https://github.com/98lukehall/renoun-mcp

renoun-mcp

Caution

Score 85 / 100 · 80 files read · 0 critical, 0 high, 1 medium, 23 low findings

Report c7f2ec6f3f07a9ae · first scanned 2026-10-28 · scanned 3× · keyed to the exact package contents, so this link always shows this version

Listed in the Agent Census directory data

Subscores

credentials56

exfiltration92

execution100

injection100

obfuscation98

files100

100 is clean. Deductions come only from the cited findings below.

Findings

mediumCode contacts static.modelcontextprotocol.io, which the documentation never mentions

(package) · line 1 · rule M3

static.modelcontextprotocol.io

low2 binary file(s) were not parsed (static text analysis only)

(package) · line 1 · rule L3

2 binary files

lowReads named environment variables (normal for API keys; listed in the permission summary)

api_client.py · line 42 · rule L1

ority api_key = os.environ.get("RENOUN_API_KEY") api_url = os.environ.get("RENOUN_API_URL") # Fall back to config fil

lowReads named environment variables (normal for API keys; listed in the permission summary)

api_config.py · line 27 · rule L1

I Server API_HOST = os.environ.get("RENOUN_API_HOST", _file_config.get("api_host", "0.0.0.0")) # Railway sets PORT; fallback to RE

lowReads named environment variables (normal for API keys; listed in the permission summary)

api.py · line 449 · rule L1

""" admin_key = os.environ.get("RENOUN_ADMIN_KEY", "") if not admin_key: raise HTTPException(status_code=503, deta

lowReads named environment variables (normal for API keys; listed in the permission summary)

auth.py · line 25 · rule L1

rectory _DATA_DIR = os.environ.get("RENOUN_DATA_DIR", str(Path.home() / ".renoun")) KEYS_FILE = Path(_DATA_DIR) / "api_keys.json"

lowReads named environment variables (normal for API keys; listed in the permission summary)

db.py · line 18 · rule L1

ame__) _DATA_DIR = os.environ.get("RENOUN_DATA_DIR", str(Path.home() / ".renoun")) DB_PATH = Path(_DATA_DIR) / "renoun.db" # Sch

lowReads named environment variables (normal for API keys; listed in the permission summary)

drip_scheduler.py · line 41 · rule L1

------ _DATA_DIR = os.environ.get("RENOUN_DATA_DIR", str(Path.home() / ".renoun")) DRIP_STATE_FILE = Path(_DATA_DIR) / "drip_stat

lowReads named environment variables (normal for API keys; listed in the permission summary)

email_sender.py · line 44 · rule L1

"api_key": os.environ.get("RESEND_API_KEY", file_config.get("resend_api_key", "")), "from_email": os.environ.get(

lowReads named environment variables (normal for API keys; listed in the permission summary)

entrypoint.sh · line 15 · rule L1

request, os token = os.environ['GITHUB_TOKEN'] headers = { 'Authorization': f'Bearer {token}', 'Accept': 'application/vnd.

lowReads named environment variables (normal for API keys; listed in the permission summary)

pre_tag.py · line 233 · rule L1

""" api_key = os.environ.get("ANTHROPIC_API_KEY", "") if not api_key: return pre_tag_cheap(utterances) try

lowReads named environment variables (normal for API keys; listed in the permission summary)

renoun_analyze.py · line 52 · rule L1

able env_path = os.environ.get("RENOUN_CORE_PATH") if env_path: p = Path(env_path) paths.append(p if p.is_

lowReads named environment variables (normal for API keys; listed in the permission summary)

renoun_store.py · line 31 · rule L1

rectory _DATA_DIR = os.environ.get("RENOUN_DATA_DIR", str(Path.home() / ".renoun")) HISTORY_DIR = Path(_DATA_DIR) / "history" INDE

lowReads named environment variables (normal for API keys; listed in the permission summary)

server.py · line 61 · rule L1

rity env_path = os.environ.get("RENOUN_CORE_PATH") if env_path: p = Path(env_path) # Accept either a direc

lowReads named environment variables (normal for API keys; listed in the permission summary)

stripe_billing.py · line 65 · rule L1

"secret_key": os.environ.get("STRIPE_SECRET_KEY", file_config.get("stripe_secret_key", "")), "webhook_secret": os.en

lowReads named environment variables (normal for API keys; listed in the permission summary)

tests/test_api.py · line 24 · rule L1

ses it _orig_home = os.environ.get("HOME") _tmpdir = tempfile.mkdtemp(prefix="renoun_api_test_") os.environ["HOME"] = _tmpdir imp

lowReads named environment variables (normal for API keys; listed in the permission summary)

