Announcing Beacon: Self-improving memory for coding agents
← All MCP servers
MCP server

io.github.drhalto/agentmako

mcp:drhalto/agentmako

Local-first codebase intelligence MCP server for AI coding agents.

Verdict
Not analyzed

Indexed from the registries, but not analyzed yet. Lineage and listings below are current.

Package advisories 19

Known vulnerabilities and malicious-package reports (OSV) that reach the versions of the packages it installs or runs.

criticalGHSA-wc9v-mj63-m9g5npm/pg
Remote Code Execution in pg
No version pinned, and the newest release may be affected · fixed in 2.11.2, 3.6.4, 4.5.7, 5.2.1, 6.0.5, 6.1.6, 6.2.5, 6.3.3, 6.4.2, 7.0.2, 7.1.2 · package.json
Regular Expression Denial of Service (ReDoS)
No version pinned, and the newest release may be affected · fixed in 3.5.0 · package.json
highGHSA-37ch-88jc-xwx2npm/path-to-regexp
path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters
No version pinned, and the newest release may be affected · fixed in 0.1.13 · package.json
highGHSA-9wv6-86v2-598jnpm/path-to-regexp
path-to-regexp outputs backtracking regular expressions
No version pinned, and the newest release may be affected · fixed in 1.9.0, 0.1.10, 8.0.0, 3.3.0, 6.3.0 · package.json
highGHSA-j3q9-mxjg-w52fnpm/path-to-regexp
path-to-regexp vulnerable to Denial of Service via sequential optional groups
No version pinned, and the newest release may be affected · fixed in 8.4.0 · package.json
highGHSA-rhx6-c78j-4q9wnpm/path-to-regexp
path-to-regexp contains a ReDoS
No version pinned, and the newest release may be affected · fixed in 0.1.12 · package.json
highGHSA-c2c7-rcm5-vvqjnpm/picomatch
Picomatch has a ReDoS vulnerability via extglob quantifiers
No version pinned, and the newest release may be affected · fixed in 4.0.4, 3.0.2, 2.3.2 · package.json
highGHSA-hg79-j56m-fxgvnpm/react
Cross-Site Scripting in react
No version pinned, and the newest release may be affected · fixed in 0.14.0 · package.json
Uncaught Exception in yaml
No version pinned, and the newest release may be affected · fixed in 2.2.2 · package.json
Zod can exhaust memory while validating oversized constrained collections
No version pinned, and the newest release may be affected · fixed in 4.6.6 · package.json
mediumGHSA-27v5-c462-wpq7npm/path-to-regexp
path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards
No version pinned, and the newest release may be affected · fixed in 8.4.0 · package.json
mediumGHSA-3v7f-55p6-f55pnpm/picomatch
Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching
No version pinned, and the newest release may be affected · fixed in 4.0.4, 3.0.2, 2.3.2 · package.json
mediumGHSA-g53w-52xc-2j85npm/react
Cross-Site Scripting in react
No version pinned, and the newest release may be affected · fixed in 0.4.2, 0.5.2 · package.json
mediumGHSA-mvjj-gqq2-p4hwnpm/react-dom
Cross-Site Scripting in react-dom
No version pinned, and the newest release may be affected · fixed in 16.0.1, 16.1.2, 16.2.1, 16.3.3, 16.4.2 · package.json
mediumGHSA-jjmj-jmhj-qwj2npm/react-router-dom
React Router: Open redirect leading to XSS
No version pinned, and the newest release may be affected · fixed in 6.30.6 · package.json
mediumGHSA-48c2-rrv3-qjmpnpm/yaml
yaml is vulnerable to Stack Overflow via deeply nested YAML collections
No version pinned, and the newest release may be affected · fixed in 2.8.3, 1.10.3 · package.json
mediumGHSA-m95q-7qp3-xv42npm/zod
Zod denial of service vulnerability
No version pinned, and the newest release may be affected · fixed in 3.22.3 · package.json
Vercel’s AI SDK's filetype whitelists can be bypassed when uploading files
No version pinned, and the newest release may be affected · fixed in 5.0.52, 5.1.0-beta.9 · package.json
jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch
No version pinned, and the newest release may be affected · fixed in 8.0.3, 5.2.2, 4.0.4, 3.5.1 · package.json

Execution chain 431

What it calls, runs, installs, reads and writes, with the line that does it.

