MCP Observatory
3m ago Tracked 26,753 Last 3m ago 24h 1,618
npm JavaScript analyzed 0.1.128

flow-nexus

v0.1.128
npm

🚀 AI-Powered Swarm Intelligence Platform - Gamified MCP Development with 70+ Tools

maintainer
ruvnet
license
Proprietary
first seen
2026-05-25
last seen
2026-07-08
releases · 30d
0
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools
transport stdio · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals npm-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v0.1.128 · analyzer v28 · 3d ago

danger signals3

code evidence v0.1.128 · npm-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 96

filesystem 24

  • fs package/bin/flow-nexus.js :12 import fs from 'fs';
  • fs package/cli.js :7 import fs, { readFileSync } from 'fs';
  • fs package/src/app-store-server.js :16 import fs from 'fs';
  • fs package/src/cli.ts :6 import * as fs from 'fs';
  • fs package/src/cli/auth-cli.js :7 import fs from 'fs';
  • fs package/src/cli/index.js :6 import fs from 'fs/promises';
  • fs package/src/cli/mcp-flow-auth.ts :12 import * as fs from 'fs';
  • fs package/src/config/secure-config.ts :7 import * as fs from 'fs';
  • fs package/src/index-mocked.js :14 import fs from 'fs/promises';
  • fs package/src/index-real.js :14 import fs from 'fs/promises';
  • fs package/src/index.js :30 import fs from 'fs/promises';
  • fs package/src/server-real.ts :18 import * as fs from 'fs/promises';
  • fs package/src/services/auth-service.js :171 await fs.mkdir(dirname(sessionPath), { recursive: true });
  • fs package/src/services/cross-platform-session.js :7 import fs from 'fs';
  • fs package/src/services/e2b-service.js :5 import fs from 'fs';
  • fs package/src/services/judge-orchestrator.js :9 import fs from 'fs/promises';
  • fs package/src/services/neural-training-service.js :11 import fs from 'fs/promises';
  • fs package/src/services/registration.js :7 import fs from 'fs/promises';
  • fs package/src/services/secure-session.js :7 import fs from 'fs';
  • fs package/src/services/session-manager.js :6 import fs from 'fs';
  • fs package/src/services/supabase-client.js :8 import fs from 'fs';
  • fs package/src/services/supabase.js :6 import fs from 'fs';
  • fs package/src/services/windows-session-fix.js :6 import fs from 'fs';
  • fs package/src/tools/auth.ts :7 import * as fs from 'fs/promises';

shell / exec 10

  • shell package/bin/flow-nexus.js :9 import { spawn } from 'child_process';
  • shell package/bin/mcp.js :8 import { spawn } from 'child_process';
  • shell package/cli.js :10 import { exec, spawnSync } from 'child_process';
  • shell package/src/cli/index.js :3 import { spawn } from 'child_process';
  • shell package/src/cli/payment-cli.js :78 const { exec } = await import('child_process');
  • shell package/src/index-real.js :16 import { exec } from 'child_process';
  • shell package/src/index.js :39 import { exec } from 'child_process';
  • shell package/src/mcp-bridge.js :8 import { spawn } from 'child_process';
  • shell package/src/server-real.ts :24 import { exec } from 'child_process';
  • shell package/src/services/judge-orchestrator.js :127 import { execSync } from 'child_process';

network 10

  • net package/src/cli.ts :196 const response = await fetch(`${options.url}/health`);
  • net package/src/index.js :1850 const createResponse = await fetch(edgeFunctionUrl, {
  • net package/src/mcp-bridge.js :9 import http from 'http';
  • net package/src/mcp-streamable.js :22 import http from 'http';
  • net package/src/services/accounting-service.ts :43 const response = await fetch(`${this.supabase.supabaseUrl}/functions/v1/transaction-processor`, {
  • net package/src/services/auth-service.js :46 const response = await fetch('https://api.flow-nexus.com/auth/validate', {
  • net package/src/services/e2b-service.js :63 // const response = await fetch(`${this.baseUrl}/sandboxes`, {
  • net package/src/services/real-wasm-integration.js :25 const response = await fetch(moduleUrl);
  • net package/src/services/seraphina-client.js :236 const response = await fetch(`${supabaseUrl}/functions/v1/seraphina-chat`, {
  • net package/src/services/workflow-executor.js :291 const response = await fetch(url, {

