MCP, MCP server
Agent Broker
An agent-callable MCP server that lets autonomous AI agents find, verify, message, schedule with, and transact with small and mid-sized businesses (SMBs) through a single compliance-enforced tool surface.
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 17c1b83d84c3, unchanged since the check below.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_DOTENV PERMISSION_SHELL_DECLARED SECRETS_ENV_READ OBFUSCATION_FILE_OVER_READ_CAP OBFUSCATION_FILE_CAP_REACHED
Why this grade
- NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
agent_interface/key_requests.py, line 97
"curl": (f"curl -X POST {_public_base()}/keys/request " - NETWORK_UNNAMED_HOST Low
Calls a fixed host that the description does not name.
agent_interface/key_requests.py, line 97
"curl": (f"curl -X POST {_public_base()}/keys/request " - SECRETS_PATH_DOTENV Low
Mentions a .env file.
billing/providers.py, line 197
# .env carries the token under POLAR_ACCESS_TOKEN (the name - PERMISSION_SHELL_DECLARED Note
Runs shell commands, and the manifest or description says so.
compliance/jev_advisory.py, line 354
proc = subprocess.run( - SECRETS_ENV_READ Note
Reads an environment variable whose name contains KEY, SECRET, TOKEN, PASSWORD or CREDENTIAL.
config.py, line 164
# os.getenv("JWT_SIGNING_SECRET"); this name had zero functional readers -- - OBFUSCATION_FILE_OVER_READ_CAP Note
A file was over the read cap and was not fully read.
websites_new.json, line 1
[ - OBFUSCATION_FILE_CAP_REACHED Note
The 400 file cap was reached before every file was read.
websites_new.json, line 1
[
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Note
requests shell access. The manifest names this permission.
PERMISSION_SHELL_DECLARED
compliance/jev_advisory.py, line 354
proc = subprocess.run(
core/check_compliance.py, line 110
# with a mocked subprocess.run (zero real jev calls) and pinned by
scripts/check_untrusted_content_is_labelled.py, line 599
proc = subprocess.run(
Show more
scripts/deploy_origin.py, line 76
return subprocess.run(["git", "rev-parse", "HEAD"], cwd=ROOT,
scripts/deploy_origin.py, line 107
r = subprocess.run(["git", "diff", "--name-only", a + ".." + b], cwd=ROOT,
scripts/preflight.py, line 198
p = subprocess.run(["bash", "-e", "-c", cmd], cwd=cwd,
scripts/preflight.py, line 202
p = subprocess.run(cmd, cwd=cwd, shell=True, capture_output=True,
scripts/refresh_edge_snapshots.py, line 108
p = subprocess.run(cmd, capture_output=True, timeout=60) # bytes, not text
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address. can reach api.telegram.org. The description does not name that host.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
agent_interface/key_requests.py, line 97
"curl": (f"curl -X POST {_public_base()}/keys/request "
billing/telegram_revenue_alerts.py, line 170
"e.g. curl -H 'X-Agent-Identity: <token>' <endpoint>.\n"
billing/usage_logger.py, line 42
"curl/", # curl probes (almost always bots)
Show more
edge/src/alerts.ts, line 79
const r = await fetch(originUrl + "/healthz/external", {
edge/src/alerts.ts, line 117
const r = await fetch(`https://api.telegram.org/bot${token}/sendMessage`, {
edge/src/discovery.ts, line 123
const r = await fetch(originUrl + pathname, {
edge/src/index.ts, line 81
const r = await fetch(c.env.ORIGIN_URL + "/health", {
edge/src/index.ts, line 147
const r = await fetch(`${c.env.ORIGIN_URL}/health`, {
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
config.py, line 164
# os.getenv("JWT_SIGNING_SECRET"); this name had zero functional readers --
main.py, line 1026
expected = os.getenv("ADMIN_SECRET", "")
billing/providers.py, line 197
# .env carries the token under POLAR_ACCESS_TOKEN (the name
Show more
main.py, line 1383
secret = os.getenv("PADDLE_WEBHOOK_SECRET", "")
main.py, line 1427
secret = os.getenv("POLAR_WEBHOOK_SECRET", "")
agent_interface/health_external.py, line 51
tok = os.getenv("TWILIO_AUTH_TOKEN", "")
agent_interface/health_external.py, line 77
key = os.getenv("CALCOM_API_KEY", "")
agent_interface/health_external.py, line 93
key = os.getenv("VAPI_API_KEY", "")
agent_interface/health_external.py, line 111
key = os.getenv("RESEND_API_KEY", "")
channels/stub_policy.py, line 46
immediately, and sets ENVIRONMENT=development (which .env.example has
scripts/backfill_credential_hygiene.py, line 31
# Load env from .env file if running locally
scripts/backfill_credential_hygiene.py, line 32
_env_path = os.path.join(os.path.dirname(__file__), "..", "..", ".env")
scripts/check_balances.py, line 21
p = os.path.join(_PROJECT_ROOT, ".env")
scripts/deploy_origin.py, line 51
for env in (os.path.join(ROOT, ".env"), os.path.join(ROOT, "..", ".env")):
scripts/deploy_origin.py, line 58
sys.exit("RENDER_API_KEY not found in environment or .env")
scripts/go_live.ps1, line 19
# - Authenticate: `flyctl auth login` OR set FLY_API_TOKEN in .env (DONE)
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
a file was over the read cap and was not fully read. the file cap was reached before every file was read.
OBFUSCATION_FILE_OVER_READ_CAP OBFUSCATION_FILE_CAP_REACHED
websites_new.json, line 1
[
edge/dist2/index.js, line 1
var __defProp = Object.defineProperty;
edge/dist2/index.js.map, line 1
{
Show more
edge/dist3/index.js, line 1
var __defProp = Object.defineProperty;
edge/dist3/index.js.map, line 1
{
edge/distX/index.js, line 1
var __defProp = Object.defineProperty;
edge/distX/index.js.map, line 1
{
edge/src/snapshots/llms-full.txt, line 1
# AgentBroker
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 17c1b83d84c3. requests shell access. The manifest names this permission. can reach a host that is not written as a fixed address. can reach api.telegram.org. The description does not name that host. reads a credential or environment file. a file was over the read cap and was not fully read. the file cap was reached before every file was read.
Date and source
Date checked:
github.com
Commit graded: 17c1b83d84c3e5676d9c7e50952ce90fc97d9d7b
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.