← Back to search Server uses shell capabilities via: child_process, execSync(), spawn() Server uses network capabilities via: axios, fetch(), https Server uses filesystem capabilities via: fs, fs sync ops, fs.promises, path Server uses env_vars capabilities via: process.env
@tenonhq/dovetail-claude-plans
MCP server + CLI for Claude Code plans and visual artifacts surfaced in the Dovetail dashboard.
npm
? Not scanned yet
Versions
0.0.26latestJun 18, 2026
0.0.25Jun 13, 2026
0.0.24Jun 9, 2026
0.0.23Jun 6, 2026
0.0.22Jun 6, 2026
+ show 20 moreshow less
0.0.21Jun 4, 2026
0.0.20May 29, 2026
0.0.19May 28, 2026
0.0.18May 28, 2026
0.0.17May 28, 2026
0.0.16May 28, 2026
0.0.15May 28, 2026
0.0.14May 28, 2026
0.0.13May 28, 2026
0.0.12May 28, 2026
0.0.11May 28, 2026
0.0.10May 26, 2026
0.0.9May 26, 2026
0.0.8May 26, 2026
0.0.7May 26, 2026
0.0.5May 18, 2026
0.0.4May 16, 2026
0.0.3May 15, 2026
0.0.2May 15, 2026
0.0.1May 14, 2026
Tools 0
No tools indexed yet.
Permissions 4
shell high network medium filesystem low env_vars low Scan Findings 59
medium
OAuth implementation without PKCE
info
Sandbox failed to start for behavioral verification
medium
Excessive dependency count: 66 direct dependencies
medium
Vulnerable dependency: axios@1.5.1 (GHSA-35jp-ww65-95wh)
medium
Vulnerable dependency: axios@1.5.1 (GHSA-3g43-6gmg-66jw)
medium
Vulnerable dependency: axios@1.5.1 (GHSA-3p68-rc4w-qgx5)
medium
Vulnerable dependency: axios@1.5.1 (GHSA-3w6x-2g7m-8v23)
medium
Vulnerable dependency: axios@1.5.1 (GHSA-42h9-826w-cgv3)
medium
Vulnerable dependency: axios@1.5.1 (GHSA-43fc-jf86-j433)
medium
Vulnerable dependency: axios@1.5.1 (GHSA-445q-vr5w-6q77)
medium
Vulnerable dependency: axios@1.5.1 (GHSA-4hjh-wcwx-xvwj)
medium
Vulnerable dependency: axios@1.5.1 (GHSA-5c9x-8gcm-mpgx)
medium
Vulnerable dependency: axios@1.5.1 (GHSA-62hf-57xw-28j9)
medium
Vulnerable dependency: axios@1.5.1 (GHSA-6chq-wfr3-2hj9)
medium
Vulnerable dependency: axios@1.5.1 (GHSA-7q8q-rj6j-mhjq)
medium
Vulnerable dependency: axios@1.5.1 (GHSA-898c-q2cr-xwhg)
medium
Vulnerable dependency: axios@1.5.1 (GHSA-8hc4-vh64-cxmj)
medium
Vulnerable dependency: axios@1.5.1 (GHSA-fvcv-3m26-pcqx)
medium
Vulnerable dependency: axios@1.5.1 (GHSA-hfxv-24rg-xrqf)
medium
Vulnerable dependency: axios@1.5.1 (GHSA-j5f8-grm9-p9fc)
medium
Vulnerable dependency: axios@1.5.1 (GHSA-jr5f-v2jv-69x6)
medium
Vulnerable dependency: axios@1.5.1 (GHSA-m7pr-hjqh-92cm)
medium
Vulnerable dependency: axios@1.5.1 (GHSA-mmx7-hfxf-jppx)
medium
Vulnerable dependency: axios@1.5.1 (GHSA-p92q-9vqr-4j8v)
medium
Vulnerable dependency: axios@1.5.1 (GHSA-pf86-5x62-jrwf)
medium
Vulnerable dependency: axios@1.5.1 (GHSA-pmv8-rq9r-6j72)
medium
Vulnerable dependency: axios@1.5.1 (GHSA-pmwg-cvhr-8vh7)
medium
Vulnerable dependency: axios@1.5.1 (GHSA-q8qp-cvcw-x6jj)
medium
Vulnerable dependency: axios@1.5.1 (GHSA-vf2m-468p-8v99)
medium
Vulnerable dependency: axios@1.5.1 (GHSA-w9j2-pvgh-6h63)
medium
Vulnerable dependency: axios@1.5.1 (GHSA-wf5p-g6vw-rhxx)
medium
Vulnerable dependency: axios@1.5.1 (GHSA-xhjh-pmcv-23jw)
medium
Vulnerable dependency: axios@1.5.1 (GHSA-xx6v-rp6x-q39c)
medium
Vulnerable dependency: lodash@4.17.21 (GHSA-f23m-r3pf-42rh)
medium
Vulnerable dependency: lodash@4.17.21 (GHSA-r5fr-rjxr-66jc)
medium
Vulnerable dependency: lodash@4.17.21 (GHSA-xxjr-mmjv-4gpg)
medium
Vulnerable dependency: express@4.18.2 (GHSA-qw6h-vgh9-j6wx)
medium
Vulnerable dependency: express@4.18.2 (GHSA-rv95-896h-c2vc)
medium
Vulnerable dependency: webpack@5.88.2 (GHSA-38r7-794h-5758)
medium
Vulnerable dependency: webpack@5.88.2 (GHSA-4vvj-4cpr-p986)
medium
Vulnerable dependency: webpack@5.88.2 (GHSA-8fgc-7cc6-rx7x)
medium
Vulnerable dependency: sanitize-html@2.17.4 (GHSA-g8qq-57p8-ggw5)
medium
Vulnerable dependency: sanitize-html@2.17.4 (GHSA-jxwj-j7wr-gfrw)
medium
Vulnerable dependency: sanitize-html@2.17.4 (GHSA-vccv-cmxp-4j9h)
medium
Buffer.from base64 in TenonHQ-Dovetail-4f8b2c2/packages/core/src/tests/v2Values.test.ts:180
medium
Buffer.from base64 in TenonHQ-Dovetail-4f8b2c2/packages/core/src/flowDesigner/values.ts:70
medium
Buffer.from base64 in TenonHQ-Dovetail-4f8b2c2/packages/gmail/src/client.ts:462
info
package.json metadata
info
Transport: stdio
info
Required env vars (44)
info
Sandbox failed to start for output poisoning scan
medium
Permission: network access detected
low
Permission: filesystem access detected
high
Permission: shell access detected
low
Permission: env_vars access detected
info
SBOM generated: 729 components
high
Hardcoded Password found in TenonHQ-Dovetail-4f8b2c2/packages/schema/README.md
high
Hardcoded Password found in TenonHQ-Dovetail-4f8b2c2/packages/core/src/initSystem/corePlugin.ts
medium
No build provenance detected (SLSA L0)