io.github.desplega-ai/agent-swarm

What we checked

Six static checks, weighted by risk. Every result reflects only what could be observed in the published package and repository — never intent.

• Injection surface

  unscannable25% of grade

  Tool descriptions/manifest scanned for instruction-injection patterns (imperatives at the model, hidden text, 'ignore previous', data-exfil URLs).

  No tool descriptions, server instructions, prompts, or resources were fetched; nothing to scan for injection.

• Supply chain

  warn25% of grade

  Package provenance: namespace verification, repo linkage, maintainer count, account age, postinstall scripts, typosquat distance.

  dependency "ai" is edit-distance 2 from popular package "chai" (typosquat candidate); dependency "e2b" is edit-distance 2 from popular package "ejs" (typosquat candidate); dependency "ink" is edit-distance 2 from popular package "pino" (typosquat candidate); dependency "hono" is edit-distance 2 from popular package "pino" (typosquat candidate); dependency "viem" is edit-distance 2 from top-20 package "vue" (typosquat candidate); dependency "@inkjs/ui" is edit-distance 2 from top-20 package "vue" (typosquat candidate); dependency "@x402/evm" is edit-distance 2 from popular package "ejs" (typosquat candidate); dependency "@x402/core" is edit-distance 1 from popular package "cors" (typosquat candidate); dependency "@opentelemetry/api" is edit-distance 2 from popular package "pg" (typosquat candidate); dependency "@earendil-works/pi-ai" is edit-distance 2 from popular package "chai" (typosquat candidate)

• Credential hygiene

  warn15% of grade

  How the server takes secrets (env vs plaintext config vs hardcoded); secrets appearing in tool schemas.

  src/tests/agent-fs-provision-seeder.test.ts: assigns a literal to apiKey (afs-…ey (len 13)) — non-provider secret literal; prefer environment intake. src/tests/api-key-tracking.test.ts: contains a hardcoded OpenAI API key (sk-a…45 (len 23)) — in an example/sample file; verify it is not a real key. src/tests/apps-spike5.test.ts: assigns a literal to secret (phas…ue (len 29)) — non-provider secret literal; prefer environment intake. src/tests/apps-sync-engine.test.ts: assigns a literal to secret (fixt…89 (len 31)) — non-provider secret literal; prefer environment intake. src/tests/artifact-sdk.test.ts: assigns a literal to API_KEY (test…ey (len 12)) — non-provider secret literal; prefer environment intake. src/tests/budget-user-scope.test.ts: assigns a literal to API_KEY (test…ey (len 26)) — non-provider secret literal; prefer environment intake. src/tests/budgets-routes.test.ts: assigns a literal to API_KEY (test…ey (len 22)) — non-provider secret literal; prefer environment intake. src/tests/claude-stop-hook.test.ts: contains a hardcoded OpenAI API key (sk-t…ok (len 23)) — in an example/sample file; verify it is not a real key. src/tests/codex-login.test.ts: assigns a literal to apiKey (supe…et (len 12)) — non-provider secret literal; prefer environment intake. src/tests/codex-login.test.ts: assigns a literal to apiKey (prom…et (len 15)) — non-provider secret literal; prefer environment intake. src/tests/config-api-only-keys.test.ts: assigns a literal to API_KEY (test…ey (len 15)) — non-provider secret literal; prefer environment intake. src/tests/connection-embedded-auth.test.ts: assigns a literal to secret (test…23 (len 12)) — non-provider secret literal; prefer environment intake. src/tests/connection-embedded-auth.test.ts: assigns a literal to secret (slug…-1 (len 13)) — non-provider secret literal; prefer environment intake. src/tests/connection-embedded-auth.test.ts: assigns a literal to secret (slug…-2 (len 13)) — non-provider secret literal; prefer environment intake. src/tests/connection-embedded-auth.test.ts: assigns a literal to secret (swit…et (len 13)) — non-provider secret literal; prefer environment intake. src/tests/connection-embedded-auth.test.ts: assigns a literal to secret (rena…et (len 13)) — non-provider secret literal; prefer environment intake. src/tests/connection-embedded-auth.test.ts: assigns a literal to secret (e2e-…yz (len 14)) — non-provider secret literal; prefer environment intake. src/tests/http/context-routes.test.ts: assigns a literal to API_KEY (test…es (len 19)) — non-provider secret literal; prefer environment intake. src/tests/internal-ai/credentials.test.ts: assigns a literal to apiKey (test…ey (len 12)) — non-provider secret literal; prefer environment intake. src/tests/internal-ai/credentials.test.ts: assigns a literal to apiKey (code…ed (len 21)) — non-provider secret literal; prefer environment intake. src/tests/internal-ai/credentials.test.ts: assigns a literal to apiKey (at_p…me (len 19)) — non-provider secret literal; prefer environment intake. src/tests/internal-ai/credentials.test.ts: assigns a literal to apiKey (code…ed (len 13)) — non-provider secret literal; prefer environment intake. src/tests/internal-ai/credentials.test.ts: assigns a literal to apiKey (stil…le (len 12)) — non-provider secret literal; prefer environment intake. src/tests/devin-adapter.test.ts: assigns a literal to API_KEY (cog_…ey (len 15)) — non-provider secret literal; prefer environment intake. src/tests/e2b-dispatch.test.ts: assigns a literal to API_KEY (supe…ue (len 18)) — non-provider secret literal; prefer environment intake. src/tests/e2b-dispatch.test.ts: assigns a literal to apiKey (cont…ey (len 14)) — non-provider secret literal; prefer environment intake. src/tests/e2b-dispatch.test.ts: assigns a literal to apiKey (supe…ey (len 16)) — non-provider secret literal; prefer environment intake. src/tests/entrypoint-api-readiness.test.ts: contains a hardcoded OpenAI API key (sk-s…ak (len 33)) — in an example/sample file; verify it is not a real key. src/tests/http-users.test.ts: assigns a literal to API_KEY (test…ey (len 14)) — non-provider secret literal; prefer environment intake. src/tests/kv-namespace-resolution.test.ts: assigns a literal to API_KEY (test…ey (len 14)) — non-provider secret literal; prefer environment intake. src/tests/kv-page-proxy.test.ts: assigns a literal to API_KEY (test…ey (len 22)) — non-provider secret literal; prefer environment intake. Reads secrets from the environment (e.g. src/tests/additive-ingress.test.ts) — the recommended intake shape.

