MCP, MCP server
ai.shipeasy/mcp
Feature flags, A/B experiments, kill switches, dynamic config & i18n — Shipeasy MCP server.
Compatibility: Not stated.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit c42f3875fed4, unchanged since the check below.
INSTALL_LIFECYCLE_HOOK
Why this grade
- INSTALL_LIFECYCLE_HOOK Medium
A package install hook (preinstall, install, postinstall or prepare) runs a script.
package.json, line 12
prepare
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
cli/src/auth/storage.ts, line 129
fs.unlinkSync(tmp);
cli/src/auth/storage.ts, line 139
fs.unlinkSync(configPath());
Install and update
Concern
runs a script at install time.
INSTALL_LIFECYCLE_HOOK
package.json, line 12
prepare
Network
Concern
can reach a host that is not written as a fixed address. can reach registry.npmjs.org. The description does not name that host.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
cli/src/api/client.ts, line 115
const res = await fetch(`${baseUrl}${path}`, {
cli/src/api/client.ts, line 139
const res = await fetch(`${baseUrl}${path}`, {
cli/src/auth/login.ts, line 280
const res = await fetch(`${baseUrl}/api/admin/projects/${creds.project_id}`, {
Show more
cli/src/auth/login.ts, line 359
const startRes = await fetch(`${workerUrl}/auth/device/start`, {
cli/src/setup/head-tags.ts, line 348
` \`fetch(url, { mode: "cors" })\` to see the real status, then add the origin in` +
cli/src/setup/report-issue.ts, line 141
const res = await fetch(`${base}/ops/bug`, {
cli/src/setup/sdk-docs.ts, line 25
const res = await fetch(url);
cli/src/setup/skills-registry.ts, line 70
const res = await fetch(
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
cli/src/auth/storage.ts, line 36
const cli_token = process.env.SHIPEASY_CLI_TOKEN?.trim();
cli/src/auth/storage.ts, line 83
const token = process.env.SHIPEASY_CLI_TOKEN?.trim();
cli/src/commands/detect.ts, line 144
secret_store: "<dir>/.env.local (gitignored)",
Show more
cli/src/commands/i18n.ts, line 13
const ENV_FILES = [".env.local", ".env.development.local", ".env", ".env.development"];
cli/src/commands/i18n.ts, line 149
// PUBLIC_SHIPEASY_CLIENT_KEY in the project's .env / .env.local
cli/src/commands/i18n.ts, line 162
console.log(`Reusing existing client SDK key (from .env / .shipeasy).`);
cli/src/commands/scan.ts, line 219
const envFiles = [".env", ".env.local", ".env.production", ".env.development"];
cli/src/commands/scan.ts, line 250
const envFiles = [".env", ".env.local", ".env.production", ".env.development"];
cli/src/commands/scan.ts, line 343
const envFiles = [".env", ".env.local", ".env.production", ".env.development"];
cli/src/commands/scan.ts, line 640
? "<dir>/.env - EXPO_PUBLIC_* only (public client key; never a server key in an app bundle)"
cli/src/setup/head-tags.ts, line 82
` serverKey: process.env.SHIPEASY_SERVER_KEY ?? "",`,
cli/src/setup/report-issue.ts, line 34
return process.env.SHIPEASY_REPORT_KEY?.trim() || BAKED_REPORT_KEY;
cli/src/util/platform-gates.ts, line 50
return (process.env.SHIPEASY_PLATFORM_CLIENT_KEY ?? PLATFORM_CLIENT_KEY).trim();
skills-eval/fixture-overlay/app/entities.ts, line 126
"const se = await shipeasy({ serverKey: process.env.SHIPEASY_SERVER_KEY ?? \"\" });",
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
a file was over the read cap and was not fully read.
OBFUSCATION_FILE_OVER_READ_CAP
mcp/docs/mcp-reference.md, line 1
# MCP reference
mcp/src/generated/tools.gen.ts, line 1
// AUTO-GENERATED from @shipeasy/openapi by scripts/gen-tools.mjs - DO NOT EDIT.
openapi/openapi.json, line 1
{
Show more
openapi/openapi.yaml, line 1
openapi: 3.2.0
openapi/src/generated/types.gen.ts, line 1
// This file is auto-generated by @hey-api/openapi-ts
Licence
Note
no licence file found.
LICENCE_MISSING
No file path was stored.
no licence file found.
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit c42f3875fed4. can delete files. runs a script at install time. can reach a host that is not written as a fixed address. can reach registry.npmjs.org. The description does not name that host. reads a credential or environment file. a file was over the read cap and was not fully read. no licence file found.
Date and source
Date checked:
github.com
Commit graded: c42f3875fed4ea7eb4865746c276dc410d0d9c78
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.