MCP Observatory
2m ago Tracked 59,480 Last 2m ago 24h 2,586
npm JavaScript analyzed 0.59.1 deep scan · partial (73/3,617 files)

eve

v0.59.1
npm

Filesystem-first framework for durable backend AI agents that run anywhere.

maintainer
matt.straka
licence
Apache-2.0
first seen
2026-06-09
last seen
2026-09-17
releases · 30d
50
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools
transport stdio counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals npm-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v0.59.1 · analyzer v33 · 24m ago

danger signals4

  • dynamic code execution eval() package/dist/src/compiled/@vercel/otel/index.js :17 unction inquire(moduleName){try{var mod=eval(`quire`.replace(/^/,`re`))(moduleName);if(mod&&(mod.length||Object.keys(mod).length))return mod}catch{}return null}}),KO=l(e=>{var r=e;r.length=function(e)
  • suspicious endpoint mcp.datadoghq.com (telemetry) expected for this server's purpose package/dist/src/compiled/@eve/catalog/index.js :1 nitors, logs, and incidents.`,mcp:{url:`https://mcp.datadoghq.com/api/mcp`}}},{slug:`honeycomb`,name:`Honeycomb`,kind:`connection`,tagline:`Explore traces and run queries through Honeycomb's MCP serve
  • suspicious endpoint mcp.mixpanel.com (telemetry) package/dist/src/compiled/@eve/catalog/index.js :1 , and manage analytics data.`,mcp:{url:`https://mcp.mixpanel.com/mcp`}}},{slug:`natural`,name:`Natural`,kind:`connection`,tagline:`Send, request, and manage payments with Natural.`,surfaces:{scaffolda
  • suspicious endpoint mcp.posthog.com (telemetry) package/dist/src/compiled/@eve/catalog/index.js :1 , events, and feature flags.`,mcp:{url:`https://mcp.posthog.com/mcp`}}},{slug:`postman`,name:`Postman`,kind:`connection`,tagline:`Give API context to your coding agents with Postman.`,surfaces:{scaffo
code evidence v0.59.1 · npm-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 3448

filesystem 4

  • fs package/bin/eve.js :4 import { access, readdir, realpath, stat } from "node:fs/promises";
  • fs package/dist/src/compiled/@workflow/world-local/index.js :5 h(e,n)}function d(e,t,n){let r=l(e,t);t.fs.mkdir(r,i=>{if(!i)return s.probe(r,t.fs,(e,i,a)=>{if(e)return t.fs.rmdir(r,()=>{}),n(e);n(null,i,a)});if(i.code!==`EEXIST`)return n(i);if(t.stale<=0)return n
  • fs (weak) package/dist/src/execution/sandbox/bindings/vercel.js :1 rtSignal})},async removePath(t){await e.fs.rm(t.path,{force:t.force,recursive:t.recursive,signal:t.abortSignal})}}}async function writeVercelSandboxSeedFiles(e){if(e.seedFiles.length===0)return;let t=
  • fs package/dist/src/setup/vercel-project-framework.js :1 PackageSpecifier(e,t){let n;try{n=await fs.readdir(e,{encoding:`utf8`,withFileTypes:!0})}catch{return!1}for(let r of n){let n=join(e,r.name);if(r.isDirectory()){if(FRAMEWORK_INTEGRATION_IGNORED_DIRECT

