DispatchSEO

What was checked

Plain notes from the hygiene checks.

• Permissions

  Pass

  No shell or command call was found in the code. This check does not read permissions an entry declares. A permission line to run shell commands was found in this repository, and it may apply to this entry.

• Install and update

  Serious

  install fetches a script from the network. The docs document an installer that pipes a download into a shell.

  INSTALL_REMOTE_SCRIPT INSTALL_DOCUMENTED_INSTALLER

  start.sh, line 134

  echo " curl -fsSL https://dispatchseo.com/install.sh | sh"

  public/install.sh, line 4

  # curl -fsSL https://dispatchseo.com/install.sh | sh

  public/install.sh, line 23

  curl -fsSL https://get.docker.com | sh

  Show more

  public/setup.sh, line 4

  # curl -fsSL https://dispatchseo.com/setup.sh | bash -s -- <project-key> <slug> [backend-url] [bundled] [agent]

  public/setup.sh, line 70

  cursor) die "Cursor's CLI isn't installed. Install it first (curl https://cursor.com/install -fsS | bash), make sure ~/.local/bin is on your PATH, then rerun." ;;

  src/proxy.ts, line 26

  // The self-host one-liner: curl -fsSL https://dispatchseo.com/install.sh | sh

  .github/workflows/cursor-canary.yml, line 63

  curl https://cursor.com/install -fsS | bash

  src/lib/mcp-connect.ts, line 279

  return `curl -fsSL ${origin}/setup.sh | bash -s -- ${token} ${slug} ${origin} ${bundled ? "1" : "0"}${suffix}`;

  src/content/docs/docker-compose.mdx, line 26

  curl -fsSL https://get.docker.com | sh

  src/content/docs/install-claude-code.mdx, line 58

  curl -fsSL https://claude.ai/install.sh | bash

  src/content/docs/install-cursor.mdx, line 54

  curl https://cursor.com/install -fsS | bash

  src/content/docs/vps.mdx, line 34

  curl -fsSL https://dispatchseo.com/install.sh | sh

• Network

  Concern

  can reach a host that is not written as a fixed address. can reach api.openai.com. The description does not name that host. can reach api.github.com.

  NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST NETWORK_NAMED_HOST

  start.sh, line 147

  # "Connection refused" (curl exit 7) is the free signal - anything that

  start.sh, line 155

  if command -v curl >/dev/null 2>&1; then

  cli/dispatchseo.mjs, line 76

  res = await fetch(`${base}/api/mcp`, {

  Show more

  docker/builder/run.sh, line 40

  resp=$(curl -sG --max-time 30 -w '\n%{http_code}' -H "Authorization: Bearer ${CRON_SECRET}" \

  docker/builder/run.sh, line 52

  resp=$(curl -sG --max-time 30 -w '\n%{http_code}' -H "Authorization: Bearer ${CRON_SECRET}" \

  docker/builder/run.sh, line 57

  resp=$(curl -sG --max-time 30 -w '\n%{http_code}' -H "Authorization: Bearer ${CRON_SECRET}" \

  docker/builder/run.sh, line 306

  code=$(curl -s -o /dev/null -w "%{http_code}" --max-time 30 -X POST "$APP/api/mcp" \

  docker/builder/run.sh, line 459

  pcode=$(curl -s --max-time 30 -o /tmp/probe.json -w "%{http_code}" https://api.openai.com/v1/responses \

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  next.config.ts, line 103

  authToken: process.env.SENTRY_AUTH_TOKEN,

  start.sh, line 83

  echo "CRON_SECRET=$SECRET" >> .env

  cli/dispatchseo.mjs, line 65

  const token = process.env.DISPATCHSEO_TOKEN;

  Show more

  public/setup.sh, line 141

  c.mcpServers[process.env.CURSOR_NAME]={url:process.env.CURSOR_URL,headers:{Authorization:"Bearer "+process.env.CURSOR_TOKEN}};

  scripts/backfill-conventions.mjs, line 11

  const token = process.env.MCP_API_KEY;

  scripts/backfill-launch-dates.mjs, line 14

  const key = process.env.SUPABASE_SERVICE_ROLE_KEY;

  scripts/gate-test.mjs, line 9

  const password = process.env.DATAFORSEO_PASSWORD;

  scripts/keyword-ideas-test.mjs, line 27

  const token = process.env.MCP_API_KEY;

  scripts/mcp-install-test.mjs, line 7

  const token = process.env.MCP_API_KEY;

  CLAUDE.md, line 26

  # one-off maintenance scripts (require .env.local loaded), e.g.:

  start.sh, line 7

  # What it does: creates .env from the example on first run, generates the

  start.sh, line 63

  [ -f .env ] || cp .env.docker.example .env

  start.sh, line 65

  # Notepad (and friends) save CRLF, and docker compose reads .env raw - a \r

  start.sh, line 69

  if grep -q "$(printf '\r')" .env 2>/dev/null; then

  start.sh, line 70

  tr -d '\r' < .env > .env.crlf-fix && mv .env.crlf-fix .env

  start.sh, line 76

  if ! grep -q '^CRON_SECRET=..*' .env; then

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read. the file cap was reached before every file was read.

  OBFUSCATION_FILE_OVER_READ_CAP OBFUSCATION_FILE_CAP_REACHED

  src/app/api/[transport]/route.ts, line 1

  import { createMcpHandler } from "mcp-handler";

  src/components/wordpress-connect.tsx, line 1

  "use client";

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 318a45dea838. install fetches a script from the network. can reach a host that is not written as a fixed address. can reach api.openai.com. The description does not name that host. can reach api.github.com. reads a credential or environment file. a file was over the read cap and was not fully read. the file cap was reached before every file was read.

Date and source

Date checked: 20 Oct 2026

Read how this letter is chosen