← All MCP servers
MCP server
io.github.drhalto/agentmako
mcp:drhalto/agentmako
Local-first codebase intelligence MCP server for AI coding agents.
Verdict
Not analyzed
Indexed from the registries, but not analyzed yet. Lineage and listings below are current.
Package advisories 19
Known vulnerabilities and malicious-package reports (OSV) that reach the versions of the packages it installs or runs.
Remote Code Execution in pg
No version pinned, and the newest release may be affected · fixed in 2.11.2, 3.6.4, 4.5.7, 5.2.1, 6.0.5, 6.1.6, 6.2.5, 6.3.3, 6.4.2, 7.0.2, 7.1.2 · package.json
Regular Expression Denial of Service (ReDoS)
No version pinned, and the newest release may be affected · fixed in 3.5.0 · package.json
path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters
No version pinned, and the newest release may be affected · fixed in 0.1.13 · package.json
path-to-regexp outputs backtracking regular expressions
No version pinned, and the newest release may be affected · fixed in 1.9.0, 0.1.10, 8.0.0, 3.3.0, 6.3.0 · package.json
path-to-regexp vulnerable to Denial of Service via sequential optional groups
No version pinned, and the newest release may be affected · fixed in 8.4.0 · package.json
path-to-regexp contains a ReDoS
No version pinned, and the newest release may be affected · fixed in 0.1.12 · package.json
Picomatch has a ReDoS vulnerability via extglob quantifiers
No version pinned, and the newest release may be affected · fixed in 4.0.4, 3.0.2, 2.3.2 · package.json
Cross-Site Scripting in react
No version pinned, and the newest release may be affected · fixed in 0.14.0 · package.json
Uncaught Exception in yaml
No version pinned, and the newest release may be affected · fixed in 2.2.2 · package.json
Zod can exhaust memory while validating oversized constrained collections
No version pinned, and the newest release may be affected · fixed in 4.6.6 · package.json
path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards
No version pinned, and the newest release may be affected · fixed in 8.4.0 · package.json
Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching
No version pinned, and the newest release may be affected · fixed in 4.0.4, 3.0.2, 2.3.2 · package.json
Cross-Site Scripting in react
No version pinned, and the newest release may be affected · fixed in 0.4.2, 0.5.2 · package.json
Cross-Site Scripting in react-dom
No version pinned, and the newest release may be affected · fixed in 16.0.1, 16.1.2, 16.2.1, 16.3.3, 16.4.2 · package.json
React Router: Open redirect leading to XSS
No version pinned, and the newest release may be affected · fixed in 6.30.6 · package.json
yaml is vulnerable to Stack Overflow via deeply nested YAML collections
No version pinned, and the newest release may be affected · fixed in 2.8.3, 1.10.3 · package.json
Zod denial of service vulnerability
No version pinned, and the newest release may be affected · fixed in 3.22.3 · package.json
Vercel’s AI SDK's filetype whitelists can be bypassed when uploading files
No version pinned, and the newest release may be affected · fixed in 5.0.52, 5.1.0-beta.9 · package.json
jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch
No version pinned, and the newest release may be affected · fixed in 8.0.3, 5.2.2, 4.0.4, 3.5.1 · package.json
Execution chain 431
What it calls, runs, installs, reads and writes, with the line that does it.
