MCP Observatory
55s ago Tracked 39,564 Last 55s ago 24h 3,136
npm JavaScript analyzed 3.38.9 unconfirmed MCP

claude-flow

v3.38.9
npm

Ruflo - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration

maintainer
ruvnet
license
MIT
first seen
2026-06-09
last seen
2026-08-14
releases · 30d
56
short id

Drift inferred · capture-to-capture

  1. HIGH code analysis flagged hidden prompt content, committed secret ×2, dynamic code execution ×6 in claude-flow
capabilities 0 tools
transport stdio · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals npm-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v3.38.9 · analyzer v32 · 14h ago

skills & prompt files 199

code evidence v3.38.9 · npm-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 1008

filesystem 176

  • fs (weak) package/.claude-plugin/scripts/ruflo-hook.cjs :28 const fs = require('fs');
  • fs package/.claude/helpers/auto-memory-hook.mjs :14 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
  • fs package/.claude/helpers/context-persistence-hook.mjs :29 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
  • fs package/.claude/helpers/github-safe.js :23 import { writeFileSync, unlinkSync } from 'fs';
  • fs package/.claude/helpers/hook-handler.cjs :17 const fs = require('fs');
  • fs package/.claude/helpers/intelligence.cjs :17 const fs = require('fs');
  • fs package/.claude/helpers/learning-service.mjs :21 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
  • fs package/.claude/helpers/memory.cjs :7 const fs = require('fs');
  • fs package/.claude/helpers/metrics-db.mjs :9 import { readFileSync, writeFileSync, existsSync, mkdirSync, readdirSync, statSync, openSync, writeSync, fsyncSync, closeSync, renameSync, rmSync } from 'fs';
  • fs package/.claude/helpers/patch-aggressive-prune.mjs :36 import { readFileSync, writeFileSync, copyFileSync, existsSync } from 'fs';
  • fs package/.claude/helpers/session.cjs :7 const fs = require('fs');
  • fs package/.claude/helpers/statusline.cjs :23 const fs = require('fs');
  • fs package/v3/@claude-flow/cli/bin/cli.js :12 import { readFileSync } from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/agenticow/speculative-exploration.js :24 import { existsSync, rmSync } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/appliance/gguf-engine.js :14 import { open, readFile, writeFile, stat as fsStat } from 'node:fs/promises';
  • fs package/v3/@claude-flow/cli/dist/src/appliance/ruvllm-bridge.js :15 import { readdir, stat } from 'node:fs/promises';
  • fs package/v3/@claude-flow/cli/dist/src/appliance/rvfa-builder.js :8 import { readFileSync, existsSync, writeFileSync, mkdirSync } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/appliance/rvfa-distribution.js :11 import { readFile, writeFile, rename, unlink, copyFile, mkdir } from 'node:fs/promises';
  • fs package/v3/@claude-flow/cli/dist/src/appliance/rvfa-format.js :11 import { readFile } from 'node:fs/promises';
  • fs package/v3/@claude-flow/cli/dist/src/appliance/rvfa-runner.js :9 import { writeFile, mkdir, rm } from 'node:fs/promises';
  • fs package/v3/@claude-flow/cli/dist/src/appliance/rvfa-signing.js :10 import { readFile, writeFile, stat, chmod, mkdir } from 'node:fs/promises';
  • fs package/v3/@claude-flow/cli/dist/src/auth/client.js :13 import { existsSync } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/autopilot-state.js :11 import { existsSync, readFileSync, mkdirSync, readdirSync } from 'node:fs';
  • fs (weak) package/v3/@claude-flow/cli/dist/src/benchmarks/gaia-agent.js :45 import * as fs from 'node:fs';
  • fs (weak) package/v3/@claude-flow/cli/dist/src/benchmarks/gaia-causal-memory.js :29 import * as fs from 'node:fs';
  • fs (weak) package/v3/@claude-flow/cli/dist/src/benchmarks/gaia-causal-memory.smoke.js :21 import * as fs from 'node:fs';
  • fs (weak) package/v3/@claude-flow/cli/dist/src/benchmarks/gaia-hardness/train-data-loader.js :40 import * as fs from 'node:fs';
  • fs (weak) package/v3/@claude-flow/cli/dist/src/benchmarks/gaia-judge.js :27 import * as fs from 'node:fs';
  • fs (weak) package/v3/@claude-flow/cli/dist/src/benchmarks/gaia-loader.js :20 import * as fs from 'node:fs';
  • fs (weak) package/v3/@claude-flow/cli/dist/src/benchmarks/gaia-tools/file_read.js :28 import * as fs from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/commands/agent.js :10 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/commands/agntcy/publish.js :22 import { readFile } from 'fs/promises';
  • fs package/v3/@claude-flow/cli/dist/src/commands/analyze.js :19 import * as fs from 'fs/promises';
  • fs package/v3/@claude-flow/cli/dist/src/commands/appliance.js :5 import { existsSync, mkdirSync, statSync } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/commands/benchmark.js :8 import { writeFileSync, existsSync, mkdirSync } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/commands/claims.js :7 import { existsSync, readFileSync, writeFileSync, mkdirSync, renameSync } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/commands/cleanup.js :8 import { existsSync, statSync, rmSync, readdirSync, readFileSync, writeFileSync } from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/commands/daemon.js :12 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/commands/deployment.js :8 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/commands/doctor.js :8 import { existsSync, readFileSync, statSync, openSync, readSync, closeSync } from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/commands/eject.js :32 import { existsSync } from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/commands/funnel.js :16 import * as fs from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/commands/guidance.js :5 import { existsSync } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/commands/hive-mind.js :12 import { mkdir, writeFile } from 'fs/promises';
  • fs package/v3/@claude-flow/cli/dist/src/commands/hooks.js :9 import { existsSync, readFileSync, statSync } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/commands/init.js :7 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/commands/memory-distill.js :27 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/commands/metaharness.js :38 import { existsSync, readFileSync } from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/commands/migrate-agent-detection.js :12 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/commands/migrate-agent-restore.js :26 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/commands/migrate.js :6 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/commands/performance.js :8 import * as fs from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/commands/process.js :5 import { readdirSync, writeFileSync, readFileSync, unlinkSync, existsSync, mkdirSync } from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/commands/proxy.js :18 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/commands/route.js :476 await fs.writeFile(filePath, JSON.stringify(data, null, 2));
