MCP, MCP server
app.vercel.ora-x402-gateway/sensations-mergulho
MCP server for 0001SENSATIONS: 107-level textual descent, append-only trace logging
Compatibility: Not stated.
Grade D
Two or more Medium findings, or a High finding. Only try it in a sandbox.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 6bf81fcb27c6.
INSTALL_LIFECYCLE_HOOK OBFUSCATION_ENCODED_BLOB OBFUSCATION_MINIFIED_PAYLOAD
Why this grade
- INSTALL_LIFECYCLE_HOOK Medium
A package install hook (preinstall, install, postinstall or prepare) runs a script.
package.json, line 6
postinstall - OBFUSCATION_ENCODED_BLOB Medium
Contains a long base64 shaped string in a file that should be readable.
supabase/functions/orum-real/index.ts, line 8
const ICON_PNG_BASE64 = "iVBORw0KGgoAAAANSUhEUgAAAgAAAAIACAYAAAD0eNT6AAAACXBIWXMAAAsTAAALEwEAmpwYAAAgAElEQVR4nO2deXRX1bn3z9tyztln/34ZSUgIECAhhEAICUlQcUYFVByoFWcExSoOOFBEilonFBEREVR - OBFUSCATION_MINIFIED_PAYLOAD Medium
Contains a very long line with almost no spaces in a script or style file.
supabase/functions/orum-real/index.ts, line 8
const ICON_PNG_BASE64 = "iVBORw0KGgoAAAANSUhEUgAAAgAAAAIACAYAAAD0eNT6AAAACXBIWXMAAAsTAAALEwEAmpwYAAAgAElEQVR4nO2deXRX1bn3z9tyztln/34ZSUgIECAhhEAICUlQcUYFVByoFWcExSoOOFBEilonFBEREVR
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
scripts/verify-kit.mjs, line 43
rejeita('recibo em falta', (d) => fs.rmSync(path.join(d, 'ancora/oro-v1.ots')));
scripts/verify-operational-gasless.mjs, line 128
} finally { for (const f of files) fs.rmSync(f, { force: true }); }
Install and update
Concern
runs a script at install time.
INSTALL_LIFECYCLE_HOOK
package.json, line 6
postinstall
Network
Concern
can reach a host that is not written as a fixed address. can reach api.github.com. The description does not name that host.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
btc-oro.js, line 6
const response = await fetch('/economia/bitcoin.json', { signal: AbortSignal.timeout(12000) });
ora-integridade.js, line 11
fetch('/integridade', { cache: 'no-store' })
ponte-calibracao.js, line 12
const response = await fetch('/api/ponte-calibracao', {cache:'no-store',signal:controller.signal});
Show more
verdelaranja.js, line 27
const response = await fetch(path, { cache: 'no-store', signal: controller.signal });
android/status.sh, line 9
if curl --fail --silent --max-time 30 --socks5-h
api/_bitcoin.js, line 96
function createHandler({ fetchFn = (...a) => fetch(...a), now = () => Date.now() } = {}) {
api/_cdp.js, line 25
function createCdp({ env = process.env, fetchFn = (...a) => fetch(...a), now = () => Date.now() } = {}) {
api/_facilitador.js, line 46
function createFacilitadorPublico({ env = process.env, fetchFn = (...a) => fetch(...a), now = () => Date.now() } = {}) {
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
api/economia.js, line 4
const SUPA_KEY = process.env.ORUM_SUPABASE_PUBLISHABLE_KEY || 'sb_publishable_XtI6QAmSYt5KHIazVCgoQw_qVYZ8AVb';
api/ponte-calibracao.js, line 3
const KEY = process.env.ORUM_SUPABASE_PUBLISHABLE_KEY || 'sb_publishable_XtI6QAmSYt5KHIazVCgoQw_qVYZ8AVb';
api/presenca.js, line 2
const SUPA_KEY = process.env.ORUM_SUPABASE_PUBLISHABLE_KEY || 'sb_publishable_XtI6QAmSYt5KHIazVCgoQw_qVYZ8AVb';
Show more
api/sensacoes.js, line 4
const SUPA_KEY = process.env.ORUM_SUPABASE_PUBLISHABLE_KEY || 'sb_publishable_XtI6QAmSYt5KHIazVCgoQw_qVYZ8AVb';
api/tesouraria.js, line 2
const SUPA_KEY = process.env.ORUM_SUPABASE_PUBLISHABLE_KEY || 'sb_publishable_XtI6QAmSYt5KHIazVCgoQw_qVYZ8AVb';
scripts/export-arca.mjs, line 12
const chave = process.env.SUPABASE_SERVICE_ROLE_KEY;
.dockerignore, line 2
.env
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Concern
contains an encoded blob in a file that should be readable. contains a minified payload.
