Locallama Mcp

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files.

  PERMISSION_DELETE_FILES

  src/modules/openrouter/index.ts, line 1220

  await fs.unlink(TRACKING_FILE_PATH).catch(() => {});

  src/modules/websocket-server/ws-server.ts, line 972

  await fs.unlink(itemPath);

  src/utils/lock-file.js, line 61

  fs.unlinkSync(lockFilePath);

  Show more

  src/utils/logger.ts, line 85

  fs.unlinkSync(oldestLog);

  docs/archive/superpowers/plans/2026-05-18-mcp-install-and-self-update.md, line 11

  **Tech Stack:** TypeScript ESM, Node.js `child_process.execSync`, `https` built-in (no new deps), Jest for tests, `@modelcontextprotocol/sdk`.

• Install and update

  Concern

  runs a script at install time.

  INSTALL_LIFECYCLE_HOOK

  package.json, line 26

  prepare

• Network

  Concern

  can reach a host that is not written as a fixed address. can reach openrouter.ai. The description does not name that host.

  NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST

  docs/archive/backup-code/orphaned-code.ts, line 49

  const response = await fetch(ollamaEndpoint, {

  docs/archive/backup-code/orphaned-code.ts, line 86

  const response = await fetch(lmStudioEndpoint, {

  docs/archive/backup-code/orphaned-code.ts, line 125

  const response = await fetch(localApiEndpoint, {

  Show more

  src/modules/cost-monitor/index.ts, line 709

  const response = await axios.get(

  src/modules/llama-cpp/index.ts, line 72

  const res = await axios.get(url, { timeout: 1000 });

  src/modules/llama-cpp/index.ts, line 230

  const res = await axios.get(`http://localhost:${proc.port}/health`, { timeout: 1000 });

  src/modules/llama-cpp/index.ts, line 276

  const res = await axios.get(`http://localhost:${p}/health`, { timeout: 500 });

  src/modules/llama-cpp/manager.ts, line 114

  await axios.get(url, { timeout: 1000 });

  src/modules/lm-studio/index.ts, line 425

  const response = await axios.get(url, {

  src/modules/lm-studio/index.ts, line 1343

  await axios.post(

  docs/OPERATIONAL_TEST_PLAN.md, line 492

  node -e "fetch('http://localhost:11434/api/tags').then(r=>r.json()).then(d=>{for (const m of (d.models||[])) console.log(m.name);}).catch(err=>{console.error(err); process.exit(1);

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  test-operational.mjs, line 27

  const envPath = join(dir, '.env');

  test-operational.mjs, line 105

  // Load .env and merge into environment for the server subprocess

  test-operational.mjs, line 109

  ...dotEnvVars, // .env overrides shell env

  Show more

  test-operational.mjs, line 274

  await runTest('reload_config - applies .env change at runtime', async () => {

  test-operational.mjs, line 275

  const envPath = join(resolve(serverEnv.LOCALLAMA_ROOT_DIR || __dirname), '.env');

  test-operational.mjs, line 604

  const previousApiKey = process.env.OPENROUTER_API_KEY;

  test-operational.mjs, line 605

  process.env.OPENROUTER_API_KEY = previousApiKey || serverEnv.OPENROUTER_API_KEY || 'test-operational-key';

  test-operational.mjs, line 654

  delete process.env.OPENROUTER_API_KEY;

  test-operational.mjs, line 656

  process.env.OPENROUTER_API_KEY = previousApiKey;

  test-operational.mjs, line 662

  const previousApiKey = process.env.OPENROUTER_API_KEY;

  test-operational.mjs, line 663

  process.env.OPENROUTER_API_KEY = previousApiKey || serverEnv.OPENROUTER_API_KEY || 'test-operational-key';

  test-operational.mjs, line 712

  delete process.env.OPENROUTER_API_KEY;

  test-operational.mjs, line 714

  process.env.OPENROUTER_API_KEY = previousApiKey;

  src/config/index.ts, line 12

  dotenv.config({ path: path.join(rootDir, '.env') });

  src/config/index.ts, line 505

  * Reload configuration from the root .env file and atomically apply hot-reloadable fields.

  src/config/index.ts, line 509

  const envPath = path.join(rootDir, '.env');

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read.

  OBFUSCATION_FILE_OVER_READ_CAP

  package-lock.json, line 1

  {

• Licence

  Note

  no licence file found.

  LICENCE_MISSING

  No file path was stored.

  no licence file found.

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 3af4d831c80b. can delete files. runs a script at install time. can reach a host that is not written as a fixed address. can reach openrouter.ai. The description does not name that host. reads a credential or environment file. a file was over the read cap and was not fully read. no licence file found.

Date and source

Date checked: 27 Oct 2026

Read how this letter is chosen