shell / exec 25

  • shell package/bin/eve.js :3 import { spawn } from "node:child_process";
  • shell package/dist/src/cli/commands/registry-setup-command.js :1 ter.`);return new Promise((i,o)=>{let s=spawn(process.execPath,[a,...t.args],{cwd:e,env:{...process.env,EVE_SETUP:`1`,EVE_SETUP_ITEM:n,EVE_SETUP_PROTOCOL:String(REGISTRY_SETUP_PROTOCOL_VERSION)},stdio
  • shell package/dist/src/cli/dev/tui/clipboard.js :1 import{spawn}from"node:child_process";function clipboardSequence(e,t=process.env){let n=`\x1b]52;c;${Buffer.from(e).toString(`base64`)}\x07`;return t.TMUX!==void 0||t.STY!==void 0?`\x1bPtmux;\x1b${n}\
  • shell package/dist/src/cli/telemetry/index.js :3 Learn more: https://eve.dev/docs/reference/telemetry`);try{await markEveTelemetryNotified()}catch{}}},async flush(){if(await isEnabled()&&t.length!==0){try{let e=isEphemeralEveTelemetryEnvironment(),n
  • shell package/dist/src/compiled/shadcn-registry/index.js :28 assert.assert/strict.async_hooks.buffer.child_process.cluster.console.constants.crypto.dgram.diagnostics_channel.dns.dns/promises.domain.events.fs.fs/promises.http.http2.https.inspector.inspector/prom
  • shell package/dist/src/evals/runner/resolve-git-metadata.js :1 import{execSync}from"node:child_process";function resolveLocalGitMetadata(e){let t=execGitCommand(`git rev-parse HEAD`,e);return{branch:execGitCommand(`git branch --show-current`,e)||void 0,sha:t||voi
  • shell (weak) package/dist/src/execution/sandbox/bindings/docker-cli.js :1 probeLinuxDockerDaemonSync(){try{let e=spawnSync(resolveDockerExecutable(),[`version`,`--format`,`{{.Server.Os}}`],{encoding:`utf8`,stdio:[`ignore`,`pipe`,`ignore`],timeout:5e3});return e.status===0&
  • shell (weak) package/dist/src/execution/sandbox/bindings/docker-session.js :2 ,resolvePath:resolveWorkspacePath,async spawn(e){let r=[`exec`,`-w`,resolveWorkspacePath(e.workingDirectory??WORKSPACE_ROOT)];for(let[t,n]of Object.entries(e.env??{}))r.push(`-e`,`${t}=${n}`);let i=`/
  • shell (weak) package/dist/src/execution/sandbox/bindings/just-bash-runtime.js :1 .rootPath,sessionKey:e.sessionKey,async spawn(e){if(e.abortSignal?.aborted)throw new DOMException(`The operation was aborted.`,`AbortError`);let t=e.workingDirectory===void 0?e.command:`( cd ${shellQu
  • shell (weak) package/dist/src/execution/sandbox/bindings/local-backend-utils.js :1 ,resolvePath:resolveWorkspacePath,async spawn(t){return await e.sandbox.spawn(t)},async readFile(t){let n=await e.sandbox.readFileBytes(t.path);return n===null?null:bufferToStream(n)},async removePath
  • shell (weak) package/dist/src/execution/sandbox/bindings/microsandbox-runtime.js :1 pshotIfExists$1(this.#e.module,t)}async spawn(e){if(e.abortSignal?.aborted)throw new DOMException(`The operation was aborted.`,`AbortError`);let t={...this.#e.options.env,...createTransformBrokerEnvir
  • shell (weak) package/dist/src/execution/sandbox/bindings/vercel.js :1 olvePath:resolveVercelSandboxPath,async spawn(t){let n=await e.runCommand({args:[`-lc`,t.command],cmd:`bash`,cwd:t.workingDirectory??WORKSPACE_ROOT,detached:!0,env:t.env,signal:t.abortSignal});return
show 13 more
  • shell (weak) package/dist/src/execution/sandbox/logging-session.js :1 unFailure(e.command,r));return r},async spawn(e){return t?.(`bootstrap spawn: ${formatCommand(e.command)}`),await n.spawn(e)},async setNetworkPolicy(e){return t?.(`bootstrap set network policy: ${form