  • fs package/v3/@claude-flow/cli/dist/src/commands/ruvector/import.js :13 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/commands/ruvector/setup.js :13 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/commands/security.js :9 import { existsSync, statSync } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/commands/session.js :8 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/commands/spinner.js :13 import * as fs from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/commands/start.js :8 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/commands/status.js :7 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/commands/swarm.js :9 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/commands/verify.js :17 import { existsSync, readFileSync } from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/commands/version.js :2 import { existsSync, readFileSync } from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/config/harness-feedback-applier.js :13 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/config/proven-config-refresh.js :16 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/fs-secure.js :19 import { chmodSync, closeSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, writeSync, } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/funnel/event-transport.js :22 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/funnel/events.js :15 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/funnel/local-signals.js :10 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/funnel/precedence.js :14 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/funnel/state.js :8 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/index.js :14 import { readFileSync } from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/init/executor.js :5 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/init/helper-refresh.js :16 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/init/helpers-generator.js :128 const fs = require('fs');
  • fs package/v3/@claude-flow/cli/dist/src/init/memory-package-resolver.js :20 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/init/settings-generator.js :229 // const fs = require('fs'); const p = require('path');
  • fs package/v3/@claude-flow/cli/dist/src/init/statusline-generator.js :12 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/mcp-server.js :24 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/mcp-tools/agent-execute-core.js :10 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/mcp-tools/agent-tools.js :7 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/mcp-tools/agentbbs-tools.js :26 import { existsSync, mkdirSync, readFileSync, writeFileSync, appendFileSync } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/mcp-tools/agenticow-loader.js :17 import { existsSync } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/mcp-tools/browser-intent-tools.js :89 import { readFileSync, existsSync } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/mcp-tools/browser-tools.js :7 import { readFileSync, existsSync } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/mcp-tools/business-pod-tools.js :18 import { readFileSync, existsSync } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/mcp-tools/claims-tools.js :11 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/mcp-tools/config-tools.js :6 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/mcp-tools/coordination-tools.js :13 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/mcp-tools/daa-tools.js :13 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/mcp-tools/embeddings-tools.js :7 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/mcp-tools/github-tools.js :9 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/mcp-tools/guidance-tools.js :11 import { existsSync, readFileSync, readdirSync } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/mcp-tools/hive-mind-tools.js :6 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/mcp-tools/hooks-tools.js :5 import { mkdirSync, writeFileSync, existsSync, readFileSync, statSync, unlinkSync, readdirSync } from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/mcp-tools/memory-tools.js :12 import { existsSync, mkdirSync, readdirSync, readFileSync, unlinkSync, writeFileSync } from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/mcp-tools/metaharness-tools.js :51 import { existsSync, readFileSync } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/mcp-tools/neural-tools.js :16 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/mcp-tools/performance-tools.js :16 import { existsSync, readFileSync, writeFileSync, mkdirSync, unlinkSync, readdirSync } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/mcp-tools/progress-tools.js :8 import { existsSync, readdirSync, readFileSync, writeFileSync, mkdirSync } from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/mcp-tools/session-tools.js :6 import { existsSync, readFileSync, readdirSync, unlinkSync, statSync, writeFileSync } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/mcp-tools/swarm-tools.js :7 import { closeSync, existsSync, mkdirSync, openSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync, } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/mcp-tools/system-tools.js :13 import { existsSync, readFileSync, writeFileSync, mkdirSync, statfsSync } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/mcp-tools/task-tools.js :6 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/mcp-tools/terminal-tools.js :7 import { existsSync } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/mcp-tools/testgen-tools.js :25 import { existsSync } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/mcp-tools/wasm-agent-tools.js :11 import { readFileSync, existsSync } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/mcp-tools/workflow-tools.js :6 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/memory/ewc-consolidation.js :33 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/memory/graph-edge-writer.js :33 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/memory/intelligence.js :13 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/memory/memory-initializer.js :11 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/memory/rabitq-index.js :13 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/memory/sona-optimizer.js :16 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/permission/permission-audit.js :10 import * as fs from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/plugins/manager.js :6 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/proxy/install.js :11 import * as fs from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/proxy/lifecycle.js :32 import * as fs from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/proxy/token-bridge.js :2 import * as fs from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/ruvector/agent-wasm.js :13 import { readFileSync } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/ruvector/coverage-router.js :10 import { existsSync } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/ruvector/enhanced-model-router.js :11 import { existsSync, readFileSync, writeFileSync } from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/ruvector/graph-analyzer.js :14 import { readFile, readdir, stat } from 'fs/promises';
