MCP Observatory
3m ago Tracked 60,000 Last 3m ago 24h 2,482
npm JavaScript analyzed 0.9.135

mixdog

v0.9.135
npm

Standalone mixdog coding-agent CLI/TUI workspace.

maintainer
trib-dev
licence
MIT
first seen
2026-07-21
last seen
2026-08-18
releases · 30d
0
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools
transport stdio · streamable-http · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals npm-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v0.9.135 · analyzer v33 · 4w ago

skills & prompt files 5

danger signals1

code evidence v0.9.135 · npm-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 1028

filesystem 250

  • fs (weak) package/scripts/.tmp-coverage-report.mjs :4 import { readFileSync, existsSync } from 'node:fs';
  • fs (weak) package/scripts/agent-lead-e2e-probe.mjs :13 import { copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
  • fs (weak) package/scripts/agent-long-prompt-repro.mjs :4 import { copyFileSync, existsSync, mkdirSync, mkdtempSync, rmSync } from 'node:fs';
  • fs (weak) package/scripts/agent-shard-spread-perf.mjs :13 import { copyFileSync, existsSync, mkdtempSync, mkdirSync, rmSync } from 'node:fs';
  • fs (weak) package/scripts/agent-turn-trace-probe.mjs :12 import { copyFileSync, existsSync, mkdtempSync, mkdirSync, readFileSync, rmSync } from 'node:fs';
  • fs (weak) package/scripts/build-token-addon.mjs :1 import { copyFile, mkdir } from 'node:fs/promises';
  • fs (weak) package/scripts/daemon-stub.mjs :11 import { rmSync, writeFileSync } from 'node:fs';
  • fs (weak) package/scripts/dependency-lock-cache-key.mjs :4 import { readFile } from 'node:fs/promises'
  • fs (weak) package/scripts/fixtures/spawn-lease-fixture-worker.mjs :5 import { writeFileSync } from 'node:fs';
  • fs (weak) package/scripts/generate-runtime-manifest.mjs :15 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
  • fs (weak) package/scripts/llm-trace-summary.mjs :2 import { existsSync, readFileSync } from 'node:fs';
  • fs (weak) package/scripts/native-spawn-test-runtime.mjs :1 import { existsSync } from 'node:fs';
show 28 more
  • fs (weak) package/scripts/patch-replay.mjs :9 import { existsSync, readFileSync, readdirSync, mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'node:fs';
  • fs (weak) package/scripts/patch-replay.test.mjs :2 import { existsSync, mkdtempSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
  • fs (weak) package/scripts/prepare-native-assets.mjs :10 } from 'node:fs/promises';
  • fs (weak) package/scripts/prune-embedding-runtime.mjs :3 import { access, readdir, readFile, rm } from 'node:fs/promises'
  • fs (weak) package/scripts/reduction-trace-report.mjs :2 import { readFileSync } from 'node:fs';
  • fs (weak) package/scripts/release-timing-report.mjs :3 import { appendFile, readFile } from 'node:fs/promises';
  • fs (weak) package/scripts/routing-corpus.mjs :6 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
  • fs (weak) package/scripts/runtime-dependency-cache-key.mjs :4 import { readFile } from 'node:fs/promises'
  • fs (weak) package/scripts/session-diag.mjs :2 import { existsSync, readFileSync } from 'node:fs';
  • fs (weak) package/scripts/session-sweep.mjs :25 import { existsSync, readdirSync, statSync } from 'fs';
  • fs (weak) package/scripts/tool-efficiency-diag.mjs :4 import { readFileSync, existsSync } from 'node:fs';
  • fs (weak) package/scripts/tool-failures.mjs :2 import { existsSync, readFileSync } from 'node:fs';
  • fs (weak) package/scripts/tool-stress.mjs :8 import { mkdtempSync, rmSync } from 'node:fs';
  • fs (weak) package/scripts/tui-transcript-jitter-harness.mjs :3 import { rm } from 'node:fs/promises';
  • fs (weak) package/scripts/verify-release-assets.mjs :2 import { readFile } from 'node:fs/promises';
  • fs package/src/app.mjs :1 import { existsSync } from 'node:fs';
  • fs package/src/headless-exec.mjs :6 } from 'node:fs';
  • fs (weak) package/src/headless-exec.test.mjs :2 import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
  • fs package/src/lib/keychain-cjs.cjs :6 const fs = require('fs');
  • fs package/src/lib/mixdog-debug.cjs :3 const fs = require('fs');
  • fs package/src/lib/rules-builder.cjs :34 const fs = require('fs');
  • fs package/src/runtime/agent/orchestrator/agent-trace-io.mjs :1 import { readFileSync, existsSync, mkdirSync, appendFileSync, statSync, renameSync } from 'fs';
  • fs package/src/runtime/agent/orchestrator/cache-mtime.mjs :1 import { statSync, readdirSync } from 'fs';
  • fs package/src/runtime/agent/orchestrator/context/collect.mjs :1 import { readFileSync, existsSync, readdirSync } from 'fs';
  • fs package/src/runtime/agent/orchestrator/dispatch-persist.mjs :21 import fs from 'fs';
  • fs package/src/runtime/agent/orchestrator/internal-agents.mjs :38 import { readFileSync, statSync } from 'fs'
  • fs package/src/runtime/agent/orchestrator/mcp/client.mjs :1 import { readFileSync, existsSync, mkdirSync } from 'fs';
  • fs (weak) package/src/runtime/agent/orchestrator/mcp/security.test.mjs :2 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';

