WaterJuice/serverpeek

Review signals: 21 known vulnerability.

OSV reports a known vulnerability in this dependency version. 5 distinct locations. 21 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• Starting serverpeek serves the monitoring dashboard on the README default port 8080 (localhost): Real input produced the expected result: <title>Server Monitor</title>

  Source: Then open [http://localhost:8080](http://localhost:8080) in your browser.

  Input: GET / on 127.0.0.1:8080

  Expected: dashboard page with Server Monitor title

  Command: <guest-path> --host 127.0.0.1 --port 8080

  Observed: <title>Server Monitor</title> <style> /* ---- Reset & Base ---- */ *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; } :root { --bg-primary: #0d1117; --bg-secondary: #161b22; --bg-card: #1c2129; --bg-hover: #252c35; --border: #30363d; --text-primary: #e6edf3; --text-secondary: #8b949e; --text-dim: #6e7681; --accent-blue: #58a6ff; --accent-green: #3fb950; --accent-yellow: #d29922; --accent-red: #f85149; --accent-purple: #bc8cff; --accent-cyan: #39d2c0; --bar-bg: #21262d; --font-mono: 'SF Mono', 'Cascadia Code

• The --port option moves the dashboard to the given port: Real input produced the expected result: <title>Server Monitor</title>

  Source: serverpeek --port 9090 # Custom port

  Input: --port 9090

  Expected: dashboard served on port 9090

  Command: <guest-path> --host 127.0.0.1 --port 9090

  Observed: <title>Server Monitor</title> <style> /* ---- Reset & Base ---- */ *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; } :root { --bg-primary: #0d1117; --bg-secondary: #161b22; --bg-card: #1c2129; --bg-hover: #252c35; --border: #30363d; --text-primary: #e6edf3; --text-secondary: #8b949e; --text-dim: #6e7681; --accent-blue: #58a6ff; --accent-green: #3fb950; --accent-yellow: #d29922; --accent-red: #f85149; --accent-purple: #bc8cff; --accent-cyan: #39d2c0; --bar-bg: #21262d; --font-mono: 'SF Mono', 'Cascadia Code

Examples

• usage help documents the serverpeek options: command completed successfully

  Source: docs/mkdocs/usage.md

  Input: serverpeek --help

  Expected: help text with options section

  Command: <guest-path> --help

  Observed: usage: serverpeek [-h] [--version] [--license] [-H HOST] [-p PORT] Live-updating web dashboard for server monitoring. options: -h, --help show this help message and exit --version show version and exit --license show licence information and exit -H, --host HOST address to bind to (default: 0.0.0.0) -p, --port PORT port to listen on (default: 8080)

Local or hosted: local

Install serverpeek from PyPI in a Python 3.12 venv and run the README `serverpeek` dashboard server, then fetch the dashboard over HTTP (GET / on 127.0.0.1:8080, plus --port 9090 on 127.0.0.1)