  • fs package/v3/@claude-flow/cli/dist/src/ruvector/lora-adapter.js :20 import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/ruvector/model-router.js :39 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/ruvector/neural-router.js :29 import { existsSync, readFileSync } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/ruvector/q-learning-router.js :16 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/ruvector/router-parallel-recorder.js :48 import { appendFileSync, mkdirSync, existsSync, statSync, renameSync, unlinkSync } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/ruvector/router-trajectory.js :31 import { appendFileSync, mkdirSync, existsSync, statSync, renameSync, unlinkSync } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/ruvector/run-transcript-recorder.js :53 import { appendFileSync, mkdirSync, existsSync, statSync, renameSync, unlinkSync, readFileSync } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/ruvector/ruvllm-wasm.js :23 import { readFileSync } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/ruvector/trajectory-tree.js :41 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/ruvector/wasm-embedder.js :17 import { readFileSync } from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/services/ai-job-dedup.js :24 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/services/claim-service.js :16 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/services/config-file-manager.js :5 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/services/container-worker-pool.js :21 import { existsSync, mkdirSync } from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/services/daemon-autostart.js :31 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/services/distill-tuning.js :39 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/services/fable-harness.js :36 import { mkdtemp, rm } from 'fs/promises';
  • fs package/v3/@claude-flow/cli/dist/src/services/flywheel-transaction.js :9 import * as fs from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/services/git-workspace-identity.js :27 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/services/global-ai-budget.js :30 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/services/harness-flywheel-generations.js :21 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/services/harness-frozen-eval.js :17 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/services/harness-improvement-ledger.js :14 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/services/harness-project-anchor.js :9 import { existsSync, readFileSync, realpathSync, } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/services/harness-qualification.js :19 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/services/harness-replay.js :11 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/services/harness-worker.js :18 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/services/headless-worker-executor.js :23 import { existsSync, readFileSync, readdirSync, mkdirSync, writeFileSync } from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/services/memory-backup.js :15 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/services/memory-distillation.js :27 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/services/native-training.js :20 import { mkdirSync, existsSync } from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/services/policy-runtime.js :4 import { closeSync, existsSync, mkdirSync, openSync, readFileSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync, } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/services/repo-supervisor.js :30 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/services/swarm-memory-branches.js :43 import { existsSync, mkdirSync, readFileSync, writeFileSync, rmSync } from 'node:fs';
  • fs package/v3/@claude-flow/cli/dist/src/services/worker-daemon.js :14 import { existsSync, mkdirSync, writeFileSync, readFileSync, appendFileSync, unlinkSync } from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/services/workspace-lease.js :22 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/transfer/export.js :5 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/transfer/storage/gcs.js :9 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/transfer/store/download.js :5 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/transfer/store/publish.js :5 import * as fs from 'fs';
  • fs (weak) package/v3/@claude-flow/cli/dist/src/transfer/test-seraphine.js :5 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/update/executor.js :6 import * as fs from 'fs';
  • fs package/v3/@claude-flow/cli/dist/src/update/rate-limiter.js :5 import * as fs from 'fs';
  • fs package/v3/@claude-flow/guidance/dist/analyzer.js :358 await fs.writeFile(claudeMdPath, this.contextContent, 'utf-8');
  • fs package/v3/@claude-flow/guidance/dist/index.js :23 import { readFile } from 'node:fs/promises';
  • fs package/v3/@claude-flow/guidance/dist/persistence.js :15 import { mkdir, readFile, writeFile, appendFile, stat, unlink, rename } from 'node:fs/promises';
  • fs package/v3/@claude-flow/shared/dist/core/config/loader.js :5 import { readFile } from 'fs/promises';
  • fs package/v3/@claude-flow/shared/dist/core/orchestrator/session-manager.js :7 import { mkdir, writeFile, readFile } from 'fs/promises';
  • fs package/v3/@claude-flow/shared/dist/events/event-store.js :18 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
  • fs package/v3/@claude-flow/shared/dist/events/rvf-event-log.js :18 import { existsSync, mkdirSync, readFileSync, writeFileSync, appendFileSync, renameSync } from 'node:fs';
  • fs package/v3/@claude-flow/shared/dist/services/v3-progress.service.js :14 import { promises as fs, existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';

