MCP, MCP server

ARGUS-3 MCP Server

🔄 Synced from a monorepo — but with a live history. argus mirrors the canonical AI-Factory monorepo.

Compatibility: Not stated.

Grade D

Two or more Medium findings, or a High finding. Only try it in a sandbox.

Graded by PlugVet21/10/2026Rubric v2

Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.

INSTALL_REMOTE_SCRIPT AGENT_IGNORE_INSTRUCTIONS

Why this grade

INSTALL_REMOTE_SCRIPT Medium
Fetches a script from the network and runs it (a pipe to a shell, or an install hook with a URL).
README.md, line 121 curl -fsSL https://magic-ai-factory.com/install | bash
AGENT_IGNORE_INSTRUCTIONS Medium
Text tells the agent to ignore earlier instructions.
docs/security-warden-es.md, line 33 | **Envenenamiento de herramientas / prompt injection** | Directivas imperativas ocultas en la *descripción* de una herramienta o esquema («ignore previous instructions», etiquetas

Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.

If you think this grade is wrong, email [email protected] with the entry link and your evidence. We aim to acknowledge within two working days and decide within seven. If we confirm an error, we aim to correct it within 24 hours of confirming it. These are aims, not guarantees.

Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.

What was checked

Plain notes from the hygiene checks.

Permissions
Note
requests shell access. The manifest names this permission.
PERMISSION_SHELL_DECLARED
.github/workflows/npm-dependency-audit.yml, line 25
paths = subprocess.check_output(['git', 'ls-files', '-z'], text=True).split('\0')
Install and update
Serious
install fetches a script from the network.
INSTALL_REMOTE_SCRIPT
README.md, line 121
curl -fsSL https://magic-ai-factory.com/install | bash
README.md, line 174
> `curl -fsSL https://modeldev.modelmarket.dev/install | bash`
docs/security-residual-risks-es.md, line 235
curl -fsSL https://ollama.com/install.sh | sh
Show more
docs/security-residual-risks-ru.md, line 235
curl -fsSL https://ollama.com/install.sh | sh
docs/security-residual-risks.md, line 235
curl -fsSL https://ollama.com/install.sh | sh
docs/use-case-external-operator-es.md, line 115
curl -fsSL https://magic-ai-factory.com/install | bash
docs/use-case-external-operator-ru.md, line 93
curl -fsSL https://magic-ai-factory.com/install | bash
docs/use-case-external-operator.md, line 115
curl -fsSL https://magic-ai-factory.com/install | bash
docs/user-guide/README.md, line 3
> **Install in one command:** `curl -fsSL https://magic-ai-factory.com/install | bash`
docs/user-guide/ar.md, line 12
curl -fsSL https://magic-ai-factory.com/install | bash
docs/user-guide/de.md, line 12
curl -fsSL https://magic-ai-factory.com/install | bash
docs/user-guide/en.md, line 50
curl -fsSL https://magic-ai-factory.com/install | bash
docs/user-guide/es.md, line 50
curl -fsSL https://magic-ai-factory.com/install | bash
docs/user-guide/fa.md, line 12
curl -fsSL https://magic-ai-factory.com/install | bash
docs/user-guide/fr.md, line 12
curl -fsSL https://magic-ai-factory.com/install | bash
docs/user-guide/hi.md, line 12
curl -fsSL https://magic-ai-factory.com/install | bash
docs/user-guide/hr.md, line 12
curl -fsSL https://magic-ai-factory.com/install | bash
docs/user-guide/id.md, line 12
curl -fsSL https://magic-ai-factory.com/install | bash