  • shell (weak) package/dist/src/execution/sandbox/session.js :1 h(t){return e.resolvePath(t)},run,async spawn(t){return await e.spawn(t)},async readFile(t){return await e.readFile({abortSignal:t.abortSignal,path:e.resolvePath(t.path)})},async readBinaryFile(t){let
  • shell package/dist/src/internal/application/optional-package-install.js :1 via \`${t} ${n.join(` `)}\`...`);let r=spawn(t,n,{cwd:e.appRoot,shell:shouldSpawnPackageManagerWithShell(),stdio:[`ignore`,`pipe`,`pipe`]}),i=[];r.stdout?.on(`data`,e=>i.push(e)),r.stderr?.on(`data`,
  • shell package/dist/src/internal/nitro/host/start-production-server.js :2 nPortUrl({host:i,port:a}),s=``,c=!1,l,u=spawn(process.execPath,[r],{cwd:n,env:{...process.env,HOST:i,NITRO_HOST:i,NITRO_PORT:String(a),PORT:String(a)},stdio:[`ignore`,`pipe`,`pipe`]});u.stdout?.on(`da
  • shell package/dist/src/public/models/openai/chatgpt/codex-app-server.js :1 ction spawnCodexAppServer(e,t,n){return spawn(e,[...t],n)}function unrefStream(e){`unref`in e&&typeof e.unref==`function`&&e.unref()}function tokenFromCodex(e){let t=extractCodexAccountIdFromToken(e),
  • shell package/dist/src/public/next/server.js :2 ess(e){return new Promise((t,n)=>{let r=spawn(e.command,e.args,{cwd:e.cwd,env:{...process.env,...e.env},stdio:[`ignore`,`pipe`,`pipe`]}),i=createEveDevOutputWriter({logLabel:e.logLabel,stream:process.
  • shell package/dist/src/public/nuxt/dev-server.js :1 ess(e){return new Promise((t,n)=>{let r=spawn(e.command,e.args,{cwd:e.cwd,env:{...process.env,...e.env},stdio:[`ignore`,`pipe`,`pipe`]}),i=setTimeout(()=>{r.kill(),n(Error(`Timed out after ${DEFAULT_S
  • shell package/dist/src/public/sveltekit/dev-server.js :1 ess(e){return new Promise((t,n)=>{let r=spawn(e.command,e.args,{cwd:e.cwd,env:{...process.env,...e.env},stdio:[`ignore`,`pipe`,`pipe`]}),i=setTimeout(()=>{r.kill(),n(Error(`Timed out after ${DEFAULT_S
  • shell package/dist/src/self-modification/extension/eve-add.js :1 ocess.env.WINDIR;if(n!==void 0&&n!==``&&spawnSync(resolve(n,`System32`,`taskkill.exe`),[`/pid`,String(e.pid),`/t`,...t===`SIGKILL`?[`/f`]:[]],{stdio:`ignore`,windowsHide:!0}).status===0)return}else tr
  • shell package/dist/src/setup/flows/chatgpt-auth.js :1 sync function loginWithCodex(e,t){let n=spawn(`codex`,[`login`],{stdio:[`ignore`,`pipe`,`pipe`],...e!==void 0&&{signal:e}}),r=createProcessOutputBuffer(({text:e})=>t(e));n.stdout.on(`data`,e=>r.write(
  • shell package/dist/src/setup/primitives/open-url.js :1 import{spawn}from"node:child_process";function osOpenCommand(e){switch(process.platform){case`darwin`:return{command:`open`,args:[e]};case`win32`:return{command:`cmd`,args:[`/c`,`start`,``,e]};default
  • shell package/dist/src/setup/primitives/pm/run.js :1 utCollector({command:s}):void 0,c;try{c=spawn(o.command,[...o.args],{cwd:t,stdio:n?[r.nonInteractive?`ignore`:`inherit`,`pipe`,`pipe`]:`inherit`,shell:o.shell,signal:r.signal})}catch(t){i?.flush();let
  • shell package/dist/src/setup/primitives/run-vercel.js :1 createProcessOutputBuffer(t.onOutput),s=spawn(a.command,a.commandArgs,{cwd:i,stdio:n.stdio,env:buildSpawnEnv(t.extraEnv??{}),shell:a.shell,signal:t.signal}),c=armProcessAbort(s,t.signal),l=[],u=[];s.s

