Claude Code, Plugin
Markifact Mcp
MCP server for Google Ads, Meta Ads, GA4, TikTok Ads, and LinkedIn Ads.
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit ac9c18645e45, unchanged since the check below.
SECRETS_PATH_DOTENV INSTALL_DOCUMENTED_INSTALLER NETWORK_NAMED_HOST
Why this grade
- SECRETS_PATH_DOTENV Low
Mentions a .env file.
.gitignore, line 7
.env - INSTALL_DOCUMENTED_INSTALLER Note
Documentation shows an installer that pipes a download into a shell.
CONNECTING.md, line 151
curl -fsSL https://raw.githubusercontent.com/markifact/markifact-mcp/main/plugins/cursor/markifact/install.sh | bash - NETWORK_NAMED_HOST Note
Calls a fixed host that the description names.
plugins/codex/markifact/install.sh, line 38
curl -fsSL https://raw.githubusercontent.com/markifact/markifact-mcp/main/plugins/codex/markifact/AGENTS.md \
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Pass
No shell or command execution found, and no extra permission was declared.
Install and update
Note
The docs document an installer that pipes a download into a shell. README documents an installer that pipes a download into a shell.
INSTALL_DOCUMENTED_INSTALLER
CONNECTING.md, line 151
curl -fsSL https://raw.githubusercontent.com/markifact/markifact-mcp/main/plugins/cursor/markifact/install.sh | bash
CONNECTING.md, line 173
curl -fsSL https://raw.githubusercontent.com/markifact/markifact-mcp/main/plugins/codex/markifact/install.sh | bash
README.md, line 69
ch **Markifact** → Install. Or script: `curl -fsSL https://raw.githubusercontent.com/markifact/markifact-mcp/main/plugins/cursor/markifact/install.sh \| bash` |
Show more
README.md, line 70
| **Codex CLI** | `curl -fsSL https://raw.githubusercontent.com/markifact/markifact-mcp/main/plugins/codex/markifact/install.sh \| bash` |
docs/codex.md, line 6
curl -fsSL https://raw.githubusercontent.com/markifact/markifact-mcp/main/plugins/codex/markifact/install.sh | bash
docs/cursor.md, line 6
curl -fsSL https://raw.githubusercontent.com/markifact/markifact-mcp/main/plugins/cursor/markifact/install.sh | bash
plugins/codex/markifact/README.md, line 8
curl -fsSL https://raw.githubusercontent.com/markifact/markifact-mcp/main/plugins/codex/markifact/install.sh | bash
plugins/codex/markifact/install.sh, line 3
# Usage: curl -fsSL https://raw.githubusercontent.com/markifact/markifact-mcp/main/plugins/codex/markifact/install.sh | bash
plugins/cursor/markifact/README.md, line 8
curl -fsSL https://raw.githubusercontent.com/markifact/markifact-mcp/main/plugins/cursor/markifact/install.sh | bash
plugins/cursor/markifact/install.sh, line 3
# Usage: curl -fsSL https://raw.githubusercontent.com/markifact/markifact-mcp/main/plugins/cursor/markifact/install.sh | bash
Network
Note
can reach raw.githubusercontent.com.
NETWORK_NAMED_HOST
plugins/codex/markifact/install.sh, line 38
curl -fsSL https://raw.githubusercontent.com/markifact/markifact-mcp/main/plugins/codex/markifact/AGENTS.md \
plugins/cursor/markifact/install.sh, line 43
curl -fsSL https://raw.githubusercontent.com/markifact/markifact-mcp/main/plugins/cursor/markifact/markifact-bundled.mdc \
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_DOTENV
.gitignore, line 6
*.bak
.gitignore, line 7
.env
.gitignore, line 9
!.env.example
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit ac9c18645e45. The docs document an installer that pipes a download into a shell. README documents an installer that pipes a download into a shell. can reach raw.githubusercontent.com. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: ac9c18645e4555a7a9bf22240daa2972b2461dd2
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.