w3bs.AccountStart building
PACKAGES / Profullstack

opencontext

Reference implementation of the LogicSRC OpenContext standard for portable, permissioned agent context.

ThreatCrush · No malware found
INSTALLw3bs install logicsrc.com/opencontext

No w3bs yet? curl -fsSL https://w3bs.org/install.sh | sh

Get started

What to type once it is installed.

  1. w3bs install logicsrc.com/opencontextInstall opencontext and track it for updates
  2. opencontext init <dir>Create a context project that validates out of the box
  3. opencontext validate --strictCheck schemas, references and permissions
  4. opencontext doctorReport context health and a score, flagging stale items
  5. opencontext resolve --role <role> --task "<task>" --explainShow the context a role gets for a task, and why

Every option: opencontext --help · docs ↗

Malware scan

ThreatCrush found no malware indicators in opencontext 0.16.0. The other findings below are ordinary code-review notes, not malware.

Scanned
2026-11-02 22:59 UTC · threatcrush 0.13.30
Files
1247 (installer + github.com/profullstack/logicsrc@fd0a6047e3a4)
Findings
4 critical · 2 high · 29 medium · 32 low
67 other findings (not malware)
  • critical
    Private Keysource/apps/pwa/src/routes/keyring.mjs:32secret-private-key · CWE-798
  • critical
    Private Keysource/packages/cli/src/keyring.ts:83secret-private-key · CWE-798
  • critical
    Private Keysource/packages/logicsrc-mcp/src/keyring.ts:20secret-private-key · CWE-798
  • critical
    Private Keysource/plugins/credential-sharing/src/providers/ssh.ts:129secret-private-key · CWE-798
  • high
    URL built from the Host headersource/apps/commandboard-web/server.js:27js-host-header-trust · CWE-346
  • high
    outbound request to a non-constant URLsource/apps/pwa/public/sw.js:45js-ssrf-outbound-request · CWE-918
  • medium
    unescaped HTML renderingsource/apps/commandboard-web/src/main.ts:19js-unescaped-html-sink · CWE-79
  • medium
    network output piped into a shellsource/apps/logicsrc-web/public/install.sh:71sh-remote-script-execution · CWE-494
  • medium
    unescaped HTML renderingsource/apps/logicsrc-web/src/app/[[...slug]]/page.tsx:59js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/logicsrc-web/src/app/layout.tsx:80js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/logicsrc-web/src/app/pricing/page.tsx:42js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/logicsrc-web/src/components/breadcrumbs.tsx:43js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/logicsrc-web/src/components/pit-footer.tsx:16js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/logicsrc-web/src/components/site-shell.tsx:36js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/pwa/public/keyring.js:51js-unescaped-html-sink · CWE-79
  • medium
    SQL built from a template literal or f-stringsource/apps/pwa/src/routes/rotation.mjs:79sql-template-interpolation · CWE-89
  • medium
    regex with nested unbounded quantifierssource/packages/cli/src/rotation-catalog.ts:253redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/packages/cli/src/rotation-catalog.ts:297redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/packages/cli/src/rotation-catalog.ts:299redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/packages/cli/src/rotation-catalog.ts:303redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/packages/cli/src/rotation-catalog.ts:307redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/packages/cli/src/rotation-catalog.ts:326redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/packages/cli/src/rotation-catalog.ts:327redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/packages/cli/src/rotation-catalog.ts:329redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/packages/cli/src/rotation-catalog.ts:330redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/packages/cli/src/rotation-catalog.ts:331redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/packages/cli/src/rotation-catalog.ts:334redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/packages/cli/src/rotation-catalog.ts:395redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/packages/cli/src/rotation-catalog.ts:402redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/packages/cli/src/rotation-catalog.ts:408redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/packages/opencontext/src/ids.ts:10redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/packages/opencontext/src/ids.ts:11redos-nested-quantifier · CWE-1333
