io.github.aibtcdev/mcp-server

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files.

  PERMISSION_DELETE_FILES

  src/services/signing-key.service.ts, line 387

  await fs.rm(keyDir, { recursive: true, force: true });

  src/tools/pillar.tools.ts, line 49

  await fs.unlink(SESSION_FILE);

  src/utils/storage.ts, line 232

  await fs.rm(walletDir, { recursive: true, force: true });

  Show more

  src/utils/storage.ts, line 297

  await fs.unlink(backupPath);

  src/utils/storage.ts, line 307

  await fs.unlink(backupPath);

• Install and update

  Concern

  runs a script at install time.

  INSTALL_LIFECYCLE_HOOK

  package.json, line 17

  prepare

• Network

  Concern

  can reach a host that is not written as a fixed address. can reach api.coingecko.com. The description does not name that host. can reach registry.npmjs.org. The description does not name that host.

  NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST

  scripts/test-inbox-202.ts, line 57

  const r1 = await fetch(url, {

  scripts/test-inbox-202.ts, line 105

  const r2 = await fetch(url, {

  src/bridge/index.ts, line 188

  const res = await fetch(OPENROUTER_URL, {

  Show more

  src/services/bitflow.service.ts, line 247

  const res = await fetch(url, {

  src/services/defi.service.ts, line 415

  const res = await fetch(

  src/services/hiro-api.ts, line 357

  * Extracted to enable retry logic in the main fetch() method.

  src/services/hiro-api.ts, line 368

  const response = await fetch(url, {

  src/services/hiro-api.ts, line 445

  return this.fetch(`/extended/v1/address/${address}/transactions${query}`);

  src/services/scaffold.service.ts, line 764

  curl http://localhost:8787/

  src/services/scaffold.service.ts, line 767

  curl http://localhost:8787/health

  src/services/scaffold.service.ts, line 770

  curl http://localhost:8787${endpoints[0]?.path || "/api/endpoint"}

  src/services/scaffold.service.ts, line 779

  curl -H "X-PAYMENT-TOKEN-TYPE: sBTC" http://localhost:8787${endpoints[0]?.path || "/api/endpoint"}

  src/services/scaffold.service.ts, line 1125

  const response = await fetch('https://openrouter.ai/api/v1/chat/completions', {

  src/services/scaffold.service.ts, line 1305

  curl http://localhost:8787/

  src/services/scaffold.service.ts, line 1308

  curl http://localhost:8787/health

  src/services/scaffold.service.ts, line 1311

  curl -X POST http://localhost:8787${endpoints[0]?.path || "/api/chat"} \\

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  src/bridge/index.ts, line 243

  const apiKey = process.env.OPENROUTER_API_KEY;

  src/config/networks.ts, line 9

  // environment: the server loads the .env of whatever directory the client

  src/config/pillar.ts, line 5

  export const PILLAR_API_KEY = process.env.PILLAR_API_KEY || "jc_b058d7f2e0976bd4ee34be3e5c7ba7ebe45289c55d3f5e45f666ebc14b7ebfd0";

  Show more

  src/config/sponsor.ts, line 17

  return process.env.SPONSOR_API_KEY;

  src/services/credentials.ts, line 145

  const pw = password ?? process.env.ARC_CREDS_PASSWORD;

  src/services/hiro-api.ts, line 360

  const apiKey = (await getHiroApiKey()) || process.env.HIRO_API_KEY || "";

  src/services/scaffold.service.ts, line 665

  .env

  src/services/scaffold.service.ts, line 1386

  { name: ".env.example", content: getAIEnvExampleTemplate(recipientAddress) },

  src/services/unisat-indexer.ts, line 138

  if (process.env.UNISAT_API_KEY) {

  src/services/unisat-indexer.ts, line 139

  headers["Authorization"] = `Bearer ${process.env.UNISAT_API_KEY}`;

  src/tools/jingswap.tools.ts, line 19

  process.env.JINGSWAP_API_KEY || "jc_b058d7f2e0976bd4ee34be3e5c7ba7ebe45289c55d3f5e45f666ebc14b7ebfd0";

  .env.example, line 21

  # keep it out of version control - .gitignore already blocks .env / .env.*.

  .githooks/pre-commit, line 48

  # (.env.example placeholder is excluded by the file filter above.)

  .gitignore, line 3

  # Secrets - never commit. .env.example (placeholders) is the only allowed match.

  .gitignore, line 4

  .env

  .gitignore, line 6

  !.env.example

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Pass

  No encoded or minified payload found.

• Licence

  Note

  no licence file found.

  LICENCE_MISSING

  No file path was stored.

  no licence file found.

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit feebe5b1633a. can delete files. runs a script at install time. can reach a host that is not written as a fixed address. can reach api.coingecko.com. The description does not name that host. can reach registry.npmjs.org. The description does not name that host. reads a credential or environment file. no licence file found.

Date and source

Date checked: 21 Oct 2026

Read how this letter is chosen