ctxai

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files.

  PERMISSION_DELETE_FILES

  src/ctxai/index_manifest.py, line 113

  result = subprocess.run(

  src/ctxai/index_operations.py, line 138

  shutil.rmtree(path)

  src/ctxai/agent/checkpoints.py, line 856

  shutil.rmtree(path)

  Show more

  src/ctxai/agent/checkpoints.py, line 874

  shutil.rmtree(path)

  src/ctxai/agent/checkpoints.py, line 902

  shutil.rmtree(path)

  src/ctxai/agent/checkpoints.py, line 947

  completed = subprocess.run( # nosec B603 - fixed argument list, no shell

  src/ctxai/agent/tools/git_tools.py, line 27

  result = subprocess.run(["git", *args], cwd=repo, capture_output=True, text=True, timeout=self.context.timeout)

  src/ctxai/evals/runner.py, line 305

  shutil.rmtree(project)

  src/ctxai/evals/runner.py, line 722

  shutil.rmtree(path, ignore_errors=True)

  src/ctxai/service/daemon.py, line 108

  proc = subprocess.Popen( # noqa: S603

  src/ctxai/service/daemon.py, line 116

  proc = subprocess.Popen( # noqa: S603

• Install and update

  Serious

  install fetches a script from the network.

  INSTALL_REMOTE_SCRIPT

  AI_AGENT.md, line 32

  curl https://ollama.ai/install.sh | sh

  QUICKSTART.md, line 39

  curl https://ollama.ai/install.sh | sh

• Network

  Concern

  can reach a host that is not written as a fixed address.

  NETWORK_NO_FIXED_HOST

  check_openrouter_models.py, line 41

  response = requests.get(url, headers=headers)

  test_openrouter.py, line 67

  response = requests.post(url, headers=headers, json=body, timeout=30)

  test_openrouter.py, line 126

  response = requests.post(url, headers=headers, json=body, timeout=30)

  Show more

  test_openrouter.py, line 196

  response = requests.post(url, headers=headers, json=body, timeout=30)

  test_openrouter.py, line 229

  response2 = requests.post(url, headers=headers, json=body, timeout=30)

  test_quick.py, line 38

  response = requests.post(url, headers=headers, json=body, timeout=30)

  test_quick.py, line 77

  response = requests.post(url, headers=headers, json=body, timeout=30)

  test_quick.py, line 113

  response2 = requests.post(url, headers=headers, json=body2, timeout=30)

  src/ctxai/agent/llm/factory.py, line 291

  response = requests.get("http://localhost:11434/api/tags", timeout=2)

  Dockerfile, line 43

  sys.exit(0 if urllib.request.urlopen('http://localhost:8000/api/v1/health', timeout=3).status == 200 else 1)" \

  docker-compose.yml, line 28

  test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/api/v1/health', timeout=3)"]

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  test_openrouter.py, line 21

  api_key = os.getenv("OPENROUTER_API_KEY")

  examples/agent_quickstart.py, line 24

  if not os.getenv("ANTHROPIC_API_KEY"):

  examples/architect_editor_example.py, line 26

  if not os.getenv("OPENROUTER_API_KEY"):

  Show more

  examples/architect_editor_example.py, line 123

  if not os.getenv("OPENROUTER_API_KEY"):

  examples/example_usage.py, line 116

  # Set global CTXAI_HOME (can also be in .env or shell profile)

  src/ctxai/app.py, line 1248

  if not os.getenv("ANTHROPIC_API_KEY"):

  src/ctxai/embeddings.py, line 119

  api_key = config.api_key or os.getenv("OPENAI_API_KEY")

  src/ctxai/embeddings.py, line 176

  api_key = config.api_key or os.getenv("HUGGINGFACE_API_KEY")

  src/ctxai/traversal.py, line 49

  ".env",

  src/ctxai/agent/llm/custom_provider.py, line 61

  api_key = os.getenv("CUSTOM_API_KEY") or os.getenv("MODAL_API_KEY")

  .env.example, line 1

  # Example .env file for ctxai

  .env.example, line 2

  # Copy this to .env and fill in your values

  .gitignore, line 122

  # Environments

  AGENTS.md, line 65

  - Config: `pyproject.toml` (deps, extras openai/dashboard/mcp/all, dev group, ruff/mypy/uv config), `pytest.ini` (ALL pytest + coverage config), `uv.lock`, `.python-version` (3.13)

  COMPLETE_SUMMARY.md, line 368

  - Use .env files for API keys

  IMPLEMENTATION.md, line 156

  - **.env.example** - Configuration template

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read.

  OBFUSCATION_FILE_OVER_READ_CAP

  uv.lock, line 1

  version = 1

  tests/fixtures/retrieval_baseline.json, line 1

  {

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 5824856d5f2e. can delete files. install fetches a script from the network. can reach a host that is not written as a fixed address. reads a credential or environment file. a file was over the read cap and was not fully read.

Date and source

Date checked: 24 Oct 2026

Read how this letter is chosen