  • medium
    MAC or signature compared with ==source/packages/opencontext/src/validate.ts:208js-timing-unsafe-mac-compare · CWE-208
  • medium
    regex with nested unbounded quantifierssource/packages/openerrand/src/browser.ts:34redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/packages/openontology/src/ids.ts:20redos-nested-quantifier · CWE-1333
  • low
    Hardcoded Credentialsource/apps/pwa/test/appbar.test.mjs:10secret-generic-credential · CWE-798
  • low
    Private Keysource/apps/pwa/test/keyring.test.mjs:137secret-private-key · CWE-798
  • low
    Hardcoded Credentialsource/apps/pwa/test/signup-profile.test.mjs:61secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/apps/pwa/test/signup-profile.test.mjs:72secret-generic-credential · CWE-798
  • low
    OpenAI API Keysource/packages/cli/src/desktop-flow.test.ts:315secret-openai-key · CWE-798
  • low
    Generic API Keysource/packages/cli/src/desktop-flow.test.ts:315secret-generic-api-key · CWE-798
  • low
    Private Keysource/packages/cli/src/keyring.test.ts:86secret-private-key · CWE-798
  • low
    Private Keysource/packages/cli/src/keyring.test.ts:88secret-private-key · CWE-798
  • low
    Private Keysource/packages/cli/src/rotate-flow.test.ts:125secret-private-key · CWE-798
  • low
    Generic API Keysource/packages/cli/src/rotate-flow.test.ts:177secret-generic-api-key · CWE-798
  • low
    Hardcoded Credentialsource/packages/cli/src/rotate-flow.test.ts:184secret-generic-credential · CWE-798
  • low
    Generic API Keysource/packages/cli/src/rotate-flow.test.ts:198secret-generic-api-key · CWE-798
  • low
    Hardcoded Credentialsource/packages/cli/src/rotate-flow.test.ts:204secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/packages/cli/src/rotators.test.ts:52secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/packages/cli/src/rotators.test.ts:75secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/packages/cli/src/rotators.test.ts:135secret-generic-credential · CWE-798
  • low
    hardcoded key materialsource/packages/cli/src/rotators.test.ts:222js-hardcoded-crypto-key · CWE-321
  • low
    Database URL with credentialssource/packages/cli/src/rotators.test.ts:258secret-database-url · CWE-798
  • low
    Database URL with credentialssource/packages/cli/src/vault-clean.test.ts:10secret-database-url · CWE-798
  • low
    Private Keysource/packages/logicsrc-mcp/src/keyring.test.ts:41secret-private-key · CWE-798
  • low
    Private Keysource/packages/logicsrc-mcp/src/keyring.test.ts:44secret-private-key · CWE-798
  • low
    AWS Access Keysource/packages/opencontext/src/permissions.test.ts:260secret-aws-access-key · CWE-798
  • low
    Private Keysource/packages/opencontext/src/permissions.test.ts:261secret-private-key · CWE-798
  • low
    Stripe Keysource/packages/opencontext/src/permissions.test.ts:262secret-stripe-key · CWE-798
  • low
    AWS Access Keysource/packages/opencontext/src/security.test.ts:228secret-aws-access-key · CWE-798
  • low
    Database URL with credentialssource/packages/opencreds/src/categories.test.ts:98secret-database-url · CWE-798
  • low
    Database URL with credentialssource/packages/opencreds/src/categories.test.ts:103secret-database-url · CWE-798
  • low
    Hardcoded Credentialsource/packages/opencreds/src/import-router.test.ts:121secret-generic-credential · CWE-798
  • low
    Private Keysource/plugins/credential-sharing/src/providers/ssh.test.ts:7secret-private-key · CWE-798
  • low
    Database URL with credentialssource/plugins/credential-sharing/src/rekey.test.ts:33secret-database-url · CWE-798
  • low
    OpenAI API Keysource/plugins/credential-sharing/src/vault-encryption.test.ts:21secret-openai-key · CWE-798
  • low
    Hardcoded Credentialsource/plugins/credential-sharing/src/vault-encryption.test.ts:21secret-generic-credential · CWE-798

Badge for your README

ThreatCrush: No malware found

[![ThreatCrush scan](https://w3bs.org/api/packages/logicsrc.com/opencontext/badge.svg)](https://w3bs.org/packages/logicsrc.com/opencontext)