network 48

  • net package/dist/src/channel/auth/oidc.js :1 t(e);if(t!==void 0)return await t;let n=fetch(e,{headers:{accept:`application/json`}}).then(async e=>{if(!e.ok)throw Error(`Discovery route returned HTTP ${e.status}.`);return oidcDiscoveryDocumentSch
  • net package/dist/src/chunks/use-eve-agent-Dmc6sX4d.js :1198 response = await fetch(url, {
  • net package/dist/src/chunks/use-eve-agent-jSR8P4nK.js :1199 response = await fetch(url, {
  • net package/dist/src/cli/commands/registry.js :1 oadOfficialSearchMetadata(){let e=await fetch(OFFICIAL_CATALOG);if(!e.ok)throw Error(`Could not read the eve registry (${e.status}).`);return parseOfficialRegistrySearchMetadata(await e.json())}functi
  • net package/dist/src/cli/dev/tui/mcp-connection-status.js :1 n probeMcpConnection(e){try{let t=await fetch(e.url,{method:`POST`,signal:e.signal,headers:{Accept:`application/json, text/event-stream`,"Content-Type":`application/json`,"MCP-Protocol-Version":`2025-
  • net package/dist/src/cli/dev/tui/subagent-pump.js :1 oritative`;){let a=!1;try{let i=await t.fetch(streamPathAt(n.childStreamPath,n.childStreamIndex),{cache:`no-store`,signal:r.signal});if(!i.ok||i.body===null)throw await i.body?.cancel().catch(()=>{}),
  • net package/dist/src/cli/telemetry/flush.js :1 function isFlushPayload(e){if(!e||typeof e!=`object`)return!1;let t=e;return typeof t.sessionId==`string`&&Array.isArray(t.events)}async function flushEveCliTelemetry(e){let t;try{let n=JSON.parse(e);
  • net package/dist/src/client/client.js :1 H_ROUTE_PATH),t=await this.#i(),n=await fetch(e,withRedirectPolicy({headers:t},this.#r));if(!n.ok){let e=await n.text();throw new ClientError(n.status,e,n.headers)}let r;try{r=await n.json()}catch{thr
  • net package/dist/src/client/open-stream.js :1 ignal,f.signal]):f.signal,m;try{m=await fetch(u,{cache:`no-store`,headers:d,redirect:e.redirect,signal:p})}catch(t){if(e.signal?.aborted||!isStreamDisconnectError(t)||l===n.maxAttempts-1)throw t;await
  • net package/dist/src/client/session-controls.js :1 t-type`,`application/json`);let n=await fetch(createClientUrl(e.context.host,e.path),withRedirectPolicy({body:e.body===void 0?void 0:JSON.stringify(e.body),headers:t,method:
  • net package/dist/src/client/session.js :1 ait e.resolveHeaders(t.headers),r=await fetch(createClientUrl(e.host,EVE_SESSION_ROUTE_PATH),{headers:n,method:`POST`,redirect:e.redirect,signal:t.signal??null});if(!r.ok){let e=await r.text();throw n
  • net package/dist/src/compiled/@ai-sdk/code-mode/index.js :12 vironment's preferred mechanism (e.g. \`fetch()\`, \`node:fs/promises\`, or a bundler import like Vite's \`?url\`)."
show 28 more
  • net package/dist/src/compiled/@chat-adapter/slack/index.js :43 e||`unknown`,webhookUrl:e});let n=await fetch(e,{method:`POST`,headers:{"Content-Type":`application/json`,"x-slack-socket-token":this.socketForwardingSecret},body:JSON.stringify(t)});if(n.ok)this.logg
  • net package/dist/src/compiled/@linqapp/chat-sdk-adapter/index.js :8 :e.url},fetchData:async()=>{let t=await fetch(e.url);if(!t.ok)throw Error(`Failed to fetch Linq attachment ${e.id||e.url}: ${t.status}`);return Buffer.from(await t.arrayBuffer())}}}function sn(e){retu
  • net package/dist/src/compiled/@vercel/blob/index.js :1 t(t);if(e!==void 0)return e}let n=await fetch(`https://oidc.vercel.com/~token`,{method:`POST`,headers:{"Content-Type":`application/json`,Accept:`application/json`,"User-Agent":`@vercel/oidc@${u.versio
  • net package/dist/src/compiled/@vercel/oidc/index.js :1 t(t);if(e!==void 0)return e}let n=await fetch(`https://oidc.vercel.com/~token`,{method:`POST`,headers:{"Content-Type":`application/json`,Accept:`application/json`,"User-Agent":`@vercel/oidc@${u.versio
  • net package/dist/src/compiled/@vercel/otel/index.js :17 el/otel/otlp: no proto`,e);return}let f=fetch(this.url,{method:`POST`,body:c,headers:{...this._headers,...d,"Content-Type":u,"User-Agent":`OTel-OTLP-Exporter-JavaScript/0.46.0`},next:{internal:!0}}).t
  • net (weak) package/dist/src/compiled/@vercel/sandbox/index.js :1 ring())});let r=Date.now(),i=await this.fetch(n.toString(),{...t,body:t?.body,method:t?.method||`GET`,headers:this.token?{Authorization:`Bearer ${this.token}`,...t?.headers}:t?.headers,dispatcher:this
  • net package/dist/src/compiled/@workflow/world-local/index.js :4 meout(()=>i.abort(),r);try{return(await fetch(`http:
  • net package/dist/src/compiled/_chunks/node/dist-PazOnsjy.js :82 }async function cu(e,t){try{let n=await fetch(e,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify(t)});return n.ok?{status:n.status}:{error:Error(`Callback URL returned ${
  • net package/dist/src/compiled/_chunks/node/token-util-DpJNusVS.js :1 function m(){if(p)return p;let e=await fetch(`https://vercel.com/.well-known/openid-configuration`,{headers:{"user-agent":f}});if(!e.ok)throw Error(`Failed to discover OAuth endpoints`);let t=await e