OBFUSCATION_ENCODED_BLOB OBFUSCATION_MINIFIED_PAYLOAD
supabase/functions/orum-real/index.ts, line 8
const ICON_PNG_BASE64 = "iVBORw0KGgoAAAANSUhEUgAAAgAAAAIACAYAAAD0eNT6AAAACXBIWXMAAAsTAAALEwEAmpwYAAAgAElEQVR4nO2deXRX1bn3z9tyztln/34ZSUgIECAhhEAICUlQcUYFVByoFWcExSoOOFBEilonFBEREVR
api/escolha.js, line 2
module.exports=async(_req,res)=>{res.setHeader('content-type','application/json; charset=utf-8');res.setHeader('access-control-allow-origin','*');res.setHeader('cache-control','no-
portable/caixa/memory.json, line 1
{
Show more
recovery/orum-recovery-bundle-02.json, line 1
{
recovery/orum-recovery-bundle-03.json, line 1
{
recovery/orum-recovery-bundle-04.json, line 1
{
recovery/orum-recovery-bundle-05.json, line 1
{
recovery/orum-recovery-bundle-06.json, line 1
{
recovery/orum-recovery-bundle-09.json, line 1
{
recovery/orum-recovery-bundle-10.json, line 1
{
scripts/verify-campo-journey.mjs, line 10
const context={document:{querySelector:q},window:{ethereum},ethereum,location:{host:'example.test',pathname:'/pagar-teste.html',search:''},navigator:{},crypto:webcrypto,Uint8Array,
scripts/verify-choice-model.mjs, line 3
const funnel={schema:'ora-ferramentas/v9',observed_at:'2026-08-31T20:20:49.256Z',window_hours:24,access:{non_internal_or_unknown:208},attempts:{by_stage:{discovered:{non_internal_o
scripts/verify-choice-model.mjs, line 4
const insufficient={stats:{total:1,open:1,closed:0,scored:0,minimum_for_calibration:20,calibration_ready:false,brier_score:null},latest:{option_key:'
scripts/verify-choice-model.mjs, line 5
const calibrated={stats:{total:25,open:2,closed:23,scored:23,minimum_for_calibration:20,calibration_ready:true,brier_score:.18},latest:{option_key:'
supabase/functions/ora-operational-wallet/core.mjs, line 63
const allowed={bazaar_register:['action'],btc_create:['action'],btc_observe:['action'],btc_preview:['action','request_id','amount_sats'],btc_send:['action','request_id','amount_sat
kit/pq/exemplo-teste.json, line 26
"assinatura": "bf986a4050693bd52da0dce83934e09b403ce4e58dfbd963b2499739cfea16975e8a57862934fa384df43f4731a0c9a33f71144a4fe5edba1dbfb1487b4046d3ce30aaf5a51eb8ea89b7f4de1af6c4094ee49
Licence
Note
no licence file found.
LICENCE_MISSING
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 6bf81fcb27c6. can delete files. runs a script at install time. can reach a host that is not written as a fixed address. can reach api.github.com. The description does not name that host. reads a credential or environment file. contains an encoded blob in a file that should be readable. contains a minified payload. no licence file found.
Date and source
Date checked:
github.com
Commit graded: 6bf81fcb27c63e2c89d4304ca0229b5ba53ea990
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.