← Back to search

io.github.asklokesh/loki-mode

asklokesh Scanned 19d ago

Autonomous spec-to-product coding-agent CLI with an MCP server exposing 34 tools over stdio.

D
40 / 100

Versions

7.34.1latest
first seen Jun 30, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 36

loki_project_status
annotations: none low

Get the current project status including RARV cycle state, agent activity, and task progress. Returns: JSON with project status, phase, iteration, agents, and task counts

loki_agent_metrics
annotations: none low

Get agent metrics including token usage, task completion rates, and timing. Returns: JSON with per-agent metrics and aggregates

loki_checkpoint_restore
annotations: none low

List available checkpoints or restore project state from a specific checkpoint. Args: checkpoint_id: ID of checkpoint to restore (empty = list all) Returns: JSON with available checkpoints or restoration result

checkpoint_id str
loki_quality_report
annotations: none low

Get quality gate results including blind review scores, council verdicts, and test coverage. Returns: JSON with quality gate status, review results, and coverage metrics

loki_memory_retrieve
annotations: none low

Retrieve relevant memories for a task using task-aware retrieval. Args: query: Search query describing what you're looking for task_type: Type of task (exploration, implementation, debugging, review, refactoring) top_k: Maximum number of results to return Returns: JSON array of relevant memory entries with summaries

query str top_k int task_type str
loki_memory_store_pattern
annotations: none low

Store a new semantic pattern learned during this session. Args: pattern: Brief description of the pattern category: Category (api, testing, security, performance, architecture, etc.) correct_approach: The correct way to handle this situation incorrect_approach: What to avoid (optional) confidence: Confidence level 0.0-1.0 Returns: Pattern ID if successful

pattern str category str confidence float correct_approach str incorrect_approach str
loki_task_queue_list
annotations: none low

List all tasks in the Loki Mode task queue. Returns: JSON array of tasks with status, priority, and description

loki_task_queue_add
annotations: none low

Add a new task to the Loki Mode task queue. Args: title: Brief task title description: Detailed task description priority: Priority level (low, medium, high, critical) phase: SDLC phase (discovery, architecture, development, testing, deployment) Returns: Task ID if successful

phase str title str priority str description str
loki_task_queue_update
annotations: none low

Update a task's status or priority. Args: task_id: ID of the task to update status: New status (pending, in_progress, completed, blocked) priority: New priority (low, medium, high, critical) Returns: Updated task if successful

status str task_id str priority str
loki_state_get
annotations: none low

Get the current Loki Mode state including phase, metrics, and status. Returns: JSON object with current state information

loki_metrics_efficiency
annotations: none low

Get efficiency metrics for the current session. Returns: JSON object with token usage, tool calls, and efficiency ratios

loki_memory_capture_session_summary
annotations: none low

v7.7.18 capture wedge: store an episode for the current agent session. Call this voluntarily at iteration close (or session end) to write a structured Episode into the project's .loki/memory/ store. Solves the diagnosis root cause where memory only captured during `loki start` sessions, missing all interactive Claude Code / Cursor / Cline / Aider work. Args: goal: Short description of what the session tried to accomplish (will be truncated to 500 chars, scrubbed for secrets). outcome: One of "success" | "failure" | "partial". Default "success". files_modified: List of file paths that were created or edited. files_read: List of file paths that were read for context. tool_calls_summary: Optional free-text summary of major actions taken (truncated to 1000 chars, scrubbed). duration_seconds: Approximate session duration. Default 0. Returns: JSON: {"episode_path": "<path>"} on success, or {"error": "...", "disabled": true} if LOKI_MEMORY_CAPTURE_DISABLED env var blocks capture, or {"error": "..."} on failure.

goal str outcome str files_read string files_modified string duration_seconds int tool_calls_summary string
loki_consolidate_memory
annotations: none low

