },
  • shell (weak) package/validation/docker/test-reasoningbank-npx.mjs :12 import { exec } from 'child_process';

network 19

  • net package/dist/cli/claude-code-wrapper.js :89 const response = await fetch(`http://localhost:${port}/health`);
  • net package/dist/core/embedding-service.js :77 const response = await fetch(this.baseURL, {
  • net package/dist/embeddings/optimized-embedder.js :384 const response = await fetch(modelInfo.url);
  • net package/dist/federation/FederationHubServer.js :8 import { createServer } from 'http';
  • net package/dist/health.js :2 import http from 'http';
  • net package/dist/intelligence/agent-booster-enhanced.js :982 { code: 'await fetch(url)', edit: 'try { await fetch(url) } catch (e) {}', lang: 'javascript' },
  • net package/dist/proxy/anthropic-to-gemini.js :56 const response = await fetch(url, {
  • net package/dist/proxy/anthropic-to-openrouter.js :141 const response = await fetch(`${this.openrouterBaseUrl}/chat/completions`, {
  • net package/dist/proxy/anthropic-to-requesty.js :144 const response = await fetch(`${this.requestyBaseUrl}/chat/completions`, {
  • net package/dist/proxy/http2-proxy.js :173 const response = await fetch(url, {
  • net package/dist/proxy/quic-proxy.js :151 return fetch(url, options);
  • net package/dist/proxy/websocket-proxy.js :14 import { createServer } from 'http';
  • net package/dist/router/providers/ollama.js :4 import axios from 'axios';
  • net package/dist/router/providers/openrouter.js :2 import axios from 'axios';
  • net package/dist/sdk/plugins.js :14 * Assert that a URL is safe to fetch (CWE-918 SSRF mitigation).
  • net package/dist/services/embedding-service.js :74 const response = await fetch(this.baseURL, {
  • net package/dist/swarm/p2p-swarm-v2.js :510 const response = await fetch(`${gateway}${cid}`, {
  • net package/dist/transport/quic-loader.js :25 import { createServer as createHttpsServer } from 'node:https';
  • net package/dist/utils/model-downloader.js :60 const response = await fetch(url);

secrets 37

  • secrets package/dist/agents/claudeAgent.js :25 const geminiKey = process.env.GOOGLE_GEMINI_API_KEY;
  • secrets package/dist/agents/claudeAgentDirect.js :28 apiKey: process.env.GOOGLE_GEMINI_API_KEY || '',
  • secrets package/dist/agents/directApiAgent.js :12 const apiKey = process.env.ANTHROPIC_API_KEY;
  • secrets package/dist/cli-proxy.js :242 console.log(` OPENROUTER_API_KEY: ${process.env.OPENROUTER_API_KEY ? '✓ set' : '✗ not set'}`);
  • secrets package/dist/cli-standalone-proxy.js :103 const apiKey = process.env.GOOGLE_GEMINI_API_KEY;
  • secrets package/dist/cli/claude-code-wrapper.js :43 apiKey: process.env.OPENROUTER_API_KEY || '',
  • secrets package/dist/core/embedding-service.js :349 const apiKey = process.env.OPENAI_API_KEY;
  • secrets (weak) package/dist/examples/use-provider-fallback.js :18 apiKey: process.env.GOOGLE_GEMINI_API_KEY,
  • secrets package/dist/federation/SecurityManager.js :18 this.jwtSecret = process.env.JWT_SECRET || crypto.randomBytes(32).toString('hex');
  • secrets package/dist/federation/integrations/realtime-federation.js :391 const anonKey = process.env.SUPABASE_ANON_KEY;
  • secrets package/dist/federation/integrations/supabase-adapter-debug.js :380 const anonKey = process.env.SUPABASE_ANON_KEY;
  • secrets package/dist/federation/integrations/supabase-adapter.js :246 const anonKey = process.env.SUPABASE_ANON_KEY;
  • secrets package/dist/health.js :9 const apiKey = process.env.ANTHROPIC_API_KEY;
  • secrets package/dist/hooks/p2p-swarm-hooks.js :50 const swarm = await getHooksSwarm(config?.agentId || process.env.AGENTIC_FLOW_SWARM_AGENT_ID, config?.swarmKey || process.env.AGENTIC_FLOW_SWARM_KEY);
  • secrets package/dist/index.js :189 process.env.ANTHROPIC_API_KEY = options.anthropicApiKey;
  • secrets package/dist/middleware/auth.middleware.js :37 jwtSecret: config?.jwtSecret ?? (process.env.JWT_SECRET || ''),
  • secrets package/dist/proxy/adaptive-proxy.js :192 const geminiApiKey = process.env.GOOGLE_GEMINI_API_KEY;
  • secrets package/dist/proxy/anthropic-to-gemini.js :434 const geminiApiKey = process.env.GOOGLE_GEMINI_API_KEY;
  • secrets package/dist/proxy/anthropic-to-openrouter.js :607 const openrouterApiKey = process.env.OPENROUTER_API_KEY;
  • secrets package/dist/proxy/anthropic-to-requesty.js :696 const requestyApiKey = process.env.REQUESTY_API_KEY;
  • secrets package/dist/proxy/http2-proxy-optimized.js :145 geminiApiKey: process.env.GOOGLE_GEMINI_API_KEY,
  • secrets package/dist/proxy/http2-proxy.js :368 const geminiApiKey = process.env.GOOGLE_GEMINI_API_KEY;
  • secrets package/dist/proxy/http3-proxy.js :34 const geminiApiKey = process.env.GOOGLE_GEMINI_API_KEY;
  • secrets package/dist/proxy/quic-proxy.js :197 const openrouterApiKey = process.env.OPENROUTER_API_KEY;
  • secrets package/dist/proxy/websocket-proxy.js :387 const geminiApiKey = process.env.GOOGLE_GEMINI_API_KEY;
  • secrets package/dist/reasoningbank/core/distill.js :42 const hasApiKey = process.env.OPENROUTER_API_KEY ||
  • secrets package/dist/reasoningbank/core/judge.js :33 const hasApiKey = process.env.OPENROUTER_API_KEY ||
  • secrets package/dist/reasoningbank/core/matts.js :189 const hasApiKey = process.env.OPENROUTER_API_KEY ||
  • secrets package/dist/router/providers/onnx-phi4.js :21 huggingfaceApiKey: config.huggingfaceApiKey || process.env.HUGGINGFACE_API_KEY || '',
  • secrets package/dist/router/router.js :55 if (process.env.ANTHROPIC_API_KEY) {
  • secrets (weak) package/dist/router/test-phi4.js :14 huggingfaceApiKey: process.env.HUGGINGFACE_API_KEY
  • secrets package/dist/sdk/e2b-sandbox.js :52 apiKey: config.apiKey || process.env.E2B_API_KEY,
  • secrets package/dist/sdk/e2b-swarm.js :45 apiKey: process.env.E2B_API_KEY,
  • secrets package/dist/services/embedding-service.js :346 const apiKey = process.env.OPENAI_API_KEY;
  • secrets (weak) package/validation/test-gemini-exclusiveMinimum-fix.ts :11 const GOOGLE_GEMINI_API_KEY = process.env.GOOGLE_GEMINI_API_KEY;
  • secrets (weak) package/validation/test-gemini-models.ts :11 const GOOGLE_GEMINI_API_KEY = process.env.GOOGLE_GEMINI_API_KEY;
  • secrets (weak) package/validation/test-provider-fallback.ts :20 apiKey: process.env.GOOGLE_GEMINI_API_KEY || 'test-key',