  • net package/dist/src/compiled/_chunks/workflow/functions-wMCGZAVk.js :1 t.abort(),this.timeout);try{let r=await fetch(`${this.endpoint}${e}`,{headers:this.headers,method:`GET`,signal:t.signal});if(r.status===404)return clearTimeout(n),null;if(r.status===200){if(r.headers.
  • net package/dist/src/compiled/_chunks/workflow/token-util-BkqzD0OM.js :1 function m(){if(p)return p;let e=await fetch(`https://vercel.com/.well-known/openid-configuration`,{headers:{"user-agent":f}});if(!e.ok)throw Error(`Failed to discover OAuth endpoints`);let t=await e
  • net package/dist/src/compiled/env-runner/index.js :1 et address(){return this._address}async fetch(e,t){for(let e=0;e<5&&!this._address&&!this.closed;e++)await new Promise(t=>setTimeout(t,100*2**e));return this._address?x(this._address,this._resolveFetc
  • net package/dist/src/compiled/env-runner/node-worker.js :1 t a \`fetch\` handler (export default { fetch(req) { ... } }).`);return r}function re
  • net package/dist/src/evals/target.js :1 ync(e,r)=>{if(t!==void 0)return await t.fetch(e,r);if(n===void 0)throw Error(`Eval target cannot fetch without a client.`);return await n.fetch(e,r)};return{capabilities:e.capabilities,kind:e.kind,url
  • net package/dist/src/eve-channel/index.js :1 set(`includeTailIndex`,`1`);let h=await fetch(p,{cache:`no-store`,headers:f,redirect:`manual`,signal:t.signal}),g=new Headers;for(let e of[`cache-control`,`content-type`,`x-accel-buffering`,EVE_SESSIO
  • net package/dist/src/execution/session-callback-request.js :1 ,n=AbortSignal.timeout(t),r;try{r=await fetch(e.url,{body:JSON.stringify(e.body),headers:await resolveSessionCallbackHeaders(e.url),method:`POST`,redirect:`error`,signal:n})}catch(r){throw e.logFailur
  • net package/dist/src/execution/tasks/child/steps.js :1 .childResponseUrl!==void 0){let t=await fetch(e.answer.childResponseUrl,{body:JSON.stringify({inputResponses:n.payload.inputResponses}),headers:{"content-type":`application/json`},method:`POST`,redire
  • net package/dist/src/execution/web-fetch/request.js :1 unction fetchWithDispatcher(e,t){return fetch(e,t)}function assertPublicHostname(e){let t=e.replace(/^\[(.*)\]$/u,`$1`);if(isIP(t)!==0){assertPublicAddress(t);return}if(isLoopbackHostname(t))throw Err
  • net package/dist/src/internal/mcp/streamable-http-server.js :1 d.toUpperCase()!==`POST`)return await i.fetch(n);let a=await inspectRequestBody(n);if(a.tooLarge)return requestBodyTooLargeResponse();if(a.invalidJson)return invalidJsonResponse();let o=a.value;if(o==
  • net package/dist/src/internal/model-auth/transport.js :1 -api-key`,e===`openai`?`Bearer ${i}`:i),fetch(t,{...n,headers:r})}}function createLocalGateway(){if(!isEveDevEnvironment())return;let e=process.env[MODEL_CONNECTION_ENV$1];if(!developmentModelBrokerAv
  • net package/dist/src/internal/model-auth/vercel.js :1 3){let i=AbortSignal.timeout(r),a=await fetch(e,{...t,redirect:`error`,signal:t.signal?AbortSignal.any([t.signal,i]):i}),o=a.body?.getReader(),s=``,c=new TextDecoder;if(o)try{let e=0;for(;;){let t=awa
  • net package/dist/src/internal/nitro/host/drained-nitro-dev-server.js :1 le.`);r=this.#b(o);let s=await o.runner.fetch(i,{signal:n
  • net package/dist/src/internal/nitro/routes/channel-dispatch.js :1 uestIp:c.args.requestIp};return await o.fetch(e.req,t)})}catch(n){let r=logError(log,`channel handler threw`,n,{routeKey:t,channel:o.name});return flushBackgroundTasks(e,c.backgroundTasks,t,o.name),Re
  • net package/dist/src/internal/workflow/development-world-client.js :1 PMENT_WORKFLOW_SECRET_ENV));let i=await fetch(n,{...t,headers:r});if(!i.ok){let e=await i.text(),t=readDevelopmentWorldError(e);throw t===void 0?Er
  • net package/dist/src/internal/workflow/index.js :1 export*from"#compiled/@workflow/core/index.js";async function fetch(...e){"use step";return await globalThis.fetch(...e)}export{fetch};
  • net package/dist/src/public/channels/slack/attachments.js :1 d:typeof r==`string`?r:void 0}),a=await fetch(t,{headers:{authorization:`Bearer ${i}`}});if(!a.ok)throw new EveAttachmentError({adapterKind:`slack`,kind:`resolver-threw`,message:`Slack file fetch retu
  • net package/dist/src/public/channels/slack/interaction-cards.js :1 ,{teamId:e.installationTeamId}),n=await fetch(`https://slack.com/api/chat.update`,{method:`POST`,headers:{authorization:`Bearer ${t}`,"content-type":`application/json; charset=utf-8`},body:JSON.string
  • net package/dist/src/public/channels/slack/interactions.js :1 nteraction.installationTeamId}),d=await fetch(`https://slack.com/api/views.open`,{method:`POST`,headers:{authorization:`Bearer ${u}`,"content-type":`application/json; charset=utf-8`},body:JSON.stringi

