npm TypeScript analyzed 4.10.28 deep scan unknown

eric-cielo/moflo

v4.10.28
npm

MoFlo — an opinionated, local-first AI agent orchestration toolkit for Claude Code: semantic memory, learned routing, gates, and spells. No API keys, no cloud, works out of the box.

maintainer
eric-cielo
licence
MIT
first seen
2026-06-03
last seen
2026-09-08
releases · 30d
0
short id

Drift inferred · capture-to-capture

tool count over time

06-03 06:54 now
0t
2t
capabilities 2 tools
transport stdio · http counts 2 tools · 0 res · 0 prompts permission surface via README inference

tools

  • bwrap

    Linux

  • none

    fallback

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v4.10.28 · analyzer v33 · 4w ago

skills & prompt files 40

danger signals8

code evidence v4.10.28 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 1324

filesystem 394

  • fs eric-cielo-moflo-1e5a863/.claude/helpers/auto-memory-hook.mjs :12 import { existsSync, mkdirSync, writeFileSync } from 'fs';
  • fs eric-cielo-moflo-1e5a863/.claude/helpers/gate.cjs :3 var fs = require('fs');
  • fs eric-cielo-moflo-1e5a863/.claude/helpers/hook-handler.cjs :3 var fs = require('fs');
  • fs eric-cielo-moflo-1e5a863/.claude/helpers/intelligence.cjs :9 const fs = require('fs');
  • fs eric-cielo-moflo-1e5a863/.claude/helpers/prompt-hook.mjs :3 import { readFileSync } from 'fs';
  • fs eric-cielo-moflo-1e5a863/.claude/helpers/statusline.cjs :16 const fs = require('fs');
  • fs eric-cielo-moflo-1e5a863/.claude/helpers/subagent-start.cjs :19 const fs = require('fs');
  • fs (weak) eric-cielo-moflo-1e5a863/.claude/scripts/build-embeddings.mjs :19 import { existsSync, readFileSync } from 'fs';
  • fs (weak) eric-cielo-moflo-1e5a863/.claude/scripts/generate-code-map.mjs :28 import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync } from 'fs';
  • fs (weak) eric-cielo-moflo-1e5a863/.claude/scripts/hooks.mjs :23 import { existsSync, appendFileSync, readFileSync, writeFileSync, mkdirSync, statSync } from 'fs';
  • fs (weak) eric-cielo-moflo-1e5a863/.claude/scripts/index-all.mjs :16 import { existsSync, appendFileSync, readFileSync, mkdirSync } from 'fs';
  • fs (weak) eric-cielo-moflo-1e5a863/.claude/scripts/index-guidance.mjs :25 import { existsSync, readdirSync, readFileSync, statSync, mkdirSync, writeFileSync } from 'fs';
show 28 more
  • fs (weak) eric-cielo-moflo-1e5a863/.claude/scripts/index-patterns.mjs :27 import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync } from 'fs';
  • fs (weak) eric-cielo-moflo-1e5a863/.claude/scripts/index-reference.mjs :34 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs';
  • fs (weak) eric-cielo-moflo-1e5a863/.claude/scripts/index-tests.mjs :25 import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync } from 'fs';
  • fs (weak) eric-cielo-moflo-1e5a863/.claude/scripts/lib/daemon-config.mjs :5 import { existsSync, readFileSync } from 'fs';
  • fs (weak) eric-cielo-moflo-1e5a863/.claude/scripts/lib/daemon-port.mjs :12 import { existsSync, readFileSync } from 'node:fs';
  • fs (weak) eric-cielo-moflo-1e5a863/.claude/scripts/lib/daemon-recycler.mjs :29 import { existsSync, openSync, closeSync, unlinkSync, writeFileSync, readFileSync } from 'node:fs';