Run memory consolidation to extract patterns from recent episodes. Args: since_hours: Process episodes from the last N hours Returns: Consolidation results with patterns created/merged

since_hours int
loki_complete_task
annotations: none low

Declare that the current PRD / task is complete. Replaces the legacy 'COMPLETION PROMISE FULFILLED: ...' prose string with a structured tool call. The orchestrator (run.sh) detects this via a signal file and stops the iteration loop gracefully. Args: completion_statement: A short statement of what is complete (for example, "PRD requirements implemented, all tests passing, checklist 100%"). evidence: Concrete evidence supporting the claim -- tests that passed, checklist items verified, files created/modified, metrics hit. confidence: One of 'high', 'medium', 'low' (default 'medium'). 'low' signals the orchestrator should still run the completion council. Returns: JSON: {"recorded": true, "path": ".loki/events.jsonl"} on success, {"error": "..."} otherwise.

evidence str confidence str completion_statement str
loki_start_project
annotations: none low

Start a new Loki Mode project from a PRD. Args: prd_content: Inline PRD content (takes priority over prd_path) prd_path: Path to a PRD file on disk Returns: JSON with project initialization status

prd_path str prd_content str
loki_code_search
annotations: none low

Search the loki-mode codebase semantically. Finds functions, classes, and code sections by meaning, not just keywords. Returns file paths, line numbers, and code snippets ranked by relevance. Args: query: Natural language search query (e.g., "rate limit detection", "model selection for RARV tier", "how does the council vote") n_results: Number of results to return (default 10, max 30) language: Filter by language: "shell", "python", "markdown" (optional) file_filter: Filter by file path substring (e.g., "autonomy/", "dashboard/") (optional) type_filter: Filter by chunk type: "function", "class", "header", "section", "file" (optional)

query str language string n_results int file_filter string type_filter string
loki_code_search_stats
annotations: none low

Get statistics about the code search index. Shows total chunks, files indexed, breakdown by language and type. Useful for verifying the index is up to date.

mem_search
annotations: none low

Search memory using full-text search (FTS5). Fast keyword search across all memory types. Supports AND, OR, NOT operators and prefix matching (e.g. "debug*"). Args: query: Search query (plain text or FTS5 syntax) collection: Which memories to search (episodes, patterns, skills, all) limit: Maximum results to return Returns: JSON array of matching memories with relevance scores

limit int query str collection str
mem_timeline
annotations: none low

Get chronological context from memory timeline. Shows recent actions, key decisions, and episode traces in time order. Use around_id to get context surrounding a specific memory entry. Args: around_id: Optional memory ID to center the timeline around limit: Maximum timeline entries to return since_hours: Only show entries from the last N hours (default 24) Returns: JSON timeline with actions and decisions

limit int around_id str since_hours int
mem_get
annotations: none low

Fetch full details for one or more memory entries by ID. Use after mem_search to get complete data for specific results. Args: ids: Comma-separated list of memory IDs to fetch Returns: JSON object with full memory details keyed by ID

ids str
loki_get_hotspots
annotations: none low

Get the most frequently changed files in the repository. Identifies code hotspots based on git commit frequency analysis. These files deserve extra care during changes (higher risk of regressions). Args: limit: Number of top hotspot files to return (default 10, max 30)

limit int
loki_get_co_changes
annotations: none low

Find files that frequently change together with a given file. Uses git co-change analysis to identify coupling between files. Useful for understanding hidden dependencies and ensuring related files are updated together. Args: file_path: Path to the file to find co-change partners for

file_path str
loki_get_doc_coverage
annotations: none low

Get documentation coverage status for the project. Reads from the docs manifest to report which files are documented, which have stale documentation, and which are missing docs entirely. Useful for prioritizing documentation work.

loki_findings
annotations: none low

Read structured code-review findings for a given iteration. Args: iteration: iteration number (default -1 = most recent). Returns: JSON {iteration, review_id, findings: [...]}.

iteration int
loki_learnings
annotations: none low

Read recent learnings (newest first) from relevant-learnings.json.