Environment variables 47
*
services/indexer/src/reef-daemon.ts:665 · passthrough
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
MAKO_API_HOST
MAKO_API_PORT
MAKO_API_URL
apps/web/vite.config.ts:27 · read
MAKO_APP_NAME
MAKO_CLI_ENTRYPOINT
MAKO_CLI_ENTRYPOINT
MAKO_DB_TOOLS_ENABLED
MAKO_DISABLE_MODELS_FETCH
MAKO_EMBEDDING_MODEL
MAKO_EMBEDDING_PROVIDER
MAKO_ENABLE_ANTHROPIC
MAKO_ENABLE_FILESYSTEM
MAKO_ENABLE_GITHUB
MAKO_ENABLE_OPENAI
MAKO_ENABLE_POSTGRES
MAKO_ENABLE_SUPABASE
MAKO_GLOBAL_DB_FILENAME
MAKO_HARNESS_APPROVAL_TIMEOUT
MAKO_HARNESS_MAX_PENDING_APPROVALS
MAKO_HARNESS_MAX_SUB_AGENT_DEPTH
MAKO_HARNESS_PROVIDER_TIMEOUT
MAKO_HARNESS_SUB_AGENT_TURN_TIMEOUT_MS
MAKO_HARNESS_URL
apps/web/vite.config.ts:26 · read
MAKO_LOG_LEVEL
MAKO_MODELS_DEV_URL
MAKO_PROJECT_DB_FILENAME
MAKO_REEF_BACKED
MAKO_REEF_MODE
MAKO_REEF_MODE
MAKO_REEF_MODE
MAKO_REEF_MODE
MAKO_SNAPSHOT_STALE_THRESHOLD_MS
MAKO_STATE_DIR
MAKO_STATE_DIRNAME
MAKO_STATE_HOME
MAKO_STATE_HOME
MAKO_SUPPORT_TARGET
MAKO_WEB_PORT
apps/web/vite.config.ts:29 · read
MAKO_WEB_PREVIEW_PORT
apps/web/vite.config.ts:30 · read
Commands run 7
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
services/indexer/src/reef-daemon.ts:661 · process
git rev-parse HEAD
Files read 122
.aws
.env
.gnupg
.ssh
{…}/package.json
services/indexer/src/project-profile.ts:277 · via:readJsonObject
{…}/package.json
services/indexer/src/project-profile.ts:386 · via:readJsonObject
<dynamic>
apps/cli/tsup.config.ts:30 · read
<dynamic>
apps/cli/tsup.config.ts:64 · read
<dynamic>
apps/cli/tsup.config.ts:76 · read
<dynamic>
apps/cli/tsup.config.ts:93 · read
<dynamic>
apps/cli/tsup.config.ts:175 · via:restoreNodePrefixes
<dynamic>
apps/web/src/lib/flow/extract-files.ts:175 · via:walk
<dynamic>
apps/web/src/lib/flow/extract-files.ts:204 · via:walk
<dynamic>
apps/web/src/lib/flow/extract-files.ts:210 · via:walk
<dynamic>
apps/web/src/lib/flow/extract-files.ts:217 · via:walk
<dynamic>
apps/web/src/lib/flow/extract-files.ts:237 · via:walk
<dynamic>
apps/web/src/lib/flow/extract-files.ts:238 · via:walk
<dynamic>
apps/web/src/lib/flow/extract-files.ts:239 · via:walk
<dynamic>
apps/web/src/lib/flow/extract-files.ts:241 · via:walk
<dynamic>
apps/web/src/lib/flow/extract-files.ts:242 · via:walk
<dynamic>
<dynamic>
packages/config/src/defaults-store.ts:145 · via:readJsonObject
<dynamic>
packages/config/src/defaults-store.ts:148 · via:readJsonObject
<dynamic>
packages/config/src/defaults-store.ts:171 · via:readJsonObject
<dynamic>
packages/config/src/defaults-store.ts:187 · via:readJsonObject
<dynamic>
<dynamic>
<dynamic>
packages/harness-core/src/catalog-source.ts:222 · via:loadCachedCatalog
<dynamic>
packages/harness-core/src/catalog-source.ts:236 · via:loadSnapshotCatalog
<dynamic>
<dynamic>
packages/harness-core/src/local-config.ts:77 · via:readConfigFile
<dynamic>
packages/harness-core/src/local-config.ts:82 · via:readConfigFile
<dynamic>
<dynamic>
<dynamic>
packages/harness-core/src/permission-engine.ts:111 · via:readRulesFile
<dynamic>
packages/harness-core/src/permission-engine.ts:114 · via:readRulesFile
<dynamic>
packages/harness-core/src/permission-engine.ts:187 · via:readRulesFileStrict
<dynamic>
packages/harness-core/src/permission-engine.ts:208 · via:readRulesFileStrict
<dynamic>
<dynamic>
<dynamic>
packages/harness-core/src/provider-registry.ts:103 · via:readProvidersFile
<dynamic>
packages/harness-core/src/provider-registry.ts:108 · via:readProvidersFile
<dynamic>
packages/harness-core/src/provider-registry.ts:151 · via:readProvidersFileStrict
<dynamic>
packages/harness-core/src/provider-registry.ts:174 · via:readProvidersFileStrict
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
packages/tools/src/code-intel/typescript-diagnostics.ts:80 · via:readConfigFile
