MCP Observatory
npm analyzed 1.10.0

ecc-universal

v1.10.0
npm

Complete collection of battle-tested Claude Code configs — agents, skills, hooks, rules, and legacy command shims evolved over 10+ months of intensive daily use by an Anthropic hackathon winner

maintainer
cogsec
license
MIT
first seen
2026-06-02
last seen
2026-06-09
releases · 30d
1
short id

Drift inferred · capture-to-capture

  1. HIGH code analysis flagged dynamic code execution ×2 in ecc-universal
capabilities0 tools
transport stdio · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

no tools enumerated yet for this server.

skills & danger signalsnpm-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v1.10.0 · analyzer v17 · 2d ago

skills & prompt files 193

code evidencev1.10.0 · npm-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

filesystem 67

  • fs package/.opencode/dist/plugins/ecc-hooks.js :15 import * as fs from "fs";
  • fs package/.opencode/dist/tools/check-coverage.js :9 import * as fs from "fs";
  • fs package/.opencode/dist/tools/format-code.js :9 import * as fs from "fs";
  • fs package/.opencode/dist/tools/lint-check.js :8 import * as fs from "fs";
  • fs package/.opencode/dist/tools/run-tests.js :9 import * as fs from "fs";
  • fs package/.opencode/dist/tools/security-audit.js :12 import * as fs from "fs";
  • fs package/.opencode/plugins/ecc-hooks.ts :17 import * as fs from "fs"
  • fs package/.opencode/tools/check-coverage.ts :10 import * as fs from "fs"
  • fs package/.opencode/tools/format-code.ts :10 import * as fs from "fs"
  • fs package/.opencode/tools/lint-check.ts :9 import * as fs from "fs"
  • fs package/.opencode/tools/run-tests.ts :10 import * as fs from "fs"
  • fs package/.opencode/tools/security-audit.ts :13 import * as fs from "fs"
  • fs package/scripts/claw.js :10 const fs = require('fs');
  • fs package/scripts/codex/merge-codex-config.js :14 const fs = require('fs');
  • fs package/scripts/codex/merge-mcp-config.js :20 const fs = require('fs');
  • fs package/scripts/gemini-adapt-agents.js :4 const fs = require('fs');
  • fs package/scripts/harness-audit.js :3 const fs = require('fs');
  • fs package/scripts/hooks/check-console-log.js :16 const fs = require('fs');
  • fs package/scripts/hooks/design-quality-check.js :12 const fs = require('fs');
  • fs package/scripts/hooks/desktop-notify.js :30 isWSL = require('fs').readFileSync('/proc/version', 'utf8').toLowerCase().includes('microsoft');
  • fs package/scripts/hooks/evaluate-session.js :16 const fs = require('fs');
  • fs package/scripts/hooks/gateguard-fact-force.js :26 const fs = require('fs');
  • fs package/scripts/hooks/mcp-health-check.js :15 const fs = require('fs');
  • fs package/scripts/hooks/plugin-hook-bootstrap.js :4 const fs = require('fs');
  • fs package/scripts/hooks/post-bash-command-log.js :4 const fs = require('fs');
  • fs package/scripts/hooks/post-edit-accumulator.js :18 const fs = require('fs');
  • fs package/scripts/hooks/post-edit-typecheck.js :13 const fs = require("fs");
  • fs package/scripts/hooks/pre-bash-commit-quality.js :20 const fs = require('fs');
  • fs package/scripts/hooks/quality-gate.js :17 const fs = require('fs');
  • fs package/scripts/hooks/run-with-flags.js :11 const fs = require('fs');
  • fs package/scripts/hooks/session-end.js :13 const fs = require('fs');
  • fs package/scripts/hooks/session-start-bootstrap.js :29 const fs = require('fs');
  • fs package/scripts/hooks/session-start.js :29 const fs = require('fs');
  • fs package/scripts/hooks/stop-format-typecheck.js :21 const fs = require('fs');
  • fs package/scripts/hooks/suggest-compact.js :16 const fs = require('fs');
  • fs package/scripts/lib/agent-compress.js :3 const fs = require('fs');
  • fs package/scripts/lib/install-executor.js :1 const fs = require('fs');
  • fs package/scripts/lib/install-lifecycle.js :1 const fs = require('fs');
  • fs package/scripts/lib/install-manifests.js :1 const fs = require('fs');
  • fs package/scripts/lib/install-state.js :1 const fs = require('fs');
  • fs package/scripts/lib/install-targets/cursor-project.js :1 const fs = require('fs');
  • fs package/scripts/lib/install-targets/helpers.js :1 const fs = require('fs');
  • fs package/scripts/lib/install/apply.js :3 const fs = require('fs');
  • fs package/scripts/lib/install/config.js :3 const fs = require('fs');
  • fs package/scripts/lib/observer-sessions.js :1 const fs = require('fs');
  • fs package/scripts/lib/orchestration-session.js :3 const fs = require('fs');
  • fs package/scripts/lib/package-manager.js :8 const fs = require('fs');
  • fs package/scripts/lib/project-detect.js :10 const fs = require('fs');
  • fs package/scripts/lib/resolve-ecc-root.js :3 const fs = require('fs');
  • fs package/scripts/lib/resolve-formatter.js :11 const fs = require('fs');
  • fs package/scripts/lib/session-adapters/canonical-session.js :3 const fs = require('fs');
  • fs package/scripts/lib/session-adapters/claude-history.js :3 const fs = require('fs');
  • fs package/scripts/lib/session-adapters/dmux-tmux.js :3 const fs = require('fs');
  • fs package/scripts/lib/session-aliases.js :6 const fs = require('fs');
  • fs package/scripts/lib/session-manager.js :11 const fs = require('fs');
  • fs package/scripts/lib/skill-evolution/health.js :3 const fs = require('fs');
  • fs package/scripts/lib/skill-evolution/provenance.js :3 const fs = require('fs');
  • fs package/scripts/lib/skill-evolution/tracker.js :3 const fs = require('fs');
  • fs package/scripts/lib/skill-evolution/versioning.js :3 const fs = require('fs');
  • fs package/scripts/lib/skill-improvement/observations.js :3 const fs = require('fs');
  • fs package/scripts/lib/state-store/index.js :3 const fs = require('fs');
  • fs package/scripts/lib/state-store/schema.js :3 const fs = require('fs');
  • fs package/scripts/lib/tmux-worktree-orchestrator.js :3 const fs = require('fs');
  • fs package/scripts/lib/utils.js :6 const fs = require('fs');
  • fs package/scripts/orchestrate-worktrees.js :4 const fs = require('fs');
  • fs package/scripts/orchestration-status.js :4 const fs = require('fs');
  • fs package/scripts/session-inspect.js :4 const fs = require('fs');