limit int
loki_graph_query
annotations: none low

Answer a codebase question from a knowledge graph instead of reading files. WHY THIS EXISTS Loading a large repo into context is the dominant token cost of working on it, and on a big codebase it is simply impossible. Measured on this repo: `autonomy/` alone is 85 files / 3,194,940 bytes, roughly 798,735 tokens if naively read. No context window holds that. MEASURED on this repo, same question, same subtree: naive file load 101,739 bytes ~= 25,434 tokens graph query 3,335 bytes ~= 833 tokens A ~30x reduction, and the answer arrives with exact file:line citations plus a provenance label on every edge (EXTRACTED / INFERRED / AMBIGUOUS) -- the same facts-vs-inference split the Evidence Receipt uses, which is why it composes cleanly with the rest of this server. This is the brownfield unlock: a ten-year-old enterprise repo is unreachable by reading, and reachable by querying. REQUIRES a graph built by graphify (`graphify <path>`), which is deterministic AST parsing with no LLM and no network. If no graph exists this returns a structured hint rather than silently degrading to a guess. Args: question: natural-language question about the codebase budget: cap the answer at roughly this many tokens (default 1500) path: repo root containing graphify-out/ (default: current directory) Returns: JSON: {ok, answer, tokens_estimate, budget, source} or {ok:false, hint}

path str budget int question str
lsp_workspace_symbols
annotations: none low

Fuzzy-search symbols across the entire workspace. Use when an agent is hunting for the right name (knows the function/class is about "config loading" but isn't sure of the actual identifier). Returns LSP workspace/symbol results scoped to the detected language (or the language override). Args: query: Symbol query (substring or fuzzy per LSP server impl). limit: Max results to return (default 20, hard cap 100). language: Optional language override. Returns: JSON: {"matches": [...], "count": N, "language": "...", "elapsed_ms": float}.

limit int query str language string
loki_verify_fast
annotations: none low

Verify code deterministically in milliseconds. No model call, no network. This is the embeddable verification primitive: an IDE, another agent, a CI step, or a third-party tool can call it and get a structured verdict back faster than a keystroke round-trip. MEASURED on loki-mode itself (1,932 tracked source files): full repo, cold 298 ms full repo, warm 87 ms diff-scoped 19 ms against an 11,040 ms shell-based baseline. The speedup came from architecture, not micro-optimization: walk the tree ONCE via the git index, run every detector as a pure function in ONE process, and cache findings by file CONTENT hash so an unchanged file is never re-read. WHY THERE IS NO LLM HERE, AND WHY THAT IS THE POINT Everything this returns is reproducible by anyone with the same commit. A verdict you can re-derive is a FACT; a verdict a model produced is an OPINION. Keeping this path purely deterministic is what makes it both fast and safe to embed in someone else's product -- they do not have to trust our model choices, only our arithmetic. Args: path: repository or directory to verify (default: current directory) diff_base: optional git ref. When given, only files changed against it are verified, which is the normal case for a pull request and the fastest path. Returns: JSON: verdict (PASS | FAIL | INCONCLUSIVE), findings[] with rule/path/line/message/severity, files_scanned, files_from_cache, elapsed_ms, and exogenous=true.

path str diff_base str
loki_counter_evidence_template
annotations: none low

Generate a counter-evidence file template for the given iteration. Pre-fills canonical findingId for each Critical/High finding so the user only has to fill in `claim` + `proofType`. Save the template body to .loki/state/counter-evidence-<iteration>.json to dispute findings via the override council.

iteration int
loki_memory_redact
annotations: none low

Redact memory versions in the managed-agents store whose content matches a regex. Iterates memory versions within the requested scope and calls ``client.beta.memory_stores.memory_versions.redact(...)`` for each match. Requires ``LOKI_MANAGED_AGENTS=true`` and ``LOKI_MANAGED_MEMORY=true`` -- otherwise raises ``ManagedDisabled``. Args: pattern: Python regex compiled with ``re.search`` against each version's content. scope: One of ``user``, ``org``, or ``all`` (default). Returns: JSON ``{"redacted_count": int, "errors": [...], "scanned": int}``.

scope str pattern str
lsp_find_references
annotations: none low

Find references to the symbol at the given file / line / character. Args: file: Absolute or cwd-relative path to the source file. line: 0-indexed line number (LSP convention). character: 0-indexed character offset within the line. include_declaration: If True, include the symbol declaration in results. Returns: JSON-encoded string. Success: {"result": [...], "language": ...}. Error: {"error": "..."}.

