Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

vppillai/kroki-server

https://github.com/vppillai/kroki-server · scanned 2026-06-16 00:52 UTC (2 months, 1 week ago)

57 raw signals (0 security + 57 graph)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 2 months, 1 week ago · v1 · 32 actionable findings from 1 signal source. 25 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON

100.0% cov · 32 findings

Severity distribution — click a segment to filter

Active filters: excluding tests × Reset all

Severity: Critical 0 High 3 Medium 15 Low 9 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 32 Crowd 0 Layer: Hardware 2 Frontend 1 Security 12 Cicd 3 Quality 10 Api 4

Exclude dismissed / FP Exclude test files

All 455 nodes from the latest scan, grouped by kind. Each node is a unit the engine identified (file, function, endpoint, table…). Most users won't need this view — it's primarily for debugging the engine's graph extraction or for AI agents that want to enumerate the project structure.

Label	Layer	Status	Path
`compute_ai_mode`	software	healthy	`demoSite/server.py:121`
`load_available_models`	software	healthy	`demoSite/server.py:175`
`apply_model_allowlist`	software	healthy	`demoSite/server.py:196`
`build_ai_payload`	software	healthy	`demoSite/server.py:242`
`fetch_models_from_proxy`	software	healthy	`demoSite/server.py:277`
`_resolve_startup_model`	software	healthy	`demoSite/server.py:370`
`get_ai_prompts`	software	healthy	`demoSite/server.py:435`
`get_available_models`	software	healthy	`demoSite/server.py:452`
`validate_model`	software	healthy	`demoSite/server.py:481`
`validate_origin`	software	healthy	`demoSite/server.py:524`
`_sign_session`	software	healthy	`demoSite/server.py:545`
`issue_session_token`	software	healthy	`demoSite/server.py:549`
`validate_session_token`	software	healthy	`demoSite/server.py:555`
`authorize_ai_request`	software	healthy	`demoSite/server.py:562`
`ratelimit_handler`	software	healthy	`demoSite/server.py:578`
`_per_ip_limit`	software	healthy	`demoSite/server.py:586`
`ai_assist`	software	healthy	`demoSite/server.py:595`
`generate`	software	healthy	`demoSite/server.py:726`
`get_config`	software	healthy	`demoSite/server.py:804`
`health_check`	software	healthy	`demoSite/server.py:825`
`get_version`	software	healthy	`demoSite/server.py:835`
`_serve_index`	software	healthy	`demoSite/server.py:870`
`index`	software	healthy	`demoSite/server.py:889`
`favicon`	software	healthy	`demoSite/server.py:894`
`static_files`	software	healthy	`demoSite/server.py:904`
`_env`	software	healthy	`demoSite/gunicorn.conf.py:10`
`app`	software	healthy	`demoSite/tests/conftest.py:33`
`client`	software	healthy	`demoSite/tests/conftest.py:41`
`server`	software	healthy	`demoSite/tests/conftest.py:46`
`__init__`	software	healthy	`demoSite/tests/conftest.py:77`
`json`	software	healthy	`demoSite/tests/conftest.py:62`
`iter_lines`	software	healthy	`demoSite/tests/conftest.py:65`
`close`	software	healthy	`demoSite/tests/conftest.py:68`
`upstream`	software	healthy	`demoSite/tests/conftest.py:73`
`fake_post`	software	healthy	`demoSite/tests/conftest.py:83`
`makeStubElement`	software	healthy	`demoSite/tests/disabledDiagramTypes.test.js:makeStubElement`
`under`	software	healthy	`demoSite/tests/disabledDiagramTypes.test.js:under`
`makeSelect`	software	healthy	`demoSite/tests/disabledDiagramTypes.test.js:makeSelect`
`const`	software	healthy	`demoSite/tests/disabledDiagramTypes.test.js:const`
`itself`	software	healthy	`demoSite/tests/disabledDiagramTypes.test.js:itself`
`collectFiles`	software	healthy	`demoSite/tests/liteBuildOutput.test.js:collectFiles`
`ai_body`	software	healthy	`demoSite/tests/test_server.py:9`
`session_cookie`	software	healthy	`demoSite/tests/test_server.py:18`
`post_ai`	software	healthy	`demoSite/tests/test_server.py:26`
`test_index_sets_signed_session_cookie`	software	healthy	`demoSite/tests/test_server.py:40`
`test_index_html_path_sets_session_cookie`	software	healthy	`demoSite/tests/test_server.py:48`
`test_session_cookie_attributes`	software	healthy	`demoSite/tests/test_server.py:58`
`test_tampered_session_token_is_rejected`	software	healthy	`demoSite/tests/test_server.py:66`
`test_ai_assist_requires_origin_header`	software	healthy	`demoSite/tests/test_server.py:77`
`test_ai_assist_rejects_disallowed_origin`	software	healthy	`demoSite/tests/test_server.py:83`

Showing first 50 of this kind. Full payload available via the JSON button at the top of the page.