secrets 24

  • secrets package/cli.js :36 apiKey: process.env.FLOW_NEXUS_API_KEY,
  • secrets package/src/app-store-server.js :28 const key = config.supabase_key || process.env.SUPABASE_ANON_KEY;
  • secrets package/src/cli.ts :53 serviceKey: process.env.SUPABASE_SERVICE_KEY!,
  • secrets package/src/cli/payment-cli.js :18 process.env.SUPABASE_ANON_KEY || ''
  • secrets package/src/index.js :4995 if (sandbox.e2b_sandbox_id && process.env.E2B_API_KEY) {
  • secrets package/src/index.ts :28 serviceKey: process.env.SUPABASE_SERVICE_KEY!,
  • secrets package/src/middleware/security.js :45 jwtSecret: process.env.JWT_SECRET || crypto.randomBytes(32).toString('hex'),
  • secrets package/src/middleware/user-isolation.ts :29 this.supabaseServiceKey = process.env.SUPABASE_SERVICE_KEY!;
  • secrets package/src/middleware/vault-security.js :69 const secret = process.env.VAULT_SECRET || crypto.randomBytes(32).toString('hex');
  • secrets package/src/server-real.ts :37 serviceKey: process.env.SUPABASE_SERVICE_KEY || '',
  • secrets package/src/services/auth-service.js :19 const encryptedKey = process.env.ENCRYPTED_SUPABASE_KEY || this.getEncryptedKey();
  • secrets package/src/services/e2b-service.js :31 this.apiKey = process.env.E2B_API_KEY || 'e2b_e4d65c7d6d3f7d4eee84dca9c59acb5725a622a8';
  • secrets package/src/services/judge-orchestrator.js :19 this.anthropicKey = process.env.ANTHROPIC_API_KEY;
  • secrets package/src/services/real-wasm-integration.js :10 this.e2bApiKey = process.env.E2B_API_KEY;
  • secrets package/src/services/realtime-swarm-coordinator.js :12 const SUPABASE_ANON_KEY = process.env.VITE_SUPABASE_ANON_KEY;
  • secrets package/src/services/sandbox-lifecycle-manager.js :64 apiKey: process.env.E2B_API_KEY,
  • secrets package/src/services/supabase.js :33 if (key === 'auth-token' && process.env.FLOW_NEXUS_ACCESS_TOKEN) {
  • secrets package/src/services/swarm-cleanup-service.js :14 process.env.SUPABASE_SERVICE_ROLE_KEY || process.env.SUPABASE_ANON_KEY
  • secrets package/src/services/swarm-template-manager.js :16 process.env.SUPABASE_ANON_KEY
  • secrets package/src/tools/auth.ts :45 private supabaseAnonKey: string = process.env.SUPABASE_ANON_KEY || ''
  • secrets package/src/tools/authenticated-tools.ts :154 const apiKey = params.apiKey || process.env.FLOW_NEXUS_API_KEY;
  • secrets package/src/tools/darknet.ts :21 process.env.SUPABASE_SERVICE_ROLE_KEY || ''
  • secrets package/src/tools/payment-mcp-tools.js :9 const stripe = new Stripe(process.env.STRIPE_SECRET_KEY || 'sk_test_51S1XHUCW68gTm0lpDgbCw7uVb6cH2WDZkcHn0Q9X9BM5bIPd8MmgdDddvbo8DYdTNk49nlWNvY8GsihEUDuiSYZL00UCjYmYO0', {
  • secrets package/src/tools/payment-tools.ts :40 this.stripe = new Stripe(config.stripeSecretKey || process.env.STRIPE_SECRET_KEY!, {

database 1

  • db package/src/middleware/rate-limit.ts :1 import Redis from 'ioredis';

declared dependencies 14

  • @modelcontextprotocol/sdk@^1.17.3
  • @anthropic-ai/sdk@^0.60.0
  • @supabase/supabase-js@^2.55.0
  • bcryptjs@^2.4.3
  • chalk@^5.3.0
  • commander@^12.0.0
  • dotenv@^17.2.2
  • inquirer@^9.2.0
  • jsonwebtoken@^9.0.2
  • node-fetch@^3.3.2
  • ora@^8.0.1
  • rate-limiter-flexible@^7.2.0
  • validator@^13.15.15
  • e2b@^2.0.3

clipboard 1

  • clipboard shell call package/src/cli/payment-cli.js :79 exec(`echo "${result.paymentUrl}" | pbcopy`);