Reach Mcp

What was checked

Plain notes from the hygiene checks.

• Permissions

  Pass

  No shell or command execution found, and no extra permission was declared.

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Concern

  can reach api.github.com. The description does not name that host. can reach a host that is not written as a fixed address. can reach go.dev. The description does not name that host. accepts a host from input, with no fixed list in this file.

  NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST

  deploy/entrypoint.sh, line 45

  r = urllib.request.urlopen('https://api.github.com/repos/mvanhorn/last30days-skill/releases/latest', timeout=30)

  deploy/entrypoint.sh, line 56

  data = urllib.request.urlopen(url, timeout=300).read()

  deploy/entrypoint.sh, line 85

  data = urllib.request.urlopen(url, timeout=60).read()

  Show more

  deploy/entrypoint.sh, line 98

  print(json.load(urllib.request.urlopen('https://api.github.com/repos/cli/cli/releases/latest', timeout=30))['tag_name'])

  deploy/entrypoint.sh, line 114

  print(json.load(urllib.request.urlopen('https://go.dev/dl/?mode=json', timeout=30))[0]['version'])

  src/reach_mcp/pipeline.py, line 263

  rows = await asyncio.wait_for(source.fetch(q, days, limit), timeout=timeout)

  src/reach_mcp/query_core.py, line 344

  core subject (their fetch() may further degrade on zero results). Strip-only

  src/reach_mcp/sources/_linuxdo_playwright.py, line 3

  linux.do is behind Cloudflare: plain HTTP 403s, and even curl WITH the login

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  src/reach_mcp/jina.py, line 33

  key = os.environ.get("JINA_API_KEY", "").strip()

  src/reach_mcp/readurl.py, line 60

  key = os.environ.get("EXA_API_KEY", "").strip()

  src/reach_mcp/readurl.py, line 90

  api_key = os.environ.get("FIRECRAWL_API_KEY", "").strip()

  Show more

  src/reach_mcp/readurl.py, line 116

  key = os.environ.get("TAVILY_API_KEY", "").strip() or "dummy"

  src/reach_mcp/sources/_apify.py, line 41

  return os.environ.get("APIFY_API_TOKEN", "").strip()

  src/reach_mcp/sources/_exa.py, line 29

  return bool(os.environ.get("EXA_API_KEY", "").strip())

  src/reach_mcp/sources/_exa.py, line 40

  key = os.environ.get("EXA_API_KEY", "").strip()

  src/reach_mcp/sources/github.py, line 26

  token = os.environ.get("GH_TOKEN", "")

  .gitignore, line 8

  .ruff_cache/

  README.md, line 165

  docker run -p 8765:8765 --env-file .env ghcr.io/xyonium/reach-mcp:latest

  docs/CREDENTIALS.md, line 7

  > - **Docker / uvx**:`.env` 文件或 compose `environment`

  docs/superpowers/plans/2026-07-29-reach-mcp-implementation.md, line 141

  .ruff_cache/

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Pass

  No encoded or minified payload found.

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 146cec71d4c4. can reach api.github.com. The description does not name that host. can reach a host that is not written as a fixed address. can reach go.dev. The description does not name that host. accepts a host from input, with no fixed list in this file. reads a credential or environment file.

Date and source

Date checked: 23 Oct 2026

Read how this letter is chosen