Label	Layer	Status	Path
`setup-kroki-server.sh`	software	healthy	`setup-kroki-server.sh`
`README.md`	software	healthy	`README.md`
`CONTRIBUTING.md`	software	healthy	`CONTRIBUTING.md`
`LICENSE.md`	software	healthy	`LICENSE.md`
`.env.example`	software	healthy	`.env.example`
`CODE_OF_CONDUCT.md`	software	healthy	`CODE_OF_CONDUCT.md`
`SECURITY.md`	software	healthy	`SECURITY.md`
`docker-compose.yml`	software	healthy	`docker-compose.yml`
`build-kroki-core.sh`	software	healthy	`build-kroki-core.sh`
`docker-compose.acme.yml`	software	healthy	`docker-compose.acme.yml`
`requirements-dev.txt`	software	healthy	`demoSite/requirements-dev.txt`
`ai-models.json`	software	healthy	`demoSite/ai-models.json`
`package.json`	software	healthy	`demoSite/package.json`
`index.html`	software	healthy	`demoSite/index.html`
`Dockerfile`	software	healthy	`demoSite/Dockerfile`
`ai-assistant-spec.md`	software	healthy	`demoSite/ai-assistant-spec.md`
`server.py`	software	healthy	`demoSite/server.py`
`gunicorn.conf.py`	software	healthy	`demoSite/gunicorn.conf.py`
`requirements.txt`	software	healthy	`demoSite/requirements.txt`
`conftest.py`	software	healthy	`demoSite/tests/conftest.py`
`disabledDiagramTypes.test.js`	software	healthy	`demoSite/tests/disabledDiagramTypes.test.js`
`configClone.test.js`	software	healthy	`demoSite/tests/configClone.test.js`
`cspInlineHandlers.test.js`	software	healthy	`demoSite/tests/cspInlineHandlers.test.js`
`aiStream.test.js`	software	healthy	`demoSite/tests/aiStream.test.js`
`liteBuildOutput.test.js`	software	healthy	`demoSite/tests/liteBuildOutput.test.js`
`test_server.py`	software	healthy	`demoSite/tests/test_server.py`
`cspImportmapHash.test.js`	software	healthy	`demoSite/tests/cspImportmapHash.test.js`
`byokKey.test.js`	software	healthy	`demoSite/tests/byokKey.test.js`
`keyboard.test.js`	software	healthy	`demoSite/tests/keyboard.test.js`
`aiResponseParser.test.js`	software	healthy	`demoSite/tests/aiResponseParser.test.js`
`liteHook.test.js`	software	healthy	`demoSite/tests/liteHook.test.js`
`diagramOptions.test.js`	software	healthy	`demoSite/tests/diagramOptions.test.js`
`aiMessages.test.js`	software	healthy	`demoSite/tests/aiMessages.test.js`
`ai-assistant-ui.js`	software	healthy	`demoSite/js/ai-assistant-ui.js`
`config-ui-templates.js`	software	healthy	`demoSite/js/config-ui-templates.js`
`ai-assistant-api.js`	software	healthy	`demoSite/js/ai-assistant-api.js`
`config.js`	software	healthy	`demoSite/js/config.js`
`code-history.js`	software	healthy	`demoSite/js/code-history.js`
`main.js`	software	healthy	`demoSite/js/main.js`
`config-ui.js`	software	healthy	`demoSite/js/config-ui.js`
`config-ui-models.js`	software	healthy	`demoSite/js/config-ui-models.js`
`ai-assistant-prompts.js`	software	healthy	`demoSite/js/ai-assistant-prompts.js`
`ai-assistant.js`	software	healthy	`demoSite/js/ai-assistant.js`
`diagramDownload.js`	software	healthy	`demoSite/js/modules/diagramDownload.js`
`drawioIntegration.js`	software	healthy	`demoSite/js/modules/drawioIntegration.js`
`fullscreen.js`	software	healthy	`demoSite/js/modules/fullscreen.js`
`diagramRenderer.js`	software	healthy	`demoSite/js/modules/diagramRenderer.js`
`diagramOptions.js`	software	healthy	`demoSite/js/modules/diagramOptions.js`
`aiStream.js`	software	healthy	`demoSite/js/modules/aiStream.js`
`diagramApi.js`	software	healthy	`demoSite/js/modules/diagramApi.js`

Showing first 50 of this kind. Full payload available via the JSON button at the top of the page.

Label	Layer	Status	Path
`demoSite`	software	healthy	`demoSite`
`tests`	software	healthy	`demoSite/tests`
`js`	software	healthy	`demoSite/js`
`modules`	software	healthy	`demoSite/js/modules`
`scripts`	software	healthy	`demoSite/scripts`
`css`	software	healthy	`demoSite/css`
`docs`	software	healthy	`docs`
`superpowers`	software	healthy	`docs/superpowers`
`plans`	software	healthy	`docs/superpowers/plans`
`specs`	software	healthy	`docs/superpowers/specs`
`releases`	software	healthy	`docs/releases`
`scripts`	software	healthy	`scripts`
`.github`	software	healthy	`.github`
`ISSUE_TEMPLATE`	software	healthy	`.github/ISSUE_TEMPLATE`
`workflows`	software	healthy	`.github/workflows`