210 more not shown — this panel samples each group; the count above is the real total.

shell / exec 52

  • shell (weak) package/scripts/agent-shard-spread-perf.mjs :14 import { execFileSync } from 'node:child_process';
  • shell (weak) package/scripts/build-token-addon.mjs :2 import { spawn } from 'node:child_process';
  • shell (weak) package/scripts/generate-runtime-manifest.mjs :14 import { execSync } from 'node:child_process';
  • shell (weak) package/scripts/lib/isolated-root-cleanup.mjs :5 import { spawnSync } from 'node:child_process';
  • shell (weak) package/scripts/smoke.mjs :1 import { spawnSync } from 'node:child_process';
  • shell (weak) package/scripts/tool-overhead-microbench.mjs :5 import { spawn } from 'node:child_process';
  • shell package/src/cli.mjs :57 const { spawnSync } = await import('node:child_process');
  • shell package/src/lib/keychain-cjs.cjs :3 const { spawn, spawnSync } = require('child_process');
  • shell package/src/runtime/agent/orchestrator/mcp/child-tree.mjs :11 import { spawn } from 'node:child_process';
  • shell package/src/runtime/agent/orchestrator/session/manager/session-lifecycle.mjs :93 // --- agent spawn (createSession) ---
  • shell (weak) package/src/runtime/agent/orchestrator/tools/builtin/git-command-tool.test.mjs :2 import { spawnSync } from 'node:child_process';
  • shell package/src/runtime/agent/orchestrator/tools/builtin/native-search-client.mjs :7 import { spawn } from 'node:child_process';
show 28 more
  • shell package/src/runtime/agent/orchestrator/tools/code-graph/graph-binary.mjs :61 const { spawn } = await import('node:child_process');
  • shell package/src/runtime/agent/orchestrator/tools/lib/native-spawn-client.mjs :1 import { spawn } from 'node:child_process';
  • shell package/src/runtime/agent/orchestrator/tools/patch/native-server.mjs :10 import { spawn } from 'node:child_process';
  • shell package/src/runtime/agent/orchestrator/tools/shell-command.mjs :188 // note). The failure is at spawn() time — before any stdio/side effect — so a
  • shell package/src/runtime/channels/lib/executor.mjs :1 import { spawn } from "child_process";
  • shell package/src/runtime/channels/lib/runtime-paths.mjs :2 import { execFileSync } from "child_process";
  • shell package/src/runtime/channels/lib/session-discovery.mjs :2 import { execFileSync } from "child_process";
  • shell package/src/runtime/channels/lib/voice-runtime-fetcher.mjs :38 import { spawnSync } from 'child_process'
  • shell package/src/runtime/channels/lib/voice-transcription.mjs :1 import { spawn } from "child_process";
  • shell package/src/runtime/channels/lib/whisper-server.mjs :39 import { spawn, spawnSync } from 'node:child_process';
  • shell package/src/runtime/media/renditions.mjs :16 import { spawn } from 'child_process';
  • shell package/src/runtime/media/store.mjs :12 import { spawn } from 'child_process';
  • shell package/src/runtime/memory/lib/embedding-worker.mjs :8 import { execFile } from 'child_process'
  • shell package/src/runtime/memory/lib/llm-worker-host.mjs :2 * llm-worker-host.mjs — LLM worker host using direct spawn (no fork).
  • shell package/src/runtime/memory/lib/memory-process-lock.mjs :4 import { execFileSync } from 'node:child_process'
  • shell package/src/runtime/memory/lib/pg/adapter.mjs :205 // Not retried — same rationale as exec(): a COMMIT that fails with
  • shell package/src/runtime/memory/lib/pg/process.mjs :14 import { spawn, spawnSync } from 'child_process'
  • shell package/src/runtime/memory/lib/pg/supervisor.mjs :374 const { spawnSync } = await import('node:child_process');
  • shell package/src/runtime/memory/lib/runtime-fetcher.mjs :27 import { spawnSync } from 'child_process'
  • shell package/src/runtime/shared/atomic-file.mjs :25 import { execFile, execFileSync } from 'child_process';
  • shell package/src/runtime/shared/child-guardian.mjs :3 import { spawn } from 'node:child_process';
  • shell package/src/runtime/shared/memory-snapshot.mjs :1 import { execFile } from 'node:child_process';
  • shell package/src/runtime/shared/open-url.mjs :1 import { spawn } from 'child_process';
  • shell package/src/runtime/shared/process-lifecycle.mjs :18 import { execFile } from 'node:child_process';
  • shell package/src/runtime/shared/staged-update.mjs :37 import { spawn } from 'node:child_process';
  • shell package/src/runtime/shared/turn-worktree-snapshot.mjs :1 import { spawn } from 'node:child_process';
  • shell package/src/runtime/shared/update-checker.mjs :19 import { spawn } from 'node:child_process';
  • shell package/src/session-runtime/workflow-agents-api.mjs :372 // spawn (the spawn path rejects unknown agent ids).