<dynamic>
packages/tools/src/code-intel/typescript-diagnostics.ts:531 · via:readConfigFile
<dynamic>
<dynamic>
packages/tools/src/context-packet/scoped-instructions.ts:64 · via:readExcerpt
<dynamic>
<dynamic>
<dynamic>
packages/tools/src/diagnostics/index.ts:46 · via:walkRulePackFiles
<dynamic>
packages/tools/src/diagnostics/index.ts:67 · via:walkRulePackFiles
<dynamic>
<dynamic>
<dynamic>
packages/tools/src/reef/working-tree-overlay.ts:53 · via:buildWorkingTreeFileFact
<dynamic>
<dynamic>
<dynamic>
packages/tools/src/rule-packs/loader.ts:81 · via:walkYamlFiles
<dynamic>
packages/tools/src/rule-packs/loader.ts:82 · via:loadRulePackFromFile
<dynamic>
<dynamic>
packages/tools/src/rule-packs/loader.ts:158 · via:walkYamlFiles
<dynamic>
packages/tools/src/rule-packs/validate-tool.ts:36 · via:loadRulePackFromFile
<dynamic>
packages/tools/src/rule-packs/validate-tool.ts:148 · via:walkYamlFiles
<dynamic>
<dynamic>
packages/tools/src/rule-packs/validate-tool.ts:168 · via:walkYamlFiles
<dynamic>
<dynamic>
services/indexer/src/file-scan.ts:160 · via:readTextFile
<dynamic>
services/indexer/src/file-scan.ts:220 · via:readTextFile
<dynamic>
<dynamic>
services/indexer/src/fs-utils.ts:23 · via:walkDirectory
<dynamic>
services/indexer/src/fs-utils.ts:39 · via:walkDirectory
<dynamic>
<dynamic>
<dynamic>
<dynamic>
services/indexer/src/index-freshness.ts:234 · via:walk
<dynamic>
services/indexer/src/index-freshness.ts:247 · via:walk
<dynamic>
services/indexer/src/project-manifest.ts:19 · via:readJsonObject
<dynamic>
<dynamic>
services/indexer/src/project-manifest.ts:199 · via:resolveIndexingInclude
<dynamic>
<dynamic>
<dynamic>
<dynamic>
services/indexer/src/project-profile.ts:394 · via:collectMiddlewareFiles
<dynamic>
<dynamic>
<dynamic>
services/indexer/src/reef-daemon.ts:913 · via:readDaemonLockMeta
<dynamic>
<dynamic>
services/indexer/src/reef-operation-log.ts:46 · via:capOperationLogUnlocked
<dynamic>
<dynamic>
<dynamic>
<dynamic>
services/indexer/src/reef-service.ts:2044 · via:readTextFile
<dynamic>
services/indexer/src/reef-writer-lock.ts:115 · via:readLockMeta
<dynamic>
services/indexer/src/reef-writer-lock.ts:116 · via:isStaleLock
<dynamic>
services/indexer/src/reef-writer-lock.ts:189 · via:readLockMeta
<dynamic>
<dynamic>
<dynamic>
<dynamic>
services/indexer/src/schema-sources/inventory.ts:208 · via:readSourceFile
<dynamic>
services/indexer/src/semantic-unit-scan.ts:76 · via:readTextFile
AGENTS.md
AGENTS.md
cookies
keychain
apps/web/src/pages/Providers.tsx:224 · literal
keychain
keychain_ref
packages/contracts/src/project.ts:28 · literal
keychain_ref
packages/tools/src/db/runtime.ts:165 · literal
keychain_ref
keychain_ref
keychain_ref
keychain_ref
services/indexer/src/status.ts:19 · literal
Files written 87
{…}.{…}.{…}.tmp
{…}.{…}.{…}.tmp
{…}.breaker
services/indexer/src/reef-writer-lock.ts:118 · via:claimBreaker
{…}.breaker
{…}.breaker
{…}.lock
{…}.lock
{…}.lock
{…}.tmp-{…}-{…}
{…}.tmp-{…}-{…}
<dynamic>
<dynamic>
<dynamic>
apps/cli/tsup.config.ts:40 · write
<dynamic>
apps/cli/tsup.config.ts:58 · write
<dynamic>
apps/cli/tsup.config.ts:64 · write
<dynamic>
apps/cli/tsup.config.ts:76 · write
<dynamic>
apps/cli/tsup.config.ts:85 · write
<dynamic>
apps/cli/tsup.config.ts:93 · write
<dynamic>
apps/cli/tsup.config.ts:176 · via:copyRuntimeAssets
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
packages/harness-core/src/catalog-source.ts:232 · via:writeCachedCatalog
<dynamic>
<dynamic>
<dynamic>
packages/harness-core/src/permission-engine.ts:191 · via:writeRulesFile
<dynamic>
packages/harness-core/src/permission-engine.ts:213 · via:writeRulesFile
<dynamic>
<dynamic>
<dynamic>
packages/harness-core/src/provider-registry.ts:153 · via:writeProvidersFile
<dynamic>