Label	Layer	Status	Path
`lint`	cicd	healthy	`.github/workflows/ci.yml`
`nginx-config`	cicd	healthy	`.github/workflows/ci.yml`
`unit-tests`	cicd	healthy	`.github/workflows/ci.yml`
`test`	cicd	healthy	`.github/workflows/ci.yml`
`demo-site-container`	cicd	healthy	`.github/workflows/ci.yml`
`build`	cicd	healthy	`.github/workflows/build-kroki-core.yml`
`merge`	cicd	healthy	`.github/workflows/build-kroki-core.yml`
`demosite-release`	cicd	healthy	`.github/workflows/release.yml`
`create-release`	cicd	healthy	`.github/workflows/release.yml`
`build`	cicd	healthy	`.github/workflows/pages.yml`
`deploy`	cicd	healthy	`.github/workflows/pages.yml`

Label	Layer	Status	Path
`ANY /api/ai-prompts`	api	healthy	`demoSite/server.py`
`ANY /api/available-models`	api	healthy	`demoSite/server.py`
`ANY /api/validate-model`	api	healthy	`demoSite/server.py`
`ANY /api/ai-assist`	api	healthy	`demoSite/server.py`
`ANY /api/config`	api	healthy	`demoSite/server.py`
`ANY /api/health`	api	healthy	`demoSite/server.py`
`ANY /api/version`	api	healthy	`demoSite/server.py`
`ANY /`	api	healthy	`demoSite/server.py`
`ANY /favicon.ico`	api	healthy	`demoSite/server.py`
`ANY /<path:filename>`	api	healthy	`demoSite/server.py`

Label	Layer	Status	Path
`FakeUpstreamResponse`	software	healthy	`demoSite/tests/conftest.py:50`
`Recorder`	software	healthy	`demoSite/tests/conftest.py:76`
`ConfigManager`	software	healthy	`demoSite/js/config.js:ConfigManager`
`CodeHistory`	software	healthy	`demoSite/js/code-history.js:CodeHistory`
`not`	software	healthy	`demoSite/js/main.js:not`
`ConfigUI`	software	healthy	`demoSite/js/config-ui.js:ConfigUI`
`AIAssistant`	software	healthy	`demoSite/js/ai-assistant.js:AIAssistant`
`DrawioIntegration`	software	healthy	`demoSite/js/modules/drawioIntegration.js:DrawioIntegration`
`AppError`	software	healthy	`demoSite/js/modules/errors.js:AppError`

Label	Layer	Status	Path
`image::demoSite/Dockerfile`	hardware	healthy	`demoSite/Dockerfile`
`core`	hardware	healthy	`docker-compose.yml`
`mermaid`	hardware	healthy	`docker-compose.yml`
`bpmn`	hardware	healthy	`docker-compose.yml`
`excalidraw`	hardware	healthy	`docker-compose.yml`
`diagramsnet`	hardware	healthy	`docker-compose.yml`
`demosite`	hardware	healthy	`docker-compose.yml`
`nginx`	hardware	healthy	`docker-compose.yml`

Label	Layer	Status	Path
`port:80`	network	healthy	`docker-compose.acme.yml`
`port:8080`	network	healthy	`docker-compose.acme.yml`
`port:8006`	network	healthy	`demoSite/Dockerfile`
`port:8443`	network	healthy	`demoSite/tests/liteHook.test.js`
`port:06`	network	healthy	`.github/workflows/build-kroki-core.yml`

Label	Layer	Status	Path
`gha::ci`	cicd	healthy	`.github/workflows/ci.yml`
`gha::build-kroki-core`	cicd	healthy	`.github/workflows/build-kroki-core.yml`
`gha::release`	cicd	healthy	`.github/workflows/release.yml`
`gha::pages`	cicd	healthy	`.github/workflows/pages.yml`

Label	Layer	Status	Path
`vps::hetzner`	hardware	healthy	`README.md`
`vps::aws`	hardware	healthy	`.env.example`
`vps::azure`	hardware	healthy	`demoSite/server.py`

Label	Layer	Status	Path
`GITHUB_TOKEN`	cicd	healthy	`—`
`KROKI_REF`	cicd	healthy	`—`

Label	Layer	Status	Path
`repobility-clone-x_68gfhe`	software	healthy	`/tmp/repobility-clone-x_68gfhe`

Label	Layer	Status	Path
`redis`	data	healthy	`.env.example`

Label	Layer	Status	Path
`127.0.0.1`	network	healthy	`setup-kroki-server.sh`

Label	Layer	Status	Path
`nginx`	network	healthy	`setup-kroki-server.sh`

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.

For AI agents + API integrations

Email me when this repo regresses

Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.

API access

This page is publicly accessible at: https://repobility.com/scan/c37df9ba-92c2-40a1-8a3e-2d6777de0f3c/

To check status programmatically (no auth required):

curl -s https://repobility.com/api/v1/public/scan/c37df9ba-92c2-40a1-8a3e-2d6777de0f3c/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.

vppillai/kroki-server

Complete repo analysis

function 50+

file 50+

directory 15

job 11

endpoint 10

class 9

container 8

port 5

pipeline 4

vps 3

env_var 2

repo 1

database 1

service 1

load_balancer 1