docs/user-guide/it.md, line 12
curl -fsSL https://magic-ai-factory.com/install | bash
docs/user-guide/ja.md, line 12
curl -fsSL https://magic-ai-factory.com/install | bash
docs/user-guide/ko.md, line 12
curl -fsSL https://magic-ai-factory.com/install | bash
docs/user-guide/nl.md, line 12
curl -fsSL https://magic-ai-factory.com/install | bash
docs/user-guide/pt.md, line 12
curl -fsSL https://magic-ai-factory.com/install | bash
docs/user-guide/ru.md, line 50
curl -fsSL https://magic-ai-factory.com/install | bash
docs/user-guide/sk.md, line 12
curl -fsSL https://magic-ai-factory.com/install | bash
docs/user-guide/th.md, line 12
curl -fsSL https://magic-ai-factory.com/install | bash
docs/user-guide/tr.md, line 12
curl -fsSL https://magic-ai-factory.com/install | bash
docs/user-guide/vi.md, line 12
curl -fsSL https://magic-ai-factory.com/install | bash
docs/user-guide/zh.md, line 12
curl -fsSL https://magic-ai-factory.com/install | bash
docs/user-guide/humor/README.md, line 33
`curl -fsSL https://magic-ai-factory.com/install | bash`
docs/user-guide/humor/ar.md, line 30
curl -fsSL https://magic-ai-factory.com/install | bash
docs/user-guide/humor/de.md, line 30
curl -fsSL https://magic-ai-factory.com/install | bash
docs/user-guide/humor/en.md, line 30
curl -fsSL https://magic-ai-factory.com/install | bash
docs/user-guide/humor/es.md, line 30
curl -fsSL https://magic-ai-factory.com/install | bash
docs/user-guide/humor/fa.md, line 30
curl -fsSL https://magic-ai-factory.com/install | bash
docs/user-guide/humor/fr.md, line 30
curl -fsSL https://magic-ai-factory.com/install | bash
docs/user-guide/humor/hi.md, line 30
curl -fsSL https://magic-ai-factory.com/install | bash
docs/user-guide/humor/hr.md, line 30
curl -fsSL https://magic-ai-factory.com/install | bash
docs/user-guide/humor/id.md, line 30
curl -fsSL https://magic-ai-factory.com/install | bash
docs/user-guide/humor/it.md, line 30
curl -fsSL https://magic-ai-factory.com/install | bash
docs/user-guide/humor/ja.md, line 30
curl -fsSL https://magic-ai-factory.com/install | bash
docs/user-guide/humor/ko.md, line 30
curl -fsSL https://magic-ai-factory.com/install | bash
docs/user-guide/humor/nl.md, line 30
curl -fsSL https://magic-ai-factory.com/install | bash
docs/user-guide/humor/pt.md, line 30
curl -fsSL https://magic-ai-factory.com/install | bash
docs/user-guide/humor/ru.md, line 30
curl -fsSL https://magic-ai-factory.com/install | bash
docs/user-guide/humor/sk.md, line 30
curl -fsSL https://magic-ai-factory.com/install | bash
docs/user-guide/humor/th.md, line 30
curl -fsSL https://magic-ai-factory.com/install | bash
docs/user-guide/humor/tr.md, line 30
curl -fsSL https://magic-ai-factory.com/install | bash
docs/user-guide/humor/vi.md, line 30
curl -fsSL https://magic-ai-factory.com/install | bash
docs/user-guide/humor/zh.md, line 30
curl -fsSL https://magic-ai-factory.com/install | bash
docs/i18n/guides.json, line 7
"install_cmd": "curl -fsSL https://magic-ai-factory.com/install | bash",
docs/i18n/guides.json, line 28
"install_cmd": "curl -fsSL https://magic-ai-factory.com/install | bash",
docs/i18n/guides.json, line 49
"install_cmd": "curl -fsSL https://magic-ai-factory.com/install | bash",
docs/i18n/guides.json, line 70
"install_cmd": "curl -fsSL https://magic-ai-factory.com/install | bash",
docs/i18n/guides.json, line 91