  • fs (weak) eric-cielo-moflo-1e5a863/.claude/scripts/lib/db-repair.mjs :43 import { existsSync, renameSync, unlinkSync } from 'node:fs';
  • fs (weak) eric-cielo-moflo-1e5a863/.claude/scripts/lib/embedding-backlog.mjs :25 import { existsSync } from 'node:fs';
  • fs (weak) eric-cielo-moflo-1e5a863/.claude/scripts/lib/file-sync.mjs :36 } from 'node:fs';
  • fs (weak) eric-cielo-moflo-1e5a863/.claude/scripts/lib/get-backend.mjs :33 import { existsSync, mkdirSync } from 'node:fs';
  • fs (weak) eric-cielo-moflo-1e5a863/.claude/scripts/lib/guidance-config.mjs :18 import { existsSync, readFileSync } from 'fs';
  • fs (weak) eric-cielo-moflo-1e5a863/.claude/scripts/lib/hook-io.mjs :12 import { existsSync, openSync, readSync, closeSync, statSync, readFileSync } from 'fs';
  • fs (weak) eric-cielo-moflo-1e5a863/.claude/scripts/lib/incremental-write.mjs :31 import { readFileSync } from 'fs';
  • fs (weak) eric-cielo-moflo-1e5a863/.claude/scripts/lib/index-fingerprint.mjs :44 } from 'node:fs';
  • fs (weak) eric-cielo-moflo-1e5a863/.claude/scripts/lib/install-global-shim.mjs :14 import { existsSync, writeFileSync, readFileSync, chmodSync } from 'fs';
  • fs (weak) eric-cielo-moflo-1e5a863/.claude/scripts/lib/meditate.mjs :35 import { existsSync, readFileSync, writeFileSync, renameSync, mkdirSync, unlinkSync } from 'fs';
  • fs (weak) eric-cielo-moflo-1e5a863/.claude/scripts/lib/migrations.mjs :24 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs';
  • fs (weak) eric-cielo-moflo-1e5a863/.claude/scripts/lib/moflo-paths.mjs :15 import { existsSync, realpathSync } from 'node:fs';
  • fs (weak) eric-cielo-moflo-1e5a863/.claude/scripts/lib/process-manager.mjs :18 import { existsSync, readFileSync, writeFileSync, renameSync, mkdirSync, unlinkSync, statSync, openSync, closeSync } from 'fs';
  • fs (weak) eric-cielo-moflo-1e5a863/.claude/scripts/lib/reference-docs.mjs :12 import { existsSync, readFileSync } from 'node:fs';
  • fs (weak) eric-cielo-moflo-1e5a863/.claude/scripts/lib/registry-cleanup.cjs :11 var fs = require('fs');
  • fs (weak) eric-cielo-moflo-1e5a863/.claude/scripts/lib/resolve-bin.mjs :27 import { existsSync } from 'node:fs';
  • fs (weak) eric-cielo-moflo-1e5a863/.claude/scripts/lib/retired-files.mjs :36 import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'fs';
  • fs (weak) eric-cielo-moflo-1e5a863/.claude/scripts/lib/session-continuity.mjs :33 import { existsSync, readFileSync, writeFileSync, renameSync, mkdirSync, readdirSync, statSync, unlinkSync } from 'fs';
  • fs (weak) eric-cielo-moflo-1e5a863/.claude/scripts/lib/shipped-scripts.mjs :19 import { readFileSync } from 'node:fs';
  • fs (weak) eric-cielo-moflo-1e5a863/.claude/scripts/lib/yaml-upgrader.mjs :13 import { readFileSync, writeFileSync, existsSync } from 'fs';
  • fs (weak) eric-cielo-moflo-1e5a863/.claude/scripts/meditate-distill.mjs :34 import { appendFileSync, mkdirSync } from 'fs';
  • fs (weak) eric-cielo-moflo-1e5a863/.claude/scripts/migrations/knowledge-purge.mjs :18 import { existsSync } from 'fs';

354 more not shown — this panel samples each group; the count above is the real total.