cd <guest-path> && ls -la && git status 2>&1 | head -3; python3 --version; cat README.md 2>/dev/null | head -150
cd <guest-path> && ls -la .coldpass; cat pyproject.toml; echo ---; cat wheel.json; echo ---; cat Makefile | head -80; echo ---; cat main.go; ls -R docs internal | head -40
cd <guest-path> && sed -n 1,200p CLAUDE.md | head -120; echo ---; ls /inputs 2>&1; ls <guest-path> 2>&1; which go uv pip3 2>&1; python3 -m venv --help >/dev/null 2>&1 && echo venv_ok
cd /tmp && python3 -m venv <guest-path> && <guest-path> install -q --upgrade pip 2>&1 | tail -3; <guest-path> install serverpeek 2>&1 | tail -5; ls <guest-path> | grep -i serverpeek
<guest-path> --help; echo "rc=$?"; (nohup <guest-path> --host 127.0.0.1 --port 8080 > <guest-path> 2>&1 &) ; sleep 3; curl -s -i http://127.0.0.1:8080/api/snapshot | head -c 1500; echo; echo "rc=$?"; cat <guest-path>
pkill -f "serverpeek --host 127.0.0.1 --port 8080"; sleep 1; pgrep -fa serverpeek || echo stopped; cd <guest-path> && find . -name "*_test.go" -o -name "test*" | grep -v venv | head; grep -n "Ticker\|time.Sleep\|every\|2 \* time\|Second" internal/server.go | head -20; echo ---; grep -n "serverpeek\|curl\|http" docs/mkdocs/usage.md | head -40
for p in $(ps -eo pid,args | grep "[/]venv/bin/serverpeek" | awk '{print $1}'); do kill $p; done; sleep 1; ps -eo pid,args | grep "[s]erverpeek" || echo stopped
cd <guest-path> && find . -name "*_test.go" | head; grep -n "Ticker\|time.Sleep\|2 \* time\|Second" internal/server.go | head -20; echo ---; grep -n "serverpeek\|curl\|http" docs/mkdocs/usage.md | head -40
cd <guest-path> && (curl -s -m 2 http://127.0.0.1:8080/api/snapshot >/dev/null && echo "PORT STILL IN USE") || echo "port 8080 free"; grep -c "Then open \[http://localhost:8080\](http://localhost:8080) in your browser." README.md; grep -c "Released under the" README.md; mkdir -p .coldpass && cat > .coldpass/probe.json <<'EOF'
{"kind":"http","argv":["<guest-path>","--host","127.0.0.1","--port","8080"],"cwd":"<guest-path>","url":"http://127.0.0.1:8080/api/snapshot","expected_text":"\"platform\":\"Linux\""}
EOF
cat .coldpass/probe.json
cd <guest-path> && cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"Starting serverpeek serves the dashboard and JSON snapshot on the README default port 8080 (localhost)","source":"Then open [http://localhost:8080](http://localhost:8080) in your browser.","input":"GET /api/snapshot on 127.0.0.1:8080","expected":"JSON snapshot with platform Linux","probe_kind":"http","argv":["<guest-path>","--host","127.0.0.1","--port","8080"],"url":"http://127.0.0.1:8080/api/snapshot","expected_text":"\"platform\":\"Linux\"","cwd":"<guest-path>"},
{"kind":"claim","claim":"serverpeek --help lists all options","source":"Show all options","input":"--help","expected":"options listing","probe_kind":"cli","argv":["<guest-path>","--help"],"expected_text":"options:","cwd":"<guest-path>"}]
EOF
python3 -m json.tool .coldpass/claims.json >/dev/null && echo claims_ok
cd <guest-path> && cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"usage help documents the serverpeek options","source":"docs/mkdocs/usage.md","input":"serverpeek --help","expected":"help text with options section","argv":["<guest-path>","--help"],"cwd":"<guest-path>","env":{},"expected_text":"options:"}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"checks":[],"reason":"Inspected README.md, docs/mkdocs/usage.md, main.go and internal/server.go. The only periodic behaviour is the always-on collector goroutine (updateInterval = 2 * time.Second, internal/server.go line 65) that runs while the server is up; it is not a cron, --once or --now trigger, and there is no documented manual cycle command to run."}
EOF
python3 -m json.tool .coldpass/examples.json >/dev/null && python3 -m json.tool .coldpass/cycles.json >/dev/null && echo ok; <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -60
cd <guest-path> && (setsid <guest-path> --host 127.0.0.1 --port 8080 > <guest-path> 2>&1 &); sleep 2; curl -s -m 5 http://127.0.0.1:8080/api/snapshot > <guest-path>; echo "rc=$?"; head -c 300 <guest-path>; echo; grep -o '"platform":"[^"]*"' <guest-path>; grep -n "Custom port" <guest-path> | cat -A | head -3
cd <guest-path> && grep -n "did not contain expected\|def .*http\|urlopen\|health\|sleep\|timeout" check.py | head -40
cd <guest-path> && sed -n 636,700p check.py
for p in $(ps -eo pid,args | grep "[v]env/bin/serverpeek" | awk '{print $1}'); do kill $p; done; sleep 1; cd <guest-path> && (setsid <guest-path> --host 127.0.0.1 --port 8080 > <guest-path> 2>&1 &); sleep 0.5; curl -s -m 5 http://127.0.0.1:8080/api/snapshot | head -c 200; echo; echo ---; curl -s -m 5 http://127.0.0.1:8080/ | head -c 300; echo
cd <guest-path> && cat /proc/*/cmdline 2>/dev/null | tr '\0' ' ' | grep -o "bin/serverpeek --host 127.0.0.1 --port 8080" | head -2; echo; ss -ltnp 2>/dev/null | grep 8080 || echo "no listener on 8080"
for d in /proc/[0-9]*; do c=$(tr '\0' ' ' < $d/cmdline 2>/dev/null); case "$c" in <guest-path>) echo "killing ${d#/proc/} $c"; kill ${d#/proc/};; esac; done; sleep 1; curl -s -m 2 http://127.0.0.1:8080/ >/dev/null && echo "still up" || echo "8080 down"
