Claude Code, Plugin
Gtm Superconnector
Evidence-first GTM workflows for Claude: account research, outreach readiness, CRM reconciliation, activation analysis, and guarded n8n operations.
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit a5a7f505befd, unchanged since the check below.
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_DOTENV SECRETS_ENV_READ
Why this grade
- INSTALL_UNPINNED Low
Dependencies use a range or git URL with no lockfile.
requirements.txt, line 3
fastmcp>=2.12,<3 - NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
servers/contact_tiers/pdl.py, line 82
r = requests.get(URL, params={ - NETWORK_UNNAMED_HOST Low
Calls a fixed host that the description does not name.
servers/contact_tiers/pdl.py, line 82
r = requests.get(URL, params={ - SECRETS_PATH_DOTENV Low
Mentions a .env file.
servers/contact_tiers/cache.py, line 77
"""Read a key from the environment, loading the repo .env once on demand. - SECRETS_ENV_READ Note
Reads an environment variable whose name contains KEY, SECRET, TOKEN, PASSWORD or CREDENTIAL.
servers/gtm_mcp/n8n.py, line 12
self.key = os.getenv("N8N_API_KEY", "")
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Pass
No shell or command execution found, and no extra permission was declared.
Install and update
Concern
dependencies are not pinned.
INSTALL_UNPINNED
requirements.txt, line 3
fastmcp>=2.12,<3
Network
Concern
can reach a host that is not written as a fixed address. can reach api.hunter.io. The description does not name that host.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
servers/contact_tiers/pdl.py, line 82
r = requests.get(URL, params={
servers/contact_tiers/verify.py, line 115
r = requests.get("https://api.hunter.io/v2/email-verifier",
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
servers/contact_tiers/cache.py, line 77
"""Read a key from the environment, loading the repo .env once on demand.
servers/contact_tiers/cache.py, line 79
Read lazily rather than at import so that whichever entry point loads .env
servers/gtm_mcp/n8n.py, line 12
self.key = os.getenv("N8N_API_KEY", "")
Show more
servers/contact_tiers/cache.py, line 88
load_dotenv(os.path.join(BASE_DIR, ".env"))
servers/gtm_mcp/server.py, line 15
load_dotenv(Path(__file__).parents[2] / ".env")
.env.example, line 1
# Copy to .env and fill in. The server loads this file from the repo root at
.env.example, line 2
# startup. .env is gitignored - never commit real credentials.
.gitignore, line 15
# Secrets and local config - never commit these
AGENTS.md, line 153
their row caps, their credit cost) and must never be committed. `.env` is the
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit a5a7f505befd. dependencies are not pinned. can reach a host that is not written as a fixed address. can reach api.hunter.io. The description does not name that host. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: a5a7f505befdf36d882043aced4a6480a3a54d42
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.