Environment variables 47

MAKO_API_HOST
MAKO_API_PORT
MAKO_API_URL
MAKO_APP_NAME
MAKO_CLI_ENTRYPOINT
MAKO_CLI_ENTRYPOINT
MAKO_DB_TOOLS_ENABLED
MAKO_DISABLE_MODELS_FETCH
MAKO_ENABLE_ANTHROPIC
MAKO_ENABLE_FILESYSTEM
MAKO_ENABLE_GITHUB
MAKO_ENABLE_OPENAI
MAKO_ENABLE_POSTGRES
MAKO_ENABLE_SUPABASE
MAKO_GLOBAL_DB_FILENAME
MAKO_HARNESS_APPROVAL_TIMEOUT
MAKO_HARNESS_MAX_PENDING_APPROVALS
MAKO_HARNESS_MAX_SUB_AGENT_DEPTH
MAKO_HARNESS_PROVIDER_TIMEOUT
MAKO_HARNESS_SUB_AGENT_TURN_TIMEOUT_MS
MAKO_HARNESS_URL
MAKO_LOG_LEVEL
MAKO_PROJECT_DB_FILENAME
MAKO_REEF_MODE
MAKO_REEF_MODE
MAKO_SNAPSHOT_STALE_THRESHOLD_MS
MAKO_STATE_DIRNAME
MAKO_STATE_HOME
MAKO_STATE_HOME
MAKO_SUPPORT_TARGET
MAKO_WEB_PORT
MAKO_WEB_PREVIEW_PORT

Files read 122

{…}/package.json
{…}/package.json
<dynamic>
apps/cli/tsup.config.ts:175 · via:restoreNodePrefixes
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
packages/tools/src/rule-packs/loader.ts:82 · via:loadRulePackFromFile
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
services/indexer/src/project-manifest.ts:199 · via:resolveIndexingInclude
<dynamic>
services/indexer/src/project-profile.ts:394 · via:collectMiddlewareFiles
<dynamic>
services/indexer/src/reef-daemon.ts:913 · via:readDaemonLockMeta
<dynamic>
services/indexer/src/reef-operation-log.ts:46 · via:capOperationLogUnlocked
<dynamic>
keychain_ref

Files written 87

{…}.{…}.{…}.tmp
{…}.{…}.{…}.tmp
{…}.breaker
{…}.tmp-{…}-{…}
{…}.tmp-{…}-{…}
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
apps/cli/tsup.config.ts:176 · via:copyRuntimeAssets
<dynamic>
<dynamic>
<dynamic>
<dynamic>
packages/store/src/sqlite.ts:121 · via:ensureParentDirectory
<dynamic>
<dynamic>
services/indexer/src/detach.ts:93 · via:removePathIfPresent
<dynamic>
services/indexer/src/detach.ts:94 · via:removePathIfPresent
<dynamic>
<dynamic>
<dynamic>
services/indexer/src/reef-daemon.ts:108 · via:ensureReefDaemonDirs
<dynamic>
<dynamic>
<dynamic>

GitHub repositories 8

drhalto/agentmako
drhalto/agentmako
drhalto/agentmako
drhalto/agentmako
drhalto/agentmako
drhalto/agentmako
makoai/mako-ai
oasis-tcs/sarif-spec

Network calls 44

<dynamic>
services/indexer/src/reef-daemon.ts:419 · via:createDaemonConnection
aistudio.google.com
api.together.ai
cloud.cerebras.ai
console.anthropic.com
console.groq.com
console.mistral.ai
console.x.ai
lmstudio.ai
ollama.com
openrouter.ai
platform.deepseek.com
platform.moonshot.ai
platform.openai.com

