io.github.byPawel/tachibot-mcp

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files.

  PERMISSION_DELETE_FILES

  src/memory/providers/dokoro-provider.ts, line 182

  await fs.unlink(filePath);

  src/session/session-logger.ts, line 747

  await fs.unlink(filepath);

  src/tools/planner-tools.ts, line 404

  if (fs.existsSync(filePath)) fs.unlinkSync(filePath);

• Install and update

  Concern

  runs a script at install time.

  INSTALL_LIFECYCLE_HOOK

  package.json, line 52

  postinstall

• Network

  Concern

  can reach api.anthropic.com. The description does not name that host. can reach a host that is not written as a fixed address. can reach registry.npmjs.org. The description does not name that host.

  NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST

  src/tools/claude-integration.ts, line 104

  const response = await fetch('https://api.anthropic.com/v1/messages', {

  src/tools/gemini-tools.ts, line 252

  const response = await fetch(url, {

  src/tools/gemini-tools.ts, line 810

  const response = await fetch(url, {

  Show more

  src/tools/grok-enhanced.ts, line 93

  // is still streaming, so clearing it right after fetch() resolved left a stalled

  src/tools/grok-enhanced.ts, line 97

  const response = await fetch(GROK_RESPONSES_URL, {

  src/tools/grok-enhanced.ts, line 186

  const response = await fetch(GROK_API_URL, {

  src/tools/grok-enhanced.ts, line 416

  const response = await fetch(GROK_API_URL, {

  src/tools/grok-tools.ts, line 150

  const response = await fetch(GROK_API_URL, {

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  scripts/package-extension.sh, line 58

  .env.example \

  src/config.ts, line 12

  // When built: dist/src/config.js -> need to go up 2 levels to reach .env

  src/config.ts, line 13

  config({ path: path.resolve(__dirname, '../../.env') });

  Show more

  src/config.ts, line 130

  anthropic: process.env.ANTHROPIC_API_KEY,

  src/config.ts, line 131

  openai: process.env.OPENAI_API_KEY,

  src/config.ts, line 132

  openrouter: process.env.OPENROUTER_API_KEY,

  src/config.ts, line 133

  gemini: process.env.GOOGLE_API_KEY,

  src/config.ts, line 134

  deepseek: process.env.DEEPSEEK_API_KEY,

  src/config.ts, line 135

  perplexity: process.env.PERPLEXITY_API_KEY,

  src/config.ts, line 137

  qwen: process.env.QWEN_API_KEY,

  src/config.ts, line 245

  status += `\n⚠️ **Warning**: No API keys configured. Add keys to .env file for full functionality.\n`;

  src/server-main.ts, line 22

  // Load .env from project root (dist/src -> go up 2 levels)

  src/server-main.ts, line 23

  // Load .env with override - API keys from .env take priority

  src/server-main.ts, line 25

  const envPath = path.resolve(__dirname, '../../.env');

  src/server-main.ts, line 27

  // Save theme-related vars before loading .env

  src/config/model-preferences.ts, line 87

  if (process.env.OPENAI_API_KEY) {

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read.

  OBFUSCATION_FILE_OVER_READ_CAP

  package-lock.json, line 1

  {

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 06dda2a3d1a0. can delete files. runs a script at install time. can reach api.anthropic.com. The description does not name that host. can reach a host that is not written as a fixed address. can reach registry.npmjs.org. The description does not name that host. reads a credential or environment file. a file was over the read cap and was not fully read.

Date and source

Date checked: 22 Oct 2026

Read how this letter is chosen