file str line int character int include_declaration bool
lsp_go_to_definition
annotations: none low

Resolve the definition location for the symbol at file / line / character. Args: file: Absolute or cwd-relative path to the source file. line: 0-indexed line number. character: 0-indexed character offset within the line. Returns: JSON-encoded string with `result` (LSP Location | Location[] | LocationLink[]) on success or `error` on failure.

file str line int character int
lsp_symbol_at_position
annotations: none low

Return the hover / symbol info at the given file / line / character. Uses LSP `textDocument/hover` which returns a `MarkupContent` plus an optional range. Args: file: Absolute or cwd-relative path to the source file. line: 0-indexed line number. character: 0-indexed character offset within the line. Returns: JSON-encoded string with `result` (LSP Hover) on success or `error` on failure.

file str line int character int
lsp_check_exists
annotations: none low

Cheap existence check for a symbol in the current workspace. The single most useful grounding primitive: an agent about to write `flightApi.getStatus()` should call `lsp_check_exists("getStatus")` first. If false, it means LSP could not find that name anywhere in the workspace; the agent should resolve via find / grep / read before writing the call. Args: symbol: Symbol name to look for (substring match per LSP spec). kind: Optional filter: 'function', 'class', 'method', 'variable', etc. If provided, only symbols whose LSP SymbolKind matches are counted. language: Optional language override. If None, auto-detected from workspace markers (package.json, requirements.txt, etc.). Returns: JSON-encoded string: {"exists": bool, "matches": N, "samples": [...], "language": "...", "elapsed_ms": float}. On no-LSP-available: {"error": "...", "exists": null}.

kind string symbol str language string
lsp_get_diagnostics
annotations: none low

Return current LSP diagnostics (errors + warnings) for a file. Diagnostics are published asynchronously by LSP servers via `textDocument/publishDiagnostics`. This tool opens the file (if not already open, or re-syncs it via didChange if edited since first open) and waits up to 1 second for diagnostics to arrive, then returns whatever has been published. Args: file: Absolute or cwd-relative path to the source file. Returns: JSON: {"diagnostics": [{severity, message, range, source}, ...], "count_errors": N, "count_warnings": M, "language": "...", "elapsed_ms": float}.

file str
lsp_find_definition_by_name
annotations: none low

Find where a named symbol is defined, without needing a file position upfront. Convenience wrapper: runs workspace/symbol then returns the first result's location. Args: symbol: Symbol name to find. language: Optional language override. Returns: JSON: {"location": {uri, range} | null, "name": str | null, "language": "...", "elapsed_ms": float}.

symbol str language string

Permissions 5

network medium
Server uses network capabilities via: fetch(), http, https, httpx, requests, socket, urllib, websocket
filesystem low
Server uses filesystem capabilities via: fs, fs sync ops, fs.promises, glob, open(), os, path, pathlib, shutil, tempfile
shell high
Server uses shell capabilities via: child_process, execSync(), os.exec*(), spawn(), spawnSync(), subprocess
database medium
Server uses database capabilities via: sqlalchemy, sqlite3
env_vars low
Server uses env_vars capabilities via: os.environ, process.env