8 more not shown — this panel samples each group; the count above is the real total.

secrets 32

  • secrets package/dist/src/cli/commands/agent-instructions.js :5 `)}function initExtensionHandoff(e){return[``,`What we set up:`,` - package.json with eve.extension source/dist roots, peer+dev eve, and zod`,` - extension/extension.ts (config schema via defineExte
  • secrets package/dist/src/compiled/@ai-sdk/code-mode/index.js :650 together.`);let t=e.continuationSecret??process.env.RUN_CONTINUATION_SECRET,n=e.continuationCodec??(t===void 0?Xn():D({secret:t})),r=e.continuationAudience??`run`,i=e.syncHostFunctions??Object.create(
  • secrets package/dist/src/compiled/@chat-adapter/slack/index.js :43 ookVerifier,n=t?void 0:e.signingSecret??process.env.SLACK_SIGNING_SECRET;if(!(n||t)&&(e.mode??`
  • secrets package/dist/src/compiled/@vercel/blob/index.js :1 xt)().headers?.[`x-vercel-oidc-token`]??process.env.VERCEL_OIDC_TOKEN;if(!e)throw Error(`The 'x-vercel-oidc-token' header is missing from the request.`);return e}0&&(t.exports={getVercelOidcTokenSync:
  • secrets package/dist/src/compiled/@vercel/detect-agent/index.js :1 T_MODEL||process.env.COPILOT_ALLOW_ALL||process.env.COPILOT_GITHUB_TOKEN)return{isAgent:!0,agent:{name:w}};try{return await(0,d.access)(`/opt/.devin`,f.constants.F_OK),{isAgent:!0,agent:{name:_}}}catc
  • secrets package/dist/src/compiled/@vercel/oidc/index.js :1 xt)().headers?.[`x-vercel-oidc-token`]??process.env.VERCEL_OIDC_TOKEN;if(!e)throw Error(`The 'x-vercel-oidc-token' header is missing from the request.`);return e}0&&(t.exports={getVercelOidcTokenSync:
  • secrets (weak) package/dist/src/compiled/@vercel/sandbox/index.js :7 xt)().headers?.[`x-vercel-oidc-token`]??process.env.VERCEL_OIDC_TOKEN;if(!e)throw Error(`The 'x-vercel-oidc-token' header is missing from the request. Do you have the OIDC option enabled in the Vercel
  • secrets package/dist/src/compiled/_chunks/node/token-Bedbhv5z.js :1 fresh OIDC token`);(0,p.saveToken)(r,t)}process.env.VERCEL_OIDC_TOKEN=r.token}0&&(r.exports={refreshToken:m})}));export default r();export{};
  • secrets package/dist/src/compiled/_chunks/workflow/frames-DJw9L4rO.js :2 xt)().headers?.[`x-vercel-oidc-token`]??process.env.VERCEL_OIDC_TOKEN;if(!e)throw Error(`The 'x-vercel-oidc-token' header is missing from the request. Do you have the OIDC option enabled in the Vercel
  • secrets package/dist/src/compiled/_chunks/workflow/token-CrFhCmWs.js :1 fresh OIDC token`);(0,p.saveToken)(r,t)}process.env.VERCEL_OIDC_TOKEN=r.token}0&&(r.exports={refreshToken:m})}));export default r();export{};
  • secrets package/dist/src/compiled/_chunks/workflow/token-D8tWQnPx.js :1 fresh OIDC token`);(0,h.saveToken)(r,t)}process.env.VERCEL_OIDC_TOKEN=r.token}0&&(i.exports={refreshToken:g})}));export default i();export{};
  • secrets package/dist/src/evals/cli/eval-client.js :1 import{resolveDevelopmentClientOptions}from"#services/dev-client/client-options.js";import{resolveVerifiedRemoteDevelopmentClient}from"#setup/verified-remote-client.js";import{Client}from"#client/clie
show 20 more
  • secrets package/dist/src/execution/session-callback-request.js :1 t?.().headers?.[`x-vercel-oidc-token`]??process.env.VERCEL_OIDC_TOKEN)?.trim();return e===``?void 0:e}export{postSessionCallbackRequest};
  • secrets package/dist/src/execution/workflow-callback-url.js :1 ame,n.pathname),r.search=n.search;let i=process.env.VERCEL_AUTOMATION_BYPASS_SECRET?.trim();return i&&r.searchParams.set(VERCEL_PROTECTION_BYPASS_QUERY,i),r.toString()}function createRemoteTaskInputCa
  • secrets package/dist/src/internal/model-auth/gateway-credential.js :1 ateway-key`)}:t!==`ai-gateway-project`&&process.env.AI_GATEWAY_API_KEY?.trim()?{kind:`api-key`,token:process.env.AI_GATEWAY_API_KEY}:{kind:`oidc`,token:await getVercelOidcToken()}}export{resolveGatewa
  • secrets package/dist/src/internal/model-auth/vercel-cli.js :1 let{directory:t,config:n,teamId:r}=e;if(process.env.VERCEL_TOKEN)return{token:process.env.VERCEL_TOKEN,teamId:r};let i=process.env.VERCEL_TOKEN_STORAGE??n.credStorage??`file`,a=join(t,`auth.json`),o;i
