Is ctx7 safe?

The component can run operating-system commands or spawn processes.

import { spawn } from "child_process";

const child = spawn(command, args, {

Why it matters: Powerful and often legitimate — confirm the commands aren't built from untrusted input.

Fix: Confirm the command and its arguments are fully controlled and not derived from untrusted input; prefer execFile with an argument array.

The component reads files from disk.

const data = JSON.parse(fs3.readFileSync(credentialsFile, "utf-8"));

Why it matters: Usually legitimate, but worth confirming it can't be steered into reading sensitive files.

Fix: Confirm which files are read and that paths cannot be influenced by untrusted input to reach sensitive locations.

The component writes or deletes files on disk.

fs.unlinkSync(lockPath);

fs.unlinkSync(lockPath);

fs3.writeFileSync(credentialsFile, JSON.stringify(data, null, 2), { mode: CREDENTIALS_MODE });

fs3.unlinkSync(credentialsFile);

fs3.unlinkSync(legacyCredentialsFile);

Why it matters: Usually legitimate, but worth confirming the paths can't be controlled by untrusted input.

Fix: Confirm which files are written/deleted and that paths cannot be influenced by untrusted input.

The component makes outbound network requests.

const response = await fetch(`${baseUrl}/api/v2/libs/search?${params}`, {

const response = await fetch(`${baseUrl}/api/v2/code?${params}`, {

const response = await fetch(`${baseUrl}/api/v2/context?${params}`, {

const response = await fetch(`${baseUrl}/api/v3/search?${params}`, {

return await fetch(url, {

fetch(`${getBaseUrl()}/api/v2/cli/events`, {

const response = await fetch(`${getBaseUrl()}/api/dashboard/whoami`, {

const response = await fetch(`${getBaseUrl()}/api/dashboard/api-keys`, {

const res = await fetch(`${base}/${path}`);

const response = await fetch(`${deployment.baseUrl}/api/auth/mcp`, {

const response = await fetch(

Why it matters: Usually legitimate, but confirm the destinations are expected and no sensitive data leaves.

Fix: Confirm the destination hosts are expected and that no sensitive data is sent off-host.

An OAuth 2.0 / OpenID Connect delegated-authentication flow was detected (authorization-code / refresh-token / token-exchange grant, an OIDC authorize/discovery endpoint or id_token, or a delegation library). Tools authenticate with the end user's delegated, scoped credentials rather than a long-lived embedded service credential.

grant_type: "refresh_token",

Fix: Delegated auth is a lower-blast-radius execution context than an embedded static credential. Confirm the requested scopes are minimal and that tokens are never logged or forwarded off-host.