Grasp Code Architecture & Dependency Analysis

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  requests shell access. No manifest field names shell or command execution. can delete files.

  PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES

  src/parser.js, line 619

  line:osLine>=0?osLine+1:undefined,desc:'os.system()/os.popen() are vulnerable to command i

  src/ingest/youtube.ts, line 59

  if (fs.existsSync(tmp)) fs.unlinkSync(tmp);

• Install and update

  Concern

  runs a script at install time.

  INSTALL_LIFECYCLE_HOOK

  package.json, line 17

  prepare

• Network

  Concern

  can reach a host that is not written as a fixed address. can reach api.osv.dev. The description does not name that host. can reach api.securityscorecards.dev. The description does not name that host. can reach api.github.com. The description does not name that host. can reach api.deps.dev. The description does not name that host.

  NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST

  src/analyzer.ts, line 1031

  const resp = await fetch(url, { headers });

  src/jira.ts, line 20

  const res = await fetch(

  src/parser.js, line 1739

  var resp=await fetch('https://api.osv.dev/v1/querybatch',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({queries:queries})});

  Show more

  src/parser.js, line 1758

  var ps=slice.map(function(id){return fetch('https://api.osv.dev/v1/vulns/'+encodeURIComponent(id)).then(function(r){return r.ok?r.json():null;}).catch(function(){return null;});});

  src/parser.js, line 1873

  var resp=await fetch(url,{headers:headers});

  src/parser.js, line 1968

  return fetch(url,{headers:{'User-Agent':'grasp-mcp-server/3.21.0'}})

  src/ingest/url.ts, line 5

  const res = await fetch(url, {

  src/llm/provider.ts, line 103

  const res = await fetch(`${this.baseUrl}/v1/messages`, {

  src/index.ts, line 8570

  const tokenResp = await fetch('https://github.com/login/oauth/access_token', {

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  src/analyzer.ts, line 894

  const glToken = gitlabToken ?? token ?? process.env['GITLAB_TOKEN'];

  src/analyzer.ts, line 906

  bitbucketPassword: extra?.bbPassword ?? process.env['BITBUCKET_PASSWORD'],

  src/analyzer.ts, line 926

  token: extra?.gheToken ?? process.env['GHE_TOKEN'],

  Show more

  src/analyzer.ts, line 936

  token: extra?.giteaToken ?? process.env['GITEA_TOKEN'],

  src/cli.ts, line 53

  const token = process.env.GITHUB_TOKEN || process.env.GH_TOKEN;

  src/cli.ts, line 54

  const gitlabToken = process.env.GITLAB_TOKEN;

  src/env-scanner.ts, line 17

  /process\.env\.([A-Z_][A-Z0-9_]+)/g,

  src/flag-tracker.ts, line 20

  { re: /process\.env\.(FEATURE_[A-Z0-9_]+|FF_[A-Z0-9_]+|ENABLE_[A-Z0-9_]+)/g, source: 'env' },

  src/parser.js, line 40

  ,'.proto','.tf','.tfvars','.dockerfile','.env','.env.example','.gitignore','.eslintrc

  src/parser.js, line 1861

  var apiKey=typeof process!=='undefined'&&process.env&&process.env.GRASP_NVD_API_KEY;

  src/sources/local-workspaces.ts, line 11

  'env', '.env', 'dist', 'build', '.next', '.nuxt', 'out', 'target',

  src/sources/local.ts, line 17

  'env', '.env', 'dist', 'build', '.next', '.nuxt', 'out', 'target',

  src/sources/local.ts, line 50

  if (entry.name.startsWith('.') && entry.name !== '.env') continue;

  README.md, line 225

  | `grasp_env_vars` | Scan all env var reads - cross-references .env.example, flags undocumented and test-only vars |

  README.md, line 542

  cp .env.gitlab.example .env.gitlab

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read.

  OBFUSCATION_FILE_OVER_READ_CAP

  package-lock.json, line 1

  {

  src/index.ts, line 1

  #!/usr/bin/env node

• Licence

  Pass

  A licence file is present (mcp/LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit f52c80536315. requests shell access. No manifest field names shell or command execution. can delete files. runs a script at install time. can reach a host that is not written as a fixed address. can reach api.osv.dev. The description does not name that host. can reach api.securityscorecards.dev. The description does not name that host. can reach api.github.com. The description does not name that host. can reach api.deps.dev. The description does not name that host. reads a credential or environment file. a file was over the read cap and was not fully read.

Date and source

Date checked: 21 Oct 2026

Read how this letter is chosen