← Back to search

@wraithwalker/mcp-server

GitHub Actions Scanned 25d ago

MCP server for exposing WraithWalker fixture directories to AI agents.

C
66.1 / 100

Versions

2.4.0latest
Apr 29, 2026
2.3.1
Apr 16, 2026
2.3.0
Apr 14, 2026
2.2.0
Apr 14, 2026
2.1.0
Apr 14, 2026
+ show 19 moreshow less
2.0.1
Apr 10, 2026
2.0.0
Apr 9, 2026
1.1.2
Apr 9, 2026
1.1.1
Apr 9, 2026
1.1.0
Apr 9, 2026
1.0.1
Apr 8, 2026
0.6.1
Apr 7, 2026
0.6.0
Apr 7, 2026
0.5.0
Apr 6, 2026
0.4.1
Apr 6, 2026
0.4.0
Apr 6, 2026
0.3.4
Apr 6, 2026
0.3.3
Apr 6, 2026
0.3.2
Apr 6, 2026
0.3.1
Apr 6, 2026
0.3.0
Apr 6, 2026
0.2.1
Apr 6, 2026
0.2.0
Apr 6, 2026
0.1.0
Apr 6, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 34

restore-file
annotations: none low

Restore a human-facing captured projection file from its canonical hidden snapshot

checkout-workspace
annotations: none low

Copy selected projection-backed captured files into a local projection workspace for same-machine agent editing

push-workspace
annotations: none low

Push tracked edits from a local projection workspace back into the human-facing fixture root

discard-workspace
annotations: none low

Remove a local projection workspace after the agent is done with it

start-trace
annotations: none low

Start a guided click-trace that the extension will record into the current WraithWalker root

stop-trace
annotations: none low

Stop a guided click-trace and keep it as a completed scenario trace on disk

list-sites
annotations: none low

List all captured origins and their fixture summary

list-files
annotations: none low

List captured static assets for an origin with optional filters, pagination, and body availability

list-api-routes
annotations: none low

List all captured API endpoints for an origin

search-files
annotations: none low

Search live fixture content across assets, endpoint bodies, and text-like files, with path fallback when body text is unavailable or misses

read-file
annotations: none low

Read a bounded page from a text fixture file by its path relative to the fixture root

read-file-snippet
annotations: none low

Read a bounded text snippet from a fixture file relative to the fixture root

read-api-response
annotations: none low

Read response metadata and a bounded body page for an API fixture returned by list-api-routes

read-site-manifest
annotations: none low

Read the RESOURCE_MANIFEST.json for an origin

write-file
annotations: none low

Overwrite a human-facing captured projection file with UTF-8 text

patch-file
annotations: none low

Patch a human-facing captured projection file by line range, with conflict detection

list-traces
annotations: none low

List guided scenario traces stored in the current WraithWalker root

read-trace
annotations: none low

Read a stored guided scenario trace by ID

analyze-js-file
annotations: none low

Analyze one known JavaScript fixture and return compact semantic summaries without dumping the AST. Use suggest-js-seeds first when you need to discover actionable seeds across chunks.

search-js
annotations: none low

Search JavaScript facts when you already have a query. For unknown bundles, use suggest-js-seeds first, then pass a returned nodeId or value into trace-js-pipeline.

suggest-js-seeds
annotations: none low

First JS discovery step: suggest high-signal endpoint, selector, call, and string seeds, including captured API metadata links for endpoint seeds when available. Next, pass a returned nodeId or value to trace-js-pipeline.

trace-js-pipeline
annotations: none low

Trace a likely JavaScript execution pipeline from a selector, endpoint, symbol, or nodeId using compact evidence and API metadata pointers. Next, use read-js-symbol for JS evidence and read-api-response for linked API metadata.

read-js-symbol
annotations: none low

Read the smallest useful snippet after suggest-js-seeds, search-js, or trace-js-pipeline returns a nodeId. Prefer nodeId follow-up over broad file reads.