"install_cmd": "curl -fsSL https://magic-ai-factory.com/install | bash",
docs/i18n/guides.json, line 112
"install_cmd": "curl -fsSL https://magic-ai-factory.com/install | bash",
docs/i18n/guides.json, line 133
"install_cmd": "curl -fsSL https://magic-ai-factory.com/install | bash",
docs/i18n/guides.json, line 154
"install_cmd": "curl -fsSL https://magic-ai-factory.com/install | bash",
docs/i18n/guides.json, line 175
"install_cmd": "curl -fsSL https://magic-ai-factory.com/install | bash",
docs/i18n/guides.json, line 196
"install_cmd": "curl -fsSL https://magic-ai-factory.com/install | bash",
docs/i18n/guides.json, line 217
"install_cmd": "curl -fsSL https://magic-ai-factory.com/install | bash",
docs/i18n/guides.json, line 238
"install_cmd": "curl -fsSL https://magic-ai-factory.com/install | bash",
docs/i18n/guides.json, line 259
"install_cmd": "curl -fsSL https://magic-ai-factory.com/install | bash",
docs/i18n/guides.json, line 280
"install_cmd": "curl -fsSL https://magic-ai-factory.com/install | bash",
docs/i18n/guides.json, line 301
"install_cmd": "curl -fsSL https://magic-ai-factory.com/install | bash",
docs/i18n/guides.json, line 322
"install_cmd": "curl -fsSL https://magic-ai-factory.com/install | bash",
docs/i18n/guides.json, line 343
"install_cmd": "curl -fsSL https://magic-ai-factory.com/install | bash",
docs/i18n/guides.json, line 364
"install_cmd": "curl -fsSL https://magic-ai-factory.com/install | bash",
docs/i18n/guides.json, line 385
"install_cmd": "curl -fsSL https://magic-ai-factory.com/install | bash",
docs/i18n/guides.json, line 406
"install_cmd": "curl -fsSL https://magic-ai-factory.com/install | bash",
docs/i18n/guides.json, line 427
"install_cmd": "curl -fsSL https://magic-ai-factory.com/install | bash",
docs/i18n/guides.json, line 448
"install_cmd": "curl -fsSL https://magic-ai-factory.com/install | bash",
docs/i18n/guides.json, line 469
"install_cmd": "curl -fsSL https://magic-ai-factory.com/install | bash",
docs/i18n/guides.json, line 490
"install_cmd": "curl -fsSL https://magic-ai-factory.com/install | bash",
docs/i18n/guides.json, line 511
"install_cmd": "curl -fsSL https://magic-ai-factory.com/install | bash",
docs/i18n/humor.json, line 22
"cta": "Still want one anyway?\n\n```bash\ncurl -fsSL https://magic-ai-factory.com/install | bash\n```",
docs/i18n/humor.json, line 45
"cta": "还是想要一个？\n\n```bash\ncurl -fsSL https://magic-ai-factory.com/install | bash\n```",
docs/i18n/humor.json, line 68
"cta": "¿Lo quieres igual?\n\n```bash\ncurl -fsSL https://magic-ai-factory.com/install | bash\n```",
docs/i18n/humor.json, line 91
"cta": "फिर भी चाहिए?\n\n```bash\ncurl -fsSL https://magic-ai-factory.com/install | bash\n```",
docs/i18n/humor.json, line 114
"cta": "ما زلت تريده؟\n\n```bash\ncurl -fsSL https://magic-ai-factory.com/install | bash\n```",
docs/i18n/humor.json, line 137
"cta": "Quer mesmo assim?\n\n```bash\ncurl -fsSL https://magic-ai-factory.com/install | bash\n```",
docs/i18n/humor.json, line 160
"cta": "Всё равно хотите?\n\n```bash\ncurl -fsSL https://magic-ai-factory.com/install | bash\n```",
docs/i18n/humor.json, line 183
"cta": "それでも欲しい？\n\n```bash\ncurl -fsSL https://magic-ai-factory.com/install | bash\n```",
docs/i18n/humor.json, line 206
"cta": "Vous le voulez quand même ?\n\n```bash\ncurl -fsSL https://magic-ai-factory.com/install | bash\n```",