shell / exec 61

  • shell (weak) package/.claude-plugin/scripts/ruflo-hook.cjs :27 const { spawnSync, execSync } = require('child_process');
  • shell package/.claude/helpers/github-safe.js :22 import { execSync, execFileSync } from 'child_process';
  • shell package/.claude/helpers/hook-handler.cjs :82 const { spawn } = require('child_process');
  • shell package/.claude/helpers/learning-service.mjs :24 import { execSync, spawn } from 'child_process';
  • shell package/.claude/helpers/metrics-db.mjs :12 import { execSync } from 'child_process';
  • shell package/.claude/helpers/statusline.cjs :25 const { execSync } = require('child_process');
  • shell package/.claude/statusline.mjs :6 import { execSync } from 'child_process';
  • shell package/v3/@claude-flow/cli/dist/src/appliance/rvfa-builder.js :10 import { execSync } from 'node:child_process';
  • shell package/v3/@claude-flow/cli/dist/src/appliance/rvfa-runner.js :11 import { spawn } from 'node:child_process';
  • shell (weak) package/v3/@claude-flow/cli/dist/src/benchmarks/gaia-agent.js :44 import { execSync } from 'node:child_process';
  • shell (weak) package/v3/@claude-flow/cli/dist/src/benchmarks/gaia-critic.js :35 import { execSync } from 'node:child_process';
  • shell (weak) package/v3/@claude-flow/cli/dist/src/benchmarks/gaia-decomposer.js :36 import { execSync } from 'node:child_process';
  • shell (weak) package/v3/@claude-flow/cli/dist/src/benchmarks/gaia-judge.js :30 import { execSync } from 'node:child_process';
  • shell (weak) package/v3/@claude-flow/cli/dist/src/benchmarks/gaia-loader.js :19 import { execSync } from 'node:child_process';
  • shell (weak) package/v3/@claude-flow/cli/dist/src/benchmarks/gaia-tools/file_read.js :30 import { execFileSync } from 'node:child_process';
  • shell (weak) package/v3/@claude-flow/cli/dist/src/benchmarks/gaia-tools/grounded_query.js :55 const { execSync } = await import('node:child_process');
  • shell package/v3/@claude-flow/cli/dist/src/business-pods/bbs-budget-tracker.js :98 // Ensure schema is present. exec() is a no-op for tables that already
  • shell package/v3/@claude-flow/cli/dist/src/commands/analyze.js :22 import { execSync } from 'child_process';
  • shell package/v3/@claude-flow/cli/dist/src/commands/daemon.js :8 import { fork } from 'child_process';
  • shell package/v3/@claude-flow/cli/dist/src/commands/doctor.js :12 import { execSync, exec } from 'child_process';
  • shell package/v3/@claude-flow/cli/dist/src/commands/eject.js :31 import { spawnSync } from 'child_process';
  • shell package/v3/@claude-flow/cli/dist/src/commands/funnel.js :15 import { execFile } from 'node:child_process';
  • shell package/v3/@claude-flow/cli/dist/src/commands/hive-mind.js :11 import { spawn as childSpawn, execSync } from 'child_process';
  • shell package/v3/@claude-flow/cli/dist/src/commands/hooks.js :3597 const { execSync } = await import('child_process');
  • shell package/v3/@claude-flow/cli/dist/src/commands/init.js :9 import { spawnSync } from 'node:child_process';
  • shell package/v3/@claude-flow/cli/dist/src/commands/metaharness.js :37 import { spawnSync } from 'child_process';
  • shell package/v3/@claude-flow/cli/dist/src/commands/neural.js :1445 'eval(', 'Function(', 'exec(', 'spawn(',
  • shell package/v3/@claude-flow/cli/dist/src/commands/ruvector/import.js :307 const { execFileSync } = await import('child_process');
  • shell package/v3/@claude-flow/cli/dist/src/commands/security.js :8 import { execSync } from 'node:child_process';
  • shell package/v3/@claude-flow/cli/dist/src/funnel/local-signals.js :12 import { execSync } from 'child_process';
  • shell package/v3/@claude-flow/cli/dist/src/init/executor.js :302 const gitRootResolver = "var c=require('child_process'),p=require('path'),u=require('url'),r;"
