Genkit

Overview

From the repository's own README, as read at the audited commit.

![Genkit logo](docs/resources/genkit-logo-dark.png#gh-dark-mode-only 'Genkit')![Genkit logo](docs/resources/genkit-logo.png#gh-light-mode-only 'Genkit')[Genkit](https://genkit.dev) is an open-source framework for building full-stack AI-powered applications, built and used in production by Google's Firebase. It provides SDKs for multiple programming languages with varying levels of stability:- **JavaScript/TypeScript**: Production-ready with full feature support- **Go**: Production-ready with full feature support- **Python (Beta)**: Wide feature support approaching production-readiness- **Dart (Preview)**: Early development with core functionalityIt offers a unified interface for integrating AI models from providers like [Google](https://genkit.dev/docs/plugins/google-genai), [OpenAI](https://genkit.dev/docs/plugins/openai), [Anthropic](https://thefireco.github.io/genkit-plugins/docs/plugins/genkitx-anthropic), [Ollama](https://genkit.dev/docs/plugins/ollama/), and more. Rapidly build and deploy production-ready chatbots, automations, and recommendation systems using streamlined APIs for multimodal content, structured outputs, tool calling, and agentic workflows.Get started with just a few lines of code:```tsimport { genkit } from 'genkit';import { googleAI } from '@genkit-ai/google-genai';const ai = genkit({ plugins: [googleAI()] });const { text } = await ai.generate({    model: googleAI.model('gemini-flash-latest'),    prompt: 'What is the meaning of life?'});```## Explore & build with GenkitPlay with AI sample apps, with visualizations of the Genkit code that powersthem, at no cost to you.[Explore Genkit by Example](https://examples.genkit.dev)## Key capabilities<table>  <tr>    <td><strong>Broad AI model support</strong></td>    <td>Use a unified interface to integrate with hundreds of models from providers like <a href="https://genkit.dev/docs/plugins/google-genai">Google</a>, <a href="https://genkit.dev/docs/plugins/openai">    OpenAI</a>, <a href="https://thef

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude mcp add test_js_app --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env CUSTOM_KEY=${CUSTOM_KEY} --env DB_PASSWORD=${DB_PASSWORD} --env DEEPSEEK_API_KEY=${DEEPSEEK_API_KEY} -- npx -y [email protected]

{
  "mcpServers": {
    "test_js_app": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
        "CUSTOM_KEY": "${CUSTOM_KEY}",
        "DB_PASSWORD": "${DB_PASSWORD}",
        "DEEPSEEK_API_KEY": "${DEEPSEEK_API_KEY}"
      }
    }
  }
}

Exposed tools (150) 135 read · 14 write · 1 destructive

Blast radius: 1 tool can delete or overwrite. An agent that can be talked into calling a tool can be talked into calling this one.

Details

Source

firebase/genkit

npm

test_js_app@1.0.0

PyPI

smoke

Transports

sse · stdio · streamable-http

Credentials it reads

ANTHROPIC_API_KEYCUSTOM_KEYDB_PASSWORDDEEPSEEK_API_KEYDJANGO_SECRET_KEYGEMINI_API_KEYGOOGLE_API_KEYGOOGLE_GENAI_API_KEYOPENAI_API_KEYPINECONE_API_KEYVERTEX_API_KEYXAI_API_KEY

License

Apache-2.0

Stars

6,449 · pushed 0d ago

Trust audit

Do not install this without reading the findings. The audit found something that could harm you or your machine.

What the source does

Filesystem

declared (3 observation(s))

Network

declared (6 observation(s))

Shell

declared (4 observation(s))

Dependencies

not all pinned

Secrets in source

found

Findings (25)

const importModule = new Function(

'AWS_DEFAULT_REGION, or a region in ~/.aws/config'

prompt injection, jailbreak attempts, and sensitive data before sending

| Content Filtering | `modelArmorFlow` | Generation with Model Armor middleware for PI/jailbreak and SDP filters |

- Error details include the specific filter that triggered (PI/jailbreak, SDP)

'iVBORw0KGgoAAAANSUhEUgAAByIAAAGdCAYAAABel7RVAAAACXBIWXMAAAsTAAALEwEAmpwYAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAADv9SURBVHgB7d1bchPn9jfgF58qdx97BH9xquIuMIKYEQRGgBkBZgSYEQAjwIwAMgKcEcS5SxXY1h7BZt+lbGy

url: 'data:image/jpeg;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAIAAACQkWg2AAABhGlDQ1BJQ0MgcHJvZmlsZQAAKJF9kT1Iw0AcxV9TpSoVETOIOGSoulgQFXHUKhShQqgVWnUwufRDaNKQtLg4Cq4FBz8Wqw4uzro6uAqC4AeIs4OToouU+L+k0CL

APIKey: "your-express-mode-api-key", // Optional: defaults to VERTEX_API_KEY, GOOGLE_API_KEY, or GOOGLE_GENAI_API_KEY

apiKey: 'test-express-api-key',

apiKey: 'test-express-api-key',

private_key: '-----BEGIN PRIVATE KEY-----',

private_key: '-----BEGIN PRIVATE KEY-----',

private_key: '-----BEGIN PRIVATE KEY-----',

private_key: '-----BEGIN PRIVATE KEY-----',

removeTask

.prettierignore

.prettierrc.yaml

.pysentry.toml

importlib.import_module(mod)

importlib.import_module(mod)

return getattr(importlib.import_module(module), name)

exec(compile(SHIM_SETUP.read_text(), str(SHIM_SETUP), 'exec'), {'__name__': '__main__'})  # noqa: S102

if ! gen_output=$(go run ../internal/cmd/jsonschemagen -outdir .. -config schemas.config ../../genkit-tools/genkit-schema.json ai 2>&1); then

echo "::error::cd go/core && go run ../internal/cmd/jsonschemagen -outdir .. -config schemas.config ../../genkit-tools/genkit-schema.json ai"

import { evalFlow } from '../../src/commands/eval-flow';

Gates applied: instruction_override, no_behavioural_pass.

Audited 2026-09-18 · audit v0.4.0 · source sha 825559c40957 · full audit: observations/trust-audit/mcp-server/firebase__genkit.json · Report an issue or request a re-scan

Audit history

Alternatives

Other servers in the same categories, safer ones first.

Questions