npm JavaScript analyzed 1.12.0

socraticode

v1.12.0

SocratiCode — MCP server for local codebase indexing, semantic search, and code dependency graphs. All private, all local via Docker.

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 25 tools

transport stdio verified reported listed in the official MCP registry counts 25 tools · 0 res · 0 prompts permission surface via code analysis

skills & danger signals npm-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v1.12.0 · analyzer v33 · 1w ago

code evidence v1.12.0 · npm-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 92

fs package/dist/config.js :5 import fs from "node:fs";
fs package/dist/index.js :39 import { writeSync } from "node:fs";
fs package/dist/services/code-graph.js :3 import fs from "node:fs/promises";
fs package/dist/services/context-artifacts.js :18 import fsp from "node:fs/promises";
fs package/dist/services/extensionless.js :10 import { constants as fsConstants } from "node:fs";
fs package/dist/services/graph-aliases.js :3 import fs from "node:fs/promises";
fs package/dist/services/graph-resolution.js :3 import { readdirSync, readFileSync, statSync } from "node:fs";
fs package/dist/services/graph-visualize-browser.js :15 import fs from "node:fs/promises";
fs package/dist/services/graph-visualize-html.js :27 import fs from "node:fs/promises";
fs package/dist/services/ignore.js :3 import fs from "node:fs";
fs package/dist/services/indexer.js :4 import fsp from "node:fs/promises";
fs package/dist/services/lock.js :4 import fs from "node:fs";
fs package/dist/services/logger.js :13 import { appendFileSync } from "node:fs";
fs package/dist/services/qdrant-client-compat.js :3 import { readFileSync } from "node:fs";
fs package/dist/services/startup.js :9 import fs from "node:fs";
fs package/dist/services/symbol-graph-incremental.js :19 import { promises as fs } from "node:fs";
fs package/dist/services/watcher.js :3 import fsp from "node:fs/promises";

shell package/dist/config.js :3 import { execFileSync } from "node:child_process";
shell package/dist/services/docker.js :3 import { execFile } from "node:child_process";
shell package/dist/services/graph-visualize-html.js :209 // would interpret `$&`, `$'`, `` $` ``, and `$$` in the replacement, which
shell package/dist/services/lock.js :3 import { execSync } from "node:child_process";

net package/dist/services/docker.js :314 * `init` is forwarded to fetch(), allowing callers to attach headers (e.g. an
net package/dist/services/provider-ollama.js :104 const resp = await fetch("http://localhost:11434/api/tags", { signal: controller.signal });
net package/dist/services/qdrant-client-compat.js :11 * hands to Node's built-in fetch. Node 26's built-in fetch (undici 8)

secrets package/dist/constants.js :17 export const QDRANT_API_KEY = process.env.QDRANT_API_KEY || undefined;
secrets package/dist/services/embedding-config.js :147 if (!process.env.LITELLM_API_KEY) {
secrets package/dist/services/provider-google.js :35 const apiKey = process.env.GOOGLE_API_KEY;
secrets package/dist/services/provider-litellm.js :74 const apiKey = process.env.LITELLM_API_KEY;
secrets package/dist/services/provider-lmstudio.js :56 apiKey: process.env.LMSTUDIO_API_KEY || "lm-studio",
secrets package/dist/services/provider-openai.js :37 const apiKey = process.env.OPENAI_API_KEY;