nowaikit

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files.

  PERMISSION_DELETE_FILES

  clients/codex/servicenow_openai_client.py, line 40

  result = subprocess.run(

  clients/gemini/servicenow_gemini_client.py, line 39

  result = subprocess.run(

  desktop/serve.cjs, line 458

  try { fs.unlinkSync(result.filePath); } catch { /* ignore */ }

  Show more

  desktop/serve.cjs, line 559

  const cleanup = () => { try { fs.unlinkSync(mcpConfigPath); } catch { /* ignore */ } };

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Serious

  accepts a host from input, with no fixed list in this file.

  NETWORK_HOST_FROM_INPUT

  desktop/main/index.ts, line 326

  const res = await fetch('https://api.anthropic.com/v1/messages', {

  desktop/main/index.ts, line 375

  const res = await fetch(url, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body) });

  desktop/main/index.ts, line 446

  const res = await fetch(url, {

  Show more

  desktop/main/server-manager.ts, line 211

  const response = await fetch(url, { headers, signal: AbortSignal.timeout(15000) });

  desktop/renderer/src/api.ts, line 95

  const resp = await fetch(url, opts);

  desktop/renderer/src/api.ts, line 341

  const resp = await fetch(url, { headers, signal: AbortSignal.timeout(15000) });

  desktop/renderer/src/api.ts, line 523

  const res = await fetch('/api/ai/claude-cli', {

  desktop/renderer/src/api.ts, line 545

  const res = await fetch('/api/ai/anthropic/v1/messages', {

  desktop/renderer/src/pages/Setup.tsx, line 110

  const resp = await fetch(`${form.instanceUrl}/api/now/table/sys_properties?sysparm_limit=1`, {

  src/cli/setup.ts, line 297

  const res = await fetch('http://localhost:11434/api/tags', { signal: controller.signal });

  src/cli/setup.ts, line 311

  const res = await fetch('http://localhost:1234/v1/models', { signal: controller.signal });

  src/dashboard/index.ts, line 88

  fetch('/health').then(r=>r.json()),

  src/dashboard/index.ts, line 89

  fetch('/api/tools').then(r=>r.json()),

  src/dashboard/index.ts, line 90

  fetch('/api/resources').then(r=>r.json()),

  src/dashboard/index.ts, line 91

  fetch('/api/prompts').then(r=>r.json()),

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  clients/codex/servicenow_openai_client.py, line 7

  1. Copy .env.basic.example or .env.oauth.example to .env and fill in credentials.

  clients/gemini/servicenow_gemini_client.py, line 7

  1. Copy .env.basic.example or .env.oauth.example to .env and fill in credentials.

  desktop/main/server-manager.ts, line 104

  ? { ...env }

  Show more

  desktop/main/server-manager.ts, line 105

  : { ...env, ELECTRON_RUN_AS_NODE: '1' };

  src/cli/detect-clients.ts, line 250

  name: 'Generate .env file only',

  src/cli/detect-clients.ts, line 252

  configPath: join(process.cwd(), '.env'),

  src/cli/detect-clients.ts, line 256

  note: 'Set SERVICENOW_INSTANCE_URL and credentials in the generated .env file.',

  src/cli/setup.ts, line 1456

  ? ` basic: { username: process.env.SN_USERNAME!, password: process.env.SN_PASSWORD! },`

  src/cli/setup.ts, line 1457

  : ` oauth: { clientId: process.env.SN_CLIENT_ID!, clientSecret: process.env.SN_CLIENT_SECRET!, username: process.env.SN_USERNAME!, password: process.env.SN_PASSWORD! },`,

  src/cli/writers/index.ts, line 131

  /** Write a .env file. */

  src/servicenow/instances.ts, line 204

  const bearer = process.env.SERVICENOW_BEARER_TOKEN || process.env.SN_BEARER_TOKEN;

  src/servicenow/instances.ts, line 224

  password: process.env.SERVICENOW_BASIC_PASSWORD,

  src/servicenow/instances.ts, line 228

  clientSecret: process.env.SERVICENOW_OAUTH_CLIENT_SECRET || process.env.SERVICENOW_CLIENT_SECRET,

  src/servicenow/instances.ts, line 230

  password: process.env.SERVICENOW_OAUTH_PASSWORD || process.env.SERVICENOW_PASSWORD,

  src/transport/auth-middleware.ts, line 16

  const raw = process.env.NOWAIKIT_API_KEY;

  src/utils/request-context.ts, line 94

  const expected = process.env.NOWAIKIT_DELEGATED_SECRET;

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read.

  OBFUSCATION_FILE_OVER_READ_CAP

  desktop/package-lock.json, line 1

  {

  desktop/renderer/src/tools-data.ts, line 1

  // Auto-generated tool manifest for browser-only mode

  desktop/resources/icon.icns, line 1

  icns��ic12��PNG

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit c764a3c033ed. can delete files. accepts a host from input, with no fixed list in this file. reads a credential or environment file. a file was over the read cap and was not fully read.

Date and source

Date checked: 20 Oct 2026

Read how this letter is chosen