shell / exec 184

  • shell eric-cielo-moflo-1e5a863/.claude/helpers/gate-hook.mjs :2 import { execFileSync } from 'child_process';
  • shell eric-cielo-moflo-1e5a863/.claude/helpers/gate.cjs :5 var cp = require('child_process');
  • shell eric-cielo-moflo-1e5a863/.claude/helpers/prompt-hook.mjs :2 import { execFileSync } from 'child_process';
  • shell eric-cielo-moflo-1e5a863/.claude/helpers/simplify-classify.cjs :44 const { execSync } = require('child_process');
  • shell eric-cielo-moflo-1e5a863/.claude/helpers/statusline.cjs :18 const { execSync } = require('child_process');
  • shell (weak) eric-cielo-moflo-1e5a863/.claude/scripts/generate-code-map.mjs :31 import { execSync, execFileSync, spawn } from 'child_process';
  • shell (weak) eric-cielo-moflo-1e5a863/.claude/scripts/hooks.mjs :22 import { spawn } from 'child_process';
  • shell (weak) eric-cielo-moflo-1e5a863/.claude/scripts/index-all.mjs :19 import { spawn, spawnSync } from 'child_process';
  • shell (weak) eric-cielo-moflo-1e5a863/.claude/scripts/index-tests.mjs :28 import { execSync, execFileSync, spawn } from 'child_process';
  • shell (weak) eric-cielo-moflo-1e5a863/.claude/scripts/lib/daemon-recycler.mjs :9 * ("spawns background tasks via spawn(detached + unref) and exits
  • shell (weak) eric-cielo-moflo-1e5a863/.claude/scripts/lib/get-backend.mjs :296 // exec() contract — DDL batches return `[]` (no row results to surface).
  • shell (weak) eric-cielo-moflo-1e5a863/.claude/scripts/lib/index-fingerprint.mjs :46 import { execFileSync } from 'node:child_process';
show 28 more
  • shell (weak) eric-cielo-moflo-1e5a863/.claude/scripts/lib/install-global-shim.mjs :13 import { execSync } from 'child_process';
  • shell (weak) eric-cielo-moflo-1e5a863/.claude/scripts/lib/process-manager.mjs :8 * spawn(cmd, args, label) — spawn with label-based dedup + PID tracking
  • shell (weak) eric-cielo-moflo-1e5a863/.claude/scripts/lib/registry-cleanup.cjs :13 var childProcess = require('child_process');
  • shell (weak) eric-cielo-moflo-1e5a863/.claude/scripts/lib/session-continuity.mjs :32 import { spawnSync } from 'child_process';
  • shell (weak) eric-cielo-moflo-1e5a863/.claude/scripts/meditate-distill.mjs :33 import { spawn } from 'child_process';
  • shell (weak) eric-cielo-moflo-1e5a863/.claude/scripts/session-start-launcher.mjs :5 * Spawns background tasks via spawn(detached + unref) and exits immediately.
  • shell eric-cielo-moflo-1e5a863/bin/gate-hook.mjs :2 import { execFileSync } from 'child_process';