12 more not shown — this panel samples each group; the count above is the real total.

network 48

  • net package/src/runtime/agent/orchestrator/agent-trace-io.mjs :259 const resp = await fetch(`${url}/admin/trace-record`, {
  • net package/src/runtime/agent/orchestrator/providers/anthropic-oauth-credentials.mjs :11 import { createServer } from 'http';
  • net package/src/runtime/agent/orchestrator/providers/anthropic-oauth.mjs :680 const sendAttempt = (gz) => fetch(API_URL, {
  • net package/src/runtime/agent/orchestrator/providers/anthropic.mjs :689 const res = await fetch(`${base}/v1/models`, {
  • net package/src/runtime/agent/orchestrator/providers/api-usage.mjs :89 const res = await fetch(url, { headers, signal: controller.signal });
  • net package/src/runtime/agent/orchestrator/providers/codex-client-meta.mjs :27 const res = await fetch('https://registry.npmjs.org/@openai/codex/latest', {
  • net package/src/runtime/agent/orchestrator/providers/grok-oauth-login.mjs :17 import { createServer } from 'http';
  • net package/src/runtime/agent/orchestrator/providers/grok-oauth-tokens.mjs :17 import { createServer } from 'http';
  • net package/src/runtime/agent/orchestrator/providers/grok-oauth.mjs :16 import { createServer } from 'http';
  • net package/src/runtime/agent/orchestrator/providers/oauth-usage.mjs :315 const response = await fetch(CODEX_RESET_CREDITS_URL, fetchOptions(codexHeaders(auth)));
  • net package/src/runtime/agent/orchestrator/providers/openai-compat.mjs :1072 const res = await fetch(`${String(this.baseURL || '').replace(/\/+$/, '')}/models`, {
  • net package/src/runtime/agent/orchestrator/providers/openai-oauth-login.mjs :11 import { createServer } from 'http';
show 28 more
  • net package/src/runtime/agent/orchestrator/providers/openai-oauth.mjs :315 const res = await fetch(TOKEN_URL, {
  • net package/src/runtime/agent/orchestrator/providers/openai-ws.mjs :282 const res = await fetch('https://api.openai.com/v1/models', {
  • net package/src/runtime/agent/orchestrator/providers/opencode-go-usage.mjs :52 // per successful fetch (TTL-gated, at most once per LIVE_TTL_MS), so the
  • net package/src/runtime/agent/orchestrator/tools/graph-binary-fetcher.mjs :89 const res = await fetch(url, { signal: AbortSignal.timeout(180_000) });
  • net package/src/runtime/agent/orchestrator/tools/patch-binary-fetcher.mjs :116 const res = await fetch(url, { signal: AbortSignal.timeout(180_000) });
  • net package/src/runtime/agent/orchestrator/tools/spawn-binary-fetcher.mjs :65 const response = await fetch(url, { signal: AbortSignal.timeout(180_000) });
