io.github.Raistlin82/btp-sap-odata-to-mcp-server-optimized

What was checked

Plain notes from the hygiene checks.

• Permissions

  Pass

  No shell or command execution found, and no extra permission was declared.

• Install and update

  Concern

  runs a script at install time.

  INSTALL_LIFECYCLE_HOOK

  package.json, line 81

  prepare

• Network

  Concern

  can reach a host that is not written as a fixed address.

  NETWORK_NO_FIXED_HOST

  src/auth/providers/ias-auth-provider.ts, line 89

  const response = await fetch(tokenUrl, {

  src/auth/providers/ias-auth-provider.ts, line 148

  const response = await fetch(introspectUrl, {

  src/auth/providers/ias-auth-provider.ts, line 199

  const response = await fetch(tokenUrl, {

  Show more

  src/auth/providers/ias-auth-provider.ts, line 260

  const response = await fetch(tokenUrl, {

  src/auth/providers/ias-auth-provider.ts, line 313

  const response = await fetch(userInfoUrl, {

  src/auth/providers/ias-auth-provider.ts, line 342

  const response = await fetch(tokenUrl, {

  src/middleware/mcp-auth.ts, line 517

  step1: `1. First authenticate: curl -X POST "${baseUrl}/auth/login" -H "Content-Type: application/json" -d '{"username":"YOUR_USERNAME","password":"YOUR_PASSWORD"}'`,

  src/services/auth-server.ts, line 315

  // Direct token authentication endpoint (for CLI/curl users)

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  scripts/security-validation.js, line 59

  regex: /process\.env\.CURRENT_USER_JWT\s*=/,

  scripts/security-validation.js, line 63

  regex: /process\.env\.AUTH_SESSION_JWT\s*=/,

  scripts/security-validation.js, line 70

  regex: /process\.env\.CURRENT_USER_JWT\s*=/,

  Show more

  scripts/security-validation.js, line 74

  regex: /process\.env\.AUTH_SESSION_JWT\s*=/,

  src/index.ts, line 270

  // Check if configuration is coming from CF services, environment, or .env

  src/index.ts, line 291

  return 'Local .env File';

  src/auth/providers/ias-auth-provider.ts, line 33

  this.clientSecret = this.config.get('ias.clientSecret', process.env.SAP_IAS_CLIENT_SECRET || '');

  src/middleware/mcp-auth.ts, line 456

  process.env.SAP_BTP_JWT_TOKEN || process.env.SAP_ACCESS_TOKEN || process.env.MCP_AUTH_TOKEN;

  src/middleware/mcp-auth.ts, line 486

  const clientSecret = process.env.SAP_IAS_CLIENT_SECRET;

  src/services/auth-server.ts, line 739

  -d "grant_type=client_credentials&client_id=${config.clientId}&client_secret=${process.env.SAP_IAS_CLIENT_SECRET || 'YOUR_CLIENT_SECRET'}"`;

  src/services/health-service.ts, line 314

  hasCredentials: !!(process.env.SAP_IAS_CLIENT_ID && process.env.SAP_IAS_CLIENT_SECRET),

  src/services/ias-auth-service.ts, line 52

  process.env.SAP_IAS_CLIENT_SECRET || ''

  src/tools/sap-tool-registry.ts, line 10

  * in your .env file. Format: ServiceId.EntityName,ServiceId.EntityName

  tools/migrate-discovery-config.ts, line 231

  echo "📝 Add these to your .env file:"

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read.

  OBFUSCATION_FILE_OVER_READ_CAP

  package-lock.json, line 1

  {

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Note

  the latest commit is more than 365 days old.

  MAINTAINER_STALE

  No file path was stored.

  2025-09-24T11:39:26+02:00

Get the full report on this tool, £49

Note

Hygiene check of commit 46fcae097f4d. runs a script at install time. can reach a host that is not written as a fixed address. reads a credential or environment file. a file was over the read cap and was not fully read. the latest commit is more than 365 days old.

Date and source

Date checked: 20 Oct 2026

Read how this letter is chosen