Verifiable receipt e117bb2f - provibe_audit result | Zambo

Verifiable receipt for a provibe_audit call on Zambo: {"provibe_score":68,"vibe_verdict":"DECENT","risk_level":"LOW","estimated_fix_time":"36–50 hours","score_b

Observed result

{"provibe_score":68,"vibe_verdict":"DECENT","risk_level":"LOW","estimated_fix_time":"36–50 hours","score_breakdown":{"security":70,"maintainability":60,"deadCode":85,"architecture":80},"summary":"The repo ships with insecure default JWT/ENCRYPTION keys in docker-compose.yml and a flood of \"any\" types, plus it lacks a lock file which makes production builds non‑deterministic despite having a solid test suite.","architecture":"AnythingMCP is a monorepo using Yarn/NPM workspaces with a NestJS backend and a Next.js frontend, both built into a single multi‑stage Docker image. The backend exposes a microservice strategy (MCP) and uses class‑validator, class‑transformer, and OpenTelemetry for observability, while the frontend is a standard Next.js app. Configuration is driven by environment variables validated at startup, and the Dockerfile isolates production dependencies per service. \nHowever, the single‑container approach couples the backend and frontend lifecycles, making independent scaling difficult. The lack of a lock file and the presence of default secrets increase supply‑chain and runtime risk. As the adapter catalog grows, the current global ValidationPipe and single‑process model may become bottlenecks, and the tight coupling of tracing, Sentry, and the Nest app initialization could hinder modular testing and future migration to a truly micro‑service architecture.","findings":[{"severity":"critical","category":"Secrets","title":"Default JWT and ENCRYPTION keys in docker-compose.yml","description":"docker-compose.yml defines JWT_SECRET and ENCRYPTION_KEY with hard‑coded placeholder values (e.g., \"change-me-in-production-min-32-chars\"). If the container is started without overriding these env vars, the application runs with weak, known secrets, allowing attackers to forge JWTs or decrypt data.","file":"docker-compose.yml","suggestedFix":"Remove the default values and require the variables at runtime. Add a validation step in the startup code (e.g., validateRequiredSecretsAtStartup) that throws if JWT_SECRET or ENCRYPTION_KEY are missing or match the placeholder pattern."},{"severity":"high","category":"Maintainability","title":"Excessive use of the 'any' type","description":"The pre‑scan reports 16 occurrences of the TypeScript 'any' type across the codebase (e.g., in utility functions and DTOs). 'any' disables type safety, increasing the risk of runtime errors and making future refactoring painful.","file":"packages/backend/src/**/*.ts (multiple locations)","suggestedFix":"Enable \"noImplicitAny\" and \"strict\" in tsconfig, then replace each 'any' with a concrete interface or generic type. Use utility types like Partial<T> or Record<string, unknown> where appropriate."},{"severity":"medium","category":"Security","title":"Missing package lock file (no package-lock.json)","description":"The repository does not commit a lock file, so npm install can resolve to different versions on each build. This opens the door to supply‑chain attacks and makes reproducing production builds unreliable.","file":"package.json","suggestedFix":"Run 'npm i --package-lock' (or 'npm ci' after generating a lock file) locally, commit the resulting package-lock.json, and add it to version control. Update CI to use 'npm ci' which will now be deterministic."}],"vibe_signals":{"console_logs":0,"todo_comments":0,"ts_ignore_count":0,"any_type_count":16,"suspected_secret_leaks":0,"has_tests":true,"test_file_count":258,"env_file_committed":false,"async_without_try_catch":0,"empty_catch_blocks":0},"repo_meta":{"stars":216,"last_pushed_days_ago":0,"language":"TypeScript","open_issues":21,"is_archived":false,"license":"GNU Affero General Public License v3.0"},"main_language":"TypeScript","file_count":1102,"result_id":"8a05d121-a283-405f-b680-dc6ac1efa0c3","result_url":"https://zambo.dev/provibecode?id=8a05d121-a283-405f-b680-dc6ac1efa0c3","upgrade_note":"Full audit: complete security scan, dead code map, tech debt report, execution plan, export super-prompt — $49 one-time","upgrade_url":"https://zambo.dev/provibecode?id=8a05d121-a283-405f-b680-dc6ac1efa0c3","input_type":"repo_url","badge":{"url":"https://zambo.dev/api/og/badge?score=68","markdown":"[![ProvibeCode Score: 68/100](https://zambo.dev/api/og/badge?score=68)](https://zambo.dev/provibecode)","html":"<a href=\"https://zambo.dev/provibecode\"><img src=\"https://zambo.dev/api/og/badge?score=68\" alt=\"ProvibeCode Score: 68/100\" style=\"height:20px\" /></a>","tip":"Add this badge to your README to show your repo's ProvibeCode score"}}

Provenance for every timeline entry

Private agent reasoning, built-in client actions, and direct calls to unrelated MCP servers are not included unless an agent or gateway reports them.