  • net package/src/runtime/agent/orchestrator/tools/token-addon-fetcher.mjs :103 const res = await fetch(url, { signal: AbortSignal.timeout(180_000) });
  • net package/src/runtime/channels/lib/voice-runtime-fetcher.mjs :249 const res = await fetch(MANIFEST_URL, { signal: AbortSignal.timeout(30_000) })
  • net package/src/runtime/channels/lib/webhook.mjs :1 import * as http from "http";
  • net package/src/runtime/channels/lib/webhook/relay-tunnel.mjs :10 import * as http from "http";
  • net package/src/runtime/channels/lib/whisper-server.mjs :36 import net from 'node:net';
  • net package/src/runtime/channels/providers/discord-attachments.mjs :18 const res = await fetch(att.url, { signal: AbortSignal.timeout(timeoutMs) });
  • net package/src/runtime/channels/providers/discord.mjs :374 const msgs = await ch.messages.fetch({ limit: capped });
  • net package/src/runtime/channels/providers/telegram.mjs :213 res = await fetch(url, {
  • net package/src/runtime/media/adapters/codex-image.mjs :67 const res = await fetch(CODEX_RESPONSES_URL, {
  • net package/src/runtime/media/adapters/gemini-image.mjs :37 return await fetch(`${BASE_URL}/${encodeURIComponent(model)}:generateContent`, {
  • net package/src/runtime/media/adapters/gemini-video.mjs :38 const res = await fetch(`${BASE_URL}/interactions`, {
  • net package/src/runtime/media/adapters/xai-media.mjs :51 const res = await fetch(`${baseURL}/${route}`, {
  • net package/src/runtime/memory/index.mjs :11 import http from 'node:http'
  • net package/src/runtime/memory/lib/agent-ipc.mjs :9 import http from 'node:http'
  • net package/src/runtime/memory/lib/ko-morph.mjs :174 const res = await fetch(KIWI_MODEL_URL, {
  • net package/src/runtime/memory/lib/pg/process.mjs :15 import { createConnection } from 'net'
  • net package/src/runtime/memory/lib/pg/supervisor.mjs :20 import { createServer } from 'node:net';
  • net package/src/runtime/memory/lib/runtime-fetcher.mjs :86 const res = await fetch(MANIFEST_URL, { signal: AbortSignal.timeout(30_000) })
  • net package/src/runtime/search/lib/http-fetch.mjs :3 import { Agent, fetch as undiciFetch } from 'undici'
  • net package/src/runtime/search/lib/ssrf-guard.mjs :2 import net from 'net'
  • net package/src/runtime/shared/llm/http-agent.mjs :5 * call the global `fetch()` with no dispatcher, so they ride Node's default
  • net package/src/runtime/shared/update-checker.mjs :126 const res = await fetch(REGISTRY_URL, { signal: controller.signal });

8 more not shown — this panel samples each group; the count above is the real total.

