WebPieces TypeScriptBLOCK
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Two things ship from this repository, and the second is the larger one:
- A microservices framework — a TypeScript port of WebPieces,
bringing enterprise-grade microservice patterns to Node.js/TypeScript.
- An organizational engineering practice, and the machine that enforces it — a set of
conventions (feature testing, one API contract, error/context discipline, a gated git workflow) plus a three-stage enforcement layer (edit-time AI hooks, build-time code rules, a PR gate) that makes teams and their AI agents follow them. This layer ships to npm separately and is adoptable without the framework. If you are here to assess scope, that is the product — read docs/ENGINEERING-PRACTICE.md first.
Overview
WebPieces-TS is a TypeScript framework for building testable, maintainable microservices — and, around it, a config-driven practice layer that scales code and process quality across teams. As a framework it provides:
- Auto-wiring REST APIs - Define API interfaces with decorators, automatically wire to controllers
- Filter Chain Architecture - Composable filters for cross-cutting concerns (logging, validation, transactions)
- Context Management - Request-scoped data that flows through async operations
- No-HTTP Testing - Test your APIs without HTTP overhead, going through the full filter stack
- Dependency Injection - Built on Inversify for clean, testable code
Quick Start
Installation
npm install
Run Tests
pnpm exec vitest run # one spec file or directory — what you want while iterating pnpm nx run :test # one project
A bare pnpm test runs every spec in the workspace. That is a once-before-the-PR command, not an inner-loop one, and it is blocked for AI agents (see .claude/rules/build-verification.md).
Build
a7543a41c87aOBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add webpieces-tooling -- npx -y @webpieces/[email protected]
{
"mcpServers": {
"webpieces-tooling": {
"command": "npx",
"args": [
"-y",
"@webpieces/[email protected]"
]
}
}
}Exposed tools (2)
2 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
x-api-key | read | Your partner key. |
x-organization-id | read | The organization the key acts for. |
Trust audit
BLOCKgrade D · trust 61/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | FAIL |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (4 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
agent-payload.ts
['169.254.0.0', 16], // link-local, and with it 169.254.169.254 CLOUD METADATA
'metadata.google.internal',
`169.254.169.254 would hand this process's own service-account tokens to whoever registered ` +
.agents/skills/bootstrap-npm-package
const SECRET = 'SECRET-sdk-foreign-throw-detail';
fixture.write('app', 'config.ts', "export const prepared = { auth: { store: 'database', password: 'never-a-graph-target' } };");.prettierignore
ServiceInfo.setInfo('billing-svc', 'v3.2.1-rc4');expect(RequestContext.buildStructuredLogFields().get('version')).toBe('v3.2.1-rc4');ServiceInfo.setInfo('my-service', 'v3.2.1-rc4');expect(ServiceInfo.getVersion()).toBe('v3.2.1-rc4');ServiceInfo.setInfo('billing-svc', 'v3.2.1-rc4');'cat $HOME/.ssh/id_rsa', // an expansion the pattern refuses to spell
import { ClientServerWiring } from '../../client-server/src/wiring';import { ClientServerWiring } from '../../client-server/src/wiring';} from '../../client-server/src/OrderErrors';
import { ClientServerWiring } from '../../client-server/src/wiring';import { Server2Wiring } from '../../server2/src/wiring';id_rsa ... curl
from the transport and re-judged hop by hop, so a partner URL that 302s at `169.254.169.254` is
['CLOUD METADATA by address', 'https://169.254.169.254'],
baseUrl = `http://127.0.0.1:${(server.address() as AddressInfo).port}`;return 'http://127.0.0.1:' + (this.server.address() as AddressInfo).port;
ClientRegistry.addUrlMapping('controlled', 'http://127.0.0.1');Gates applied: no_behavioural_pass.
a7543a41c87afull audit observations/trust-audit/mcp-server/deanhiller__webpieces-ts.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | a7543a41c87a | BLOCK | D | 61 | first audit |
Questions
What tools does @webpieces/mcp-server expose?
2 in total: 2 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is @webpieces/mcp-server safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (61/100) and found 4 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does @webpieces/mcp-server need?
No credential environment variables were found in its source, so it appears to need none.
How current is this page?
The grade is for one exact copy of the source (a7543a41c87a), read on 2026-10-11. The repository is watched and re-audited when it changes.