MCP Observatory
49s ago Tracked 59,450 Last 49s ago 24h 2,448
npm JavaScript analyzed 4.376.0 deep scan · partial (45/521 files)

decocms

v4.376.0
npm

Deco CMS — Self-hostable MCP Gateway for managing AI connections and tools

maintainer
camudo
licence
MIT
first seen
2026-05-22
last seen
2026-09-17
releases · 30d
1645
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools
transport stdio counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals npm-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v4.376.0 · analyzer v33 · 12m ago

danger signals5

code evidence v4.376.0 · npm-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 477

filesystem 1

  • fs package/dist/server/cli.js :5 ns argument");return $.mkdir=$.mkdir||$.fs.mkdir||I0.default.mkdir,$.mkdirAsync=y21($.mkdir),$.stat=$.stat||$.fs.stat||I0.default.stat,$.statAsync=y21($.stat),$.statSync=$.statSync||$.fs.statSync||I0.

shell / exec 1

  • shell package/dist/server/cli.js :28 e, falling back to git clone..."),await Bun.spawn(["git","clone","--depth=1","https://github.com/decocms/mcp-app.git",Z],{stdout:"inherit",stderr:"inherit"}).exited!==0)console.error("Failed to clone

network 56

  • net package/dist/client/assets/admin-fetch-CCSvjTk1.js :1 async function r(a,e){const t=await fetch(a,{credentials:"include",...e});if(!t.ok){const n=await t.json().catch(()=>({}));throw new Error(n.error||`Request failed (HTTP ${t.status})`)}return await t.
  • net package/dist/client/assets/agent-analytics-BJTe-WT2.js :1 f n)}async function xt(n){const e=await fetch(n),i=await e.json().catch(()=>({}));if(!e.ok){const a=i&&typeof i=="object"&&"error"in i?String(i.error):`request failed (${e.status})`;throw new et(a,e.s
  • net package/dist/client/assets/agent-automation-BIgf2eVS.js :6 -d '{"hello":"world"}'`:"",_=n&&s?f==="header"?`await fetch("${S}", {
  • net package/dist/client/assets/agent-e2e-DgZKhQJU.js :1 =401}async function ds(n){const e=await fetch(n),s=await e.json().catch(()=>({}));if(!e.ok){const l=s&&typeof s=="object"&&"error"in s?String(s.error):`request failed (${e.status})`;throw new Nt(l,e.s
  • net package/dist/client/assets/agent-hosting-qLrSaTBn.js :1 e})`}async function Kt(r){const e=await fetch(r),o=await e.json().catch(()=>({}));if(!e.ok)throw new It(us(o,e.status),e.status);return o}async function at(r,e,o){const l=await fetch(r,{method:e,heade
  • net package/dist/client/assets/agent-monitor-DtdoOdMx.js :1 00"];async function g3(t){const e=await fetch(t),n=await e.json().catch(()=>({}));if(!e.ok){const r=n&&typeof n=="object"&&"error"in n?String(n.error):`request failed (${e.status})`;throw new Error(r)
  • net package/dist/client/assets/agent-site-editor-Dkn6uW5_.js :24 lMcpId||!t.branch?Promise.resolve(null):fetch(qn(_,`exec/${encodeURIComponent(M)}`),{method:"POST"}),m=M=>!t.virtualMcpId||!t.branch?Promise.resolve(null):fetch(qn(_,`
  • net package/dist/client/assets/agent-site-editor-code-DZCjGWZ6.js :2 ,branch:o,threadId:r},"config"),c=await fetch(h);return c.ok?(await c.json()).repoDir??null:null},t[5]=o,t[6]=m,t[7]=r,t[8]=i,t[9]=n):n=t[9];let a;return t[10]!==s||t[11]!==l||t[12]!==n?(a={queryKey:l
  • net package/dist/client/assets/agent-site-editor-content-DhLz2SwC.js :2 itle)}async function hl(){const t=await fetch("/api/deco-apps");if(!t.ok)throw new Error(`Failed to fetch deco apps: ${t.status}`);return(await t.json()).apps??[]}function gl(t,e,n){const o=je.c(12),c
  • net package/dist/client/assets/agent-site-editor-preview-eh-T4gl9.js :434 return fetch(src, {