  • secrets package/dist/src/internal/nitro/host/vercel-build-prewarm.js :1 import{prewarmAppSandboxes}from"#execution/sandbox/prewarm.js";async function runVercelBuildPrewarm(e){return process.env.VERCEL?.trim()?process.env.VERCEL_OIDC_TOKEN?.trim()?(await prewarmAppSandboxe
  • secrets package/dist/src/internal/nitro/routes/info.js :1 rn{apiKey:!1,oidc:!1}}let t=hasEnvValue(process.env.AI_GATEWAY_API_KEY);if(e.kind===`external`||t)return{apiKey:t,oidc:!1};try{return await getVercelOidcToken(),{apiKey:!1,oidc:!0}}catch{return{apiKey
  • secrets package/dist/src/public/channels/discord/api.js :1 tion resolveDiscordBotToken(e){let t=e??process.env.DISCORD_BOT_TOKEN;if(!t)throw Error(`DISCORD_BOT_TOKEN is required.`);return typeof t==`function`?await t():t}async function callDiscordApi(e){let t
  • secrets package/dist/src/public/channels/github/auth.js :1 ion resolveGitHubPrivateKey(e){let t=e??process.env.GITHUB_APP_PRIVATE_KEY;if(!t)throw Error(`githubChannel: GITHUB_APP_PRIVATE_KEY is required.`);return normalizeGitHubPrivateKey(typeof t==`function`
  • secrets package/dist/src/public/channels/linear/auth.js :1 async function resolveLinearAccessToken(e){let t=typeof e==`function`?await e():e??process.env.LINEAR_AGENT_ACCESS_TOKEN??process.env.LINEAR_ACCESS_TOKEN??process.env.LINEAR_API_KEY??process.env.LINEA
  • secrets package/dist/src/public/channels/photon/photonIMessageChannel.js :1 essageChannel(e){let t=e.webhookSecret??process.env.IMESSAGE_WEBHOOK_SECRET,n=createiMessageAdapter({credentials:e.credentials,...e.webhookVerifier?{webhookVerifier:e.webhookVerifier}:t?{webhookSecret
  • secrets package/dist/src/public/channels/slack/api.js :1 n resolveSlackBotToken(e,t={}){let n=e??process.env.SLACK_BOT_TOKEN;if(!n)throw Error(`SLACK_BOT_TOKEN is required.`);return typeof n==`function`?n(t):resolveSlackBotToken$1(n)}async function callSlac
  • secrets package/dist/src/public/channels/slack/slackChannel.js :1 gningSecret??(t?.webhookVerifier?void 0:process.env.SLACK_SIGNING_SECRET),webhookVerifier:t?.webhookVerifier})}catch(e){return log.warn(`slack inbound verification failed`,{error:e}),null}}async funct
  • secrets package/dist/src/public/channels/teams/api.js :1 ion resolveTeamsAppPassword(e){let t=e??process.env.MICROSOFT_APP_PASSWORD??process.env.TEAMS_APP_PASSWORD;if(!t)throw Error(`MICROSOFT_APP_PASSWORD or TEAMS_APP_PASSWORD is required.`);return typeof
  • secrets package/dist/src/public/channels/telegram/api.js :1 ion resolveTelegramBotToken(e){let t=e??process.env.TELEGRAM_BOT_TOKEN;if(!t)throw Error(`TELEGRAM_BOT_TOKEN is required.`);return typeof t==`function`?await t():t}async function callTelegramApi(e){le
  • secrets package/dist/src/public/channels/telegram/verify.js :1 eTelegramWebhookSecretToken(e){let t=e??process.env.TELEGRAM_WEBHOOK_SECRET_TOKEN;if(!t)throw Error(`TELEGRAM_WEBHOOK_SECRET_TOKEN is required.`);return typeof t==`function`?await t():t}async function
  • secrets package/dist/src/self-modification/credentials.js :1 const SELF_MODIFICATION_GITHUB_TOKEN_ENV=`EVE_SELF_MODIFICATION_GITHUB_TOKEN`;function hasGitHubCredential(){return(process.env.EVE_SELF_MODIFICATION_GITHUB_TOKEN?.trim().length??0)>0}function createG
  • secrets package/dist/src/services/dev-client/credential-gate.js :1 import{VERCEL_PROTECTION_BYPASS_HEADER}from"./request-headers.js";function createDevelopmentCredentialGate(e){let t=new URL(e).origin,n={kind:`anonymous`},r;return{authorize:e=>{if(e.target.origin!==t
  • secrets package/dist/src/setup/integrations/linq/setup.js :11 apiKey: process.env.LINQ_API_KEY!,
  • secrets package/dist/src/setup/integrations/photon/setup-flow.js :11 const projectSecret = process.env.IMESSAGE_PROJECT_SECRET;
  • secrets package/dist/src/shared/vercel-project.js :1 const EMPTY_CLAIMS={ownerId:void 0,projectId:void 0},VERCEL_OIDC_ISSUER=`https://oidc.vercel.com`;function isVercelOidcIssuer(e){return e===VERCEL_OIDC_ISSUER||e?.startsWith(`${VERCEL_OIDC_ISSUER}/`)=