list-configured-sites
annotations: none low

List the explicit site config entries stored in the current WraithWalker root

whitelist-site
annotations: none low

Ensure an origin is explicitly configured in the current root using the agent-friendly default capture patterns

remove-site
annotations: none low

Remove an explicit site config entry from the current WraithWalker root

update-site-patterns
annotations: none low

Replace, append, or reset dump allowlist patterns for an explicitly configured origin

prepare-site-for-capture
annotations: none low

Ensure an origin is configured in the current root and report whether the connected extension is ready to capture it

browser-status
annotations: none low

Report whether the browser extension is connected to this local server and ready to capture

read-console
annotations: none low

Read recent browser console and log entries observed by the connected extension

trace-status
annotations: none low

Report guided trace readiness plus an agent-friendly summary of the active trace, if one exists

list-snapshots
annotations: none low

List all saved fixture scenarios

save-trace-as-snapshot
annotations: none low

Save the current fixture workspace as a named scenario snapshot and attach trace provenance

diff-snapshots
annotations: none low

Compare two scenario snapshots and report differences in API endpoints

Permissions 4

network medium
Server uses network capabilities via: fetch(), http
filesystem low
Server uses filesystem capabilities via: fs sync ops
shell high
Server uses shell capabilities via: child_process, spawn(), spawnSync()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 117