  • net package/dist/client/assets/agents-list-J7lqHacr.js :1 }async function Ie(e,t,o){const i=await fetch(e,t),r=await i.json().catch(()=>({}));if(!i.ok)throw new Error(r.error??`${o} (${i.status})`);return r}function Vt(e){return Ie(`/api/${e}/deco-sites`,voi
  • net package/dist/client/assets/asset-utils-BcGTQmUM.js :1 ype||"application/octet-stream",n=await fetch(`/api/${encodeURIComponent(t.slug)}/file-configs/${encodeURIComponent(c.configId)}/upload?filename=${encodeURIComponent(c.file.name)}`,{method:"POST",head
show 28 more
  • net package/dist/client/assets/auth-entry-4lTFP5BN.js :1 ;try{d=await Qe(async()=>{const g=await fetch("/api/auth/custom/local-session",{method:"POST",credentials:"include"});if(g.status>=500)throw new ke(g);return g},{maxAttempts:5,minTimeout:1e3,maxTimeou
  • net package/dist/client/assets/authenticate-and-persist-oauth-D3Kb-cEZ.js :1 import"./index-COJyT2bn.js";import{i as u,a as p}from"./mcp-oauth-BX-s6twV.js";async function k({connectionId:n,orgId:s,orgSlug:o,persistFallback:r}){const c=new URL(`/api/${o}/mcp/${n}`,window.locati
  • net package/dist/client/assets/chat-context-BYHljAsB.js :37 we=async()=>{m.stop();try{const l=await fetch(`
  • net package/dist/client/assets/choose-editor-CT6dxgF8.js :1 e=new URLSearchParams({site:t}),l=await fetch(`/api/_editor-resolve?${e.toString()}`,
  • net package/dist/client/assets/connection-detail-DT02vAy0.js :1 :F??""}));return}if(C)try{const L=await fetch(`/api/${f.slug}/connections/${p}/oauth-token`,{method:"POST",headers:{"Content-Type":"application/json"},credentials:"include",body:JSON.stringify({access
  • net package/dist/client/assets/decofile-api-DmitnqlG.js :1 d")}async function I(e,t){const o=await fetch(s(t),{cache:"no-store"});if(!o.ok){const i=new Error(`Failed to fetch decofile: ${o.status}`);throw i.status=o.status,i}const n=await o.json();return n.to
  • net package/dist/client/assets/file-explorer-jsQSheKe.js :1 1);async function ie(t,n){const o=await fetch(Hr(x,t),{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(n)});if(!o.ok){const c=await o.json().catch(()=>({}));throw new Err
  • net package/dist/client/assets/file-share-button-XI0XmzQG.js :3 n}try{if(l.source===null){const w=await fetch(a.readUrl,{credentials:"include"});if(!w.ok)throw new Error(`HTTP ${w.status}`);l.source=await w.text()}const c=Ae(l.source);if(c===null||c!==o.witness.ch
  • net package/dist/client/assets/hooks-BOS6vZ4t.js :11 rtSignal.any([r,h]):h;let R;try{R=await fetch(c,{method:"POST",credentials:"include",headers:{"content-type":"application/json"},body:JSON.stringify(u),signal:I})}catch(M){throw h.aborted&&!r?.aborted
  • net package/dist/client/assets/hooks-CMDCYMGT.js :2 :!0},E="updated",w(E,c);const L=await S.fetch(T.query||"",i);if(L.status==="aborted")return;const K=e.getState(l.state);if(!K?.active){S.abort();return}c=L.status==="resolved"?{...c,items:L.items,load
  • net package/dist/client/assets/index-COJyT2bn.js :2 (n){if(n.ep)return;n.ep=!0;const i=o(n);fetch(n.href,i)}})();const CU="modulepreload",PU=function(e){return"/"+e},v1={},je=function(t,o,a){let n=Promise.resolve();if(o&&o.length>0){let l=function(p){r
  • net package/dist/client/assets/index-D522cKSf.js :1 token&&(s.eventSourceInit={fetch:(o,a)=>fetch(o,{...a,headers:{...i,Accept:"text/event-stream"},signal:e})}),new of(new URL(t.url),s)}return new hf(new URL(t.url),{requestInit:{headers:i,signal:e,cred
  • net package/dist/client/assets/infiniteQueryObserver-C2EEO2RI.js :1 cResult(e)}fetchNextPage(e){return this.fetch({...e,meta:{fetchMore:{direction:"forward"}}})}fetchPreviousPage(e){return this.fetch({...e,meta:{fetchMore:{direction:"backward"}}})}createResult(e,t){co