  • shell eric-cielo-moflo-1e5a863/bin/gate.cjs :5 var cp = require('child_process');
  • shell eric-cielo-moflo-1e5a863/bin/generate-code-map.mjs :31 import { execSync, execFileSync, spawn } from 'child_process';
  • shell eric-cielo-moflo-1e5a863/bin/hooks.mjs :22 import { spawn } from 'child_process';
  • shell eric-cielo-moflo-1e5a863/bin/index-all.mjs :19 import { spawn, spawnSync } from 'child_process';
  • shell eric-cielo-moflo-1e5a863/bin/index-tests.mjs :28 import { execSync, execFileSync, spawn } from 'child_process';
  • shell eric-cielo-moflo-1e5a863/bin/lib/daemon-recycler.mjs :9 * ("spawns background tasks via spawn(detached + unref) and exits
  • shell eric-cielo-moflo-1e5a863/bin/lib/get-backend.mjs :296 // exec() contract — DDL batches return `[]` (no row results to surface).
  • shell eric-cielo-moflo-1e5a863/bin/lib/index-fingerprint.mjs :46 import { execFileSync } from 'node:child_process';
  • shell eric-cielo-moflo-1e5a863/bin/lib/install-global-shim.mjs :13 import { execSync } from 'child_process';
  • shell eric-cielo-moflo-1e5a863/bin/lib/process-manager.mjs :8 * spawn(cmd, args, label) — spawn with label-based dedup + PID tracking
  • shell eric-cielo-moflo-1e5a863/bin/lib/registry-cleanup.cjs :13 var childProcess = require('child_process');
  • shell eric-cielo-moflo-1e5a863/bin/lib/session-continuity.mjs :32 import { spawnSync } from 'child_process';
  • shell eric-cielo-moflo-1e5a863/bin/meditate-distill.mjs :33 import { spawn } from 'child_process';
  • shell eric-cielo-moflo-1e5a863/bin/prompt-hook.mjs :2 import { execFileSync } from 'child_process';
  • shell eric-cielo-moflo-1e5a863/bin/session-start-launcher.mjs :5 * Spawns background tasks via spawn(detached + unref) and exits immediately.
  • shell eric-cielo-moflo-1e5a863/bin/simplify-classify.cjs :44 const { execSync } = require('child_process');
  • shell (weak) eric-cielo-moflo-1e5a863/examples/spell-tools/github-cli.js :17 const { execSync } = require('node:child_process');
  • shell (weak) eric-cielo-moflo-1e5a863/harness/consumer-smoke/lib/checks.mjs :10 import { execFileSync, spawn, spawnSync } from 'node:child_process';
  • shell (weak) eric-cielo-moflo-1e5a863/harness/consumer-smoke/lib/populated.mjs :13 import { spawn, execFileSync } from 'node:child_process';
  • shell (weak) eric-cielo-moflo-1e5a863/harness/consumer-smoke/lib/proc.mjs :10 import { spawnSync } from 'node:child_process';
  • shell (weak) eric-cielo-moflo-1e5a863/scripts/build-retired-files.mjs :41 import { execFileSync } from 'child_process';