  • shell package/v3/@claude-flow/cli/dist/src/init/helpers-generator.js :452 "const { spawn } = require('child_process');",
  • shell package/v3/@claude-flow/cli/dist/src/mcp-client.js :42 import { execFileSync } from 'node:child_process';
  • shell package/v3/@claude-flow/cli/dist/src/mcp-server.js :20 import { execFileSync } from 'child_process';
  • shell package/v3/@claude-flow/cli/dist/src/mcp-tools/auto-install.js :7 import { spawnSync } from 'child_process';
  • shell package/v3/@claude-flow/cli/dist/src/mcp-tools/browser-session-tools.js :32 const { execFile } = await import('node:child_process');
  • shell package/v3/@claude-flow/cli/dist/src/mcp-tools/browser-tools.js :19 const { execFileSync } = await import('child_process');
  • shell package/v3/@claude-flow/cli/dist/src/mcp-tools/github-tools.js :11 import { execFileSync, execSync } from 'node:child_process';
  • shell package/v3/@claude-flow/cli/dist/src/mcp-tools/hive-mind-tools.js :151 count: { type: 'number', description: 'Number of workers to spawn (default: 1)', default: 1 },
  • shell package/v3/@claude-flow/cli/dist/src/mcp-tools/metaharness-tools.js :50 import { spawn } from 'node:child_process';
  • shell package/v3/@claude-flow/cli/dist/src/mcp-tools/terminal-tools.js :11 import { execSync } from 'node:child_process';
  • shell package/v3/@claude-flow/cli/dist/src/mcp-tools/testgen-tools.js :24 import { spawn } from 'node:child_process';
  • shell package/v3/@claude-flow/cli/dist/src/plugins/manager.js :8 import { execFile } from 'child_process';
  • shell package/v3/@claude-flow/cli/dist/src/proxy/lifecycle.js :6 * native binary instead of a forked Node process. `spawn()` here passes zero
  • shell package/v3/@claude-flow/cli/dist/src/ruvector/diff-classifier.js :4 import { execFileSync, execFile } from 'node:child_process';
  • shell package/v3/@claude-flow/cli/dist/src/services/claim-service.js :18 import { execFileSync } from 'child_process';
  • shell package/v3/@claude-flow/cli/dist/src/services/container-worker-pool.js :19 import { spawn, exec } from 'child_process';
  • shell package/v3/@claude-flow/cli/dist/src/services/daemon-autostart.js :33 import { spawn } from 'child_process';
  • shell package/v3/@claude-flow/cli/dist/src/services/distill-oracle.js :37 import { spawn } from 'child_process';
  • shell package/v3/@claude-flow/cli/dist/src/services/fable-harness.js :35 import { spawn } from 'child_process';
  • shell package/v3/@claude-flow/cli/dist/src/services/git-workspace-identity.js :24 import { execFileSync } from 'child_process';
  • shell package/v3/@claude-flow/cli/dist/src/services/harness-hosts.js :13 import { execFileSync } from 'child_process';
  • shell package/v3/@claude-flow/cli/dist/src/services/headless-worker-executor.js :21 import { spawn, execSync } from 'child_process';
  • shell package/v3/@claude-flow/cli/dist/src/services/memory-backup.js :85 const { execFileSync } = await import('child_process');
  • shell package/v3/@claude-flow/cli/dist/src/services/policy-runtime.js :3 import { execFileSync } from 'node:child_process';
  • shell package/v3/@claude-flow/cli/dist/src/services/weight-eft.js :36 import { spawnSync } from 'node:child_process';
  • shell package/v3/@claude-flow/cli/dist/src/transfer/storage/gcs.js :11 import { execFileSync } from 'child_process';
  • shell package/v3/@claude-flow/cli/dist/src/update/executor.js :5 import { execFileSync } from 'child_process';
  • shell package/v3/@claude-flow/guidance/dist/analyzer.js :344 const { execFile } = await import('node:child_process');
  • shell package/v3/@claude-flow/guidance/dist/headless.js :21 const { execFile } = await import('node:child_process');
  • shell package/v3/@claude-flow/shared/dist/core/orchestrator/lifecycle-manager.js :56 async spawn(config) {