low
Tool 'list-sites' has no annotations annotation_checker · 100%
low
Tool 'list-files' has no annotations annotation_checker · 100%
low
Tool 'list-api-routes' has no annotations annotation_checker · 100%
low
Tool 'search-files' has no annotations annotation_checker · 100%
low
Tool 'read-file' has no annotations annotation_checker · 100%
low
Tool 'read-file-snippet' has no annotations annotation_checker · 100%
low
Tool 'read-api-response' has no annotations annotation_checker · 100%
low
Tool 'read-site-manifest' has no annotations annotation_checker · 100%
low
Tool 'write-file' has no annotations annotation_checker · 100%
low
Tool 'patch-file' has no annotations annotation_checker · 100%
low
Tool 'restore-file' has no annotations annotation_checker · 100%
low
Tool 'checkout-workspace' has no annotations annotation_checker · 100%
low
Tool 'push-workspace' has no annotations annotation_checker · 100%
low
Tool 'discard-workspace' has no annotations annotation_checker · 100%
low
Tool 'start-trace' has no annotations annotation_checker · 100%
low
Tool 'stop-trace' has no annotations annotation_checker · 100%
low
Tool 'list-traces' has no annotations annotation_checker · 100%
low
Tool 'read-trace' has no annotations annotation_checker · 100%
low
Tool 'analyze-js-file' has no annotations annotation_checker · 100%
low
Tool 'search-js' has no annotations annotation_checker · 100%
low
Tool 'suggest-js-seeds' has no annotations annotation_checker · 100%
low
Tool 'trace-js-pipeline' has no annotations annotation_checker · 100%
low
Tool 'read-js-symbol' has no annotations annotation_checker · 100%
low
Tool 'list-configured-sites' has no annotations annotation_checker · 100%
low
Tool 'whitelist-site' has no annotations annotation_checker · 100%
low
Tool 'remove-site' has no annotations annotation_checker · 100%
low
Tool 'update-site-patterns' has no annotations annotation_checker · 100%
low
Tool 'prepare-site-for-capture' has no annotations annotation_checker · 100%
low
Tool 'browser-status' has no annotations annotation_checker · 100%
low
Tool 'read-console' has no annotations annotation_checker · 100%
low
Tool 'trace-status' has no annotations annotation_checker · 100%
low
Tool 'list-snapshots' has no annotations annotation_checker · 100%
low
Tool 'save-trace-as-snapshot' has no annotations annotation_checker · 100%
low
Tool 'diff-snapshots' has no annotations annotation_checker · 100%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Suspicious package name: react-dom dependency_analyzer · 60%
medium
Vulnerable dependency: postcss@8.5.17 (GHSA-fxqj-rqcc-2cmp) dependency_analyzer · 95%
medium
Vulnerable dependency: postcss@8.5.17 (GHSA-r28c-9q8g-f849) dependency_analyzer · 95%
medium
Vulnerable dependency: turbo@2.5.4 (GHSA-3qcw-2rhx-2726) dependency_analyzer · 95%
medium
Vulnerable dependency: turbo@2.5.4 (GHSA-hcf7-66rw-9f5r) dependency_analyzer · 95%
medium
Vulnerable dependency: @trpc/server@11.7.1 (GHSA-43p4-m455-4f4j) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@3.2.4 (GHSA-5xrq-8626-4rwp) dependency_analyzer · 95%
medium
Vulnerable dependency: mermaid@11.14.0 (GHSA-2v8p-3f2j-5mp7) dependency_analyzer · 95%
medium
Vulnerable dependency: mermaid@11.14.0 (GHSA-3rrr-jr9j-h3q3) dependency_analyzer · 95%
medium
Vulnerable dependency: mermaid@11.14.0 (GHSA-6m6c-36f7-fhxh) dependency_analyzer · 95%
medium
Vulnerable dependency: mermaid@11.14.0 (GHSA-6x64-9x62-f2gx) dependency_analyzer · 95%
medium
Vulnerable dependency: mermaid@11.14.0 (GHSA-87f9-hvmw-gh4p) dependency_analyzer · 95%
medium
Vulnerable dependency: mermaid@11.14.0 (GHSA-c4c3-pg64-4m4v) dependency_analyzer · 95%
medium
Vulnerable dependency: mermaid@11.14.0 (GHSA-ghcm-xqfw-q4vr) dependency_analyzer · 95%
medium
Vulnerable dependency: mermaid@11.14.0 (GHSA-rhh3-jpg6-66xh) dependency_analyzer · 95%
medium
Vulnerable dependency: mermaid@11.14.0 (GHSA-xcj9-5m2h-648r) dependency_analyzer · 95%
medium
Vulnerable dependency: happy-dom@20.3.4 (GHSA-6q6h-j7hj-3r64) dependency_analyzer · 95%
medium
Vulnerable dependency: happy-dom@20.3.4 (GHSA-w4gp-fjgq-3q4g) dependency_analyzer · 95%
medium
Hex string literal (>50 chars) in VictorQueiroz-WraithWalker-d2b0f23/packages/extension/tests/utilities.test.ts:50 entropy_analyzer · 70%
medium
Buffer.from base64 in VictorQueiroz-WraithWalker-d2b0f23/packages/extension/tests/fixture-repository.test.ts:264 entropy_analyzer · 75%
medium
