Codex, Plugin
capsule
Codex plugin MCP server (codex-plugin-mcp) for token efficiency, token reduction, context compression: exact-recoverable terminal, file, project, web, memory.
Compatibility: Not stated.
Grade D
Two or more Medium findings, or a High finding. Only try it in a sandbox.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 06fb5e308b1d, unchanged since the check below.
NETWORK_HOST_FROM_INPUT SECRETS_PATH_CREDENTIAL OBFUSCATION_MINIFIED_PAYLOAD
Why this grade
- NETWORK_HOST_FROM_INPUT High
A file takes a URL or endpoint as input and has no fixed host list.
mcp/semantic-interrupt.cjs, line 133
const response = await fetch(String(probe.url || ""), { - SECRETS_PATH_CREDENTIAL Medium
Mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc).
scripts/hook.cjs, line 630
".editorconfig", ".npmrc", ".prettierrc", ".eslintrc", - OBFUSCATION_MINIFIED_PAYLOAD Medium
Contains a very long line with almost no spaces in a script or style file.
mcp/terminal-genome.cjs, line 14
const STRUCTURAL_ATOM_RE = /https?:\/\/[^\s"'<>]+|[A-Za-z]:[\\/][^\s"'<>|]+|(?:\.{0,2}[\\/])?(?:[\w.@+-]+[\\/])+[\w.@+/-]+|\b\d{4}-\d{2}-\d{2}(?:[T ][0-2]\d:[0-5]\d:[0-5]\d(?:\.\d+
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
If you think this grade is wrong, email [email protected] with the entry link and your evidence. We aim to acknowledge within two working days and decide within seven. If we confirm an error, we aim to correct it within 24 hours of confirming it. These are aims, not guarantees.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
bench/ab_benchmark.py, line 28
generated = subprocess.run(
bench/adaptive_microprogram_ab.cjs, line 149
main().finally(() => fs.rmSync(root, { recursive: true, force: true }));
bench/adaptive_pressure_ab.cjs, line 208
fs.rmSync(state, { recursive: true, force: true });
Show more
bench/browser_efficiency_ab.cjs, line 181
fs.rmSync(state, { recursive: true, force: true });
bench/cases.cjs, line 466
fs.rmSync(temporary, { recursive: true, force: true });
bench/causal_toolchain_jit_ab.cjs, line 157
main().finally(() => fs.rmSync(root, { recursive: true, force: true }));
bench/compaction_model_ab.cjs, line 97
fs.rmSync(root, { recursive: true, force: true });
bench/compaction_replay_benchmark.cjs, line 156
fs.rmSync(state, { recursive: true, force: true });
bench/context_interest_ab.cjs, line 95
fs.rmSync(state, { recursive: true, force: true });
bench/skill_router_benchmark.py, line 90
completed = subprocess.run(
scripts/hook.cjs, line 727
if (/\b(?:Import-Module|Invoke-Expression|ConvertTo-Json|ConvertFrom-Json|ConvertTo-Yaml|ConvertFrom-Yaml|Import-Csv|Export-Csv)\b/i.test(text)) return null;
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Serious
accepts a host from input, with no fixed list in this file.
NETWORK_HOST_FROM_INPUT
mcp/semantic-interrupt.cjs, line 133
const response = await fetch(String(probe.url || ""), {
mcp/unified.cjs, line 1399
const response = await fetch(spec.url, {
scripts/live-surface-smoke.cjs, line 67
const response = await fetch(url, { method, redirect: "follow", signal: controller.signal, headers: { "user-agent": "capsule-live-surface-audit/1.0" } });
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
mcp/cognition.cjs, line 107
const disabled = process.env.CAPSULE_TOKEN_ESCROW === "0";
mcp/cognition.cjs, line 174
enabled: process.env.CAPSULE_TOKEN_ESCROW !== "0",
scripts/hook.cjs, line 630
".editorconfig", ".npmrc", ".prettierrc", ".eslintrc",
Show more
mcp/core.cjs, line 1392
...env,
scripts/hook.cjs, line 629
"dockerfile", "makefile", "license", "readme", "agents.md", ".env", ".gitignore", ".gitattributes",
.gitignore, line 11
.vscode/
.gitignore, line 12
.env
.gitignore, line 14
!.env.example
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Concern
contains a minified payload.
OBFUSCATION_MINIFIED_PAYLOAD
mcp/terminal-genome.cjs, line 14
const STRUCTURAL_ATOM_RE = /https?:\/\/[^\s"'<>]+|[A-Za-z]:[\\/][^\s"'<>|]+|(?:\.{0,2}[\\/])?(?:[\w.@+-]+[\\/])+[\w.@+/-]+|\b\d{4}-\d{2}-\d{2}(?:[T ][0-2]\d:[0-5]\d:[0-5]\d(?:\.\d+
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 06fb5e308b1d. can delete files. accepts a host from input, with no fixed list in this file. reads a credential or environment file. contains a minified payload.
Date and source
Date checked:
github.com
Commit graded: 06fb5e308b1d09e5056426072a0579d17dbcd173
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.