io.github.1gr14/agents-party

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files.

  PERMISSION_DELETE_FILES

  src/cli.test.ts, line 23

  fs.rmSync(dir, { recursive: true, force: true })

  src/mcp.test.ts, line 23

  fs.rmSync(dir, { recursive: true, force: true })

  src/store/pool.ts, line 48

  fs.rmSync(file, { force: true })

• Install and update

  Concern

  runs a script at install time. dependencies are not pinned.

  INSTALL_LIFECYCLE_HOOK INSTALL_UNPINNED

  package.json, line 95

  prepare

  package.json, line 99

  @modelcontextprotocol/sdk

• Network

  Concern

  can reach a host that is not written as a fixed address.

  NETWORK_NO_FIXED_HOST

  scripts/distribution-check.ts, line 27

  return await fetch(url, { ...init, signal: AbortSignal.timeout(15_000) })

  src/prune.ts, line 149

  const response = await fetch(`${baseUrl}${path}`, { method, ...(headers === undefined ? {} : { headers }) })

  src/client/connection.ts, line 174

  const response = await fetch(`${baseUrl}${path}`, {

  Show more

  src/client/manage.ts, line 26

  const response = await fetch(`${parsed.baseUrl}/api/parties/${encodeURIComponent(parsed.partyId)}`, {

  src/server/server.contract.test.ts, line 35

  const noToken = await fetch(`${server.url}/api/parties`)

  src/server/server.contract.test.ts, line 37

  const badToken = await fetch(`${server.url}/api/parties`, { headers: { authorization: 'Bearer wrong' } })

  src/server/server.contract.test.ts, line 39

  const listed = await fetch(`${server.url}/api/parties`, { headers: { authorization: `Bearer ${TOKEN}` } })

  src/server/server.contract.test.ts, line 42

  const participants = await fetch(`${server.url}/api/parties/${partyId}/participants`)

  docker/Dockerfile, line 24

  CMD node -e "fetch('http://127.0.0.1:7799/api/server').then(r => process.exit(r.ok ? 0 : 1), () => process.exit(1))"

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  src/client/config.ts, line 37

  explicit ?? process.env.AGENTS_PARTY_TOKEN ?? readConfig(dir).servers?.[server]?.token

  src/server/http.ts, line 142

  const token = opts.token ?? process.env.AGENTS_PARTY_SERVER_TOKEN

  .gitignore, line 16

  # Environment variables

  Show more

  .gitignore, line 18

  # …except the template the self-hosting instructions tell you to copy (docker/.env.example).

  .gitignore, line 19

  !.env.example

  CHANGELOG.md, line 37

  fetches and renews, a `.env` with the two variables that matter, and the

  README.md, line 360

  cp .env.example .env

  README.md, line 385

  `.env.example`. They live in [`docker/`](./docker) if you'd rather read them

  README.md, line 388

  Everything is configured through `.env`:

  docker/.env.example, line 1

  # Copy to `.env` next to compose.yml and fill in. Compose refuses to start without the two required ones.

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read.

  OBFUSCATION_FILE_OVER_READ_CAP

  bun.lock, line 1

  {

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit af00afbd49b3. can delete files. runs a script at install time. dependencies are not pinned. can reach a host that is not written as a fixed address. reads a credential or environment file. a file was over the read cap and was not fully read.

Date and source

Date checked: 17 Oct 2026

Read how this letter is chosen