npm analyzed 0.1.128

flow-nexus

v0.1.128

npm

🚀 AI-Powered Swarm Intelligence Platform - Gamified MCP Development with 70+ Tools

maintainer: ruvnet
license: Proprietary
first seen: 2026-05-25
last seen: 2026-06-11
releases · 30d: 0
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools

transport stdio · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

no tools enumerated yet for this server.

skills & danger signals npm-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v0.1.128 · analyzer v18 · 9h ago

danger signals3

credential in logscredential in logpackage/src/cli/index.js:95console.log(`API Key: ${result.apiKey}`);
credential in logscredential in logpackage/src/cli/mcp-flow-auth.ts:74console.log(` • API Key: ${session.user.apiKey}`);
credential in logscredential in logpackage/src/cli/payment-cli.js:307console.log(chalk.cyan(`${process.env.BASE_URL || 'https://flow.ruv.net'}/subscribe?secret=${result.clientSecret}`));

code evidence v0.1.128 · npm-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

filesystem 30

fs package/bin/flow-nexus.js :12 import fs from 'fs';
fs package/cli.js :7 import fs, { readFileSync } from 'fs';
fs package/scripts/clear-phantom-cache.js :13 import fs from 'fs/promises';
fs package/scripts/configure-webhook.js :184 await fs.writeFile('./setup-webhook.sql', setupScript);
fs package/scripts/fix-critical-issues.js :16 import fs from 'fs/promises';
fs package/scripts/fix-execution-engine.js :19 import fs from 'fs/promises';
fs package/scripts/init-user.js :3 import fs from 'fs/promises';
fs package/scripts/postinstall.js :3 import fs from 'fs';
fs package/src/app-store-server.js :16 import fs from 'fs';
fs package/src/cli.ts :6 import * as fs from 'fs';
fs package/src/cli/auth-cli.js :7 import fs from 'fs';
fs package/src/cli/index.js :6 import fs from 'fs/promises';
fs package/src/cli/mcp-flow-auth.ts :12 import * as fs from 'fs';
fs package/src/config/secure-config.ts :7 import * as fs from 'fs';
fs package/src/index-mocked.js :14 import fs from 'fs/promises';
fs package/src/index-real.js :14 import fs from 'fs/promises';
fs package/src/index.js :30 import fs from 'fs/promises';
fs package/src/server-real.ts :18 import * as fs from 'fs/promises';
fs package/src/services/auth-service.js :171 await fs.mkdir(dirname(sessionPath), { recursive: true });
fs package/src/services/cross-platform-session.js :7 import fs from 'fs';
fs package/src/services/e2b-service.js :5 import fs from 'fs';
fs package/src/services/judge-orchestrator.js :9 import fs from 'fs/promises';
fs package/src/services/neural-training-service.js :11 import fs from 'fs/promises';
fs package/src/services/registration.js :7 import fs from 'fs/promises';
fs package/src/services/secure-session.js :7 import fs from 'fs';
fs package/src/services/session-manager.js :6 import fs from 'fs';
fs package/src/services/supabase-client.js :8 import fs from 'fs';
fs package/src/services/supabase.js :6 import fs from 'fs';
fs package/src/services/windows-session-fix.js :6 import fs from 'fs';
fs package/src/tools/auth.ts :7 import * as fs from 'fs/promises';

shell / exec 12

shell package/bin/flow-nexus.js :9 import { spawn } from 'child_process';
shell package/bin/mcp.js :8 import { spawn } from 'child_process';
shell package/cli.js :10 import { exec, spawnSync } from 'child_process';
shell package/scripts/debug-chat.js :3 import { spawn } from 'child_process';
shell package/scripts/fix-critical-issues.js :351 import { exec } from 'child_process';
shell package/src/cli/index.js :3 import { spawn } from 'child_process';
shell package/src/cli/payment-cli.js :78 const { exec } = await import('child_process');
shell package/src/index-real.js :16 import { exec } from 'child_process';
shell package/src/index.js :39 import { exec } from 'child_process';
shell package/src/mcp-bridge.js :8 import { spawn } from 'child_process';
shell package/src/server-real.ts :24 import { exec } from 'child_process';
shell package/src/services/judge-orchestrator.js :127 import { execSync } from 'child_process';

network 11

net package/scripts/configure-webhook.js :116 const response = await fetch(`${SUPABASE_URL}/functions/v1/trigger-judge`, {
net package/src/cli.ts :196 const response = await fetch(`${options.url}/health`);
net package/src/index.js :1850 const createResponse = await fetch(edgeFunctionUrl, {
net package/src/mcp-bridge.js :9 import http from 'http';
net package/src/mcp-streamable.js :22 import http from 'http';
net package/src/services/accounting-service.ts :43 const response = await fetch(`${this.supabase.supabaseUrl}/functions/v1/transaction-processor`, {
net package/src/services/auth-service.js :46 const response = await fetch('https://api.flow-nexus.com/auth/validate', {
net package/src/services/e2b-service.js :63 // const response = await fetch(`${this.baseUrl}/sandboxes`, {
net package/src/services/real-wasm-integration.js :25 const response = await fetch(moduleUrl);
net package/src/services/seraphina-client.js :236 const response = await fetch(`${supabaseUrl}/functions/v1/seraphina-chat`, {
net package/src/services/workflow-executor.js :291 const response = await fetch(url, {

