[DEPRECATED] This package has been renamed. Please use @ironbee-ai/devtools instead.
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport stdio
verified
reported
listed in the official MCP registry counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed v0.9.1 · analyzer v33 · 4w ago
danger signals1
- suspicious endpoint us.posthog.com (telemetry)
expected for this server's purpose
package/dist/core-LHB3GTND.js :1
kaD8OaYPa4bIqqUoxsCfeFsy",POSTHOG_HOST="https://us.posthog.com",_initialized=!1,_client=null,_anonymousId="",_enabled=!1,_source="mcp-unknown",_mcpTransport,_browserDevtoolsVersion=(()=>{let candidate
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 57
filesystem 1
- fs package/dist/core-ELMAUBJZ.js :1
kdirSync(dir,{recursive:!0}),_logStream=fs.createWriteStream(filePath,{flags:"a"})}function _timeAsS
shell / exec 2
- shell package/dist/cli/runner.js :2
(`Daemon port: ${opts.port}`);let child=spawn(process.execPath,[daemonServerPath,"--port",String(opts - shell package/dist/core-MK77NQWN.js :291
utBytes=0,stderrText="",child;try{child=spawn(cmd,args)}catch(err){finish({reachable:!1,recentLineCount:0,error:err instanceof Error?err.message:String(err)});return}let killTimer=setTimeout(()=>{try{
network 3
- net package/dist/cli/runner.js :2
n port ${port}`);try{let response=await fetch(`http://localhost:${port}/health`,{method:"GET",signal:AbortSignal.timeout(3e3)});if(response.ok){let isRunning=(await response.json()).status==="ok";retu - net package/dist/core-ELMAUBJZ.js :2
async fetchUrl=>{try{let response=await fetch(fetchUrl);return response.ok?{data:await response.text()}:{error:` - net package/dist/core-MK77NQWN.js :603
nc _forwardUpstream(item){let res=await fetch(item.upstreamUrl,{method:item.method,headers:item.headers,body:new Uint8Array(item.body)});if(res.status<200||res.status>=300){let text=await this._safeRe
secrets 1
- secrets package/dist/core-LHB3GTND.js :1
2),"utf-8")}catch{}}var POSTHOG_API_KEY=process.env.POSTHOG_API_KEY??"phc_ekFEnQ9ipk0F1BbO0KCkaD8OaYPa4bIqqUoxsCfeFsy",POSTHOG_HOST="https://us.posthog.com",_initialized=!1,_client=null,_anonymousId="
install hooks 1
- postinstall package/package.json :57
node postinstall.cjs
declared dependencies 58
- @modelcontextprotocol/sdk@^1.23.1
- @aws-sdk/client-bedrock-runtime@^3.966.0
- @aws-sdk/credential-providers@^3.966.0
- @grpc/grpc-js@^1.14.3
- @grpc/proto-loader@^0.7.15
- @hono/mcp@^0.1.4
- @hono/node-server@^1.19.5
- @opentelemetry/core@^2.6.0
- @playwright/browser-chromium@^1.59.1
- @playwright/browser-firefox@^1.59.1
- @playwright/browser-webkit@^1.59.1
- commander@^14.0.1
show 28 more
- hono@^4.11.4
- jpeg-js@^0.4.4
- minisearch@^7.2.0
- picomatch@^4.0.3
- playwright@^1.59.1
- pngjs@^7.0.0
- posthog-node@^5.21.2
- sharp@^0.34.5
- ssim.js@^3.5.0
- stemmer@^2.0.1
- tough-cookie@^5.1.2
- undici@^7.25.0
- ws@^8.19.0
- zod@^3.24.3
- @anthropic-ai/mcpb@^2.1.2
- @anthropic-ai/sdk@^0.32.1
- @anthropic-ai/tokenizer@^0.0.4
- @opentelemetry/auto-instrumentations-web@^0.54.0
- @opentelemetry/context-zone@^2.2.0
- @opentelemetry/exporter-trace-otlp-http@^0.208.0
- @opentelemetry/exporter-trace-otlp-proto@^0.208.0
- @swc/core@^1.15.33
- @swc/jest@^0.2.39
- @types/express@^5.0.6
- @types/jest@^30.0.0
- @types/node@^18.19.87
- @types/picomatch@^4.0.2
- @types/pngjs@^6.0.5
18 more not shown — this panel samples each group; the count above is the real total.
perm:untrusted 1
- untrusted package/dist/core-MK77NQWN.js :1001
ion _fetchJson(url,token){let res=await fetch(url,{method:"GET",headers:{"X-Figma-Token":token,Accept:"application/json"}}),text=await res.text(),json;try{json=text?JSON.parse(text):{}}catch{throw new