MCP, MCP server
B2IGE Verify
Don't trust done.
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_FILE_OVER_READ_CAP
Why this grade
- PERMISSION_DELETE_FILES Low
Contains a call that can delete files.
benchmarks/run-local.py, line 18
subprocess.run(["cargo", "build", "--workspace", "--release", "--locked"], cwd=repo, check=True) - NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
distribution/build_mcpb.py, line 28
with urllib.request.urlopen(f"{base}/{name}", timeout=120) as response: - SECRETS_PATH_DOTENV Low
Mentions a .env file.
benchmarks/corpus/blindtest.rs, line 282
.env("DOCKER_BUILDKIT", "0") - OBFUSCATION_FILE_OVER_READ_CAP Note
A file was over the read cap and was not fully read.
THIRD-PARTY-NOTICES.txt, line 1
B2IGE Verify 0.3.0 - third-party notices
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
benchmarks/run-local.py, line 18
subprocess.run(["cargo", "build", "--workspace", "--release", "--locked"], cwd=repo, check=True)
benchmarks/run-local.py, line 24
subprocess.run([str(binary), "bench", *scope, "--output", "json", "--save", str(root / name), *flags], cwd=repo, stdout=output, check=True)
benchmarks/run-local.py, line 33
comparison = subprocess.run([str(binary), "bench", "compare", str(r
Show more
distribution/build_mcpb.py, line 65
version = subprocess.check_output([args.mcpb, "--version"], text=True).strip()
distribution/build_mcpb.py, line 112
subprocess.run([args.mcpb, "validate", str(stage / "manifest.json")], check=True)
distribution/build_mcpb.py, line 114
subprocess.run([args.mcpb, "pack", str(stage), str(packed)], check=True)
distribution/build_mcpb.py, line 128
subprocess.run([args.mcpb, "validate", str(extracted_manifest)], check=True)
distribution/test_distribution.py, line 33
return subprocess.run(["/bin/sh", str(self.bundle / "launch.sh"), *args],
npm/b2ige/download.test.cjs, line 46
} finally {fs.rmSync(dir,{recursive:true,force:true});}
npm/b2ige/download.test.cjs, line 97
fs.unlinkSync(path.join(dir,'asset')); // Cached matching delivery works with transport unavailable.
npm/b2ige/download.test.cjs, line 104
} finally {fs.rmSync(dir,{recursive:true,force:true});}
npm/b2ige/bin/download.cjs, line 123
} finally { fs.rmSync(stage, {recursive:true, force:true}); }
scripts/ci-verify.py, line 43
pathlib.Path(a.report).unlink(missing_ok=True)
scripts/ci-verify.py, line 45
pathlib.Path(a.summary).unlink(missing_ok=True)
scripts/install-release.py, line 237
shutil.rmtree(destination)
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
distribution/build_mcpb.py, line 28
with urllib.request.urlopen(f"{base}/{name}", timeout=120) as response:
npm/b2ige/bin/download.cjs, line 37
active = https.get(parsed, {headers:{'User-Agent':'b2ige-verify-launcher','Accept-Encoding':'identity'}}, response => {
scripts/external_pilot_ci.py, line 71
repo = fetch(prefix)
Show more
scripts/external_pilot_ci.py, line 73
pr = fetch(prefix + '/pulls/' + str(pr_number))
scripts/external_pilot_ci.py, line 74
run = fetch(prefix + '/actions/runs/' + str(run_id))
scripts/external_pilot_ci.py, line 88
content = fetch(prefix + '/contents/' + workflow + '?ref=' + base)
scripts/external_pilot_ci.py, line 98
jobs = fetch(prefix + '/actions/runs/' + str(run_id) + '/jobs?per_page=100')
scripts/external_pilot_ci.py, line 106
inventory = fetch(prefix + '/actions/runs/' + str(run_id) + '/artifacts?per_page=100')
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_DOTENV
benchmarks/corpus/blindtest.rs, line 282
.env("DOCKER_BUILDKIT", "0")
examples/blindtest/controller.rs, line 279
.env("DOCKER_BUILDKIT", "0")
scripts/history-scan.py, line 62
if any(p in {'.b2ige', '.git', 'target', '.DS_Store'} or p == '.env' or p.startswith('.env.') for p in parts):
Show more
scripts/hygiene.py, line 19
or part == '.env' or part.startswith('.env.') for part in p.parts):bad.append(str(p));continue
scripts/test-release.py, line 400
for name in ['../escape', '/absolute', 'package/.env', 'package/.git/config', 'package/.b2ige/store.json', 'package/target/binary']:
scripts/validate-archive.py, line 35
if any(p in {'.git', '.b2ige', '.DS_Store', 'target', 'node_modules', '__pycache__', '.cache'} or p == '.env' or p.startswith('.env.') for p in path.parts):
.gitignore, line 11
node_modules/
.gitignore, line 12
.env
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
a file was over the read cap and was not fully read.
OBFUSCATION_FILE_OVER_READ_CAP
THIRD-PARTY-NOTICES.txt, line 1
B2IGE Verify 0.3.0 - third-party notices
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit ec91bb4ad46d. can delete files. can reach a host that is not written as a fixed address. reads a credential or environment file. a file was over the read cap and was not fully read.
Date and source
Date checked:
github.com
Commit graded: ec91bb4ad46d884f1ba854fb34fcc406117f4fc0
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.