  • net package/dist/client/assets/mcp-oauth-BX-s6twV.js :1 _(),r=!n||new URL(n).origin===o,a=await fetch(s,{credentials:r?"include":"omit"});return a.ok?{hasToken:(await a.json()).hasToken===!0}:{hasToken:!1}}catch{return{hasToken:!1}}}async function te({url:
  • net package/dist/client/assets/mustache-B1tltvSE.js :1 0,existed:!0}}const c=V(n,X(o)),u=await fetch(`/api/${s}/sandbox/${encodeURIComponent(e)}/${encodeURIComponent(t)}/unlink`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringif
  • net package/dist/client/assets/onboarding-ml0KhpSL.js :1 }]:[]}async function Je(){const i=await fetch("/api/auth/custom/domain-lookup",{credentials:"include"});if(!i.ok)throw new Error(`Failed to look up domain (${i.status})`);return i.json()}function be(i
  • net package/dist/client/assets/organization-choice-DyBOUTdt.js :1 ";async function T(i,e,p){const o=await fetch(i,{method:"POST",credentials:"include",headers:{"Content-Type":"application/json"},body:JSON.stringify({organizationSlug:e})}),l=await o.json();if(!o.ok||
  • net package/dist/client/assets/orgs-d7uzFXRt.js :1 e[13]!==l.id?(h=async r=>{const K=await fetch(`/api/_admin/orgs/${l.id}/sites`,{method:"POST",credentials:"include",headers:{"Content-Type":"application/json"},body:JSON.stringify(r)}),ie=await K.json
  • net package/dist/client/assets/pair-PFcTXb_H.js :40 t g;e[7]!==d?(g=async()=>{const X=await fetch(d);if(!X.ok)throw new Error(`
  • net package/dist/client/assets/profile-D5UD6t5O.js :1 nction zt(){return(await(await Le(await fetch("/api/_users/avatars"))).json()).avatars}function Lt(){const e=E.c(22),t=Ue(),l=Je
  • net package/dist/client/assets/provision-repo-scoped-github-connection-B6zdkC6p.js :1 o-scoped GitHub connection");if(!(await fetch(`/api/${n}/connections/${d}/oauth-token`,{method:"POST",headers:{"Content-Type":"application/json"},credentials:"include",body:JSON.stringify({accessToken
  • net package/dist/client/assets/registry-layout-lqv7Wdye.js :27 or}));return}if(J.tokenInfo){if(!(await fetch(`/api/${g.slug}/connections/${f}/oauth-token`,{method:"POST",headers:{"Content-Type":"application/json"},credentials:"include",body:JSON.stringify({access
  • net package/dist/client/assets/reports-AdPTt8B7.js :1 toString()?`?${a.toString()}`:"";return fetch(`/api/_reports/site/${encodeURIComponent(r)}${n}`).then(i=>kf(i))}function lk(r){return fetch("/api/_reports/run",{method:"POST",headers:{"Content-Type":"
  • net package/dist/client/assets/reports-onboarding-C2Jgwku4.js :1 async function Tt(){const e=await(await fetch("/api/auth/custom/ensure-organization",{method:"POST",credentials:"include",headers:{"Content-Type":"application/json"}})).json();return e.success&&(e.sta
  • net package/dist/client/assets/repositories-CgzO6Xfa.js :1 us}async function ue(t,e){const i=await fetch(t,e);if(!i.ok)throw new de(i.status);return i}const Ae=()=>null;function ht(t,e){const i=new BroadcastChannel(t);i.postMessage(e),i.close()}function gt(){
  • net package/dist/client/assets/repository-picker-DocVIjle.js :1 t n;t[0]!==e?(n=async()=>{const l=await fetch(`/api/${encodeURIComponent(e.slug)}/git-providers/github/cli/connect`,{method:"POST",headers:{"Content-Type":"application/json"},body:"{}"}),c=await l.jso
  • net package/dist/client/assets/route-BF20JrYe.js :1 ?(l=async g=>{const{signal:j}=g,v=await fetch(`/api/_me/projects/search?q=${encodeURIComponent(s)}`,{signal:j});if(!v.ok)throw new Error(`Project search failed: ${v.status}`);return await v.json()},e[
  • net package/dist/client/assets/runnable-block-editor-B6xxtm11.js :1 on Cn(t,e){const n=Ce(t,"read"),s=await fetch(n,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({path:e,full:!0})}),i=ur(s.status);if(i==="absent")return{kind:"absent"};