Scan Findings 188

low
Tool 'loki_agent_metrics' has no annotations annotation_checker · 100%
low
Tool 'loki_checkpoint_restore' has no annotations annotation_checker · 100%
low
Tool 'loki_quality_report' has no annotations annotation_checker · 100%
low
Tool 'loki_memory_retrieve' has no annotations annotation_checker · 100%
low
Tool 'loki_memory_store_pattern' has no annotations annotation_checker · 100%
low
Tool 'loki_task_queue_list' has no annotations annotation_checker · 100%
low
Tool 'loki_task_queue_add' has no annotations annotation_checker · 100%
low
Tool 'loki_task_queue_update' has no annotations annotation_checker · 100%
low
Tool 'loki_state_get' has no annotations annotation_checker · 100%
low
Tool 'loki_metrics_efficiency' has no annotations annotation_checker · 100%
low
Tool 'loki_memory_capture_session_summary' has no annotations annotation_checker · 100%
low
Tool 'loki_consolidate_memory' has no annotations annotation_checker · 100%
low
Tool 'loki_complete_task' has no annotations annotation_checker · 100%
low
Tool 'loki_start_project' has no annotations annotation_checker · 100%
low
Tool 'loki_project_status' has no annotations annotation_checker · 100%
medium
Vulnerable dependency: esbuild@0.19.8 (GHSA-67mh-4wv8-2f99) dependency_analyzer · 95%
low
Tool 'loki_code_search' has no annotations annotation_checker · 100%
low
Tool 'loki_code_search_stats' has no annotations annotation_checker · 100%
low
Tool 'mem_search' has no annotations annotation_checker · 100%
low
Tool 'mem_timeline' has no annotations annotation_checker · 100%
low
Tool 'mem_get' has no annotations annotation_checker · 100%
low
Tool 'loki_get_hotspots' has no annotations annotation_checker · 100%
low
Tool 'loki_get_co_changes' has no annotations annotation_checker · 100%
low
Tool 'loki_get_doc_coverage' has no annotations annotation_checker · 100%
low
Tool 'loki_findings' has no annotations annotation_checker · 100%
low
Tool 'loki_learnings' has no annotations annotation_checker · 100%
low
Tool 'loki_graph_query' has no annotations annotation_checker · 100%
low
Tool 'loki_verify_fast' has no annotations annotation_checker · 100%
low
Tool 'loki_counter_evidence_template' has no annotations annotation_checker · 100%
low
Tool 'loki_memory_redact' has no annotations annotation_checker · 100%
low
Tool 'lsp_find_references' has no annotations annotation_checker · 100%
low
Tool 'lsp_go_to_definition' has no annotations annotation_checker · 100%
low
Tool 'lsp_symbol_at_position' has no annotations annotation_checker · 100%
low
Tool 'lsp_check_exists' has no annotations annotation_checker · 100%
low
Tool 'lsp_get_diagnostics' has no annotations annotation_checker · 100%
low
Tool 'lsp_workspace_symbols' has no annotations annotation_checker · 100%
low
Tool 'lsp_find_definition_by_name' has no annotations annotation_checker · 100%
high
Hardcoded API key in asklokesh-loki-mode-380f799/tests/policies/engine.test.js auth_checker · 90%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Suspicious package name: react-dom dependency_analyzer · 60%
medium
Vulnerable dependency: esbuild@0.24.0 (GHSA-67mh-4wv8-2f99) dependency_analyzer · 95%
medium
Vulnerable dependency: postcss@8.5.3 (GHSA-6g55-p6wh-862q) dependency_analyzer · 95%
medium
Vulnerable dependency: postcss@8.5.3 (GHSA-fxqj-rqcc-2cmp) dependency_analyzer · 95%
medium
Vulnerable dependency: postcss@8.5.3 (GHSA-qx2v-qp2m-jg93) dependency_analyzer · 95%
medium
