pvharmo2/gha-lab-7927d7d06fSecurity-research lab reproducing CVE-2026-22869 (pwn) — arbitrary code execution in privileged pull_request_target run via npx local-bin hijack, snapshot of eigent-ai/eigent @ 2a406536
server/ provides a local backend (FastAPI + PostgreSQL) to achieve complete separation between local and cloud environments. After deploying this service, sensitive data such as user registration, model provider configurations, tool settings, and chat history are stored on your machine and are not uploaded to our cloud unless you explicitly configure external services (e.g., cloud model providers or remote MCP servers).
POST /register: Email + password registration (local DB only)POST /login: Email + password login; returns a locally issued tokenGET/PUT /user, /user/profile, /user/privacy, /user/current_credits, /user/stat, etc.GET /providers, POST /provider, PUT /provider/{id}, DELETE /provider/{id}POST /provider/prefer: Set a preferred provider (frontend/backend will prioritize it)GET /configs, POST /configs, PUT /configs/{id}, DELETE /configs/{id}, GET /config/infoapp/controller/chat/, all persisted to local DBGET /mcps, POST /mcp/install, POST /mcp/import/{Local|Remote}, etc.Note: All the above data is stored in the local PostgreSQL volume in Docker (see “Data Persistence” below). If you configure external models or remote MCP, requests go to the third-party services you specify.
Prerequisite: Docker Desktop installed.
cd server
# Copy .env.example to .env(or create .env according to .env.example)
cp .env.example .env
docker compose up -d
.env.development to enable local mode and point to the local backend:VITE_BASE_URL=/api
VITE_USE_LOCAL_PROXY=true
VITE_PROXY_URL=http://localhost:3001
npm install
npm run dev
http://localhost:3001/docs (Swagger UI)3001 → Container 56785432 → Container 5432server_postgres_data at /var/lib/postgresql/data inside the containerstart.sh → alembic upgrade head)# List running containers
docker ps
# Stop/Start API container (keep DB)
docker stop eigent_api
docker start eigent_api
# Stop/Start all (API + DB)
docker compose stop
docker compose start
# View logs
docker logs -f eigent_api | cat
docker logs -f eigent_postgres | cat
You can run the API locally with hot-reload while keeping the database in Docker:
# Stop API in container, keep DB
docker stop eigent_api
# Run locally (provide DB connection string)
cd server
export database_url=postgresql://postgres:123456@localhost:5432/eigent
uv run uvicorn main:api --reload --port 3001 --host 0.0.0.0
http://localhost:3001/docs/app/runtime/log/app.log in the containeruv run pybabel extract -F babel.cfg -o messages.pot .
uv run pybabel init -i messages.pot -d lang -l zh_CN
uv run pybabel compile -d lang -l zh_CN
For a fully offline environment, only use local models and local MCP servers, and avoid configuring any external Providers or remote MCP addresses.