network 29

  • net package/v3/@claude-flow/cli/dist/src/appliance/rvfa-distribution.js :13 import { request as httpsRequest } from 'node:https';
  • net (weak) package/v3/@claude-flow/cli/dist/src/benchmarks/gaia-agent.js :235 res = await fetch(ANTHROPIC_API_URL, {
  • net (weak) package/v3/@claude-flow/cli/dist/src/benchmarks/gaia-critic.js :193 const response = await fetch(ANTHROPIC_API_URL, {
  • net (weak) package/v3/@claude-flow/cli/dist/src/benchmarks/gaia-decomposer.js :87 const response = await fetch(ANTHROPIC_API_URL, {
  • net (weak) package/v3/@claude-flow/cli/dist/src/benchmarks/gaia-judge.js :21 * API pattern: raw fetch() against https://api.anthropic.com/v1/messages —
  • net (weak) package/v3/@claude-flow/cli/dist/src/benchmarks/gaia-loader.js :23 import * as https from 'node:https';
  • net (weak) package/v3/@claude-flow/cli/dist/src/benchmarks/gaia-tools/grounded_query.js :89 const resp = await fetch(url, {
  • net (weak) package/v3/@claude-flow/cli/dist/src/benchmarks/gaia-tools/web_search.js :18 import * as https from 'node:https';
  • net package/v3/@claude-flow/cli/dist/src/commands/doctor.js :1493 const resp = await fetch(`http://${bind}/status`, {
  • net package/v3/@claude-flow/cli/dist/src/commands/neural.js :1153 const response = await fetch('https://api.pinata.cloud/pinning/pinJSONToIPFS', {
  • net package/v3/@claude-flow/cli/dist/src/commands/providers.js :82 const res = await fetch(endpointConfig.url, {
  • net package/v3/@claude-flow/cli/dist/src/commands/verify.js :26 const res = await fetch(url, { signal: AbortSignal.timeout(30000) });
  • net package/v3/@claude-flow/cli/dist/src/funnel/event-transport.js :23 import * as https from 'https';
  • net package/v3/@claude-flow/cli/dist/src/funnel/message-transport.js :33 import * as https from 'https';
  • net package/v3/@claude-flow/cli/dist/src/mcp-server.js :21 import { request as httpRequestFn } from 'http';
  • net package/v3/@claude-flow/cli/dist/src/mcp-tools/agent-execute-core.js :166 const res = await fetch('https://api.anthropic.com/v1/messages', {
  • net package/v3/@claude-flow/cli/dist/src/mcp-tools/browser-intent-tools.js :88 import { createServer } from 'node:http';
  • net package/v3/@claude-flow/cli/dist/src/mcp-tools/http-fetch-tools.js :205 const response = await fetch(parsed.toString(), {
  • net package/v3/@claude-flow/cli/dist/src/mcp-tools/managed-agent-tools.js :47 res = await fetch(`${API_BASE}/v1${path}`, {
  • net package/v3/@claude-flow/cli/dist/src/plugins/store/discovery.js :15 const downloadsRes = await fetch(downloadsUrl, { signal: AbortSignal.timeout(3000) });
  • net package/v3/@claude-flow/cli/dist/src/proxy/release.js :52 const response = await fetch(url, { redirect: 'follow', signal: AbortSignal.timeout(120_000) });
  • net package/v3/@claude-flow/cli/dist/src/services/registry-api.js :35 const response = await fetch(`${REGISTRY_API_URL}?action=rate`, {
  • net package/v3/@claude-flow/cli/dist/src/transfer/ipfs/client.js :48 const response = await fetch(`${gateway}/api/v0/name/resolve?arg=/ipns/${ipnsName}`, {
  • net package/v3/@claude-flow/cli/dist/src/transfer/ipfs/upload.js :56 const response = await fetch(`${endpoint}/upload`, {
  • net package/v3/@claude-flow/cli/dist/src/transfer/store/discovery.js :104 const response = await fetch(`${gateway}/api/v0/name/resolve?arg=${ipnsName}`, {
  • net package/v3/@claude-flow/cli/dist/src/transfer/store/download.js :132 const response = await fetch(url);
  • net package/v3/@claude-flow/cli/dist/src/update/checker.js :35 const response = await fetch(`https://registry.npmjs.org/${encodeURIComponent(packageName)}`, {
  • net package/v3/@claude-flow/shared/dist/mcp/transport/http.js :16 import { createServer } from 'http';
  • net package/v3/@claude-flow/shared/dist/mcp/transport/websocket.js :16 import { createServer } from 'http';