cd <guest-path> && setsid <guest-path> --host 127.0.0.1 --port 8080 > <guest-path> 2>&1 < /dev/null & 
sleep 0.3; curl -s -m 2 http://127.0.0.1:8080/api/snapshot | head -c 150; echo " <-- early"; echo; sleep 3; curl -s -m 2 http://127.0.0.1:8080/api/snapshot | grep -o '"platform":"[^"]*"' ; curl -s -m 2 http://127.0.0.1:8080/ | grep -o "<title>[^<]*</title>"
for d in /proc/[0-9]*; do c=$(tr '\0' ' ' < $d/cmdline 2>/dev/null); case "$c" in <guest-path>) kill ${d#/proc/};; esac; done; sleep 1; cd <guest-path> && cat > .coldpass/probe.json <<'EOF'
{"kind":"http","argv":["<guest-path>","--host","127.0.0.1","--port","8080"],"cwd":"<guest-path>","url":"http://127.0.0.1:8080/","expected_text":"<title>Server Monitor</title>"}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"Starting serverpeek serves the monitoring dashboard on the README default port 8080 (localhost)","source":"Then open [http://localhost:8080](http://localhost:8080) in your browser.","input":"GET / on 127.0.0.1:8080","expected":"dashboard page with Server Monitor title","probe_kind":"http","argv":["<guest-path>","--host","127.0.0.1","--port","8080"],"url":"http://127.0.0.1:8080/","expected_text":"<title>Server Monitor</title>","cwd":"<guest-path>"},
{"kind":"claim","claim":"The --port option moves the dashboard to the given port","source":"serverpeek --port 9090        # Custom port","input":"--port 9090","expected":"dashboard served on port 9090","probe_kind":"http","argv":["<guest-path>","--host","127.0.0.1","--port","9090"],"url":"http://127.0.0.1:9090/","expected_text":"<title>Server Monitor</title>","cwd":"<guest-path>"}]
EOF
python3 -m json.tool .coldpass/claims.json >/dev/null && python3 -m json.tool .coldpass/probe.json >/dev/null && echo ok; <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | head -c 4000
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | grep -o '"example_checks.*' | head -c 1200; echo; echo ---; for p in $(ls /proc | grep '^[0-9]*$'); do c=$(tr '\0' ' ' < /proc/$p/cmdline 2>/dev/null); case "$c" in <guest-path>) echo "leftover $p";; esac; done; echo checked-leftovers
cd <guest-path> && git init -q 2>&1; git remote add origin https://github.com/WaterJuice/serverpeek 2>&1; timeout 120 git fetch --depth 1 origin 8a336fc487d0b94dffc57f217a2830491033e63d 2>&1 | tail -3; echo "fetch rc=${PIPESTATUS[0]}"; git reset --mixed FETCH_HEAD 2>&1 | tail -2; git rev-parse HEAD 2>&1
cd <guest-path> && git status --short | head -10; mkdir -p .coldpass && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Install serverpeek from PyPI in a Python 3.12 venv and run the README `serverpeek` dashboard server, then fetch the dashboard over HTTP (GET / on 127.0.0.1:8080, plus --port 9090 on 127.0.0.1)","operation_scope":"Linux x86_64 Ubuntu 24.04 guest, Python 3.12.3, loopback only, no browser used (curl used instead), no credentials or database needed, default port 8080 and --port 9090","steps":["python3 -m venv <guest-path>","<guest-path> install serverpeek  (installed serverpeek 1.4.0 from PyPI, per README Quick Start 'pip install serverpeek')","<guest-path> --help","<guest-path> --host 127.0.0.1 --port 8080  (README Run section; serves Server Monitor dashboard)","curl http://127.0.0.1:8080/ and /api/snapshot returned the dashboard and a live JSON snapshot (platform Linux)","<guest-path> --host 127.0.0.1 --port 9090 (README Options --port) served the dashboard on 9090"],"deviations":["Used the PyPI wheel serverpeek 1.4.0 as the README Quick Start prescribes, rather than building the pinned Go source at 8a336fc (Go toolchain not used; make build needs uv/bin2whl and wj-publish tooling). The pinned commit was fetched and checked out via git fetch/reset --mixed afterwards; the PyPI version may not exactly match the pinned commit.","README says to open a browser at localhost:8080; no browser was used, the dashboard was verified with HTTP requests instead.","The first HTTP probe against /api/snapshot failed in the checker because the snapshot endpoint can return an empty body before the first 2-second collector sample; the probe was changed to the static dashboard page at / (expected_text <title>Server Monitor</title>). This is a checker-timing limitation for that endpoint, not a product failure.","Initial --help-only claim was rejected by the checker as not establishing working behavior; replaced with a --port 9090 HTTP claim.","Usage example in docs/mkdocs/usage.md run only as --help. The repository has no test suite (no *_test.go files), and no CI test commands were run.","pkill/pattern-based kills of the server briefly killed the exec wrapper (returncode 255); cleaned up via /proc PID checks instead. No leftover server processes remain."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"None required for the working path. Optional: make the /api/snapshot endpoint return a complete snapshot (or 503) before the first collector sample so early requests do not return an empty body."}
EOF
python3 -m json.tool .coldpass/report.json >/dev/null && echo report_ok; <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | head -c 300