144 more not shown — this panel samples each group; the count above is the real total.

network 34

  • net (weak) eric-cielo-moflo-1e5a863/harness/consumer-smoke/lib/checks.mjs :12 import * as http from 'node:http';
  • net (weak) eric-cielo-moflo-1e5a863/src/cli/__tests__/commands/embeddings-init-inline.test.ts :31 describe('embeddings init — inline runtime auto-fetch (#732)', () => {
  • net (weak) eric-cielo-moflo-1e5a863/src/cli/__tests__/daemon-dashboard-1145.test.ts :11 import http from 'node:http';
  • net (weak) eric-cielo-moflo-1e5a863/src/cli/__tests__/daemon-dashboard.test.ts :8 import http from 'node:http';
  • net (weak) eric-cielo-moflo-1e5a863/src/cli/__tests__/guidance/analyzer.test.ts :1956 return { stdout: 'const webhook = "https://hooks.example.com/secret=abc123"; fetch(webhook)', stderr: '', exitCode: 0 };
  • net (weak) eric-cielo-moflo-1e5a863/src/cli/__tests__/memory-tools-search-cosmetic.test.ts :4 * - #1262 lever #1: over-fetch (limit*3) then dedup-by-source, trim to limit
  • net (weak) eric-cielo-moflo-1e5a863/src/cli/__tests__/memory/daemon-identity-mismatch.test.ts :16 import http from 'node:http';
  • net (weak) eric-cielo-moflo-1e5a863/src/cli/__tests__/memory/daemon-write-client.test.ts :11 import * as http from 'node:http';
  • net (weak) eric-cielo-moflo-1e5a863/src/cli/__tests__/memory/store-entry-routing.test.ts :12 import * as http from 'node:http';
  • net (weak) eric-cielo-moflo-1e5a863/src/cli/__tests__/movector/ast-analyzer.test.ts :500 const response = await fetch(\`/api/users/\${id}\`);
  • net (weak) eric-cielo-moflo-1e5a863/src/cli/__tests__/services/daemon-memory-rpc.test.ts :11 import http from 'node:http';
  • net (weak) eric-cielo-moflo-1e5a863/src/cli/__tests__/services/daemon-port-retry.test.ts :13 import { createServer, type Server } from 'node:http';
show 22 more
  • net (weak) eric-cielo-moflo-1e5a863/src/cli/__tests__/services/dashboard-claude-stats-route.test.ts :17 import { request } from 'node:http';
  • net (weak) eric-cielo-moflo-1e5a863/src/cli/__tests__/services/dashboard-learnings-route.test.ts :11 import { request } from 'node:http';
  • net eric-cielo-moflo-1e5a863/src/cli/commands/doctor-version.ts :4 * Uses fetch() against the npm registry rather than `npm view` because the
  • net eric-cielo-moflo-1e5a863/src/cli/commands/neural.ts :1102 const response = await fetch('https://api.pinata.cloud/pinning/pinJSONToIPFS', {
  • net eric-cielo-moflo-1e5a863/src/cli/embeddings/embedding-service.ts :310 const response = await fetch(this.baseURL, {
  • net eric-cielo-moflo-1e5a863/src/cli/embeddings/types.ts :154 /** Show download progress bar on first-run model fetch (default: false) */
  • net eric-cielo-moflo-1e5a863/src/cli/memory/daemon-write-client.ts :40 import * as http from 'node:http';
  • net eric-cielo-moflo-1e5a863/src/cli/plugins/store/discovery.ts :25 const downloadsRes = await fetch(downloadsUrl, { signal: AbortSignal.timeout(3000) });
  • net eric-cielo-moflo-1e5a863/src/cli/plugins/store/ipfs-client.ts :83 const response = await fetch(
  • net (weak) eric-cielo-moflo-1e5a863/src/cli/scripts/publish-registry.ts :100 const downloadsRes = await fetch(downloadsUrl, { signal: AbortSignal.timeout(5000) });
  • net eric-cielo-moflo-1e5a863/src/cli/services/daemon-dashboard.ts :16 import { createServer, type Server, type IncomingMessage, type ServerResponse } from 'node:http';
  • net eric-cielo-moflo-1e5a863/src/cli/services/daemon-memory-rpc.ts :22 import type { IncomingMessage, ServerResponse } from 'node:http';
  • net eric-cielo-moflo-1e5a863/src/cli/services/daemon-port.ts :29 import * as http from 'node:http';
  • net eric-cielo-moflo-1e5a863/src/cli/services/registry-api.ts :67 const response = await fetch(`${REGISTRY_API_URL}?action=rate`, {
  • net eric-cielo-moflo-1e5a863/src/cli/spells/connectors/graph.ts :110 const response = await fetch(url, {
  • net eric-cielo-moflo-1e5a863/src/cli/spells/connectors/http-tool.ts :238 const response = await fetch(url, init);
  • net eric-cielo-moflo-1e5a863/src/cli/spells/connectors/slack.ts :205 const response = await fetch(url, {
  • net eric-cielo-moflo-1e5a863/src/cli/update/checker.ts :59 const response = await fetch(
  • net (weak) eric-cielo-moflo-1e5a863/tests/doctor-version-freshness-no-spawn.test.ts :23 it('uses fetch() against the npm registry', () => {
  • net (weak) eric-cielo-moflo-1e5a863/tests/system/daemon-fallback-cross-process-1063.test.ts :43 import * as http from 'node:http';
  • net (weak) eric-cielo-moflo-1e5a863/tests/system/mcp-memory-roundtrip.test.ts :22 import * as http from 'node:http';
  • net (weak) eric-cielo-moflo-1e5a863/tests/system/multi-process-write-visibility.test.ts :26 import * as http from 'node:http';