16 more not shown — this panel samples each group; the count above is the real total.

install hooks 1

  • prepublishOnly package/package.json :35 bun run --cwd=../.. build:studio

declared dependencies 61

  • @modelcontextprotocol/sdk@1.29.0
  • @ai-sdk/anthropic@^3.0.85
  • @ai-sdk/google@^3.0.83
  • @ai-sdk/openai@^3.0.73
  • @anthropic-ai/sdk@^0.105.0
  • @aws-sdk/client-s3@^3.1013.0
  • @aws-sdk/client-sts@^3.1013.0
  • @aws-sdk/lib-storage@^3.1013.0
  • @aws-sdk/s3-request-presigner@^3.1013.0
  • @clickhouse/client@^1.8.1
  • @dbos-inc/dbos-sdk@^4.21.6
  • @inkjs/ui@^2.0.0
show 28 more
  • @nats-io/jetstream@3.4.0
  • @nats-io/kv@3.4.0
  • @nats-io/nats-core@3.4.0
  • @nats-io/transport-node@3.4.0
  • @openrouter/ai-sdk-provider@^2.9.1
  • @opentelemetry/core@^2.6.0
  • embedded-postgres@^18.3.0-beta.16
  • ink@^6.8.0
  • kysely@^0.28.12
  • posthog-node@^5.0.0
  • react@^19.2.6
  • react-dom@^19.2.6
  • @ai-sdk/provider@^3.0.10
  • @better-auth/sso@1.4.1
  • @decocms/better-auth@1.5.17
  • @decocms/bindings@workspace:*
  • @decocms/mcp-utils@workspace:*
  • @decocms/runtime@workspace:*
  • @decocms/sandbox@workspace:*
  • @decocms/shared@workspace:*
  • @jitl/quickjs-wasmfile-release-sync@0.31.0
  • @opentelemetry/api@^1.9.0
  • @opentelemetry/api-logs@^0.211.0
  • @opentelemetry/exporter-logs-otlp-proto@^0.211.0
  • @opentelemetry/exporter-prometheus@^0.208.0
  • @opentelemetry/exporter-trace-otlp-proto@^0.207.0
  • @opentelemetry/instrumentation-runtime-node@^0.24.0
  • @opentelemetry/resources@^2.6.0

21 more not shown — this panel samples each group; the count above is the real total.

perm:untrusted 11

  • untrusted package/dist/client/assets/agent-analytics-BJTe-WT2.js :1 f n)}async function xt(n){const e=await fetch(n),i=await e.json().catch(()=>({}));if(!e.ok){const a=i&&typeof i=="object"&&"error"in i?String(i.error):`request failed (${e.status})`;throw new et(a,e.s
  • untrusted package/dist/client/assets/agent-e2e-DgZKhQJU.js :1 =401}async function ds(n){const e=await fetch(n),s=await e.json().catch(()=>({}));if(!e.ok){const l=s&&typeof s=="object"&&"error"in s?String(s.error):`request failed (${e.status})`;throw new Nt(l,e.s
  • untrusted package/dist/client/assets/agent-hosting-qLrSaTBn.js :1 e})`}async function Kt(r){const e=await fetch(r),o=await e.json().catch(()=>({}));if(!e.ok)throw new It(us(o,e.status),e.status);return o}async function at(r,e,o){const l=await fetch(r,{method:e,heade
  • untrusted package/dist/client/assets/agent-monitor-DtdoOdMx.js :1 00"];async function g3(t){const e=await fetch(t),n=await e.json().catch(()=>({}));if(!e.ok){const r=n&&typeof n=="object"&&"error"in n?String(n.error):`request failed (${e.status})`;throw new Error(r)
  • untrusted package/dist/client/assets/agents-list-J7lqHacr.js :1 }async function Ie(e,t,o){const i=await fetch(e,t),r=await i.json().catch(()=>({}));if(!i.ok)throw new Error(r.error??`${o} (${i.status})`);return r}function Vt(e){return Ie(`/api/${e}/deco-sites`,voi
  • untrusted package/dist/client/assets/hooks-BOS6vZ4t.js :11 rtSignal.any([r,h]):h;let R;try{R=await fetch(c,{method:"POST",credentials:"include",headers:{"content-type":"application/json"},body:JSON.stringify(u),signal:I})}catch(M){throw h.aborted&&!r?.aborted
  • untrusted package/dist/client/assets/index-COJyT2bn.js :10 v===void 0||v>_.state.dataUpdatedAt)&&_.fetch(void 0,{initialPromise:Promise.resolve(f).then(i)}).catch(ta)})}var Y$=I$;function Z$(){let e=[],t=0,o=c=>{c()},a=c=>{c()},n=Y$;const i=c=>{t?e.push(c):n(
  • untrusted package/dist/client/assets/organization-choice-DyBOUTdt.js :1 ";async function T(i,e,p){const o=await fetch(i,{method:"POST",credentials:"include",headers:{"Content-Type":"application/json"},body:JSON.stringify({organizationSlug:e})}),l=await o.json();if(!o.ok||
  • untrusted package/dist/client/monaco/0.52.0/vs/base/worker/workerMain.js :6 h)!==self.origin)&&this._canUseEval(a)){fetch(m).then(o=>{if(o.status!==200)throw new Error(o.statusText);return o.text()}).t
  • untrusted package/dist/client/monaco/0.52.0/vs/language/json/jsonWorker.js :40 ypeof fetch<"u"&&(mr=function(e){return fetch(e).then(t=>t.text())});var ct=class{constructor(t,r){this._ctx=t,this._languageSettings=r.languageSettings,this._languageId=r.languageId,this._languageSer
  • untrusted package/dist/client/monaco/0.52.0/vs/loader.js :6 h)!==self.origin)&&this._canUseEval(e)){fetch(i).then(o=>{if(o.status!==200)throw new Error(o.statusText);return o.text()}).then(o=>{o=`${o}