MCP, MCP server
Agent Web Fetch
Agent Web Fetch, an MCP server listed in the PlugVet directory.
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
NETWORK_NO_FIXED_HOST
Why this grade
- NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
internal/fetch/cache.go, line 44
// fresh fetch (and refreshing the entry). onMiss is invoked outside the lock.
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Pass
No shell or command execution found, and no extra permission was declared.
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
internal/fetch/cache.go, line 44
// fresh fetch (and refreshing the entry). onMiss is invoked outside the lock.
README.md, line 25
fetch({ "url": "https://example.com" })
README.md, line 143
> `fetch`, so the model calls `fetch(...)`. Two servers exposing a tool both
Show more
README.zh-CN.md, line 16
fetch({ "url": "https://example.com" })
README.zh-CN.md, line 108
> **命名说明：** 上面的键名（`chhsich-web-fetch`）是你在客户端侧给 server 起的标签 - - 想叫什么都行。它暴露的工具名为 `fetch`，所以模型调用的是 `fetch(...)`。两个 server 都提供名为 `fetch` 的工具不会冲突，只要 server 的键名不同（server 名就是命名空间）。
docs/adr/0004-implementation-language-go.md, line 40
package fetch (we're not `npx`), no telemetry call home, no update check.
Secrets
Pass
No read of a credential file or secret environment variable found.
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 7feff01fa418. can reach a host that is not written as a fixed address.
Date and source
Date checked:
github.com
Commit graded: 7feff01fa418d8a65964f916a33c11397afb5acc
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.