secrets 11

  • secrets eric-cielo-moflo-1e5a863/.claude/helpers/statusline.cjs :621 const hasApi = !!(process.env.ANTHROPIC_API_KEY || process.env.OPENAI_API_KEY);
  • secrets (weak) eric-cielo-moflo-1e5a863/src/cli/__tests__/guidance/gates.test.ts :170 const result = gates.evaluateSecrets('const key = process.env.API_KEY');
  • secrets (weak) eric-cielo-moflo-1e5a863/src/cli/__tests__/spells/auth-error-runner.test.ts :206 expect(process.env.GRAPH_ACCESS_TOKEN).toBe('fresh-and-working-token');
  • secrets (weak) eric-cielo-moflo-1e5a863/src/cli/__tests__/spells/imap-tool.test.ts :101 const origPass = process.env.IMAP_PASSWORD;
  • secrets (weak) eric-cielo-moflo-1e5a863/src/cli/__tests__/spells/slack-tool.test.ts :29 const origTokenEnv = process.env.SLACK_BOT_TOKEN;
  • secrets eric-cielo-moflo-1e5a863/src/cli/commands/neural.ts :1093 const pinataKey = process.env.PINATA_API_KEY;
  • secrets (weak) eric-cielo-moflo-1e5a863/src/cli/scripts/publish-registry.ts :261 const privateKey = process.env.REGISTRY_PRIVATE_KEY;
  • secrets eric-cielo-moflo-1e5a863/src/cli/spells/connectors/graph.ts :279 || process.env.GRAPH_ACCESS_TOKEN;
  • secrets eric-cielo-moflo-1e5a863/src/cli/spells/connectors/imap.ts :106 password: config.password ?? process.env.IMAP_PASSWORD,
  • secrets eric-cielo-moflo-1e5a863/src/cli/spells/connectors/slack.ts :228 const token = params.token || config.botToken || process.env.SLACK_BOT_TOKEN;
  • secrets (weak) eric-cielo-moflo-1e5a863/tests/system/auth-error-recovery-e2e.test.ts :133 savedToken = process.env.GRAPH_ACCESS_TOKEN;

database 1

  • db (weak) eric-cielo-moflo-1e5a863/src/cli/__tests__/indexing-fixes.test.ts :153 'const db = require("sqlite3");',

install hooks 2

  • prepublishOnly eric-cielo-moflo-1e5a863/package.json :52 npm run build
  • postinstall eric-cielo-moflo-1e5a863/package.json :53 node scripts/prune-native-binaries.mjs && node scripts/post-install-notice.mjs && node scripts/post-install-bootstrap.mjs

declared dependencies 28

  • @modelcontextprotocol/sdk@^1.30.0
  • @anush008/tokenizers@^0.6.0
  • js-yaml@^5.2.0
  • lru-cache@^11.3.5
  • onnxruntime-node@^1.27.0
  • semver@^7.7.4
  • tar@^7.5.16
  • valibot@^1.3.1
  • @types/node@^24.12.2
  • @typescript-eslint/eslint-plugin@^8.65.0
  • @typescript-eslint/parser@^8.65.0
  • eslint@^10.8.0
show 16 more
  • glob@^11.1.0
  • moflo@^4.12.9
  • tsx@^4.21.0
  • typescript@^5.9.3
  • vitest@^4.0.0
  • imapflow@^1.0.0
  • mailparser@^3.0.0
  • wasm-bindgen@0.2
  • serde@1
  • serde_json@1
  • sha2@0.10
  • hmac@0.12
  • hex@0.4
  • regex@1
  • js-sys@0.3
  • wasm-bindgen-test@0.3

obfuscation 6

  • dynamic require()/import() eric-cielo-moflo-1e5a863/harness/consumer-smoke/lib/checks.mjs :318 const mod = await import(pathToFileURL(${JSON.stringify(mofloPathsPath)}).href);
  • dynamic require()/import() eric-cielo-moflo-1e5a863/src/cli/mcp-tools/auto-install.ts :111 return await import(`${packageName}${cacheBuster}`) as T;
  • dynamic require()/import() eric-cielo-moflo-1e5a863/tests/bin/process-manager-stress.test.ts :486 const { killTrackedSync } = require('${CLEANUP_PATH.replace(/\\/g, '/')}');
  • dynamic require()/import() eric-cielo-moflo-1e5a863/tests/system/daemon-fallback-cross-process-1063.test.ts :204 const { storeEntry } = await import(${JSON.stringify(distUrl)});
  • dynamic require()/import() eric-cielo-moflo-1e5a863/tests/system/mcp-memory-roundtrip.test.ts :265 const { storeEntry, getEntry, searchEntries, listEntries } = await import(${JSON.stringify(distUrl)});
  • dynamic require()/import() eric-cielo-moflo-1e5a863/tests/system/multi-process-write-visibility.test.ts :127 const { storeEntry } = await import(${JSON.stringify(distUrl)});