MCP, MCP server
ai.adeu/adeu
Automated DOCX Redlining Engine
Compatibility: Portable across standard formats.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 557eb3f924e3.
OBFUSCATION_MINIFIED_PAYLOAD
Why this grade
- OBFUSCATION_MINIFIED_PAYLOAD Medium
Contains a very long line with almost no spaces in a script or style file.
langchain/uv.lock, line 1
version = 1
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
node/packages/mcp-server/src/parity_live.test.ts, line 161
fs.unlinkSync(tempJsonPath);
python/scripts/patch_smithery_mcpb.py, line 11
proc = subprocess.Popen(
python/src/adeu/mcp_components/shared.py, line 113
git_sha = subprocess.check_output(
Show more
python/src/adeu/mcp_components/shared.py, line 125
build_ts_raw = subprocess.check_output(
python/src/adeu/mcp_components/tools/document.py, line 1288
subprocess.run(["open", str(p)], check=True)
python/src/adeu/mcp_components/tools/document.py, line 1290
subprocess.run(["xdg-open", str(p)], check=True)
AGENTS.md, line 47
- **Test Subprocesses Decode Explicitly (python/):** `subprocess.run(..., text=True)` with no `encoding=` decodes with the host ANSI code page (cp1252 on Windows) while the CLI wri
scripts/bump.py, line 30
result = subprocess.run(
scripts/check_engine_branches.py, line 51
res = subprocess.run(cmd, capture_output=True, text=True)
Install and update
Note
The docs document an installer that pipes a download into a shell.
INSTALL_DOCUMENTED_INSTALLER
python/src/adeu/cli.py, line 132
" macOS/Linux: curl -LsSf https://astral.sh/uv/install.sh | sh\n"
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
python/scripts/login_staging.py, line 78
with urllib.request.urlopen(req, timeout=10) as response:
.github/workflows/ci.yml, line 151
# partial fetch (Canada.ca bot-blocks some entries) still produces a useful
docs/MCP_AUTH_ARCHITECTURE.md, line 83
with urllib.request.urlopen(req) as response:
Show more
scripts/fetch_corpus.py, line 84
with urllib.request.urlopen(req, timeout=120) as resp:
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
python/scripts/verify_staging_polling.py, line 85
api_key = os.environ.get("ADEU_API_KEY")
python/scripts/login_staging.py, line 26
env_path = repo_root / ".env"
python/scripts/login_staging.py, line 28
env_path = repo_root / "python" / ".env"
Show more
python/scripts/login_staging.py, line 120
# 4. Save to .env for scripts and tooling
python/scripts/verify_staging_polling.py, line 25
env_path = repo_root / ".env"
python/scripts/verify_staging_polling.py, line 27
env_path = repo_root / "python" / ".env"
python/scripts/verify_staging_polling.py, line 95
print("❌ No API key found in .env or platform keyring.")
python/scripts/verify_staging_polling.py, line 103
# Persist variables back to .env
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Concern
contains a minified payload.
OBFUSCATION_MINIFIED_PAYLOAD
langchain/uv.lock, line 1
version = 1
node/package-lock.json, line 1
{
node/packages/core/src/engine.ts, line 1
import { DocumentObject } from "./docx/bridge.js";
Show more
node/packages/mcp-server/src/assets/marked.min.js, line 13
]`).replace("lheading",oe).replace("|table","").replace("blockquote"," {0,3}>").replace("|fences","").replace("|list","").replace("|html","").replace("|tag","").getRegex()},qe=/^\\
node/packages/mcp-server/src/assets/marked.min.js, line 16
`)}}}fences(e){let t=this.rules.block.fences.exec(e);if(t){let n=t[0],s=rt(n,t[3]||"",this.rules);return{type:"code",raw:n,lang:t[2]?t[2].trim().replace(this.rules.inline.anyPunctu
node/packages/mcp-server/src/assets/marked.min.js, line 35
`,e=e.substring(G.length+1),d=C.slice(f)}}i.loose||(o?i.loose=!0:this.rules.other.doubleBlankLine.test(p)&&(o=!0));let y=null,ee;this.options.gfm&&(y=this.rules.other.listIsTask.ex
node/packages/mcp-server/src/assets/marked.min.js, line 36
`):[],r={type:"table",raw:t[0],header:[],align:[],rows:[]};if(n.length===s.length){for(let o of s)this.rules.other.tableAlignRight.test(o)?r.align.push("right"):this.rules.other.ta
node/packages/mcp-server/src/assets/marked.min.js, line 37
`?t[1].slice(0,-1):t[1];return{type:"paragraph",raw:t[0],text:n,tokens:this.lexer.inline(n)}}}text(e){let t=this.rules.block.text.exec(e);if(t)return{type:"text",raw:t[0],text:t[0]
node/packages/mcp-server/src/assets/marked.min.js, line 38
`),this.blockTokens(e,this.tokens);for(let t=0;t<this.inlineQueue.length;t++){let n=this.inlineQueue[t];this.inlineTokens(n.src,n.tokens)}return this.inlineQueue=[],this.tokens}blo
node/packages/mcp-server/src/assets/marked.min.js, line 41
`+s.text,this.inlineQueue.at(-1).src=r.text):t.push(s);continue}if(s=this.tokenizer.fences(e)){e=e.substring(s.raw.length),t.push(s);continue}if(s=this.tokenizer.heading(e)){e=e.su
node/packages/mcp-server/src/assets/marked.min.js, line 43
`+s.raw,this.inlineQueue.at(-1).src=r.text):this.tokens.links[s.tag]||(this.tokens.links[s.tag]={href:s.href,title:s.title});continue}if(s=this.tokenizer.table(e)){e=e.substring(s.
python/uv.lock, line 1
version = 1
python/src/adeu/redline/engine.py, line 1
import datetime
python/tests/test_cross_platform_integrity.py, line 1
"""
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 557eb3f924e3. can delete files. can reach a host that is not written as a fixed address. reads a credential or environment file. contains a minified payload.
Date and source
Date checked:
github.com
Commit graded: 557eb3f924e395948ccf6e3f8cb9404da9e39738
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.