shell / exec 24

  • shell package/.cursor/hooks/adapter.js :8 const { execFileSync } = require('child_process');
  • shell package/.opencode/dist/tools/git-summary.js :7 import { execSync } from "child_process";
  • shell package/.opencode/tools/git-summary.ts :8 import { execSync } from "child_process"
  • shell package/scripts/claw.js :13 const { spawnSync } = require('child_process');
  • shell package/scripts/codex/merge-mcp-config.js :50 const { execFileSync } = require('child_process');
  • shell package/scripts/ecc.js :3 const { spawnSync } = require('child_process');
  • shell package/scripts/hooks/auto-tmux-dev.js :29 const { spawnSync } = require('child_process');
  • shell package/scripts/hooks/desktop-notify.js :18 const { spawnSync } = require('child_process');
  • shell package/scripts/hooks/mcp-health-check.js :20 const { spawn, spawnSync } = require('child_process');
  • shell package/scripts/hooks/plugin-hook-bootstrap.js :6 const { spawnSync } = require('child_process');
  • shell package/scripts/hooks/post-edit-format.js :20 const { execFileSync, spawnSync } = require('child_process');
  • shell package/scripts/hooks/post-edit-typecheck.js :12 const { execFileSync } = require("child_process");
  • shell package/scripts/hooks/pre-bash-commit-quality.js :18 const { spawnSync } = require('child_process');
  • shell package/scripts/hooks/quality-gate.js :19 const { spawnSync } = require('child_process');
  • shell package/scripts/hooks/run-with-flags.js :13 const { spawnSync } = require('child_process');
  • shell package/scripts/hooks/session-activity-tracker.js :13 const { spawnSync } = require('child_process');
  • shell package/scripts/hooks/session-start-bootstrap.js :31 const { spawnSync } = require('child_process');
  • shell package/scripts/hooks/stop-format-typecheck.js :20 const { execFileSync, spawnSync } = require('child_process');
  • shell package/scripts/lib/install-executor.js :4 const { execFileSync } = require('child_process');
  • shell package/scripts/lib/observer-sessions.js :4 const { spawnSync } = require('child_process');
  • shell package/scripts/lib/orchestration-session.js :5 const { spawnSync } = require('child_process');
  • shell package/scripts/lib/state-store/index.js :47 exec(sql) {
  • shell package/scripts/lib/tmux-worktree-orchestrator.js :5 const { spawnSync } = require('child_process');
  • shell package/scripts/lib/utils.js :10 const { execSync, spawnSync } = require('child_process');

network 1

  • net package/scripts/hooks/mcp-health-check.js :18 const http = require('http');

install hooks 1

  • postinstall (suspicious) package/package.json :243 echo '\n ecc-universal installed!\n Run: npx ecc typescript\n Compat: npx ecc-install typescript\n Docs: https://github.com/affaan-m/everything-claude-code\n'

declared dependencies 11

  • @iarna/toml@^2.2.5
  • ajv@^8.18.0
  • sql.js@^1.14.1
  • @eslint/js@^9.39.2
  • @opencode-ai/plugin@^1.0.0
  • @types/node@^20.19.24
  • c8@^11.0.0
  • eslint@^9.39.2
  • globals@^17.4.0
  • markdownlint-cli@^0.48.0
  • typescript@^5.9.3