What is this?

Zambo's receipt store reports a tool call and records its result. The SHA-256 commitment covers the exact canonical bytes. The provenance label is bound to v0.4 receipt bytes when that check passes, but no pinned signature or trusted issuer key is checked. An anchor can timestamp a fingerprint; it does not authenticate the issuer.

What is an execution receipt?

An execution receipt is a public record of a reported AI agent tool call. Its byte commitment and provenance claim can be checked independently; neither alone authenticates the issuer. Read the canonical definition of an AI agent execution receipt.

Keep the work moving

This receipt records a completed tool call. When the free allowance is not enough, choose the access path that fits the job.

UNLOCK 24H DAY PASS ($0.99) →

See all plans on the pricing page →

RUN YOUR OWN FREE CALL →

Or re-run this exact call, using the same tool and arguments.

Share this receipt

Share on X ·

Verification checks

Committed provenance claim

EXECUTED BY ZAMBO

The receipt schema version is missing or unsupported; provenance binding was not accepted.

Receipt ID
e117bb2f-154d-4f80-bfc2-abfacbe0fcd0
SHA-256 output hash
sha256:49fe175f51b5b83f8d09271f208b9c32c5573bf543b4782a60579ecbbfc03d72
Canonical bytes
eyJhcmNoaXRlY3R1cmUiOiJBbnl0aGluZ01DUCBpcyBhIG1vbm9yZXBvIHVzaW5nIFlhcm4vTlBNIHdvcmtzcGFjZXMgd2l0aCBhIE5lc3RKUyBiYWNrZW5kIGFuZCBhIE5leHQuanMgZnJvbnRlbmQsIGJvdGggYnVpbHQgaW50byBhIHNpbmdsZSBtdWx0aeKAkXN0YWdlIERvY2tlciBpbWFnZS4gVGhlIGJhY2tlbmQgZXhwb3NlcyBhIG1pY3Jvc2VydmljZSBzdHJhdGVneSAoTUNQKSBhbmQgdXNlcyBjbGFzc+KAkXZhbGlkYXRvciwgY2xhc3PigJF0cmFuc2Zvcm1lciwgYW5kIE9wZW5UZWxlbWV0cnkgZm9yIG9ic2VydmFiaWxpdHksIHdoaWxlIHRoZSBmcm9udGVuZCBpcyBhIHN0YW5kYXJkIE5leHQuanMgYXBwLiBDb25maWd1cmF0aW9uIGlzIGRyaXZlbiBieSBlbnZpcm9ubWVudCB2YXJpYWJsZXMgdmFsaWRhdGVkIGF0IHN0YXJ0dXAsIGFuZCB0aGUgRG9ja2VyZmlsZSBpc29sYXRlcyBwcm9kdWN0aW9uIGRlcGVuZGVuY2llcyBwZXIgc2VydmljZS4gXG5Ib3dldmVyLCB0aGUgc2luZ2xl4oCRY29udGFpbmVyIGFwcHJvYWNoIGNvdXBsZXMgdGhlIGJhY2tlbmQgYW5kIGZyb250ZW5kIGxpZmVjeWNsZXMsIG1ha2luZyBpbmRlcGVuZGVudCBzY2FsaW5nIGRpZmZpY3VsdC4gVGhlIGxhY2sgb2YgYSBsb2NrIGZpbGUgYW5kIHRoZSBwcmVzZW5jZSBvZiBkZWZhdWx0IHNlY3JldHMgaW5jcmVhc2Ugc3VwcGx54oCRY2hhaW4gYW5kIHJ1bnRpbWUgcmlzay4gQXMgdGhlIGFkYXB0ZXIgY2F0YWxvZyBncm93cywgdGhlIGN1cnJlbnQgZ2xvYmFsIFZhbGlkYXRpb25QaXBlIGFuZCBzaW5nbGXigJFwcm9jZXNzIG1vZGVsIG1heSBiZWNvbWUgYm90dGxlbmVja3MsIGFuZCB0aGUgdGlnaHQgY291cGxpbmcgb2YgdHJhY2luZywgU2VudHJ5LCBhbmQgdGhlIE5lc3QgYXBwIGluaXRpYWxpemF0aW9uIGNvdWxkIGhpbmRlciBtb2R1bGFyIHRlc3RpbmcgYW5kIGZ1dHVyZSBtaWdyYXRpb24gdG8gYSB0cnVseSBtaWNyb+KAkXNlcnZpY2UgYXJjaGl0ZWN0dXJlLiIsImJhZGdlIjp7Imh0bWwiOiI8YSBocmVmPVwiaHR0cHM6Ly96YW1iby5kZXYvcHJvdmliZWNvZGVcIj48aW1nIHNyYz1cImh0dHBzOi8vemFtYm8uZGV2L2FwaS9vZy9iYWRnZT9zY29yZT02OFwiIGFsdD1cIlByb3ZpYmVDb2RlIFNjb3JlOiA2OC8xMDBcIiBzdHlsZT1cImhlaWdodDoyMHB4XCIgLz48L2E+IiwibWFya2Rvd24iOiJbIVtQcm92aWJlQ29kZSBTY29yZTogNjgvMTAwXShodHRwczovL3phbWJvLmRldi9hcGkvb2cvYmFkZ2U/c2NvcmU9NjgpXShodHRwczovL3phbWJvLmRldi9wcm92aWJlY29kZSkiLCJ0aXAiOiJBZGQgdGhpcyBiYWRnZSB0byB5b3VyIFJFQURNRSB0byBzaG93IHlvdXIgcmVwbydzIFByb3ZpYmVDb2RlIHNjb3JlIiwidXJsIjoiaHR0cHM6Ly96YW1iby5kZXYvYXBpL29nL2JhZGdlP3Njb3JlPTY4In0sImVzdGltYXRlZF9maXhfdGltZSI6IjM24oCTNTAgaG91cnMiLCJmaWxlX2NvdW50IjoxMTAyLCJmaW5kaW5ncyI6W3siY2F0ZWdvcnkiOiJTZWNyZXRzIiwiZGVzY3JpcHRpb24iOiJkb2NrZXItY29tcG9zZS55bWwgZGVmaW5lcyBKV1RfU0VDUkVUIGFuZCBFTkNSWVBUSU9OX0tFWSB3aXRoIGhhcmTigJFjb2RlZCBwbGFjZWhvbGRlciB2YWx1ZXMgKGUuZy4sIFwiY2hhbmdlLW1lLWluLXByb2R1Y3Rpb24tbWluLTMyLWNoYXJzXCIpLiBJZiB0aGUgY29udGFpbmVyIGlzIHN0YXJ0ZWQgd2l0aG91dCBvdmVycmlkaW5nIHRoZXNlIGVudiB2YXJzLCB0aGUgYXBwbGljYXRpb24gcnVucyB3aXRoIHdlYWssIGtub3duIHNlY3JldHMsIGFsbG93aW5nIGF0dGFja2VycyB0byBmb3JnZSBKV1RzIG9yIGRlY3J5cHQgZGF0YS4iLCJmaWxlIjoiZG9ja2VyLWNvbXBvc2UueW1sIiwic2V2ZXJpdHkiOiJjcml0aWNhbCIsInN1Z2dlc3RlZEZpeCI6IlJlbW92ZSB0aGUgZGVmYXVsdCB2YWx1ZXMgYW5kIHJlcXVpcmUgdGhlIHZhcmlhYmxlcyBhdCBydW50aW1lLiBBZGQgYSB2YWxpZGF0aW9uIHN0ZXAgaW4gdGhlIHN0YXJ0dXAgY29kZSAoZS5nLiwgdmFsaWRhdGVSZXF1aXJlZFNlY3JldHNBdFN0YXJ0dXApIHRoYXQgdGhyb3dzIGlmIEpXVF9TRUNSRVQgb3IgRU5DUllQVElPTl9LRVkgYXJlIG1pc3Npbmcgb3IgbWF0Y2ggdGhlIHBsYWNlaG9sZGVyIHBhdHRlcm4uIiwidGl0bGUiOiJEZWZhdWx0IEpXVCBhbmQgRU5DUllQVElPTiBrZXlzIGluIGRvY2tlci1jb21wb3NlLnltbCJ9LHsiY2F0ZWdvcnkiOiJNYWludGFpbmFiaWxpdHkiLCJkZXNjcmlwdGlvbiI6IlRoZSBwcmXigJFzY2FuIHJlcG9ydHMgMTYgb2NjdXJyZW5jZXMgb2YgdGhlIFR5cGVTY3JpcHQgJ2FueScgdHlwZSBhY3Jvc3MgdGhlIGNvZGViYXNlIChlLmcuLCBpbiB1dGlsaXR5IGZ1bmN0aW9ucyBhbmQgRFRPcykuICdhbnknIGRpc2FibGVzIHR5cGUgc2FmZXR5LCBpbmNyZWFzaW5nIHRoZSByaXNrIG9mIHJ1bnRpbWUgZXJyb3JzIGFuZCBtYWtpbmcgZnV0dXJlIHJlZmFjdG9yaW5nIHBhaW5mdWwuIiwiZmlsZSI6InBhY2thZ2VzL2JhY2tlbmQvc3JjLyoqLyoudHMgKG11bHRpcGxlIGxvY2F0aW9ucykiLCJzZXZlcml0eSI6ImhpZ2giLCJzdWdnZXN0ZWRGaXgiOiJFbmFibGUgXCJub0ltcGxpY2l0QW55XCIgYW5kIFwic3RyaWN0XCIgaW4gdHNjb25maWcsIHRoZW4gcmVwbGFjZSBlYWNoICdhbnknIHdpdGggYSBjb25jcmV0ZSBpbnRlcmZhY2Ugb3IgZ2VuZXJpYyB0eXBlLiBVc2UgdXRpbGl0eSB0eXBlcyBsaWtlIFBhcnRpYWw8VD4gb3IgUmVjb3JkPHN0cmluZywgdW