secrets 25

  • secrets package/.claude/helpers/context-persistence-hook.mjs :716 const password = process.env.RUVECTOR_PASSWORD || process.env.PGPASSWORD;
  • secrets (weak) package/v3/@claude-flow/cli/dist/src/benchmarks/gaia-agent.js :104 const envKey = process.env.ANTHROPIC_API_KEY;
  • secrets (weak) package/v3/@claude-flow/cli/dist/src/benchmarks/gaia-critic.js :57 const fromEnv = process.env['ANTHROPIC_API_KEY'];
  • secrets (weak) package/v3/@claude-flow/cli/dist/src/benchmarks/gaia-decomposer.js :66 const envKey = process.env.ANTHROPIC_API_KEY;
  • secrets (weak) package/v3/@claude-flow/cli/dist/src/benchmarks/gaia-decomposer.smoke.js :78 process.env.ANTHROPIC_API_KEY = 'sk-ant-test-key';
  • secrets (weak) package/v3/@claude-flow/cli/dist/src/benchmarks/gaia-e2e-smoke.js :49 const hasKey = !!(process.env.ANTHROPIC_API_KEY?.trim());
  • secrets (weak) package/v3/@claude-flow/cli/dist/src/benchmarks/gaia-judge.js :155 const envKey = process.env.ANTHROPIC_API_KEY;
  • secrets (weak) package/v3/@claude-flow/cli/dist/src/benchmarks/gaia-loader.js :36 const envToken = process.env.HF_TOKEN;
  • secrets (weak) package/v3/@claude-flow/cli/dist/src/benchmarks/gaia-tools/grounded_query.js :15 * 1. process.env.GOOGLE_AI_API_KEY
  • secrets package/v3/@claude-flow/cli/dist/src/commands/doctor.js :1964 const rawKey = process.env.CLAUDE_FLOW_ENCRYPTION_KEY;
  • secrets package/v3/@claude-flow/cli/dist/src/commands/neural.js :1146 const pinataKey = process.env.PINATA_API_KEY;
  • secrets package/v3/@claude-flow/cli/dist/src/commands/ruvector/backup.js :17 password: ctx.flags.password || process.env.PGPASSWORD || '',
  • secrets package/v3/@claude-flow/cli/dist/src/commands/ruvector/benchmark.js :17 password: ctx.flags.password || process.env.PGPASSWORD || '',
  • secrets package/v3/@claude-flow/cli/dist/src/commands/ruvector/init.js :17 password: ctx.flags.password || process.env.PGPASSWORD || '',
  • secrets package/v3/@claude-flow/cli/dist/src/commands/ruvector/migrate.js :143 password: ctx.flags.password || process.env.PGPASSWORD || '',
  • secrets package/v3/@claude-flow/cli/dist/src/commands/ruvector/optimize.js :17 password: ctx.flags.password || process.env.PGPASSWORD || '',
  • secrets package/v3/@claude-flow/cli/dist/src/commands/ruvector/status.js :16 password: ctx.flags.password || process.env.PGPASSWORD || '',
  • secrets package/v3/@claude-flow/cli/dist/src/mcp-tools/agent-execute-core.js :103 const ollamaKey = process.env.OLLAMA_API_KEY;
  • secrets package/v3/@claude-flow/cli/dist/src/mcp-tools/managed-agent-tools.js :27 return process.env.ANTHROPIC_API_KEY || process.env.CLAUDE_API_KEY || null;
  • secrets package/v3/@claude-flow/cli/dist/src/ruvector/agent-wasm.js :103 const hasAny = !!(process.env.ANTHROPIC_API_KEY || process.env.OPENROUTER_API_KEY || process.env.OLLAMA_API_KEY);
  • secrets package/v3/@claude-flow/cli/dist/src/ruvector/model-router.js :101 const hasOpenRouter = !!process.env.OPENROUTER_API_KEY;
  • secrets package/v3/@claude-flow/cli/dist/src/services/container-worker-pool.js :283 ANTHROPIC_API_KEY: process.env.ANTHROPIC_API_KEY || '',
  • secrets package/v3/@claude-flow/cli/dist/src/services/policy-runtime.js :196 signingKey: process.env.CLAUDE_FLOW_POLICY_SIGNING_KEY,
  • secrets package/v3/@claude-flow/cli/dist/src/transfer/ipfs/upload.js :13 return process.env.WEB3_STORAGE_TOKEN ||
  • secrets package/v3/@claude-flow/cli/dist/src/transfer/storage/gcs.js :22 keyFile: process.env.GOOGLE_APPLICATION_CREDENTIALS,

