Komodo MCP Server

What was checked

Plain notes from the hygiene checks.

• Permissions

  Pass

  No shell or command execution found, and no extra permission was declared.

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Concern

  can reach a host that is not written as a fixed address.

  NETWORK_NO_FIXED_HOST

  src/client.ts, line 68

  const response = await fetch(`${normalized}/version`, {

  .github/instructions/docker.instructions.md, line 26

  Uses Node.js built-in `fetch()` - no wget/curl needed:

  .github/instructions/docker.instructions.md, line 31

  node -e "fetch('http://localhost:'+(process.env.MCP_PORT||8000)+'/ready').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"; \

  Show more

  Dockerfile, line 134

  # Uses Node.js built-in fetch() - no extra tools (wget/curl) needed

  Dockerfile, line 137

  node -e "fetch('http://localhost:'+(process.env.MCP_PORT||8000)+'/ready').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"; \

  compose.yaml, line 26

  # test: ["CMD-SHELL", "node -e \"fetch('http://localhost:8000/ready').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))\""]

  docker/README.md, line 247

  docker compose exec komodo-mcp-server node -e "fetch('https://komodo.example.com:9120/health').then(async r=>console.log(await r.text())).catch(console.error)"

  docker/compose.yaml, line 49

  # test: ["CMD-SHELL", "node -e \"fetch('http://localhost:8000/ready').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))\""]

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  src/config/env.ts, line 272

  password: process.env["KOMODO_PASSWORD"] ?? readSecretFile(process.env["KOMODO_PASSWORD_FILE"]) ?? file?.password,

  src/config/env.ts, line 273

  apiKey: process.env["KOMODO_API_KEY"] ?? readSecretFile(process.env["KOMODO_API_KEY_FILE"]) ?? file?.api_key,

  src/tools/schemas/repo.ts, line 93

  env_file_path: z.string().optional().describe('Env file path relative to repo root. Default: ".env"'),

  Show more

  src/config/env.ts, line 275

  process.env["KOMODO_API_SECRET"] ?? readSecretFile(process.env["KOMODO_API_SECRET_FILE"]) ?? file?.api_secret,

  src/config/env.ts, line 277

  process.env["KOMODO_JWT_TOKEN"] ?? readSecretFile(process.env["KOMODO_JWT_TOKEN_FILE"]) ?? file?.jwt_token,

  src/tools/schemas/stack.ts, line 54

  env_file_path: z.string().optional().describe('Path for environment file. Default: ".env"'),

  src/utils/redact-config.test.ts, line 18

  process.env["MCP_SCRUB_ADDITIONAL_KEYS"] = "fw_extra_key";

  src/utils/redact-config.test.ts, line 19

  process.env["MCP_SCRUB_ALLOW_KEYS"] = "fw_allowed";

  src/utils/redact-config.test.ts, line 20

  process.env["MCP_SECRET_SCRUB_KEYS"] = "komodo_extra_key";

  src/utils/redact-config.test.ts, line 21

  process.env["MCP_SECRET_SCRUB_ALLOW_KEYS"] = "komodo_allowed";

  .devcontainer/compose.yaml, line 11

  - ../.env

  .dockerignore, line 12

  # Environment files

  .github/copilot-instructions.md, line 232

  - Never commit `.env` files

  .github/instructions/coding.instructions.md, line 199

  - Never commit `.env` files

  .gitignore, line 15

  # Environment variables

  .gitignore, line 16

  .env

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Concern

  contains an encoded blob in a file that should be readable.

  OBFUSCATION_ENCODED_BLOB

  README.md, line 11

  [](https://github.com/MP-Tool/komodo-mcp-server/releases) [![License: GPL-3.0](https

• Licence

  Pass

  A licence file is present (LICENSE.txt).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 489f7e04b160. can reach a host that is not written as a fixed address. reads a credential or environment file. contains an encoded blob in a file that should be readable.

Date and source

Date checked: 19 Oct 2026

Read how this letter is chosen