ReactuseBLOCK
115+ production-ready React Hooks for sensors, UI, state & browser APIs. Tree-shakable, SSR-safe, TypeScript-first. Used by Shopee, PDD & Ctrip. Inspired by VueUse.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://mcptoplist.com/server/glama%2Fchildrentime%2Freactuse)
f0053623a81cOBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add website-astro --env INDEXNOW_KEY=${INDEXNOW_KEY} -- npx -y [email protected]{
"mcpServers": {
"website-astro": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"INDEXNOW_KEY": "${INDEXNOW_KEY}"
}
}
}
}Exposed tools (3)
3 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
get_hook | read | |
list_hooks | read | |
search_hooks | read |
Trust audit
BLOCKgrade F · trust 53/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (4 observation(s))
- Network
- declared (2 observation(s))
- Shell
- declared (6 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
exec(`pnpm run build:tsdown${watch ? ' -- --watch' : ''}`, {- **Page visibility**: The standard `request` method defers wake lock acquisition until the page becomes visible. Use `forceRequest` to bypass this safety check when needed.
- **Page visibility**: The standard `request` method defers wake lock acquisition until the page becomes visible. Use `forceRequest` to bypass this safety check when needed.
| When the task involves... | Read / do this |
out.append('' if (in_code and line.strip() == '') else line)packages/website-astro/.claude/skills/adapt
packages/website-astro/.claude/skills/animate
packages/website-astro/.claude/skills/audit
packages/website-astro/.claude/skills/bolder
packages/website-astro/.claude/skills/clarify
apiKey: 'd70ec992605c0048bc1301c882f4a2ec',
.gitpod.yml
.node-version
const rootDir = path.resolve(__dirname, '../../../')
const apiDir = resolve(__dirname, '../../website-astro/api')
import { createMockMediaMatcher } from '../../.test'import { sleep } from '../../.test/testingHelpers'import { sleep } from '../../.test/testingHelpers'await waitForHealth(`http://127.0.0.1:${PORT}/healthz`)const transport = new StreamableHTTPClientTransport(new URL(`http://127.0.0.1:${PORT}/mcp`))const res = await fetch(`http://127.0.0.1:${PORT}/healthz`)const res = await fetch(`http://127.0.0.1:${PORT}/mcp`)@babel/core, @babel/preset-env, @babel/preset-react, @babel/preset-typescript, @types/fs-extra, @types/node, @types/react, @types/react-dom
@microsoft/fetch-event-source, js-cookie, lodash-es, screenfull, use-sync-external-store, @jsdevtools/version-bump-prompt, @testing-library/dom, @testing-library/react
@modelcontextprotocol/sdk, express, zod, @jsdevtools/version-bump-prompt, @types/express, @types/node, ts-node, tsup
Gates applied: instruction_override, no_behavioural_pass.
f0053623a81cfull audit observations/trust-audit/mcp-server/childrentime__reactuse.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | f0053623a81c | BLOCK | F | 53 | first audit |
Questions
What is the @reactuses/core MCP server?
115+ production-ready React Hooks for sensors, UI, state & browser APIs. Tree-shakable, SSR-safe, TypeScript-first. Used by Shopee, PDD & Ctrip. Inspired by VueUse.
What tools does @reactuses/core expose?
3 in total: 3 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is @reactuses/core safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (53/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does @reactuses/core need?
It reads INDEXNOW_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does @reactuses/core run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as website-astro at 0.0.1.
How current is this page?
The grade is for one exact copy of the source (f0053623a81c), read on 2026-10-12. The repository is watched and re-audited when it changes.