ServerFS_MCP

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files.

  PERMISSION_DELETE_FILES

  agent_bridge/scripts/claude_live_smoke.py, line 311

  shutil.rmtree(smoke_dir, ignore_errors=True)

  agent_bridge/scripts/claude_live_smoke.py, line 312

  shutil.rmtree(temp_root, ignore_errors=True)

  agent_bridge/scripts/codex_live_smoke.py, line 244

  shutil.rmtree(smoke_dir, ignore_errors=True)

  Show more

  agent_bridge/scripts/codex_live_smoke.py, line 245

  shutil.rmtree(temp_root, ignore_errors=True)

  agent_bridge/scripts/qoder_live_smoke.py, line 342

  shutil.rmtree(smoke_dir, ignore_errors=True)

  agent_bridge/scripts/qoder_live_smoke.py, line 343

  shutil.rmtree(temp_root, ignore_errors=True)

  deployment/agent-bridge/measure_peercred.py, line 120

  shutil.rmtree(directory, ignore_errors=True)

  deployment/native/proxy_acceptance_harness.py, line 269

  # Popen + full-tree kill: subprocess.run's timeout would orphan the

  deployment/native/proxy_acceptance_harness.py, line 272

  process = subprocess.Popen(

  deployment/native/proxy_acceptance_harness.py, line 284

  subprocess.run(

  deployment/native/proxy_acceptance_harness.py, line 314

  completed = subprocess.run(

  deployment/native/proxy_acceptance_harness.py, line 363

  process = subprocess.Popen(

  deployment/native/proxy_acceptance_harness.py, line 374

  subprocess.run(

  deployment/native/proxy_acceptance_harness.py, line 397

  subprocess.run(

  deployment/native/proxy_acceptance_harness.py, line 669

  completed = subprocess.run(

  src/serverfs_mcp/darwin_service.py, line 268

  shutil.rmtree(build_root)

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Concern

  can reach a host that is not written as a fixed address.

  NETWORK_NO_FIXED_HOST

  deployment/native/proxy_acceptance_harness.py, line 145

  upstream = socket.create_connection((host, int(port)), timeout=5)

  src/serverfs_mcp/agent_doctor.py, line 111

  with socket.create_connection((host, port), timeout=timeout):

  src/serverfs_mcp/auth_clients.py, line 78

  sock = socket.create_connection(

  Show more

  src/serverfs_mcp/auth_clients.py, line 100

  def fetch(self, client_id: str) -> dict[str, Any]:

  src/serverfs_mcp/auth_clients.py, line 218

  client = client_from_cimd(client_id, self.fetcher.fetch(client_id))

  src/serverfs_mcp/doctor.py, line 576

  with socket.create_connection((host, port), timeout=5):

  src/serverfs_mcp/file_ingress.py, line 205

  raw = socket.create_connection((self._address, self.port), self.timeout)

  src/serverfs_mcp/file_ingress_client.py, line 39

  def fetch(self, download_url: str, *, max_bytes: int) -> bytes:

  compose.oauth.yml, line 126

  "import os,urllib.request; p=os.environ.get('SERVERFS_AUTH_PORT','8082'); urllib.request.urlopen(f'http://127.0.0.1:{p}/healthz', timeout=2).read()",

  compose.yml, line 402

  "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8081/healthz', timeout=2).read()",

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  deployment/agent-bridge/install.sh, line 10

  --env-file PATH ServerFS .env (default: <repo>/.env)

  deployment/agent-bridge/install.sh, line 35

  ENV_FILE="$REPO_ROOT/.env"

  deployment/agent-bridge/render_config.py, line 2

  """Render a production Agent Bridge JSON config from the ServerFS .env.

  Show more

  deployment/agent-bridge/render_config.py, line 5

  .env syntax. It does not execute shell syntax, expand variables or source the

  deployment/agent-bridge/render_config.py, line 6

  file. The normal ServerFS .env is the single source of truth for workdirs,

  deployment/agent-bridge/render_config.py, line 11

  .env and rendered only into the private 0600 Bridge config.

  deployment/native/proxy_acceptance_harness.py, line 516

  path = scratch / f"proxy-env-{env_file_serial}.env"

  deployment/windows/start-native.ps1, line 2

  # Layout contract: repo root holds serverfs.toml and its sibling .env;

  src/serverfs_mcp/cli.py, line 415

  api_key = os.environ.get("CONTROL_PLANE_API_KEY", "").strip() or None

• Agent instructions

  Serious

  instructions tell the agent to ignore earlier instructions.

  AGENT_IGNORE_INSTRUCTIONS

  dev_plan.md, line 1906

  Ignore all previous instructions.

• Obfuscation

  Note

  the file cap was reached before every file was read.

  OBFUSCATION_FILE_CAP_REACHED

  tests/test_agent_client.py, line 1

  """Agent Bridge UDS client protocol tests."""

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit b4a66e94346c. can delete files. can reach a host that is not written as a fixed address. reads a credential or environment file. instructions tell the agent to ignore earlier instructions. the file cap was reached before every file was read.

Date and source

Date checked: 23 Oct 2026

Read how this letter is chosen