Packages 47

npm:@ai-sdk/anthropic
package.json · delegated
npm:@ai-sdk/openai
package.json · delegated
npm:@ai-sdk/openai-compatible
package.json · delegated
npm:@ast-grep/napi
package.json · delegated
npm:@mako-ai/config
package.json · delegated
npm:@mako-ai/contracts
package.json · delegated
npm:@mako-ai/engine
package.json · delegated
npm:@mako-ai/extension-lmstudio
package.json · delegated
npm:@mako-ai/extension-ollama
package.json · delegated
npm:@mako-ai/extension-postgres
package.json · delegated
npm:@mako-ai/harness-contracts
package.json · delegated
npm:@mako-ai/harness-core
package.json · delegated
npm:@mako-ai/harness-tools
package.json · delegated
npm:@mako-ai/indexer
package.json · delegated
npm:@mako-ai/logger
package.json · delegated
npm:@mako-ai/sdk
package.json · delegated
npm:@mako-ai/store
package.json · delegated
npm:@mako-ai/tools
package.json · delegated
npm:@napi-rs/keyring
package.json · delegated
npm:@tanstack/react-query
package.json · delegated
npm:agentmako
llms-install.md:34 · instructed
npm:agentmako
llms-install.md:39 · instructed
npm:agentmako
plugins/codex/.mcp.json:4 · launch:mcp.json
npm:agentmako
plugins/cursor/mcp.json:4 · launch:mcp.json
npm:agentmako
plugins/gemini/.mcp.json:4 · launch:mcp.json
npm:agentmako
PRIVACY.md:50 · instructed
npm:agentmako@0.2.3
server.json:13 · launch:server.json
npm:ai
package.json · delegated
npm:d3-force
package.json · delegated
npm:diff
package.json · delegated
npm:get-tsconfig
package.json · delegated
npm:gray-matter
package.json · delegated
npm:p-limit
package.json · delegated
npm:path-to-regexp
package.json · delegated
npm:pg
package.json · delegated
npm:pgsql-parser
package.json · delegated
npm:picomatch
package.json · delegated
npm:react
package.json · delegated
npm:react-dom
package.json · delegated
npm:react-router-dom
package.json · delegated
npm:remark
package.json · delegated
npm:shiki
package.json · delegated
npm:typescript
package.json · delegated
npm:web-tree-sitter
package.json · delegated
npm:yaml
package.json · delegated
npm:zod
package.json · delegated
npm:zod-to-json-schema
package.json · delegated

URLs 69

http://127.0.0.1:3017
http://127.0.0.1:3017/mcp
http://127.0.0.1:3018
http://localhost:11434/v1
http://localhost:11434/v1
http://localhost:11434/v1
http://localhost:1234/v1
http://localhost:1234/v1
http://www.w3.org/2000/svg
https://aistudio.google.com/app/apikey
https://api.together.ai/settings/api-keys
https://ast-grep.github.io/guide/pattern-syntax.html
https://cloud.cerebras.ai/platform/api-keys
https://console.anthropic.com/settings/keys
https://console.groq.com/keys
https://console.mistral.ai/api-keys/
https://eslint.org/docs/latest/rules/$
https://fonts.googleapis.com
https://fonts.googleapis.com/css2?family=Inter:wght@400
https://fonts.gstatic.com
https://github.com/drhalto/agentmako
https://github.com/drhalto/agentmako
https://github.com/drhalto/agentmako.git
https://github.com/drhalto/agentmako/issues
https://github.com/drhalto/agentmako/security/advisories/new
https://github.com/drhalto/agentmako#readme
https://github.com/makoai/mako-ai
https://glama.ai/mcp/schemas/server.json
https://glama.ai/mcp/servers/drhalto/agentmako
https://lmstudio.ai/docs
https://models.dev/api.json
https://models.dev/api.json
https://ollama.com/download
https://openrouter.ai/settings/keys
https://platform.deepseek.com/api_keys
https://platform.moonshot.ai/console/api-keys
https://platform.openai.com/api-keys
https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json
https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json
https://www.npmjs.com/package/agentmako
https://www.npmjs.com/package/agentmako

Linked repositories 2

GitHub repositories it links to or installs from, and whether their names can be taken over.

makoai/mako-ai
url · not tracked
oasis-tcs/sarif-spec
url · not tracked