Grades are a hygiene check, not a security guarantee.

Paid report

The full report on a tool

The grade on each entry page gives you the letter and the main reasons. The full report gives you every finding, where it sits in the code, and ticket text you can paste into your tracker.

Request a report by email

What the report contains

  • The letter grade, the rubric version and the date checked, on the cover.
  • Every reason code behind the grade, not only the main ones.
  • The file, line and snippet for each finding.
  • A plain English explanation of each finding.
  • Ticket text for each finding, ready to paste into your tracker or send to the maker.
  • The checks the tool passed.

A PlugVet engineer reviews every paid report and any grade we hold back. Free directory grades, including C and D, are automated and not reviewed by hand.

The report is a hygiene check of the source at a stated commit on a stated date, against our published rubric. It is not a security audit, a penetration test or a guarantee, and no findings does not mean no risk. The decision to use the tool stays with you.

Turnaround, refunds and re-runs

  • Your report arrives by email within 5 working days of your payment reaching us.
  • We take up to two reports a week. If we are full, we will tell you the delivery date before you pay.
  • If it is late, we refund you in full.
  • If a rubric change within 90 days changes your report's grade or findings, we re-run it free and mark what changed. The five tool pack covers all five tools.

Who can order

Reports are for teams checking a tool before they use it. Makers of a tool listed on PlugVet cannot order a report on their own tool. If you make a listed tool and think its grade is wrong, email [email protected] with the entry link. That is always free.

How to order

  1. Email [email protected] with the tool you want checked and the package. The button above fills in the subject for you.
  2. We reply with an invoice, payable by bank transfer.
  3. Once your payment arrives, we send the report within 5 working days.

There is no checkout on this site and we never ask for card details.

A sample report

This sample is based on a public tool, with its name, file paths and dates changed.

Tool: an email client MCP server

Checked: 14/09/2026 (illustrative)

Rubric: Rubric v2 (severity tiers)

Grade: D. Two or more Medium findings, or a High finding. Only try it in a sandbox.

Findings behind the grade

Each finding is a pattern our checks spotted in the code. It describes what is in the files, not what the tool does in use or what its maker meant. A real report gives the exact file, line and snippet for each one.

  • NETWORK_HOST_FROM_INPUT High

    A file takes a URL or endpoint as input and has no fixed host list. Found in several places across the search, archive and network modules and a diagnostic tool.

  • PERMISSION_SHELL_UNDECLARED Medium

    Runs shell commands that the manifest or description does not mention. Found in several places across the runtime and diagnostic modules.

  • SECRETS_PATH_CREDENTIAL Medium

    Mentions a credential store path. Found in the config module, a helper script and the documentation.

Also noted, not counted in the grade: PERMISSION_DELETE_FILES (can delete files).

Checks passed: install and update, agent instructions, obfuscation, licence, maintainer activity.

Ticket text, ready to paste

Title: PlugVet NETWORK_HOST_FROM_INPUT (High) in an email client MCP server

Where: a search module (exact file and line in the real report)

Rule: A file takes a URL or endpoint as input and has no fixed host list (Rubric v2).

Ask: Please confirm which hosts this call can reach, or add a fixed host list, then request a re-run.

How the grade was reached

Under Rubric v2, one High finding and two Medium findings give a D. The grade comes from the scanner rules and the rubric on our How we grade page.

Questions

Can a maker pay for a better grade?

No. Grades are never for sale, and makers cannot buy reports on their own tools.

Does a D mean I should not use the tool?

No. A D means we suggest trying it in a sandbox first. The grade reflects only the reason codes listed, on the date shown.

How do I pay?

By bank transfer, against the invoice we email you.