Vulnerable dependency: postcss@8.5.3 (GHSA-r28c-9q8g-f849) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.2.0 (GHSA-356w-63v5-8wf4) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.2.0 (GHSA-4r4m-qw57-chr8) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.2.0 (GHSA-4w7w-66w2-5vf9) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.2.0 (GHSA-859w-5945-r5v3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.2.0 (GHSA-93m4-6634-74q7) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.2.0 (GHSA-fx2h-pf6j-xcff) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.2.0 (GHSA-g4jq-h2w9-997c) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.2.0 (GHSA-jqfw-vq24-v9c3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.2.0 (GHSA-p9ff-h696-f583) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.2.0 (GHSA-v6wh-96g9-6wx3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.2.0 (GHSA-x574-m823-4x7w) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.2.0 (GHSA-xcj6-pq6g-qj4x) dependency_analyzer · 95%
medium
Vulnerable dependency: postcss@8.4.32 (GHSA-6g55-p6wh-862q) dependency_analyzer · 95%
medium
Vulnerable dependency: postcss@8.4.32 (GHSA-fxqj-rqcc-2cmp) dependency_analyzer · 95%
medium
Vulnerable dependency: postcss@8.4.32 (GHSA-qx2v-qp2m-jg93) dependency_analyzer · 95%
medium
Vulnerable dependency: postcss@8.4.32 (GHSA-r28c-9q8g-f849) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.8 (GHSA-356w-63v5-8wf4) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.8 (GHSA-4r4m-qw57-chr8) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.8 (GHSA-4w7w-66w2-5vf9) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.8 (GHSA-64vr-g452-qvp3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.8 (GHSA-859w-5945-r5v3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.8 (GHSA-8jhw-289h-jh2g) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.8 (GHSA-93m4-6634-74q7) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.8 (GHSA-9cwx-2883-4wfx) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.8 (GHSA-c24v-8rfc-w8vw) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.8 (GHSA-c27g-q93r-2cwf) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.8 (GHSA-fx2h-pf6j-xcff) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.8 (GHSA-g4jq-h2w9-997c) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.8 (GHSA-jqfw-vq24-v9c3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.8 (GHSA-v6wh-96g9-6wx3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.8 (GHSA-vg6x-rcgg-rjx6) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.8 (GHSA-x574-m823-4x7w) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.8 (GHSA-xcj6-pq6g-qj4x) dependency_analyzer · 95%
medium
Vulnerable dependency: fastapi@0.100.0 (PYSEC-2024-38) dependency_analyzer · 95%
medium
Vulnerable dependency: pydantic@2.0.0 (GHSA-mr82-8j83-vxmv) dependency_analyzer · 95%
medium
Vulnerable dependency: pydantic@2.0.0 (PYSEC-2026-1812) dependency_analyzer · 95%
medium
Vulnerable dependency: cryptography@41.0.0 (GHSA-3ww4-gg4f-jr7f) dependency_analyzer · 95%
medium
Vulnerable dependency: cryptography@41.0.0 (GHSA-537c-gmf6-5ccf) dependency_analyzer · 95%
medium
Vulnerable dependency: cryptography@41.0.0 (GHSA-6vqw-3v5j-54x4) dependency_analyzer · 95%
medium
Vulnerable dependency: cryptography@41.0.0 (GHSA-9v9h-cgj8-h64p) dependency_analyzer · 95%
medium
Vulnerable dependency: cryptography@41.0.0 (GHSA-cf7p-gm2m-833m) dependency_analyzer · 95%
medium
Vulnerable dependency: cryptography@41.0.0 (GHSA-h4gh-qq45-vh27) dependency_analyzer · 95%
medium
Vulnerable dependency: cryptography@41.0.0 (GHSA-jfhm-5ghh-2f97) dependency_analyzer · 95%
medium
Vulnerable dependency: cryptography@41.0.0 (GHSA-jm77-qphf-c4w8) dependency_analyzer · 95%
medium
Vulnerable dependency: cryptography@41.0.0 (GHSA-jwv3-5hgf-82ww) dependency_analyzer · 95%
medium
Vulnerable dependency: cryptography@41.0.0 (GHSA-m2h6-j472-rp4c) dependency_analyzer · 95%
medium
Vulnerable dependency: cryptography@41.0.0 (GHSA-m959-cc7f-wv43) dependency_analyzer · 95%
medium
Vulnerable dependency: cryptography@41.0.0 (GHSA-r6ph-v2qm-q3c2) dependency_analyzer · 95%