5rbm93bj4gd2hlcmUgYXBwcm9wcmlhdGUuIiwidGl0bGUiOiJFeGNlc3NpdmUgdXNlIG9mIHRoZSAnYW55JyB0eXBlIn0seyJjYXRlZ29yeSI6IlNlY3VyaXR5IiwiZGVzY3JpcHRpb24iOiJUaGUgcmVwb3NpdG9yeSBkb2VzIG5vdCBjb21taXQgYSBsb2NrIGZpbGUsIHNvIG5wbSBpbnN0YWxsIGNhbiByZXNvbHZlIHRvIGRpZmZlcmVudCB2ZXJzaW9ucyBvbiBlYWNoIGJ1aWxkLiBUaGlzIG9wZW5zIHRoZSBkb29yIHRvIHN1cHBseeKAkWNoYWluIGF0dGFja3MgYW5kIG1ha2VzIHJlcHJvZHVjaW5nIHByb2R1Y3Rpb24gYnVpbGRzIHVucmVsaWFibGUuIiwiZmlsZSI6InBhY2thZ2UuanNvbiIsInNldmVyaXR5IjoibWVkaXVtIiwic3VnZ2VzdGVkRml4IjoiUnVuICducG0gaSAtLXBhY2thZ2UtbG9jaycgKG9yICducG0gY2knIGFmdGVyIGdlbmVyYXRpbmcgYSBsb2NrIGZpbGUpIGxvY2FsbHksIGNvbW1pdCB0aGUgcmVzdWx0aW5nIHBhY2thZ2UtbG9jay5qc29uLCBhbmQgYWRkIGl0IHRvIHZlcnNpb24gY29udHJvbC4gVXBkYXRlIENJIHRvIHVzZSAnbnBtIGNpJyB3aGljaCB3aWxsIG5vdyBiZSBkZXRlcm1pbmlzdGljLiIsInRpdGxlIjoiTWlzc2luZyBwYWNrYWdlIGxvY2sgZmlsZSAobm8gcGFja2FnZS1sb2NrLmpzb24pIn1dLCJpbnB1dF90eXBlIjoicmVwb191cmwiLCJtYWluX2xhbmd1YWdlIjoiVHlwZVNjcmlwdCIsInByb3ZpYmVfc2NvcmUiOjY4LCJyZXBvX21ldGEiOnsiaXNfYXJjaGl2ZWQiOmZhbHNlLCJsYW5ndWFnZSI6IlR5cGVTY3JpcHQiLCJsYXN0X3B1c2hlZF9kYXlzX2FnbyI6MCwibGljZW5zZSI6IkdOVSBBZmZlcm8gR2VuZXJhbCBQdWJsaWMgTGljZW5zZSB2My4wIiwib3Blbl9pc3N1ZXMiOjIxLCJzdGFycyI6MjE2fSwicmVzdWx0X2lkIjoiOGEwNWQxMjEtYTI4My00MDVmLWI2ODAtZGM2YWMxZWZhMGMzIiwicmVzdWx0X3VybCI6Imh0dHBzOi8vemFtYm8uZGV2L3Byb3ZpYmVjb2RlP2lkPThhMDVkMTIxLWEyODMtNDA1Zi1iNjgwLWRjNmFjMWVmYTBjMyIsInJpc2tfbGV2ZWwiOiJMT1ciLCJzY29yZV9icmVha2Rvd24iOnsiYXJjaGl0ZWN0dXJlIjo4MCwiZGVhZENvZGUiOjg1LCJtYWludGFpbmFiaWxpdHkiOjYwLCJzZWN1cml0eSI6NzB9LCJzdW1tYXJ5IjoiVGhlIHJlcG8gc2hpcHMgd2l0aCBpbnNlY3VyZSBkZWZhdWx0IEpXVC9FTkNSWVBUSU9OIGtleXMgaW4gZG9ja2VyLWNvbXBvc2UueW1sIGFuZCBhIGZsb29kIG9mIFwiYW55XCIgdHlwZXMsIHBsdXMgaXQgbGFja3MgYSBsb2NrIGZpbGUgd2hpY2ggbWFrZXMgcHJvZHVjdGlvbiBidWlsZHMgbm9u4oCRZGV0ZXJtaW5pc3RpYyBkZXNwaXRlIGhhdmluZyBhIHNvbGlkIHRlc3Qgc3VpdGUuIiwidXBncmFkZV9ub3RlIjoiRnVsbCBhdWRpdDogY29tcGxldGUgc2VjdXJpdHkgc2NhbiwgZGVhZCBjb2RlIG1hcCwgdGVjaCBkZWJ0IHJlcG9ydCwgZXhlY3V0aW9uIHBsYW4sIGV4cG9ydCBzdXBlci1wcm9tcHQg4oCUICQ0OSBvbmUtdGltZSIsInVwZ3JhZGVfdXJsIjoiaHR0cHM6Ly96YW1iby5kZXYvcHJvdmliZWNvZGU/aWQ9OGEwNWQxMjEtYTI4My00MDVmLWI2ODAtZGM2YWMxZWZhMGMzIiwidmliZV9zaWduYWxzIjp7ImFueV90eXBlX2NvdW50IjoxNiwiYXN5bmNfd2l0aG91dF90cnlfY2F0Y2giOjAsImNvbnNvbGVfbG9ncyI6MCwiZW1wdHlfY2F0Y2hfYmxvY2tzIjowLCJlbnZfZmlsZV9jb21taXR0ZWQiOmZhbHNlLCJoYXNfdGVzdHMiOnRydWUsInN1c3BlY3RlZF9zZWNyZXRfbGVha3MiOjAsInRlc3RfZmlsZV9jb3VudCI6MjU4LCJ0b2RvX2NvbW1lbnRzIjowLCJ0c19pZ25vcmVfY291bnQiOjB9LCJ2aWJlX3ZlcmRpY3QiOiJERUNFTlQifQ==
Timestamp