Buffer.from base64 in VictorQueiroz-WraithWalker-d2b0f23/packages/extension/tests/fixture-repository.test.ts:349 entropy_analyzer · 75%
medium
Buffer.from base64 in VictorQueiroz-WraithWalker-d2b0f23/packages/extension/tests/fixture-repository.test.ts:356 entropy_analyzer · 75%
medium
Buffer.from base64 in VictorQueiroz-WraithWalker-d2b0f23/packages/extension/tests/fixture-repository.test.ts:415 entropy_analyzer · 75%
medium
Buffer.from base64 in VictorQueiroz-WraithWalker-d2b0f23/packages/extension/tests/fixture-repository.test.ts:422 entropy_analyzer · 75%
medium
Buffer.from base64 in VictorQueiroz-WraithWalker-d2b0f23/packages/extension/tests/fixture-repository.test.ts:456 entropy_analyzer · 75%
medium
Buffer.from base64 in VictorQueiroz-WraithWalker-d2b0f23/packages/extension/tests/fixture-repository.test.ts:490 entropy_analyzer · 75%
medium
Buffer.from base64 in VictorQueiroz-WraithWalker-d2b0f23/packages/extension/tests/fixture-repository.test.ts:557 entropy_analyzer · 75%
medium
Buffer.from base64 in VictorQueiroz-WraithWalker-d2b0f23/packages/extension/tests/offscreen-entrypoint.test.ts:1128 entropy_analyzer · 75%
medium
Buffer.from base64 in VictorQueiroz-WraithWalker-d2b0f23/packages/extension/tests/context-generator.test.ts:117 entropy_analyzer · 75%
medium
Buffer.from base64 in VictorQueiroz-WraithWalker-d2b0f23/packages/extension/tests/replay-flow.test.ts:323 entropy_analyzer · 75%
medium
Buffer.from base64 in VictorQueiroz-WraithWalker-d2b0f23/packages/extension/tests/root-runtime.test.ts:107 entropy_analyzer · 75%
medium
Buffer.from base64 in VictorQueiroz-WraithWalker-d2b0f23/packages/mcp-server/tests/trpc.test.ts:278 entropy_analyzer · 75%
medium
Buffer.from base64 in VictorQueiroz-WraithWalker-d2b0f23/packages/core/src/fixture-presentation.mts:199 entropy_analyzer · 75%
medium
Buffer.from base64 in VictorQueiroz-WraithWalker-d2b0f23/packages/core/src/root-fs.mts:188 entropy_analyzer · 75%
medium
Buffer.from base64 in VictorQueiroz-WraithWalker-d2b0f23/packages/core/src/har-import.mts:552 entropy_analyzer · 75%
medium
Buffer.from base64 in VictorQueiroz-WraithWalker-d2b0f23/packages/core/src/har-import.mts:567 entropy_analyzer · 75%
medium
Buffer.from base64 in VictorQueiroz-WraithWalker-d2b0f23/packages/core/tests/fixture-repository.test.ts:39 entropy_analyzer · 75%
medium
Buffer.from base64 in VictorQueiroz-WraithWalker-d2b0f23/packages/core/tests/root-runtime.test.ts:154 entropy_analyzer · 75%
info
package.json metadata manifest_parser · 100%
info
Tool: list-sites manifest_parser · 85%
info
Tool: list-files manifest_parser · 85%
info
Tool: list-api-routes manifest_parser · 85%
info
Tool: search-files manifest_parser · 85%
info
Tool: read-file manifest_parser · 85%
info
Tool: read-file-snippet manifest_parser · 85%
info
Tool: read-api-response manifest_parser · 85%
info
Tool: read-site-manifest manifest_parser · 85%
info
Tool: write-file manifest_parser · 85%
info
Tool: patch-file manifest_parser · 85%
info
Tool: restore-file manifest_parser · 85%
info
Tool: checkout-workspace manifest_parser · 85%
info
Tool: push-workspace manifest_parser · 85%
info
Tool: discard-workspace manifest_parser · 85%
info
Tool: start-trace manifest_parser · 85%
info
Tool: stop-trace manifest_parser · 85%
info
Tool: list-traces manifest_parser · 85%
info
Tool: read-trace manifest_parser · 85%
info
Tool: analyze-js-file manifest_parser · 85%
info
Tool: search-js manifest_parser · 85%
info
Tool: suggest-js-seeds manifest_parser · 85%
info
Tool: trace-js-pipeline manifest_parser · 85%
info
Tool: read-js-symbol manifest_parser · 85%
info
Tool: list-configured-sites manifest_parser · 85%
info
Tool: whitelist-site manifest_parser · 85%
info
Tool: remove-site manifest_parser · 85%
info
Tool: update-site-patterns manifest_parser · 85%
info
Tool: prepare-site-for-capture manifest_parser · 85%
info
Tool: browser-status manifest_parser · 85%
info
Tool: read-console manifest_parser · 85%
info
Tool: trace-status manifest_parser · 85%
info
Tool: list-snapshots manifest_parser · 85%
info
Tool: save-trace-as-snapshot manifest_parser · 85%
info
Tool: diff-snapshots manifest_parser · 85%
info
Transport: streamable-http manifest_parser · 80%
info
Required env vars (19) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 80%
low
Permission: filesystem access detected permission_analyzer · 90%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 1296 components sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%