tests/test_edge_cases.py · line 26 · rule L1

state _orig_home = os.environ.get("HOME") _tmpdir = tempfile.mkdtemp(prefix="renoun_edge_test_") os.environ["HOME"] = _tmpdir im

lowReads named environment variables (normal for API keys; listed in the permission summary)

tests/test_finance.py · line 25 · rule L1

ses it _orig_home = os.environ.get("HOME") _tmpdir = tempfile.mkdtemp(prefix="renoun_finance_test_") os.environ["HOME"] = _tmpdir

lowReads named environment variables (normal for API keys; listed in the permission summary)

tests/test_integration.py · line 324 · rule L1

self._orig_home = os.environ.get("HOME") self._tmpdir = tempfile.mkdtemp(prefix="renoun_test_") os.environ["HOME

lowReads named environment variables (normal for API keys; listed in the permission summary)

tests/test_live_api.py · line 39 · rule L1

lway.app" API_KEY = os.environ.get("RENOUN_API_KEY", "") TIMEOUT = 30.0 # seconds pytestmark = pytest.mark.live # ------------

lowReads named environment variables (normal for API keys; listed in the permission summary)

tests/test_server_handlers.py · line 26 · rule L1

state _orig_home = os.environ.get("HOME") _tmpdir = tempfile.mkdtemp(prefix="renoun_server_handler_test_") os.environ["HOME"] = _

lowReads named environment variables (normal for API keys; listed in the permission summary)

tests/test_stripe.py · line 27 · rule L1

state _orig_home = os.environ.get("HOME") _tmpdir = tempfile.mkdtemp(prefix="renoun_stripe_test_") os.environ["HOME"] = _tmpdir

lowReads named environment variables (normal for API keys; listed in the permission summary)

usage.py · line 22 · rule L1

rectory _DATA_DIR = os.environ.get("RENOUN_DATA_DIR", str(Path.home() / ".renoun")) USAGE_LOG = Path(_DATA_DIR) / "usage.log" de

lowReads named environment variables (normal for API keys; listed in the permission summary)

webhooks.py · line 76 · rule L1

rectory _DATA_DIR = os.environ.get("RENOUN_DATA_DIR", str(Path.home() / ".renoun")) WEBHOOKS_FILE = Path(_DATA_DIR) / "webhooks.js

Permission surface

Network endpoints: a.comapi.anthropic.comapi.binance.comapi.binance.usapi.coingecko.comapi.github.comapi.harrisoncollab.comapi.resend.comapi1.binance.comapi2.binance.comapp.netlify.comb.combucolic-crisp-2325ac.netlify.appc.comdashboard.stripe.comdata-api.binance.visiondel.comexample.comfail.comfonts.googleapis.comgithub.comharrisoncollab.comimg.shields.iomcp.somcpmarket.commcpserverfinder.commcpservers.orgmin-api.cryptocompare.comown.compulsemcp.compypi.orgrailway.comregistry.modelcontextprotocol.iorenoun.devresend.comsmithery.aistatic.modelcontextprotocol.iostripe.comt.metest.comweb-production-817e2.up.railway.appwww.harrisoncollab.comx.comyour-bot.comyour-domain.comyour-domain.up.railway.app
Environment read: ANTHROPIC_API_KEYGITHUB_TOKENHOMEPORTRENOUN_ADMIN_KEYRENOUN_API_HOSTRENOUN_API_KEYRENOUN_API_PORTRENOUN_API_URLRENOUN_BOOTSTRAP_KEYSRENOUN_CORE_PATHRENOUN_CORS_ORIGINSRENOUN_DATA_DIRRESEND_API_KEYRESEND_FROM_EMAILSTRIPE_CANCEL_URLSTRIPE_METERED_PRICE_IDSTRIPE_PRICE_IDSTRIPE_SECRET_KEYSTRIPE_SUCCESS_URLSTRIPE_WEBHOOK_SECRET
Shell execution: yes — code or scripts can run shell commands
Install hooks: none
Credential material: Reads named environment variables (normal for API keys; listed in the permission summary)

Provenance

Source: GitHub
Repository: 98lukehall/renoun-mcp
Owner: 98lukehall
Stars: 2
Forks: 1
Repo created: 2026-03-03
Last push: 2026-03-22
License: NOASSERTION

Badge for the author

[![Preflight: Caution](https://preflight.orbitaldeskllc.com/badge/c7f2ec6f3f07a9ae.svg)](https://preflight.orbitaldeskllc.com/b/c7f2ec6f3f07a9ae)

The badge links back to this report and updates if the package is re-scanned at a new version.

Watch this package

Interest list only. We store the address and this report link, nothing else. No mail is sent in v1.

Share this report: https://preflight.orbitaldeskllc.com/r/c7f2ec6f3f07a9ae