packages/harness-core/src/provider-registry.ts:179 · via:writeProvidersFile
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
packages/store/src/sqlite.ts:33 · write
<dynamic>
packages/store/src/sqlite.ts:121 · via:ensureParentDirectory
<dynamic>
<dynamic>
<dynamic>
packages/tools/src/artifacts/export.ts:85 · via:atomicWrite
<dynamic>
<dynamic>
<dynamic>
services/indexer/src/detach.ts:93 · via:removePathIfPresent
<dynamic>
services/indexer/src/detach.ts:94 · via:removePathIfPresent
<dynamic>
<dynamic>
<dynamic>
<dynamic>
services/indexer/src/reef-daemon-state.ts:82 · via:ensureReefDaemonDirs
<dynamic>
<dynamic>
<dynamic>
services/indexer/src/reef-daemon-state.ts:108 · via:ensureReefDaemonDirs
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
services/indexer/src/reef-daemon.ts:108 · via:ensureReefDaemonDirs
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
services/indexer/src/reef-writer-lock.ts:90 · via:writeLockFiles
<dynamic>
services/indexer/src/reef-writer-lock.ts:101 · via:createHandle
<dynamic>
<dynamic>
services/indexer/src/reef-writer-lock.ts:181 · via:writeHeartbeat
<dynamic>
<dynamic>
<dynamic>
services/indexer/src/reef-writer-lock.ts:224 · via:writeHeartbeat
<dynamic>
GitHub repositories 8
drhalto/agentmako
llms-install.md:72 · url
drhalto/agentmako
package.json:7 · url
drhalto/agentmako
package.json:10 · url
drhalto/agentmako
package.json:13 · url
drhalto/agentmako
PRIVACY.md:89 · url
drhalto/agentmako
server.json:6 · url
makoai/mako-ai
oasis-tcs/sarif-spec
Network calls 44
<dynamic>
<dynamic>
<dynamic>
<dynamic>
apps/web/src/lib/http.ts:33 · call
<dynamic>
apps/web/src/lib/http.ts:56 · call
<dynamic>
apps/web/src/lib/http.ts:58 · call
<dynamic>
apps/web/src/lib/http.ts:60 · call
<dynamic>
apps/web/src/lib/http.ts:62 · call
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
<dynamic>
services/indexer/src/reef-daemon.ts:419 · via:createDaemonConnection
<dynamic>
<dynamic>
aistudio.google.com
apps/web/src/pages/Providers.tsx:39 · url_literal
api.together.ai
apps/web/src/pages/Providers.tsx:47 · url_literal
cloud.cerebras.ai
apps/web/src/pages/Providers.tsx:37 · url_literal
console.anthropic.com
apps/web/src/pages/Providers.tsx:36 · url_literal
console.groq.com
apps/web/src/pages/Providers.tsx:40 · url_literal
console.mistral.ai
apps/web/src/pages/Providers.tsx:42 · url_literal
console.x.ai
apps/web/src/pages/Providers.tsx:48 · url_literal
lmstudio.ai
apps/web/src/pages/Providers.tsx:41 · url_literal
localhost
packages/harness-core/src/embedding-provider.ts:166 · url_literal
models.dev
apps/cli/scripts/snapshot-models.ts:21 · url_literal
ollama.com
apps/web/src/pages/Providers.tsx:44 · url_literal
openrouter.ai
apps/web/src/pages/Providers.tsx:46 · url_literal
platform.deepseek.com
apps/web/src/pages/Providers.tsx:38 · url_literal
platform.moonshot.ai
apps/web/src/pages/Providers.tsx:43 · url_literal
platform.openai.com
apps/web/src/pages/Providers.tsx:45 · url_literal
Packages 47
npm:@ai-sdk/anthropic
package.json · delegated
npm:@ai-sdk/openai
package.json · delegated
npm:@ai-sdk/openai-compatible
package.json · delegated
npm:@ast-grep/napi
package.json · delegated
npm:@mako-ai/config
package.json · delegated
npm:@mako-ai/contracts
package.json · delegated
npm:@mako-ai/engine
package.json · delegated
npm:@mako-ai/extension-lmstudio
package.json · delegated
npm:@mako-ai/extension-ollama
package.json · delegated
npm:@mako-ai/extension-postgres
package.json · delegated
npm:@mako-ai/harness-contracts
package.json · delegated
npm:@mako-ai/harness-core
package.json · delegated
npm:@mako-ai/harness-tools
package.json · delegated
npm:@mako-ai/indexer
package.json · delegated
npm:@mako-ai/logger
package.json · delegated
npm:@mako-ai/sdk
package.json · delegated
npm:@mako-ai/store