declared dependencies 77

  • @modelcontextprotocol/server@2.0.0
  • nitro@3.0.260903-beta
  • undici@8.9.0
  • @agentclientprotocol/sdk@1.3.0
  • @ai-sdk/anthropic@^4.0.49
  • @ai-sdk/code-mode@^1.0.62
  • @ai-sdk/google@^4.0.64
  • @ai-sdk/mcp@^2.0.45
  • @ai-sdk/openai@^4.0.60
  • @ai-sdk/otel@^1.0.93
  • @ai-sdk/provider@^4.0.10
  • @ai-sdk/provider-utils@^5.0.36
show 28 more
  • @chat-adapter/slack@4.34.0
  • @chat-adapter/state-memory@4.34.0
  • @chat-adapter/twilio@4.34.0
  • @clack/core@1.3.1
  • @eve/catalog@0.0.1
  • @linqapp/chat-sdk-adapter@^0.5.1
  • @nuxt/kit@^4.0.0
  • @nuxt/schema@^4.0.0
  • @opentelemetry/context-async-hooks@2.6.1
  • @opentelemetry/core@2.6.1
  • @opentelemetry/otlp-transformer@0.214.0
  • @opentelemetry/sdk-trace-base@2.6.1
  • @photon-ai/chat-adapter-imessage@3.2.0
  • @standard-schema/spec@1.1.0
  • @sveltejs/kit@^2.0.0
  • @types/json-schema@7.0.15
  • @types/react@19.2.15
  • @types/react-test-renderer@19.1.0
  • @vercel/blob@2.8.0
  • @vercel/detect-agent@1.2.3
  • @vercel/oidc@3.8.0
  • @vercel/otel@2.1.3
  • @vercel/sandbox@3.3.0
  • @vercel/sdk@1.28.8
  • @workflow/builders@5.0.0-beta.51
  • @workflow/core@5.0.0-beta.51
  • @workflow/errors@5.0.0-beta.21
  • @workflow/serde@5.0.0-beta.2

37 more not shown — this panel samples each group; the count above is the real total.

clipboard 1

  • clipboard shell call package/dist/src/cli/dev/tui/clipboard.js :1 ,t=process.env){if(e===`darwin`)return[`pbcopy`];if(e===`linux`)return t.WAYLAND_DISPLAY===void 0?[`xclip`,`-selection`,`clipboard`]:[`wl-copy`];if(e===`win32`)return[`clip`]}function copyTextToClipbo

perm:untrusted 5

  • untrusted package/dist/src/channel/auth/oidc.js :1 t(e);if(t!==void 0)return await t;let n=fetch(e,{headers:{accept:`application/json`}}).then(async e=>{if(!e.ok)throw Error(`Discovery route returned HTTP ${e.status}.`);return oidcDiscoveryDocumentSch
  • untrusted package/dist/src/client/session-controls.js :1 t-type`,`application/json`);let n=await fetch(createClientUrl(e.context.host,e.path),withRedirectPolicy({body:e.body===void 0?void 0:JSON.stringify(e.body),headers:t,method:`POST`,signal:e.signal},e.c
  • untrusted package/dist/src/compiled/@vercel/otel/index.js :17 el/otel/otlp: no proto`,e);return}let f=fetch(this.url,{method:`POST`,body:c,headers:{...this._headers,...d,"Content-Type":u,"User-Agent":`OTel-OTLP-Exporter-JavaScript/0.46.0`},next:{internal:!0}}).t
  • untrusted package/dist/src/compiled/_chunks/node/token-util-DpJNusVS.js :1 ction h(e){let t=await m();return await fetch(t,{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`,"user-agent":f},body:new URLSearchParams({client_id:`cl_HYyOPBNtFMfHhaUn9L4QP
  • untrusted package/dist/src/compiled/_chunks/workflow/token-util-BkqzD0OM.js :1 ction h(e){let t=await m();return await fetch(t,{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`,"user-agent":f},body:new URLSearchParams({client_id:`cl_HYyOPBNtFMfHhaUn9L4QP