MCP Observatory
npm analyzed 2.0.1080

gm-codex

v2.0.1080
npm

Spool-dispatch orchestration engine with unified state machine, skills, and automated git enforcement

maintainer
lanmower
license
MIT
first seen
2026-05-22
last seen
2026-06-17
releases · 30d
0
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools
transport stdio counts 0 tools · 0 res · 0 prompts permission surface via code analysis

no tools enumerated yet for this server.

skills & danger signals npm-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v2.0.1080 · analyzer v18 · 8h ago

skills & prompt files 27

danger signals1

code evidence v2.0.1080 · npm-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

filesystem 16

  • fs package/bin/bootstrap.js :4 const fs = require('fs');
  • fs package/bin/plugkit.js :10 const fs = require('fs');
  • fs package/cli.js :2 const fs = require('fs');
  • fs package/install.js :2 const fs = require('fs');
  • fs package/lib/browser-spool-handler.js :1 const fs = require('fs');
  • fs package/lib/browser.js :1 const fs = require('fs');
  • fs package/lib/codeinsight.js :1 const fs = require('fs');
  • fs package/lib/daemon-bootstrap.js :1 const fs = require('fs');
  • fs package/lib/git.js :2 const fs = require('fs');
  • fs package/lib/learning.js :1 const fs = require('fs');
  • fs package/lib/skill-bootstrap.js :1 const fs = require('fs');
  • fs package/lib/spool-dispatch.js :1 const fs = require('fs');
  • fs package/lib/spool.js :1 const fs = require('fs');
  • fs package/lib/wasm-host.js :1 const fs = require('fs');
  • fs package/scripts/watch-cascade.js :37 const fs = require('fs');
  • fs package/uninstall.js :2 const fs = require('fs');

shell / exec 6

  • shell package/bin/bootstrap.js :8 const { spawnSync } = require('child_process');
  • shell package/bin/plugkit.js :8 const { spawnSync } = require('child_process');
  • shell package/lib/daemon-bootstrap.js :4 const { spawn, execSync } = require('child_process');
  • shell package/lib/skill-bootstrap.js :4 const { execSync, spawn } = require('child_process');
  • shell package/lib/wasm-host.js :3 const { execSync, spawnSync } = require('child_process');
  • shell package/scripts/watch-cascade.js :4 const { execSync, spawnSync } = require('child_process');

network 2

  • net package/lib/skill-bootstrap.js :3 const https = require('https');
  • net package/lib/wasm-host.js :4 const fetch = (...args) => import('node-fetch').then(({ default: fetch }) => fetch(...args));

declared dependencies 1

  • gm-plugkit@*