docs/i18n/humor.json, line 229
"cta": "Trotzdem installieren?\n\n```bash\ncurl -fsSL https://magic-ai-factory.com/install | bash\n```",
docs/i18n/humor.json, line 252
"cta": "그래도 원하나?\n\n```bash\ncurl -fsSL https://magic-ai-factory.com/install | bash\n```",
docs/i18n/humor.json, line 275
"cta": "Lo vuoi lo stesso?\n\n```bash\ncurl -fsSL https://magic-ai-factory.com/install | bash\n```",
docs/i18n/humor.json, line 298
"cta": "Yine de istiyor musun?\n\n```bash\ncurl -fsSL https://magic-ai-factory.com/install | bash\n```",
docs/i18n/humor.json, line 321
"cta": "Tetap mau?\n\n```bash\ncurl -fsSL https://magic-ai-factory.com/install | bash\n```",
docs/i18n/humor.json, line 344
"cta": "Vẫn muốn cài?\n\n```bash\ncurl -fsSL https://magic-ai-factory.com/install | bash\n```",
docs/i18n/humor.json, line 367
"cta": "ยังอยากได้อยู่ไหม?\n\n```bash\ncurl -fsSL https://magic-ai-factory.com/install | bash\n```",
docs/i18n/humor.json, line 390
"cta": "Toch installeren?\n\n```bash\ncurl -fsSL https://magic-ai-factory.com/install | bash\n```",
docs/i18n/humor.json, line 413
"cta": "باز هم می‌خواهید؟\n\n```bash\ncurl -fsSL https://magic-ai-factory.com/install | bash\n```",
docs/i18n/humor.json, line 436
"cta": "Aj tak chcete?\n\n```bash\ncurl -fsSL https://magic-ai-factory.com/install | bash\n```",
docs/i18n/humor.json, line 459
"cta": "Ipak želite?\n\n```bash\ncurl -fsSL https://magic-ai-factory.com/install | bash\n```",
docs/i18n/humor.json, line 482
"cta": "তবুও একটা চান?\n\n```bash\ncurl -fsSL https://magic-ai-factory.com/install | bash\n```",
docs/i18n/humor.json, line 505
"cta": "Gusto mo pa rin ba?\n\n```bash\ncurl -fsSL https://magic-ai-factory.com/install | bash\n```",
docs/i18n/humor.json, line 528
"cta": "עדיין רוצה אחד?\n\n```bash\ncurl -fsSL https://magic-ai-factory.com/install | bash\n```",
docs/i18n/humor.json, line 551
"cta": "Masih nak juga?\n\n```bash\ncurl -fsSL https://magic-ai-factory.com/install | bash\n```",
docs/i18n/humor.json, line 574
"cta": "Ipak ga hoćeš?\n\n```bash\ncurl -fsSL https://magic-ai-factory.com/install | bash\n```",
docs/user-guide/humor/cartoon.html, line 85
<code id="endCmd">curl -fsSL https://magic-ai-factory.com/install | bash</code>
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
src/cli/commands/mandate.ts, line 41
const res = await fetch(`${hub}${path}`, {
src/cli/commands/mandate.ts, line 87
const res = await fetch(`${hub}/ai-market/v2/mandates`, {
src/economy/aimarket.ts, line 157
return fetch(input, init);
Show more
src/economy/aimarket.ts, line 164
const res = await fetch(`${this.o.hubUrl}/ai-market/v2/search?${params.toString()}`, {
src/economy/aimarket.ts, line 280
const res = await fetch(`${this.o.hubUrl}/ai-market/v2/invoke`, {
src/economy/aimarket.ts, line 374
const res = await fetch(`${this.o.hubUrl}/ai-market/v2/verification/${encodeURIComponent(nonce)}`, {
src/economy/lottery.ts, line 73
const response = await fetch(`${lotteryHubUrl()}/ai-market/v2/lottery/work-seat-entitlement`, {
src/economy/lottery.ts, line 108
const r = await fetch(`${relayerUrl()}/work-seat`, {
Dockerfile, line 49
CMD node -e "fetch('http://127.0.0.1:'+(process.env.ARGUS_HTTP_PORT||8787)+'/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
docker-compose.yml, line 48
test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:'+(process.env.ARGUS_HTTP_PORT||8787)+'/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
