Mcp Dockhand

What was checked

Plain notes from the hygiene checks.

• Permissions

  Pass

  No shell or command execution found, and no extra permission was declared.

• Install and update

  Concern

  runs a script at install time.

  INSTALL_LIFECYCLE_HOOK

  package.json, line 18

  prepare

• Network

  Concern

  can reach a host that is not written as a fixed address.

  NETWORK_NO_FIXED_HOST

  src/auth/session.ts, line 131

  response = await fetch(url, {

  src/client/dockhand-client.ts, line 263

  response = await fetch(url, init);

  src/client/dockhand-client.ts, line 294

  * #215: `fetch()` resolves as soon as the response HEADERS arrive, before the

  Show more

  src/client/dockhand-client.ts, line 306

  * `fetch()` resolves:

  src/client/dockhand-client.ts, line 319

  * mock `fetch()` with - those never gained a `.body` property and must keep

  src/client/dockhand-client.ts, line 354

  // Unlike the fetch()-reject warn in loggedFetch (no response ever arrived,

  src/client/dockhand-client.ts, line 373

  // headers }` response objects several existing tests mock `fetch()` with -

  src/tools/meta.ts, line 298

  * `fetch()` (`probeRawHealth()`) and the per-environment `POST .../test` calls inside

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  scripts/generate-tool-endpoint-map.mjs, line 54

  * least-wrong anchor: its summary explicitly says "...empty content deletes the .env

  scripts/generate-tool-endpoint-map.mjs, line 108

  // the tool's primary write target (DB-backed secrets); the .env-file write via

  scripts/generate-tool-endpoint-map.mjs, line 125

  // Composes two conditional client.put(...) calls (DB store, .env-raw store) plus two

  Show more

  scripts/generate-tool-endpoint-map.mjs, line 131

  // the .env file..."). PUT .../env (what first-wins previously picked, matching

  scripts/lib/body-checks.mjs, line 61

  // stacks.ts:398 -- derselbe Diff-Mechanismus für die .env-Datei, gesendet als `content`

  src/index.ts, line 42

  'required environment variable is not set - copy .env.example to .env and fill in your Dockhand credentials',

  src/openapi/description-overrides.ts, line 60

  // .env file content to disk", "empty content deletes the .env file"). `remove_stack_env_vars`

  src/openapi/description-overrides.ts, line 67

  'values); non-secret keys are removed from the .env file. Keys present in neither are ' +

  src/tools/meta.ts, line 413

  DOCKHAND_PASSWORD: !!process.env.DOCKHAND_PASSWORD,

  src/tools/meta.ts, line 639

  password: process.env['DOCKHAND_PASSWORD'],

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read.

  OBFUSCATION_FILE_OVER_READ_CAP

  package-lock.json, line 1

  {

  docs/dockhand-openapi.json, line 1

  {

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit cb90bf44bca2. runs a script at install time. can reach a host that is not written as a fixed address. reads a credential or environment file. a file was over the read cap and was not fully read.

Date and source

Date checked: 22 Oct 2026

Read how this letter is chosen