Bilibili MCP Server

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files.

  PERMISSION_DELETE_FILES

  .codex/scripts/pre_compact.py, line 27

  result = subprocess.run(

  .codex/scripts/stop_summary.py, line 75

  result = subprocess.run(

  .codex/scripts/stop_summary.py, line 89

  result = subprocess.run(

  Show more

  harness/codex_direct.py, line 119

  process = subprocess.Popen(

  harness/context.py, line 57

  result = subprocess.run(

  harness/paseo_collaboration.py, line 479

  process = subprocess.Popen(

  src/asr/installer.ts, line 569

  fs.unlinkSync(probePath);

  src/asr/installer.ts, line 714

  fs.rmSync(target, { recursive: true, force: true });

  src/asr/installer.ts, line 737

  fs.rmSync(target, { recursive: true, force: true });

  src/asr/installer.ts, line 923

  try { fs.rmSync(modelBackup, { recursive: true, force: true }); } catch { /* best-effort */ }

  src/asr/installer.ts, line 927

  try { fs.rmSync(venvBackup, { recursive: true, force: true }); } catch { /* best-effort */ }

  src/asr/installer.ts, line 948

  fs.rmSync(asrPaths.model, { recursive: true, force: true });

  src/asr/installer.ts, line 961

  fs.rmSync(asrPaths.venv, { recursive: true, force: true });

  .codex/hooks.json, line 9

  "command": "python -c \"import os,runpy,subprocess,sys; root=subprocess.check_output(['git','rev-parse','--show-toplevel'],text=True).strip(); script=os.path.join(root,'harness','c

  .codex/hooks.json, line 22

  "command": "python -c \"import os,runpy,subprocess,sys; root=subprocess.check_output(['git','rev-parse','--show-toplevel'],text=True).strip(); script=os.path.join(root,'harness','c

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Concern

  can reach a host that is not written as a fixed address.

  NETWORK_NO_FIXED_HOST

  src/bilibili/fingerprint.ts, line 33

  const resp = await fetch(`${BASE_URL}/x/frontend/finger/spi`, {

  src/bilibili/http.ts, line 298

  const response = await fetch(url.toString(), {

  src/bilibili/http.ts, line 462

  const response = await fetch(url.toString(), {

  Show more

  docs/agent-memory/executions/2026-08-19-github-46-codex-paseo-claude-report.md, line 61

  one-page catalog fetch (`ps=20`, `order=pubdate`), defensive row

  docs/agent-memory/handoffs/2026-07-19-wbi-transport-retry-claude-report.md, line 9

  - `src/bilibili/wbi.ts` - wrapped the `fetch()` call inside `getWBI()`'s retry callback with a local `try/catch/finally` (lines 75 - 91).

  docs/agent-memory/handoffs/2026-07-19-wbi-transport-retry-claude-report.md, line 13

  The `fetch()` call was inline followed by `clearTimeout(timeoutId)`. Replaced with:

  docs/agent-memory/handoffs/2026-07-19-wbi-transport-retry-claude-report.md, line 18

  navRes = await fetch(`${BASE_URL}/x/web-interface/nav`, { ... });

  docs/agent-memory/handoffs/2026-08-05-strix-deepseek-security-remediation-claude-report.md, line 39

  userinfo subtitle URLs before fetch ("Unsupported subtitle URL port or

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_PATH_DOTENV

  .codex/scripts/generate_learning_proposals.py, line 204

  "- [ ] Contains no Cookie, token, `.env`, or secret values.",

  harness/evolution.py, line 1499

  r"(?i)(?:^|[\\/])\.env(?:\.|$)|\bignore\s+(?:the\s+)?(?:parent|scope|instructions?)\b",

  src/cli.ts, line 268

  console.log("3. 创建 .env 文件");

  Show more

  src/cli.ts, line 422

  "若重新登录后仍提示凭证失效，请检查环境变量或项目 .env 中的旧 Cookie。",

  src/load-env.ts, line 7

  // project-local .env instead of freezing defaults before dotenv runs.

  src/load-env.ts, line 9

  const envPath = resolve(moduleDirectory, "../.env");

  src/load-env.ts, line 14

  // .env is optional.

  .claude/agents/credential-sanitizer.md, line 3

  description: Use for credential and secret cleanup in this repository, especially hard-coded Bilibili Cookie values, SESSDATA, bili_jct, DedeUserID, .env leakage, and reports that

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read. the file cap was reached before every file was read.

  OBFUSCATION_FILE_OVER_READ_CAP OBFUSCATION_FILE_CAP_REACHED

  docs/agent-memory/verification-log.md, line 1

  # Verification Log

  harness/tests/test_paseo_collaboration.py, line 1

  """Tests for the Codex-Paseo-Claude collaboration seam (Issue #32).

  src/bilibili/playback.ts, line 1

  import { config } from "../config.js";

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 5ad5b7459fcd. can delete files. can reach a host that is not written as a fixed address. reads a credential or environment file. a file was over the read cap and was not fully read. the file cap was reached before every file was read.

Date and source

Date checked: 20 Oct 2026

Read how this letter is chosen