docker-compose.yml, line 84
test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:'+(process.env.ARGUS_HTTP_PORT||8787)+'/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
src/config.ts, line 235
feedPublicKey: process.env.ARGUS_THREAT_FEED_PUBKEY || undefined,
src/config.ts, line 271
tlsKey: process.env.ARGUS_TLS_KEY || undefined,
src/config.ts, line 276
token: process.env.ALIEN_API_TOKEN ?? process.env.ALIEN_MONITOR_API_TOKEN ?? "",
Show more
src/config.ts, line 419
// code/config default OFF and a deployment opts in via .env (never committed).
src/config.ts, line 427
merged.economy.agentKeySeedHex = process.env.ARGUS_AGENT_KEY?.trim() || undefined;
src/config.ts, line 439
token: process.env.ALIEN_API_TOKEN ?? process.env.ALIEN_MONITOR_API_TOKEN ?? "",
src/env-file.ts, line 5
/** Parse `.env` text into key/value pairs (supports # comments and quoted values). */
src/env-file.ts, line 30
/** Candidate `.env` paths: explicit file → cwd → ARGUS_HOME / ~/.argus/agent. */
src/env-file.ts, line 42
add(resolve(process.cwd(), ".env"));
src/env-file.ts, line 44
add(join(home, ".env"));
src/cli/commands/a2a.ts, line 78
const apiKey = process.env.ARGUS_HUB_API_KEY?.trim() || undefined;
src/cli/commands/a2a.ts, line 95
const apiKey = process.env.ARGUS_HUB_API_KEY?.trim() || undefined;
src/cli/commands/channels.ts, line 103
token: process.env.ARGUS_HTTP_TOKEN?.trim(),
src/cli/commands/channels.ts, line 211
console.log("You can now remove ARGUS_TELEGRAM_TOKEN from your .env file.");
src/cli/commands/keystore.ts, line 108
console.log(" You can now remove ARGUS_WALLET_KEY / ARGUS_WALLET_MNEMONIC from .env.");
src/cli/commands/mandate.ts, line 23
console.log("Put the secret in your .env as ARGUS_AGENT_KEY=<secret> (never commit it). Give the did:key");
Agent instructions
Serious
instructions tell the agent to ignore earlier instructions.
AGENT_IGNORE_INSTRUCTIONS
docs/security-warden-es.md, line 33
| **Envenenamiento de herramientas / prompt injection** | Directivas imperativas ocultas en la *descripción* de una herramienta o esquema («ignore previous instructions», etiquetas
docs/security-warden-es.md, line 101
parámetro* de credencial pesaba lo mismo que «ignore all previous instructions». Un
docs/security-warden-ru.md, line 34
| **Отравление инструментов / prompt injection** | Императивные директивы, скрытые в *описании* инструмента или схеме («ignore previous instructions», теги `<system>`, «do not tell
Show more
docs/security-warden-ru.md, line 103
учётными данными весило столько же, сколько «ignore all previous instructions».
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 48f8a08192e4. requests shell access. The manifest names this permission. install fetches a script from the network. can reach a host that is not written as a fixed address. reads a credential or environment file. instructions tell the agent to ignore earlier instructions.

Date and source

Date checked: 21 Oct 2026

View source

github.com

Commit graded: 48f8a08192e48dd3b9fa453e908de9067c29a3bd

This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.

Read how this letter is chosen

What was checked

Permissions

Install and update

Network

Secrets

Agent instructions

Obfuscation

Licence

Maintainer activity

Note

Date and source