package.json · delegated
npm:@mako-ai/tools
package.json · delegated
npm:@napi-rs/keyring
package.json · delegated
npm:@tanstack/react-query
package.json · delegated
npm:agentmako
llms-install.md:34 · instructed
npm:agentmako
llms-install.md:39 · instructed
npm:agentmako
plugins/codex/.mcp.json:4 · launch:mcp.json
npm:agentmako
plugins/cursor/mcp.json:4 · launch:mcp.json
npm:agentmako
plugins/gemini/.mcp.json:4 · launch:mcp.json
npm:agentmako
PRIVACY.md:50 · instructed
npm:agentmako@0.2.3
server.json:13 · launch:server.json
npm:ai
package.json · delegated
npm:d3-force
package.json · delegated
npm:diff
package.json · delegated
npm:get-tsconfig
package.json · delegated
npm:gray-matter
package.json · delegated
npm:p-limit
package.json · delegated
npm:path-to-regexp
package.json · delegated
npm:pg
package.json · delegated
npm:pgsql-parser
package.json · delegated
npm:picomatch
package.json · delegated
npm:react
package.json · delegated
npm:react-dom
package.json · delegated
npm:react-router-dom
package.json · delegated
npm:remark
package.json · delegated
npm:shiki
package.json · delegated
npm:typescript
package.json · delegated
npm:web-tree-sitter
package.json · delegated
npm:yaml
package.json · delegated
npm:zod
package.json · delegated
npm:zod-to-json-schema
package.json · delegated
URLs 69
http://127.0.0.1:3017
http://127.0.0.1:3017/mcp
http://127.0.0.1:3018
http://localhost:11434/v1
http://localhost:11434/v1
http://localhost:11434/v1
http://localhost:11434/v1
http://localhost:11434/v1
http://localhost:11434/v1
http://localhost:1234/v1
http://localhost:1234/v1
http://localhost:1234/v1
http://www.w3.org/2000/svg
http://www.w3.org/2000/svg
http://www.w3.org/2000/svg
http://www.w3.org/2000/svg
http://www.w3.org/2000/svg
http://www.w3.org/2000/svg
http://www.w3.org/2000/svg
http://www.w3.org/2000/svg
http://www.w3.org/2000/svg
http://www.w3.org/2000/svg
http://www.w3.org/2000/svg
http://www.w3.org/2000/svg
http://www.w3.org/2000/svg
https://aistudio.google.com/app/apikey
https://api.moonshot.ai/v1
https://api.together.ai/settings/api-keys
https://ast-grep.github.io/guide/pattern-syntax.html
https://cloud.cerebras.ai/platform/api-keys
https://console.anthropic.com/settings/keys
https://console.groq.com/keys
https://console.mistral.ai/api-keys/
https://console.x.ai/
https://eslint.org/docs/latest/rules/$
https://fonts.googleapis.com
https://fonts.googleapis.com/css2?family=Inter:wght@400
https://fonts.gstatic.com
https://github.com/drhalto/agentmako
https://github.com/drhalto/agentmako
https://github.com/drhalto/agentmako.git
https://github.com/drhalto/agentmako/issues
https://github.com/drhalto/agentmako/security/advisories/new
https://github.com/drhalto/agentmako#readme
https://github.com/makoai/mako-ai
https://glama.ai/mcp/schemas/server.json
https://glama.ai/mcp/servers/drhalto/agentmako
https://lmstudio.ai/docs
https://models.dev/api.json
https://models.dev/api.json
https://models.dev/api.json
https://models.dev/api.json
https://models.dev/api.json
https://ollama.com/download
https://ollama.com/v1
https://ollama.com/v1
https://openrouter.ai/settings/keys
https://owasp.org/Top10/2025/
https://owasp.org/Top10/2025/
https://platform.deepseek.com/api_keys
https://platform.moonshot.ai/console/api-keys
https://platform.openai.com/api-keys
https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json
https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json
https://typescript.tv/errors/#$
https://typescript.tv/errors/#$
https://www.npmjs.com/package/agentmako
https://www.npmjs.com/package/agentmako
Linked repositories 2
GitHub repositories it links to or installs from, and whether their names can be taken over.
makoai/mako-ai
url · not tracked
oasis-tcs/sarif-spec
url · not tracked