medium
Vulnerable dependency: cryptography@41.0.0 (GHSA-v8gr-m533-ghj9) dependency_analyzer · 95%
medium
Vulnerable dependency: cryptography@41.0.0 (PYSEC-2023-112) dependency_analyzer · 95%
medium
Vulnerable dependency: cryptography@41.0.0 (PYSEC-2023-254) dependency_analyzer · 95%
medium
Vulnerable dependency: cryptography@41.0.0 (PYSEC-2024-225) dependency_analyzer · 95%
medium
Vulnerable dependency: cryptography@41.0.0 (PYSEC-2026-1283) dependency_analyzer · 95%
medium
Vulnerable dependency: cryptography@41.0.0 (PYSEC-2026-1285) dependency_analyzer · 95%
medium
Vulnerable dependency: cryptography@41.0.0 (PYSEC-2026-2141) dependency_analyzer · 95%
medium
Vulnerable dependency: cryptography@41.0.0 (PYSEC-2026-35) dependency_analyzer · 95%
medium
Vulnerable dependency: cryptography@41.0.0 (PYSEC-2026-3553) dependency_analyzer · 95%
medium
Vulnerable dependency: cryptography@41.0.0 (PYSEC-2026-3554) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.0.0 (GHSA-3qhf-m339-9g5v) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.0.0 (GHSA-9h52-p55h-vw2f) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.0.0 (GHSA-j975-95f5-7wqh) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.0.0 (GHSA-jpw9-pfvf-9f58) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.0.0 (GHSA-vj7q-gjh5-988w) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.0.0 (PYSEC-2026-1616) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.0.0 (PYSEC-2026-1617) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.0.0 (PYSEC-2026-1618) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.0.0 (PYSEC-2026-3482) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.0.0 (PYSEC-2026-3483) dependency_analyzer · 95%
medium
Vulnerable dependency: chromadb@1.0.0 (GHSA-f4j7-r4q5-qw2c) dependency_analyzer · 95%
medium
Vulnerable dependency: chromadb@1.0.0 (PYSEC-2026-311) dependency_analyzer · 95%
medium
Vulnerable dependency: flask@3.0.0 (GHSA-68rp-wp8r-4726) dependency_analyzer · 95%
medium
Vulnerable dependency: flask@3.0.0 (PYSEC-2026-2151) dependency_analyzer · 95%
medium
High-entropy string (6.11 bits/char) in asklokesh-loki-mode-380f799/dashboard/static/assets/mermaid.min.js:350 entropy_analyzer · 56%
medium
High-entropy string (8.41 bits/char) in asklokesh-loki-mode-380f799/dashboard/static/assets/mermaid.min.js:1608 entropy_analyzer · 91%
medium
High-entropy string (7.35 bits/char) in asklokesh-loki-mode-380f799/dashboard/static/assets/mermaid.min.js:1608 entropy_analyzer · 75%
high
String.fromCharCode chain in asklokesh-loki-mode-380f799/dashboard/static/assets/mermaid.min.js:345 entropy_analyzer · 90%
high
Long unicode escape chain in asklokesh-loki-mode-380f799/dashboard/static/assets/mermaid.min.js:372 entropy_analyzer · 80%
medium
Hex string literal (>50 chars) in asklokesh-loki-mode-380f799/dashboard/static/assets/mermaid.min.js:7 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in asklokesh-loki-mode-380f799/loki-ts/tests/commands/crash.test.ts:129 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in asklokesh-loki-mode-380f799/loki-ts/tests/commands/crash.test.ts:232 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in asklokesh-loki-mode-380f799/loki-ts/tests/commands/crash.test.ts:233 entropy_analyzer · 70%
medium
High-entropy string (6.02 bits/char) in asklokesh-loki-mode-380f799/autonomy/lib/checkpoint_sync.py:361 entropy_analyzer · 55%
medium
High-entropy string (6.11 bits/char) in asklokesh-loki-mode-380f799/dashboard-ui/assets/mermaid.min.js:350 entropy_analyzer · 56%
medium
High-entropy string (8.41 bits/char) in asklokesh-loki-mode-380f799/dashboard-ui/assets/mermaid.min.js:1608 entropy_analyzer · 91%
medium
High-entropy string (7.35 bits/char) in asklokesh-loki-mode-380f799/dashboard-ui/assets/mermaid.min.js:1608 entropy_analyzer · 75%
