Kernel Mcp Server

What was checked

Plain notes from the hygiene checks.

• Permissions

  Pass

  No shell or command execution found, and no extra permission was declared.

• Install and update

  Concern

  dependencies are not pinned.

  INSTALL_UNPINNED

  package.json, line 36

  @clerk/nextjs

• Network

  Concern

  can reach a host that is not written as a fixed address. can reach example.com. The description does not name that host.

  NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST

  fixtures/mcp-http-server.ts, line 97

  requests.get(`${clientId}:${codeChallenge}`) ?? null,

  fixtures/mcp-http-server.ts, line 152

  requests.delete(`${clientId}:${consumedRequest.codeChallenge}`);

  fixtures/mcp-http-server.ts, line 206

  async fetch(request) {

  Show more

  src/app/[transport]/dual-era.test.ts, line 138

  const response = await fetch(request);

  src/app/[transport]/dual-era.test.ts, line 331

  const authorized = await fetch(provider.authorizationUrl!, {

  src/app/[transport]/dual-era.test.ts, line 494

  const response = await fetch(endpoint, {

  src/app/[transport]/dual-era.test.ts, line 555

  const preflight = await fetch(endpoint, { method: "OPTIONS" });

  src/app/[transport]/dual-era.test.ts, line 567

  const response = await fetch(endpoint, {

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  fixtures/mcp-http-server.ts, line 10

  process.env.CLERK_SECRET_KEY = "

  fixtures/mcp-http-server.ts, line 12

  process.env.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY = `pk_test_${Buffer.from("clerk.example.test$").toString("base64")}`;

  fixtures/mcp-http-server.ts, line 16

  delete process.env.POSTHOG_PROJECT_TOKEN;

  Show more

  fixtures/mcp-http-server.ts, line 21

  const signingKey = new TextEncoder().encode(process.env.CLERK_SECRET_KEY);

  scripts/record-oauth-redis-contract.ts, line 38

  process.env.CLERK_SECRET_KEY = "

  scripts/record-oauth-redis-contract.ts, line 139

  return createHmac("sha256", process.env.CLERK_SECRET_KEY!)

  scripts/record-oauth-redis-contract.ts, line 441

  CLERK_SECRET_KEY: process.env.CLERK_SECRET_KEY,

  src/app/[transport]/route.test.ts, line 8

  process.env.CLERK_SECRET_KEY ??= "test-clerk-secret";

  AGENTS.md, line 25

  cp .env.example .env.local

  .env.example, line 2

  # For local testing copy this file at kernel-mcp-server/.env.local

  .env.example, line 3

  # Values can be found at 1pass > DevEnvVars > MCP section, copy and past at .env.local

  .gitignore, line 15

  .env

  .gitignore, line 16

  .env.local

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Concern

  contains an encoded blob in a file that should be readable.

  OBFUSCATION_ENCODED_BLOB

  src/lib/mcp/apps/generated/managed-auth-app.ts, line 1

  // Generated by scripts/build-managed-auth-app.mjs. Do not edit.

  src/lib/mcp/apps/generated/managed-auth-app.ts, line 2

  export const MANAGED_AUTH_APP_HTML = "<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 5c0e58bd7528. dependencies are not pinned. can reach a host that is not written as a fixed address. can reach example.com. The description does not name that host. reads a credential or environment file. contains an encoded blob in a file that should be readable.

Date and source

Date checked: 20 Oct 2026

Read how this letter is chosen