database 2

  • db package/.claude/helpers/context-persistence-hook.mjs :99 const Database = require('better-sqlite3');
  • db package/.claude/helpers/learning-service.mjs :25 import Database from 'better-sqlite3';

install hooks 3

  • prepublishOnly package/package.json :55 node scripts/prepare-root-publish.mjs
  • postinstall package/v3/@claude-flow/cli/package.json :89 node ./scripts/postinstall.cjs
  • prepublishOnly package/v3/@claude-flow/cli/package.json :90 node scripts/prepare-publish.mjs

declared dependencies 37

  • @claude-flow/cli-core@3.7.0-alpha.5
  • @claude-flow/codex@3.0.3
  • @claude-flow/mcp@3.0.0-alpha.9
  • @claude-flow/neural@3.0.0-alpha.9
  • @claude-flow/plugin-agent-federation@1.0.0-alpha.18
  • @claude-flow/security@3.0.0-alpha.14
  • @claude-flow/shared@3.0.0-alpha.8
  • @iarna/toml@^2.2.5
  • @noble/ed25519@2.3.0
  • @ruvector/rabitq-wasm@0.1.0
  • bcryptjs@^3.0.3
  • chalk@^5.3.0
  • commander@^12.0.0
  • fs-extra@^11.2.0
  • inquirer@^9.2.0
  • semver@7.7.3
  • toml@^3.0.0
  • ws@>=8.21.0
  • yaml@^2.8.0
  • zod@3.25.76
  • @openai/codex@^0.98.0
  • @types/bcrypt@^5.0.2
  • @types/node@^20.0.0
  • eslint@^8.0.0
  • tsx@^4.21.0
  • typescript@^5.0.0
  • vitest@^3.2.6
  • @napi-rs/keyring@1.3.0
  • @claude-flow/plugin-gastown-bridge@^0.1.3
  • @ruvector/attention@^0.1.3
  • @ruvector/core@^0.1.30
  • @ruvector/router@^0.1.30
  • @ruvector/router-linux-x64-gnu@^0.1.30
  • @ruvector/sona@^0.1.5
  • agentdb@^3.0.0-alpha.17
  • agentic-flow@^2.0.14
  • better-sqlite3@12.9.0

obfuscation 7

  • dynamic require()/import() package/.claude/helpers/auto-memory-hook.mjs :178 return await import(`file://${rec.distPath}`);
  • dynamic require()/import() package/.claude/helpers/context-persistence-hook.mjs :757 memPkg = await import(`file://${localDist}`);
  • dynamic require()/import() package/v3/@claude-flow/cli/dist/src/commands/gaia-bench.js :231 const { loadGaia } = (await import(benchmarksBase + 'gaia-loader.js'));
  • dynamic require()/import() package/v3/@claude-flow/cli/dist/src/commands/init.js :57 const mod = await import(`file://${projectPath}`);
  • dynamic require()/import() package/v3/@claude-flow/cli/dist/src/init/helpers-generator.js :1043 return await import(\`file://\${rec.distPath}\`);
  • dynamic require()/import() package/v3/@claude-flow/cli/dist/src/mcp-tools/auto-install.js :79 return await import(`${packageName}${cacheBuster}`);
  • dynamic require()/import() package/v3/@claude-flow/cli/dist/src/mcp-tools/security-tools.js :96 const aidefence = await import(`file://${modulePath}${cacheBust}`);

perm:untrusted 1

  • untrusted package/v3/@claude-flow/cli/dist/src/mcp-tools/http-fetch-tools.js :290 description: 'ADR-164 §5.1.8 — HTTP probe primitive for business-pod ops benches (synthetic 200/500 endpoint checks, third-party status pages). Default-secure: blocks file://, ftp://, RFC-1918 / loopb