MCP, MCP server
Aries Cli
Agentic coding harness with persistent memory and a REPL body.
Compatibility: Not stated.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 9863894076e0, unchanged since the check below.
NETWORK_HOST_FROM_INPUT
Why this grade
- NETWORK_HOST_FROM_INPUT Medium
A file takes a URL or endpoint as input and has no fixed host list.
bench/swe-lite/fetch-tasks.ts, line 36
const res = await fetch(url);
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
bench/swe-lite/run.ts, line 307
// Workaround: pre-write a Python wrapper that does subprocess.run([...])
bench/swe-lite/run.ts, line 327
'r = subprocess.run(',
body/codebase.py, line 616
result = subprocess.run(
Show more
body/shell.py, line 3
# namespace. Wraps the TS child_process.exec - the model writes
body/test_api_contract.py, line 83
proc = subprocess.Popen(
body/test_fs_paths.py, line 68
shutil.rmtree(TMP, ignore_errors=True)
body/version.py, line 64
out = subprocess.run(
scripts/a10_substrate_smoke.py, line 133
proc = subprocess.Popen(
scripts/a10_substrate_smoke.py, line 345
check_result = subprocess.run(
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address. accepts a host from input, with no fixed list in this file. can reach r.jina.ai. The description does not name that host. can reach api.tavily.com. The description does not name that host. can reach google.serper.dev. The description does not name that host.
NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
bench/swe-lite/fetch-tasks.ts, line 36
const res = await fetch(url);
body/research.py, line 161
def fetch(self, url: str, focus: str = "", title: str = "") -> dict:
body/server.py, line 201
# `web.fetch(url)` / `web.search(q)` without caring about backend config.
Show more
body/web.py, line 7
# `results = web.search(q); content = web.fetch(results[0]['url'])` in one
body/web.py, line 11
# - fetch(url, max_length=50000) - proxies WebFetchTool via bridge
body/web.py, line 97
def fetch(self, url: str, max_length: int = 50_000) -> str:
body/web.py, line 127
to web.fetch (Jina Reader under the hood, falls back to direct
body/web.py, line 132
return self.fetch(url, max_length=max_length)
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
bench/compare.ts, line 244
anthropicApiKey: process.env.ANTHROPIC_API_KEY,
bench/effort-grid.ts, line 43
// Load .env for API keys (DeepSeek, OpenRouter, etc - Anthropic uses OAuth via config).
bench/effort-grid.ts, line 45
const envText = readFileSync('.env', 'utf-8');
Show more
bench/effort-grid.ts, line 50
} catch { /* no .env */ }
bench/plan-schema-stub.ts, line 45
// Load .env if present.
bench/plan-schema-stub.ts, line 47
const envText = readFileSync('.env', 'utf-8');
bench/plan-schema-stub.ts, line 52
} catch { /* no .env */ }
bench/quick.ts, line 146
// Load .env
bench/quick.ts, line 148
const envText = readFileSync('.env', 'utf-8');
bench/quick.ts, line 335
anthropicApiKey: process.env.ANTHROPIC_API_KEY,
bench/2026-04/runner/run.ts, line 103
const apiKey = process.env.ANTHROPIC_API_KEY;
bench/2026-04/runner/run.ts, line 443
if (!process.env.ANTHROPIC_API_KEY) {
bench/swe-lite/run.ts, line 451
const apiKey = DOTENV.ANTHROPIC_API_KEY ?? process.env.ANTHROPIC_API_KEY;
bench/swe-lite/run.ts, line 452
const openrouterKey = DOTENV.OPENROUTER_API_KEY ?? process.env.OPENROUTER_API_KEY;
bench/swe-lite/run.ts, line 453
const oauthToken = DOTENV.ANTHROPIC_AUTH_TOKEN ?? process.env.ANTHROPIC_AUTH_TOKEN;
scripts/loop2_thinking_probe.ts, line 13
const apiKey = process.env.ANTHROPIC_API_KEY;
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Concern
contains an encoded blob in a file that should be readable.
