CiteNexus

What was checked

Plain notes from the hygiene checks.

• Permissions

  Note

  requests shell access. The manifest names this permission.

  PERMISSION_SHELL_DECLARED

  scripts/check_distribution.py, line 101

  subprocess.run([uv, "venv", str(environment), "--python", sys.executable], check=True)

  scripts/check_distribution.py, line 103

  subprocess.run(

  scripts/check_distribution.py, line 106

  subprocess.run([str(python), "-I", "-c", SMOKE, version], cwd=root, check=True, timeout=30)

  Show more

  scripts/check_distribution.py, line 107

  result = subprocess.run(

  scripts/check_wtfp.py, line 69

  result = subprocess.run(

  scripts/check_wtfp.py, line 84

  offline = subprocess.run(

  scripts/check_wtfp.py, line 106

  result = subprocess.run(

  scripts/release_gate.py, line 29

  return subprocess.check_output(["git", *args], cwd=ROOT, text=True).strip()

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Serious

  accepts a host from input, with no fixed list in this file.

  NETWORK_HOST_FROM_INPUT

  scripts/marketplaces.py, line 99

  with urllib.request.urlopen(request, timeout=12) as response:

  src/cite_nexus_mcp/llm_factory.py, line 129

  response = requests.get(f"{base}/api/tags", timeout=5)

  src/cite_nexus_mcp/llm_factory.py, line 142

  response = requests.get(f"{self.api_base}/models", timeout=5)

  Show more

  src/cite_nexus_mcp/providers/academic.py, line 210

  data = await self.http.get(

  src/cite_nexus_mcp/providers/academic.py, line 225

  data = await self.http.get(

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  scripts/check_distribution.py, line 48

  if path.name == ".env" or (path.name.startswith(".env.") and path.name != ".env.example"):

  scripts/smoke_public.py, line 1

  """Explicit live smoke check. No .env loading, API keys, paid providers or LLM calls."""

  src/cite_nexus_mcp/config.py, line 1

  """Explicit configuration; importing this package never reads .env or calls a service."""

  Show more

  src/cite_nexus_mcp/config.py, line 47

  if alias := os.getenv("SERP_API_KEY") or os.getenv("SERPAPI_KEY"):

  src/cite_nexus_mcp/llm_factory.py, line 52

  openai_key = os.getenv("OPENAI_API_KEY")

  src/cite_nexus_mcp/llm_factory.py, line 181

  self.api_key = os.getenv("OPENAI_API_KEY")

  src/cite_nexus_mcp/server.py, line 401

  "--env-file", type=Path, help="Explicit .env path (defaults to ./.env if present)"

  src/cite_nexus_mcp/server.py, line 404

  "--no-env-file", action="store_true", help="Use process environment only; ignore .env files"

  src/cite_nexus_mcp/server.py, line 417

  load_dotenv(args.env_file or Path.cwd() / ".env", override=False)

  .dockerignore, line 2

  .venv

  .dockerignore, line 3

  .env

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read.

  OBFUSCATION_FILE_OVER_READ_CAP

  uv.lock, line 1

  version = 1

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 3f92bcfbd499. requests shell access. The manifest names this permission. accepts a host from input, with no fixed list in this file. reads a credential or environment file. a file was over the read cap and was not fully read.

Date and source

Date checked: 21 Oct 2026

Read how this letter is chosen