Bound call context

Receipt schema
0.2
v0.2 receipt; call-context metadata was not recorded.

Bound upstream evidence

Status
captured
Evidence SHA-256
sha256:0219621db17ece2f0e30ec92d09526964bfab2e2892f8a610dc525ac4d6b836b
Byte length
4573

Fetch exact evidence bytes

Neutral Nostr anchor

Event ID
658b484ef459a1fcdb1af93e290e13dc77443ae46300af8e6af69ce2d46eeec5
Anchor status
partial
Public key
e13475107d30c918ec664adf2ab1141024a22fb35190f82c9e933704fa49af41

Relay hints: wss://relay.damus.io · wss://nos.lol · wss://relay.primal.net

Anchor status "partial": Published to some configured relay targets; publication was not confirmed by every configured relay.

Check this hash yourself

Recompute the SHA-256 commitment in your browser. Open the API v2 JSON response to inspect the machine-readable checks. Signature and chain remain NOT CHECKED unless a real signature verifier or chain proof is supplied. There is no combined “verified” verdict. See the Nostr anchor event on a public viewer. The fingerprint is timestamped outside Zambo too.

Embed this receipt

Markdown

[![Verifiable Zambo receipt](https://zambo.dev/api/receipt/e117bb2f-154d-4f80-bfc2-abfacbe0fcd0/badge.svg)](https://zambo.dev/run/e117bb2f-154d-4f80-bfc2-abfacbe0fcd0)

HTML

<a href="https://zambo.dev/run/e117bb2f-154d-4f80-bfc2-abfacbe0fcd0"><img src="https://zambo.dev/api/receipt/e117bb2f-154d-4f80-bfc2-abfacbe0fcd0/badge.svg" alt="Verifiable Zambo receipt"></a>

Open badge SVG

Recent receipts

40,833 verifiable receipts minted

RUN YOUR OWN FREE CALL →

Run your own calls. Free, 20 free calls per metered tool each day, no account.

Open the interactive receipt view