OBFUSCATION_ENCODED_BLOB
bench/2026-04/runs/2026-04-27/02-repl-failure-audit-claude-code.json, line 1
{
bench/2026-04/runs/2026-04-27/02-repl-failure-audit-claude-code.transcript.txt, line 1
{"type":"system","subtype":"init","cwd":"C:\\Users\\aayoa\\Desktop\\aries-cli","session_id":"4a0e4615-54a6-4c3e-9bfa-e673fcd72030","tools":["Task","AskUserQuestion","Bash","CronCre
spike/body/graph.json, line 1
{
Show more
bench/2026-04/runs/2026-04-27/01-cache-break-trace-claude-code.json, line 22
"transcript": "{\"type\":\"system\",\"subtype\":\"init\",\"cwd\":\"C:\\\\Users\\\\aayoa\\\\Desktop\\\\aries-cli\",\"session_id\":\"790e6f3f-ae8b-42a0-a802-84d2d88779e7\",\"tools\":
bench/2026-04/runs/2026-04-27/01-cache-break-trace-claude-code.transcript.txt, line 7
{"type":"stream_event","event":{"type":"content_block_delta","index":0,"delta":{"type":"signature_delta","signature":"EpADClsIDRgCKkDjzJbnROYIbwLlrNzaimgd/KkvcJrm17X+j2rnA33fR+faPD
bench/2026-04/runs/2026-04-27/01-cache-break-trace-claude-code.transcript.txt, line 8
{"type":"assistant","message":{"model":"claude-sonnet-4-6","id":"msg_01TPvAvvvTY35v8nykzDFaGE","type":"message","role":"assistant","content":[{"type":"thinking","thinking":"The use
bench/2026-04/runs/2026-04-27/02-repl-failure-audit-claude-code.json, line 21
"transcript": "{\"type\":\"system\",\"subtype\":\"init\",\"cwd\":\"C:\\\\Users\\\\aayoa\\\\Desktop\\\\aries-cli\",\"session_id\":\"4a0e4615-54a6-4c3e-9bfa-e673fcd72030\",\"tools\":
bench/2026-04/runs/2026-04-27/02-repl-failure-audit-claude-code.transcript.txt, line 7
{"type":"stream_event","event":{"type":"content_block_delta","index":0,"delta":{"type":"signature_delta","signature":"Er4CClsIDRgCKkAraTeB4wDy9pylybaiBZa2lJ+wOfQv6QfiW2VkkM4yTSR9ac
bench/2026-04/runs/2026-04-27/02-repl-failure-audit-claude-code.transcript.txt, line 8
{"type":"assistant","message":{"model":"claude-sonnet-4-6","id":"msg_0147XurWnzZjgD9Ei6jiKgK9","type":"message","role":"assistant","content":[{"type":"thinking","thinking":"The use
bench/2026-04/runs/2026-04-27/02-repl-failure-audit-claude-code.transcript.txt, line 110
{"type":"stream_event","event":{"type":"content_block_delta","index":0,"delta":{"type":"signature_delta","signature":"EvUDClsIDRgCKkCyHHplA8qXUqwVwZYFELq4ftPDloUd4L4Bg/Y0Vh8p4l6epg
bench/2026-04/runs/2026-04-27/02-repl-failure-audit-claude-code.transcript.txt, line 111
{"type":"assistant","message":{"model":"claude-sonnet-4-6","id":"msg_019PAt7P5m7bR7No5knWnDh6","type":"message","role":"assistant","content":[{"type":"thinking","thinking":"Now I u
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 9863894076e0. can delete files. can reach a host that is not written as a fixed address. accepts a host from input, with no fixed list in this file. can reach r.jina.ai. The description does not name that host. can reach api.tavily.com. The description does not name that host. can reach google.serper.dev. The description does not name that host. reads a credential or environment file. contains an encoded blob in a file that should be readable.
Date and source
Date checked:
github.com
Commit graded: 9863894076e03ec03b82f309fc5ef742aa1994d9
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.