Governance substrate for AI coding agents — adversarial PR review, drift-detected rules, tamper-evident audit, and closed-loop outcome routing for Claude, Codex, Gemini, and OpenCode
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport stdio · http counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 78
filesystem 22
- fs package/dist/child-mcp-config-CPBWB4TY.js :9
import { writeFile, mkdtemp, rm } from "fs/promises"; - fs package/dist/chunk-AO5OIT2P.js :615
import { readFileSync } from "fs"; - fs package/dist/chunk-AXTD4TFK.js :6
import { mkdirSync } from "fs"; - fs package/dist/chunk-B3LK3YIF.js :3013
import { writeFileSync, rmSync, mkdtempSync } from "fs"; - fs package/dist/chunk-CMBIBZIY.js :1063
import { readFileSync, existsSync } from "fs"; - fs package/dist/chunk-DHVMSIT5.js :2
import { existsSync, readFileSync, realpathSync, statSync } from "fs"; - fs package/dist/chunk-GUKHGODJ.js :6
import { copyFileSync, existsSync, mkdirSync, writeFileSync } from "fs"; - fs package/dist/chunk-I7HYMCVW.js :51
import { writeFileSync, readFileSync, renameSync, unlinkSync, existsSync } from "fs"; - fs package/dist/chunk-IPQW2QHU.js :14
import * as fs2 from "fs/promises"; - fs package/dist/chunk-K2D2IFR6.js :35
import { existsSync as existsSync4 } from "fs"; - fs package/dist/chunk-KSQSWEFH.js :4
import { mkdirSync } from "fs"; - fs package/dist/chunk-N7LGY3C4.js :9
import { appendFileSync, existsSync, mkdirSync, readFileSync, readdirSync } from "fs"; - fs package/dist/chunk-P52ISEJO.js :37
import * as fs3 from "fs"; - fs package/dist/chunk-PM35LR5P.js :30
import { readFile } from "fs/promises"; - fs package/dist/chunk-QPG55YAU.js :10
import * as fs from "fs"; - fs package/dist/chunk-U3SXRK5O.js :4037
import * as fs from "fs"; - fs package/dist/chunk-YF35FKKD.js :2
import { readdir } from "fs/promises"; - fs package/dist/chunk-YN7QDYG6.js :1019
import { appendFileSync, existsSync, mkdirSync } from "fs"; - fs package/dist/cli.js :461
import { existsSync } from "fs"; - fs package/dist/index.js :927
import * as fs from "fs"; - fs package/dist/init-opencode-DJ42XZQZ.js :15
import { existsSync, readFileSync, writeFileSync } from "fs"; - fs package/dist/registry-command-YXKTAFZX.js :19
import { mkdirSync, writeFileSync } from "fs";
shell / exec 12
- shell package/dist/chunk-6INAAUGD.js :8
import { execFile } from "child_process"; - shell package/dist/chunk-7N576XGX.js :24
import { execFile } from "child_process"; - shell package/dist/chunk-B3LK3YIF.js :1504
import { spawn } from "child_process"; - shell package/dist/chunk-HFOQKCD2.js :280
const { execFile } = await import("child_process"); - shell package/dist/chunk-HT7IBYJL.js :45
return new RegExp(`^${withWildcards}$`); - shell package/dist/chunk-I7HYMCVW.js :2249
import { execFile } from "child_process"; - shell package/dist/chunk-K2D2IFR6.js :67
import { execSync } from "child_process"; - shell package/dist/chunk-KU4HIPQ4.js :567
const { execFile } = await import("child_process"); - shell package/dist/chunk-PM35LR5P.js :29
import { execFile as execFile2 } from "child_process"; - shell package/dist/chunk-XDNDQ7M3.js :96
const { execFile } = await import("child_process"); - shell package/dist/chunk-YN7QDYG6.js :1236
const anchored = escaped.startsWith("~/") ? `(^|/)${escaped.slice(2)}$` : escaped.startsWith("/") ? `^${escaped}$` : `(^|/)${escaped}$`; - shell package/dist/cli.js :4157
import { execSync } from "child_process";
network 4
- net package/dist/chunk-I7HYMCVW.js :773
const response = await fetch(url, { - net package/dist/chunk-VIHP2LFY.js :31
import { isIPv4, isIPv6 } from "net"; - net package/dist/cli.js :4275
const response = await fetch("https://api.github.com/user", { - net package/dist/setup-custom-api-YXXKSX5F.js :58
const res = await fetch(url, { headers: init.headers });
secrets 6
- secrets package/dist/chunk-AO5OIT2P.js :692
const envKey = process.env["NEXUS_OPENAI_COMPAT_KEY"]?.trim(); - secrets package/dist/chunk-B3LK3YIF.js :4515
if (process.env["ANTHROPIC_API_KEY"] !== void 0 && process.env["ANTHROPIC_API_KEY"] !== "") { - secrets package/dist/chunk-I7HYMCVW.js :1154
const apiKey = process.env["SEMANTIC_SCHOLAR_API_KEY"]; - secrets package/dist/chunk-KU4HIPQ4.js :561
const envToken = process.env["GITHUB_TOKEN"] ?? process.env["GH_TOKEN"]; - secrets package/dist/cli.js :15055
const appPassword = process.env.BLUESKY_APP_PASSWORD; - secrets package/dist/setup-custom-api-YXXKSX5F.js :64
const envKey = process.env["NEXUS_CUSTOM_API_KEY"];
database 1
- db package/dist/chunk-KSQSWEFH.js :3
import Database from "better-sqlite3";
install hooks 1
- postinstall package/package.json :131
node scripts/postinstall.js || true
declared dependencies 31
- @modelcontextprotocol/sdk@^1.29.0
- @anthropic-ai/sdk@^0.111.0
- @ast-grep/lang-go@0.0.6
- @ast-grep/lang-python@0.0.6
- @ast-grep/napi@0.44.1
- @google/genai@^2.12.0
- better-sqlite3@^12.11.1
- jsonc-parser@^3.3.1
- ollama@^0.6.3
- openai@^6.46.0
- semver@^7.8.5
- tiktoken@^1.0.22
- ts-morph@^27.0.2
- typescript@^6.0.3
- yaml@^2.9.0
- zod@^4.4.3
- @ai-sdk/anthropic@^3.0.96
- @ai-sdk/google@^3.0.91
- @ai-sdk/openai@^3.0.84
- @types/better-sqlite3@^7.6.13
- @types/semver@^7.7.1
- @vitest/coverage-v8@4.1.10
- ai@^6.0.224
- fast-check@^4.9.0
- tsup@^8.5.1
- typedoc@0.28.20
- typedoc-plugin-frontmatter@1.3.1
- typedoc-plugin-markdown@4.12.0
- vitest@4.1.10
- nexus-memory@0.1.4
- @atproto/api@^0.20.28