secrets 9

  • secrets package/src/runtime/agent/orchestrator/agent-runtime/cache-strategy.mjs :289 && process.env.MIXDOG_OAI_CODEX_THREAD_CACHE_KEY !== '0'
  • secrets package/src/runtime/agent/orchestrator/providers/anthropic.mjs :75 this.apiKey = this.config.apiKey || (this.name === 'anthropic' ? process.env.ANTHROPIC_API_KEY : null);
  • secrets package/src/runtime/agent/orchestrator/providers/api-usage.mjs :361 process.env.ANTHROPIC_ADMIN_API_KEY,
  • secrets package/src/runtime/agent/orchestrator/providers/cursor-auth.mjs :37 if (process.env.CURSOR_ACCESS_TOKEN) {
  • secrets package/src/runtime/agent/orchestrator/providers/gemini.mjs :136 const apiKey = config.apiKey || process.env.GEMINI_API_KEY || '';
  • secrets package/src/runtime/agent/orchestrator/providers/oauth-credential-probes.mjs :92 if (process.env.CURSOR_ACCESS_TOKEN) {
  • secrets package/src/runtime/agent/orchestrator/providers/openai-compat.mjs :895 const apiKey = this.config?.apiKey || process.env.XAI_API_KEY;
  • secrets package/src/runtime/agent/orchestrator/providers/openai-oauth.mjs :801 const threadKeyGate = String(process.env.MIXDOG_OAI_CODEX_THREAD_CACHE_KEY || '').toLowerCase();
  • secrets package/src/runtime/shared/config.mjs :539 return process.env.OPENAI_USAGE_SESSION_KEY

install hooks 4

  • postinstall package/package.json :46 node scripts/prune-embedding-runtime.mjs && node scripts/prepare-native-assets.mjs
  • prepack package/package.json :47 npm run build:tui
  • prepublishOnly (suspicious) package/package.json :48 node -e "if(!process.env.CI){console.error('local npm publish is disabled — run npm run release:patch');process.exit(1)}"
  • prepare package/vendor/ink/package.json :23 npm run build

declared dependencies 31

  • @modelcontextprotocol/sdk@^1.29.0
  • @anthropic-ai/sdk@^0.105.0
  • @google/generative-ai@^0.24.1
  • @huggingface/transformers@^3.8.1
  • @mozilla/readability@^0.6.0
  • chalk@^5.6.2
  • cli-highlight@^2.1.11
  • diff@^9.0.0
  • discord.js@^14.26.4
  • ink@^7.1.0
  • jsdom@^27.0.0
  • kiwi-nlp@^0.21.0
show 19 more
  • marked@^14.1.4
  • node-cron@^4.5.0
  • openai@^6.44.0
  • pg@^8.22.0
  • puppeteer-core@^25.2.0
  • react@^19.2.7
  • sharp@^0.35.3
  • string-width@^8.2.1
  • strip-ansi@^7.2.0
  • tiktoken@^1.0.22
  • unpdf@^1.8.0
  • undici@^8.5.0
  • wrap-ansi@^10.0.0
  • ws@^8.21.0
  • zod@^3.25.76
  • acorn@^8.17.0
  • esbuild@^0.28.1
  • eslint-scope@^9.1.2
  • @vscode/ripgrep@^1.18.0

clipboard 3

  • clipboard shell call package/src/tui/app/clipboard.mjs :54 cmd: 'clip.exe',
  • clipboard shell call package/src/tui/dist/index.mjs :438 const wl = await execFileBuffer("wl-paste", ["--type", "image/png"], { timeout: 3e3 });
  • clipboard shell call package/src/tui/paste-attachments.mjs :214 const wl = await execFileBuffer('wl-paste', ['--type', 'image/png'], { timeout: 3000 });

obfuscation 3

  • dynamic require()/import() package/scripts/tui-transcript-jitter-harness.mjs :37 await import(`${pathToFileURL(outfile).href}?run=${Date.now()}`);
  • dynamic require()/import() package/src/runtime/attachments/store.test.mjs :122 const freshStore = await import(`./store.mjs?integrity=${Date.now()}`);
  • dynamic require()/import() package/src/runtime/media/store.test.mjs :54 const store = await import(`./store.mjs?test=${Date.now()}`);