Free static sample · public source only
The first boundary map,
before anything runs.
This preflight pinned the public Local Knowledge Terminal repository, read sixteen selected text files through the GitHub API, and recovered the likely MCP surface and transport clues. It did not clone or execute repository code.
Static discovery can prepare a scope. It cannot establish runtime behavior, a vulnerability, or a production go/no-go.
Pinned snapshot
Three surface candidates.
Two transport clues.
query_private_knowledge and trace_private_claim.lkt://collections/status.625a8d6e4c9ed1e1047ccacff32f982fea959d81.Recovered surface
Enough evidence to prepare the right questions.
The preflight found tool and resource declarations in lkt/mcp_server.py, transport references in the repository documentation, and the configuration name LKT_KNOWLEDGE_DB. Configuration values were never requested.
Two likely calls
query_private_knowledge and trace_private_claim, both tied to an exact public evidence file.
One likely URI
lkt://collections/status, recovered from the same pinned server source.
Two paths to inspect
stdio and Streamable HTTP appear in the selected documentation. The preflight does not claim either is enabled in production.
Where static inspection stops
The remaining decisions belong to the real deployment.
Before an executed review, the owner still needs to name the client and version, transport and network boundary, in-scope tools and resources, allowed fixtures and network calls, and the decision the report must support.
Not executed
No handshake, tool call, resource read, invalid request, timeout, or external call was performed.
Not inferred
A capability name is not proof of read-only behavior, authentication, isolation, or production fitness.
Next useful step
Use the static inventory to agree ten runtime checks, then execute only the accepted scope in a disposable environment.
Your public repository · free first look
Send the repository URL, not the source.
The fit check needs only a clean public GitHub repository URL, contact email, and confirmation that you are authorized to request the review. No source upload, credentials, server access, or payment.