Agent^Rider

What was checked

Plain notes from the hygiene checks.

• Permissions

  Pass

  No shell or command execution found, and no extra permission was declared.

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Concern

  can reach a host that is not written as a fixed address. can reach api.x.ai. The description does not name that host.

  NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST

  packages/agent-rider-quickstart/quickstart.mjs, line 33

  const res = await fetch(`${LIVE_BASE}${path}`, {

  scripts/odin-lab-team-poll.mjs, line 16

  const res = await fetch(`${BASE}/api/channels/${CHANNEL}/messages?limit=30`);

  src/app/page.tsx, line 38

  const res = await fetch("/api/checkout", {

  Show more

  src/app/api/mcp/route.ts, line 83

  // fetch()-ing agentmagnet's own REST API. agentmagnet's server and MCP

  src/app/chat/page.tsx, line 124

  const res = await fetch("/api/chat/gate", { credentials: "

  src/app/chat/page.tsx, line 130

  const cfg = await fetch("/api/chat/config", { credentials: "

  src/app/chat/page.tsx, line 158

  const res = await fetch("/api/chat/gate", {

  src/app/chat/page.tsx, line 173

  const cfg = await fetch("/api/chat/config", { credentials: "

  src/app/docs/page.tsx, line 288

  <CodeBlock>{`curl -X POST https://agentrider.fly.dev/api/verify \\

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  .cursor/install.sh, line 5

  # - Creates a local dev env file (src/.env.local) with SAFE PLACEHOLDER values

  .cursor/install.sh, line 24

  if [ -f .env.local ]; then

  packages/agent-rider-quickstart/quickstart.mjs, line 104

  const sandboxKey = process.env.RIDER_SANDBOX_KEY || DOCUMENTED_SANDBOX_KEY;

  Show more

  .cursor/install.sh, line 25

  echo ".env.local already present - leaving it untouched"

  .cursor/install.sh, line 27

  echo "generating src/.env.local with placeholder dev values + throwaway rider keypair"

  .cursor/install.sh, line 53

  fs.writeFileSync(".env.local", lines.join("\n"));

  .cursor/install.sh, line 54

  console.log("wrote .env.local");

  src/app/api/health/route.ts, line 14

  const hasStripe = Boolean(process.env.STRIPE_SECRET_KEY);

  src/app/api/health/route.ts, line 15

  const hasRider = Boolean(process.env.RIDER_PRIVATE_KEY && process.env.RIDER_PUBLIC_KEY);

  src/app/api/rider/issue/route.ts, line 81

  process.env.RIDER_PLATFORM_KEY &&

  src/app/api/rider/issue/route.ts, line 82

  platformKey === process.env.RIDER_PLATFORM_KEY

  src/app/api/v0/citizen-receipts/route.ts, line 73

  const configuredIngest = process.env.CUNI_STUDIO_INGEST_KEY?.trim() || null;

  src/app/api/v0/contracts/route.ts, line 147

  if (!process.env.SUPABASE_SERVICE_ROLE_KEY) {

  src/app/api/webhook/stripe/route.ts, line 42

  const webhookSecret = process.env.STRIPE_WEBHOOK_SECRET;

  src/lib/amp-settle-adapter.selftest.mjs, line 159

  const envEx = readFileSync(join(repoRoot, ".env.example"), "utf8");

  src/lib/db.ts, line 80

  "Missing SUPABASE_URL / SUPABASE_SERVICE_ROLE_KEY (also accepts NEXT_PUBLIC_SUPABASE_URL and SUPABASE_SECRET_KEY). See .env.example and supabase/schema.sql."

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read.

  OBFUSCATION_FILE_OVER_READ_CAP

  src/cuni-bin/cuni, line 1

  ELF
  
  >
  �

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit aa9791f41bd4. can reach a host that is not written as a fixed address. can reach api.x.ai. The description does not name that host. reads a credential or environment file. a file was over the read cap and was not fully read.

Date and source

Date checked: 22 Oct 2026

Read how this letter is chosen