io.github.CrossPad/crosspad-mcp

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files.

  PERMISSION_DELETE_FILES

  eval/grade.test.ts, line 153

  fs.rmSync(file, { force: true });

  src/hil/daemon.ts, line 77

  /** Test seam: replaces child_process.spawn. */

  src/resources/skills.test.ts, line 16

  for (const d of made.splice(0)) fs.rmSync(d, { recursive: true, force: true });

  Show more

  src/tools/app-manager.test.ts, line 79

  afterEach(() => { for (const d of made.splice(0)) fs.rmSync(d, { recursive: true, force: true }); });

  src/tools/architecture.test.ts, line 29

  afterAll(() => fs.rmSync(coreDir, { recursive: true, force: true }));

  src/tools/build.test.ts, line 452

  fs.rmSync(f, { force: true });

  src/tools/build.test.ts, line 477

  for (const f of written.splice(0)) fs.rmSync(f, { force: true });

  src/tools/build.ts, line 77

  fs.rmSync(BUILD_DIR, { recursive: true, force: true });

  src/tools/docs-search.test.ts, line 8

  afterEach(() => { for (const d of made.splice(0)) fs.rmSync(d, { recursive: true, force: true }); });

  docs/superpowers/plans/2026-08-25-crosspad-hil-p0-core.md, line 2598

  return subprocess.run(argv, capture_output=True, text=True, timeout=timeout).stdout

  docs/superpowers/plans/2026-08-25-crosspad-hil-p0-scenarios-cli-daemon.md, line 6929

  p = subprocess.run([sys.executable, str(TOOLS / script), "--help"],

  docs/superpowers/plans/2026-08-25-crosspad-mcp-v10-p0.md, line 52

  - `export interface ChildLike` (the subset of `ChildProcess` the daemon uses) and `export type SpawnFn = (cmd: string, args: string[], opts: {cwd?: string}) => ChildLike` — **contr

  docs/superpowers/plans/2026-08-25-crosspad-mcp-v10-p0.md, line 463

  /** Test seam: replaces child_process.spawn. */

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Concern

  can reach a host that is not written as a fixed address.

  NETWORK_NO_FIXED_HOST

  eval/hil-triage-live.mjs, line 28

  const res = await fetch(TYPESAFE_ENDPOINT, {

  skills/before-after/scripts/sim_kit_shot.py, line 17

  self.f = socket.create_connection((HOST, PORT), timeout=20).makefile("rwb")

  skills/before-after/scripts/sim_tour.py, line 27

  self.f = socket.create_connection((HOST, PORT), timeout=timeout).makefile("rwb")

  Show more

  src/index.mcp.test.ts, line 321

  const anon = await fetch(url, { method: "POST" });

  src/index.mcp.test.ts, line 325

  const wrong = await fetch(url, { method: "POST", headers: { authorization: "Bearer nope" } });

  src/index.mcp.test.ts, line 329

  const good = await fetch(url, { method: "POST", headers: { authorization: "Bearer s3cret" } });

  src/tools/hil-triage.ts, line 229

  return await fetch(TYPESAFE_ENDPOINT, {

  src/tools/trace-webui.test.ts, line 248

  const ws1 = new WebSocket(`ws://127.0.0.1:${port}/`);

• Secrets

  Pass

  No read of a credential file or secret environment variable found.

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read.

  OBFUSCATION_FILE_OVER_READ_CAP

  docs/superpowers/plans/2026-08-25-crosspad-hil-p0-core.md, line 1

  # crosspad-hil P0 core Implementation Plan

  docs/superpowers/plans/2026-08-25-crosspad-hil-p0-scenarios-cli-daemon.md, line 1

  # crosspad-hil P0 scenarios, CLI and daemon Implementation Plan

  docs/superpowers/plans/2026-08-25-crosspad-mcp-v10-p0.md, line 1

  # crosspad-mcp v10 P0 Implementation Plan

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit a0e3bbe992d1. can delete files. can reach a host that is not written as a fixed address. a file was over the read cap and was not fully read.

Date and source

Date checked: 20 Oct 2026

Read how this letter is chosen