secrets 32

secrets package/cli.js :36 apiKey: process.env.FLOW_NEXUS_API_KEY,
secrets package/scripts/cleanup-sandboxes.js :17 const SUPABASE_SERVICE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY || process.env.SUPABASE_ANON_KEY;
secrets package/scripts/cleanup-test-swarms.js :27 process.env.SUPABASE_ANON_KEY
secrets package/scripts/clear-phantom-cache.js :56 process.env.SUPABASE_SERVICE_ROLE_KEY || process.env.SUPABASE_ANON_KEY
secrets package/scripts/configure-webhook.js :16 const SUPABASE_SERVICE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY;
secrets package/scripts/emergency-swarm-cleanup.js :26 const supabaseKey = process.env.SUPABASE_SERVICE_ROLE_KEY || process.env.SUPABASE_ANON_KEY;
secrets package/scripts/fix-critical-issues.js :27 const SUPABASE_SERVICE_KEY = process.env.SUPABASE_SERVICE_KEY;
secrets package/scripts/fix-database-schema.js :21 const SUPABASE_SERVICE_KEY = process.env.SUPABASE_SERVICE_KEY;
secrets package/scripts/fix-execution-engine.js :28 const SUPABASE_SERVICE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY;
secrets package/scripts/force-cleanup-phantom-swarms.js :40 process.env.SUPABASE_ANON_KEY
secrets package/scripts/force-destroy-phantoms.js :40 process.env.SUPABASE_SERVICE_ROLE_KEY || process.env.SUPABASE_ANON_KEY
secrets package/scripts/init-user.js :28 const SUPABASE_ANON_KEY = process.env.SUPABASE_ANON_KEY || 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImtrbGtpdmtzZGRrY2F6a3ZmanN3Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3MzU1NzMzNzY
secrets package/src/app-store-server.js :28 const key = config.supabase_key || process.env.SUPABASE_ANON_KEY;
secrets package/src/cli.ts :53 serviceKey: process.env.SUPABASE_SERVICE_KEY!,
secrets package/src/cli/payment-cli.js :18 process.env.SUPABASE_ANON_KEY || ''
secrets package/src/index.js :6516 if (process.env.STRIPE_SECRET_KEY) {
secrets package/src/index.ts :28 serviceKey: process.env.SUPABASE_SERVICE_KEY!,
secrets package/src/middleware/security.js :45 jwtSecret: process.env.JWT_SECRET || crypto.randomBytes(32).toString('hex'),
secrets package/src/middleware/user-isolation.ts :29 this.supabaseServiceKey = process.env.SUPABASE_SERVICE_KEY!;
secrets package/src/middleware/vault-security.js :69 const secret = process.env.VAULT_SECRET || crypto.randomBytes(32).toString('hex');
secrets package/src/server-real.ts :37 serviceKey: process.env.SUPABASE_SERVICE_KEY || '',
secrets package/src/services/auth-service.js :19 const encryptedKey = process.env.ENCRYPTED_SUPABASE_KEY || this.getEncryptedKey();
secrets package/src/services/judge-orchestrator.js :19 this.anthropicKey = process.env.ANTHROPIC_API_KEY;
secrets package/src/services/realtime-swarm-coordinator.js :12 const SUPABASE_ANON_KEY = process.env.VITE_SUPABASE_ANON_KEY;
secrets package/src/services/supabase.js :33 if (key === 'auth-token' && process.env.FLOW_NEXUS_ACCESS_TOKEN) {
secrets package/src/services/swarm-cleanup-service.js :14 process.env.SUPABASE_SERVICE_ROLE_KEY || process.env.SUPABASE_ANON_KEY
secrets package/src/services/swarm-template-manager.js :16 process.env.SUPABASE_ANON_KEY
secrets package/src/tools/auth.ts :45 private supabaseAnonKey: string = process.env.SUPABASE_ANON_KEY || ''
secrets package/src/tools/authenticated-tools.ts :154 const apiKey = params.apiKey || process.env.FLOW_NEXUS_API_KEY;
secrets package/src/tools/darknet.ts :21 process.env.SUPABASE_SERVICE_ROLE_KEY || ''
secrets package/src/tools/payment-mcp-tools.js :9 const stripe = new Stripe(process.env.STRIPE_SECRET_KEY || 'sk_test_51S1XHUCW68gTm0lpDgbCw7uVb6cH2WDZkcHn0Q9X9BM5bIPd8MmgdDddvbo8DYdTNk49nlWNvY8GsihEUDuiSYZL00UCjYmYO0', {
secrets package/src/tools/payment-tools.ts :40 this.stripe = new Stripe(config.stripeSecretKey || process.env.STRIPE_SECRET_KEY!, {

database 1

db package/src/middleware/rate-limit.ts :1 import Redis from 'ioredis';

declared dependencies 14

@anthropic-ai/sdk@^0.60.0
@modelcontextprotocol/sdk@^1.17.3
@supabase/supabase-js@^2.55.0
bcryptjs@^2.4.3
chalk@^5.3.0
commander@^12.0.0
dotenv@^17.2.2
inquirer@^9.2.0
jsonwebtoken@^9.0.2
node-fetch@^3.3.2
ora@^8.0.1
rate-limiter-flexible@^7.2.0
validator@^13.15.15
e2b@^2.0.3