database 6

  • db package/dist/agentdb/validate-frontier.cjs :12 const Database = require('better-sqlite3');
  • db package/dist/federation/EphemeralAgent.js :10 import Database from 'better-sqlite3';
  • db package/dist/federation/FederationHubServer.js :10 import Database from 'better-sqlite3';
  • db package/dist/intelligence/EmbeddingCache.js :34 BetterSqlite3 = require('better-sqlite3');
  • db package/dist/reasoningbank/db/queries.js :5 import Database from 'better-sqlite3';
  • db package/dist/workers/worker-registry.js :120 const Database = require('better-sqlite3');

install hooks 2

  • postinstall package/package.json :36 node scripts/postinstall.js || true
  • prepublishOnly package/package.json :42 npm run build

declared dependencies 43

  • fastmcp@^3.19.0
  • @anthropic-ai/claude-agent-sdk@^0.1.5
  • @anthropic-ai/sdk@^0.65.0
  • @google/genai@^1.22.0
  • @metaharness/router@^0.3.2
  • @ruvector/core@^0.1.29
  • @ruvector/edge-full@^0.1.0
  • @ruvector/router@^0.1.30
  • @ruvector/ruvllm@^2.5.5
  • @ruvector/tiny-dancer@^0.1.17
  • @supabase/supabase-js@^2.78.0
  • @huggingface/transformers@^3.8.1
  • agentdb@3.0.0-alpha.20
  • axios@^1.12.2
  • dotenv@^16.4.5
  • express@^5.1.0
  • glob@^13.0.0
  • gun@^0.2020.1241
  • http-proxy-middleware@^3.0.5
  • ruvector@0.2.40
  • ruvector-onnx-embeddings-wasm@^0.1.2
  • tiktoken@^1.0.22
  • ulid@^3.0.1
  • ws@^8.20.0
  • yaml@^2.8.1
  • zod@^3.25.76
  • @types/better-sqlite3@^7.6.13
  • @types/express@^5.0.3
  • @types/node@^20.19.19
  • @types/uuid@^11.0.0
  • @types/ws@^8.18.1
  • @vitest/coverage-v8@^4.0.14
  • patch-package@^8.0.1
  • tsx@^4.19.0
  • typescript@^5.6.3
  • vitest@^4.0.14
  • @rollup/rollup-darwin-arm64@^4.59.0
  • @ruvector/attention@^0.1.4
  • @ruvector/sona@^0.1.4
  • better-sqlite3@^11.10.0
  • onnxruntime-node@^1.23.2
  • sharp@^0.34.3
  • sql.js@^1.11.0

transport_posture 2

  • network-listening, binds all interfaces, no auth detected package/dist/config/quic.js :12 host: '0.0.0.0',
  • network-listening, binds all interfaces, no auth detected package/dist/transport/quic-loader.js :166 async listen(port, host = '0.0.0.0') {