dev.hythe/hythe

What was checked

Plain notes from the hygiene checks.

• Permissions

  Pass

  No shell or command execution found, and no extra permission was declared.

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Concern

  can reach a host that is not written as a fixed address.

  NETWORK_NO_FIXED_HOST

  mcp-stdio-http-bridge.cjs, line 258

  const req = http.request({

  mcp-stdio-http-bridge.cjs, line 331

  const req = http.request(options, (res) => {

  mcp-stdio-http-bridge.cjs, line 598

  const req = http.request(options, (res) => {

  Show more

  mcp-stdio-http-bridge.cjs, line 666

  const req = http.request(options, (res) => {

  bin/engram-mcp.cjs, line 397

  const req = http.request(

  src/notifications/index.ts, line 32

  const res = await fetch(this.webhookUrl, {

  src/unified-server/eng4/resource.ts, line 12

  * fetch (fail closed on corruption - never serve unverifiable bytes).

  docker/Dockerfile, line 42

  CMD node -e "fetch('http://localhost:6174/ready').then(async r=>{const b=await r.json();process.exit(r.status===200&&b.ready===true&&b.degraded===false?0:1)}).catch(()=>process.exi

  docker/docker-compose.yml, line 35

  test: ["CMD", "node", "-e", "fetch('http://localhost:6174/ready').then(async r=>{const b=await r.json();process.exit(r.status===200&&b.ready===true&&b.degraded===false?0:1)}).catch

  docker/pavilion-production.compose.yml, line 51

  test: ["CMD", "node", "-e", "fetch('http://localhost:6174/ready').then(async r=>{const b=await r.json();process.exit(r.status===200&&b.ready===true&&b.degraded===false?0:1)}).catch

  src/unified-neural-mcp-server.ts, line 1714

  const response = await fetch(`${baseUrl}/api/agents/register`, {

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  mcp-stdio-http-bridge.cjs, line 246

  if (process.env.API_KEY) headers['x-api-key'] = process.env.API_KEY;

  bin/engram-mcp.cjs, line 12

  * --write-env generates an API key and writes ./.env

  bin/engram-mcp.cjs, line 56

  ' --write-env generate an API key + write ./.env (mode 600; write-once)',

  Show more

  bin/engram-mcp.cjs, line 281

  const envPath = path.resolve(process.cwd(), '.env');

  bin/engram-mcp.cjs, line 296

  `${CLI_NAME} init: ./.env already exists - refusing to overwrite. ` +

  bin/engram-mcp.cjs, line 316

  lines.push(`Then place a mode-600 .env in that checkout and run ${CLIENT_PACKAGE_SPEC} init there before Docker Compose.`);

  bin/engram-mcp.cjs, line 338

  if (process.env.API_KEY) return;

  bin/engram-mcp.cjs, line 350

  process.env.API_KEY = parseApiKeyFile(fs.readFileSync(keyFilePath, 'utf8'));

  bin/engram-mcp.cjs, line 434

  const apiKey = process.env.API_KEY;

  docker/verify-transformer-runtime.mjs, line 13

  const env = transformers.env || transformers.default?.env;

  scripts/verify-hythe-release-tree.mjs, line 68

  const envExample = read('.env.example');

  scripts/verify-hythe-release-tree.mjs, line 312

  if (publicInitExamples.length === 0) failures.push('.env.example public init example missing');

  src/message-hub/websocket-server.ts, line 107

  const configuredKey = process.env.API_KEY || process.env.NEURAL_API_KEY;

  src/middleware/security.ts, line 125

  const serverApiKey = process.env.API_KEY || process.env.NEURAL_API_KEY;

  src/middleware/security.ts, line 299

  const customPrefix = process.env.RATE_LIMIT_REDIS_KEY_PREFIX || '';

  src/middleware/security.ts, line 516

  const serverApiKey = process.env.API_KEY || process.env.NEURAL_API_KEY;

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read.

  OBFUSCATION_FILE_OVER_READ_CAP

  package-lock.json, line 1

  {

  src/unified-neural-mcp-server.ts, line 1

  import express from 'express';

  src/unified-server/memory/index.ts, line 1

  // Hierarchical Memory Manager Implementation

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 449794a59251. can reach a host that is not written as a fixed address. reads a credential or environment file. a file was over the read cap and was not fully read.

Date and source

Date checked: 17 Oct 2026

Read how this letter is chosen