• Permission scope

  warn15% of grade

  Declared tools vs. breadth (filesystem, network, exec); flags shell-exec and unbounded filesystem access.

  has both shell/exec and network egress — capable of download-and-run, though no such path was observed (templates/community/dora-metrics/report.mjs: imports child_process and calls exec/spawn; src/github/app.ts: outbound HTTP/socket call). has both shell/exec and destructive filesystem writes (templates/community/dora-metrics/report.mjs: imports child_process and calls exec/spawn; templates/community/code-health-reports/report.mjs: destructive/writing fs.* call (write/unlink/rm/chmod/rename)). discloses shell/exec capability: 4 files (templates/community/dora-metrics/report.mjs, src/commands/codex-login.ts, src/providers/harness-version.ts, +1 more) discloses dynamic code execution: src/workflows/executors/code-match.ts: uses new Function(…) discloses broad/destructive filesystem access: 4 files (templates/community/code-health-reports/report.mjs, templates/community/dora-metrics/report.mjs, src/providers/codex-oauth/auth-json-fs.ts, +1 more) Capability DISCLOSURE, not a verdict: static analysis sees the primitive is present and reachable, not whether its use is attacker-controlled.

• Version behavior

  fail10% of grade

  Diff of tool definitions between versions; new permissions or changed descriptions in a patch release (the postmark-mcp class).

  vs prior 1.136.0 (minor bump): new capability primitive(s) in source: child_process, dynamic-eval, fs-write, http-client; new hardcoded outbound host/BCC destination(s): ..., 127.0.0.1, a.com, agent-fs.example.test, agent-fs.test, agent-swarm.dev, api., api.agentmail.ai, api.agentmail.to, api.atlassian.com, api.broken.test, api.dark.test, api.desplega.agent-swarm.dev, api.devin.ai, api.devin.ai., api.dormant.test, api.e2b.app, api.e2b.example, api.echo.test, api.example.com, api.example.test, api.ghost.test, api.github.com, api.kapso.ai, api.lead.test, api.linear.app, api.mine.test, api.openai.com, api.owner.test, api.sandbox.example.com, api.slack.com, api.swarm.localhost, api.test, api.vendor.test, api2.vendor.test, app.agent-swarm.dev, app.devin.ai, as.example.com, auth.atlassian.com, auth.openai.com, b.com, backend.composio.dev, cdn.jsdelivr.net, chatgpt.com, code.claude.com, d3js.org, dash.example.com, dashboard.example.test, developer.atlassian.com, developers.openai.com, disabled.example.com, docs.agent-swarm.dev, docs.claude.com, dora.dev, env.example.com, example.atlassian.net, example.com, files.slack.com, first.atlassian.net, flag.example.com, gateway.example.test, git.test, github.com, gitlab.com, gitlab.example.com, gitlab.mycompany.com, gmail.googleapis.com, id.atlassian.com, inactive.example.com, internal, kapso.test, keep.atlassian.net, legacy.example.com, linear.app, live.agent-fs.dev, mcp.example.com, mcp.example.test, mcp.stripe.com, multi.example.com, nodejs.org, opencode.ai, openrouter.ai, otel.example.test, platform.claude.com, sandbox.private.e2b.test, sandbox.sandbox.example.com, sandboxes.internal, second.atlassian.net, sentry.example.com, signed.example, stale, steering.test, swarm, swarm-api, swarm.example, swarm.example.com, swarm.example.test, swarm.test, test-api, test-app, test.example.com, test.invalid, test.lt.example.com, testart.loca.lt, ui.swarm.localhost, vendor.test, x, x.atlassian.net, x.com, x.test, your-dashboard.com.

• Transport config

  warn10% of grade

  Remote servers: TLS and auth mode (none/token/OAuth). Local servers: whether the manifest indicates it phones home.

  sends telemetry to third-party SDK (Datadog) — disclosure, verify opt-in; manifest/source references tracking behavior — disclosure