high
String.fromCharCode chain in asklokesh-loki-mode-380f799/dashboard-ui/assets/mermaid.min.js:345 entropy_analyzer · 90%
high
Long unicode escape chain in asklokesh-loki-mode-380f799/dashboard-ui/assets/mermaid.min.js:372 entropy_analyzer · 80%
medium
Hex string literal (>50 chars) in asklokesh-loki-mode-380f799/dashboard-ui/assets/mermaid.min.js:7 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in asklokesh-loki-mode-380f799/tests/integrations/teams/adapter.test.js:369 entropy_analyzer · 70%
medium
High-entropy string (5.95 bits/char) in asklokesh-loki-mode-380f799/vscode-extension/src/utils/webview.ts:12 entropy_analyzer · 54%
info
package.json metadata manifest_parser · 100%
info
pyproject.toml metadata manifest_parser · 100%
info
Tool: loki_memory_retrieve manifest_parser · 90%
info
Tool: loki_memory_store_pattern manifest_parser · 90%
info
Tool: loki_task_queue_list manifest_parser · 90%
info
Tool: loki_task_queue_add manifest_parser · 90%
info
Tool: loki_task_queue_update manifest_parser · 90%
info
Tool: loki_state_get manifest_parser · 90%
info
Tool: loki_metrics_efficiency manifest_parser · 90%
info
Tool: loki_memory_capture_session_summary manifest_parser · 90%
info
Tool: loki_consolidate_memory manifest_parser · 90%
info
Tool: loki_complete_task manifest_parser · 90%
info
Tool: loki_start_project manifest_parser · 90%
info
Tool: loki_project_status manifest_parser · 90%
info
Tool: loki_agent_metrics manifest_parser · 90%
info
Tool: loki_checkpoint_restore manifest_parser · 90%
info
Tool: loki_quality_report manifest_parser · 90%
info
Tool: loki_code_search manifest_parser · 90%
info
Tool: loki_code_search_stats manifest_parser · 90%
info
Tool: mem_search manifest_parser · 90%
info
Tool: mem_timeline manifest_parser · 90%
info
Tool: mem_get manifest_parser · 90%
info
Tool: loki_get_hotspots manifest_parser · 90%
info
Tool: loki_get_co_changes manifest_parser · 90%
info
Tool: loki_get_doc_coverage manifest_parser · 90%
info
Tool: loki_findings manifest_parser · 90%
info
Tool: loki_learnings manifest_parser · 90%
info
Tool: loki_graph_query manifest_parser · 90%
info
Tool: loki_verify_fast manifest_parser · 90%
info
Tool: loki_counter_evidence_template manifest_parser · 90%
info
Tool: loki_memory_redact manifest_parser · 90%
info
Tool: lsp_find_references manifest_parser · 90%
info
Tool: lsp_go_to_definition manifest_parser · 90%
info
Tool: lsp_symbol_at_position manifest_parser · 90%
info
Tool: lsp_check_exists manifest_parser · 90%
info
Tool: lsp_get_diagnostics manifest_parser · 90%
info
Tool: lsp_workspace_symbols manifest_parser · 90%
info
Tool: lsp_find_definition_by_name manifest_parser · 90%
info
Transport: streamable-http manifest_parser · 80%
info
Required env vars (366) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 90%
low
Permission: filesystem access detected permission_analyzer · 90%
high
Permission: shell access detected permission_analyzer · 95%
medium
Permission: database access detected permission_analyzer · 90%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 1000 components sbom_generator · 100%
critical
Database URL with Password found in asklokesh-loki-mode-380f799/templates/rest-api-auth.md secret_scanner · 85%
critical
AWS Access Key ID found in asklokesh-loki-mode-380f799/autonomy/lib/secure-scan.py secret_scanner · 95%
high
Generic API Key Assignment found in asklokesh-loki-mode-380f799/docs/enterprise/integration-cookbook.md secret_scanner · 75%
critical
Database URL with Password found in asklokesh-loki-mode-380f799/docs/architecture/DASHBOARD_V2_ARCHITECTURE.md secret_scanner · 85%
high
Hardcoded Password found in asklokesh-loki-mode-380f799/web-app/deploy/k8s/purple-lab/secret.yaml secret_scanner · 65%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%