MCP, MCP server
B4n1Web
B4n1Web, an MCP server listed in the PlugVet directory.
Compatibility: Not stated.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 68a7b5c6b6f3.
INSTALL_REMOTE_SCRIPT
Why this grade
- INSTALL_REMOTE_SCRIPT Medium
Fetches a script from the network and runs it (a pipe to a shell, or an install hook with a URL).
scripts/install.sh, line 4
# Usage: curl -sL https://raw.githubusercontent.com/B4N1-com/b4n1-web/master/scripts/install.sh | bash
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
If you think this grade is wrong, email [email protected] with the entry link and your evidence. We aim to acknowledge within two working days and decide within seven. If we confirm an error, we aim to correct it within 24 hours of confirming it. These are aims, not guarantees.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Note
requests shell access. The manifest names this permission.
PERMISSION_SHELL_DECLARED
sdks/go/b4n1web.go, line 210
cmd := exec.CommandContext(ctx, argv[0], argv[1:]...)
sdks/php/src/B4n1Web/AgentBrowser.php, line 110
$proc = proc_open($cmd, $spec, $pipes);
sdks/python/b4n1web/__main__.py, line 103
subprocess.run(["chmod", "+x", str(binary_path)], check=True)
Show more
sdks/python/b4n1web/__main__.py, line 107
subprocess.run(
sdks/python/b4n1web/browser.py, line 110
result = subprocess.run(
sdks/python/b4n1web/browser.py, line 187
result = subprocess.run(
sdks/python/b4n1web/browser.py, line 212
result = subprocess.run(
sdks/python/b4n1web/mcp.py, line 42
self._process: Optional[subprocess.Popen] = None
Install and update
Serious
install fetches a script from the network. The docs document an installer that pipes a download into a shell.
INSTALL_REMOTE_SCRIPT INSTALL_DOCUMENTED_INSTALLER
scripts/install.sh, line 4
# Usage: curl -sL https://raw.githubusercontent.com/B4N1-com/b4n1-web/master/scripts/install.sh | bash
sdks/go/b4n1web.go, line 191
return "", fmt.Errorf("%w. Install it (curl -sL https://raw.githubusercontent.com/B4N1-com/b4n1-web/master/scripts/install.sh | bash) or set B4N1WEB_BIN_PATH", ErrBinaryNotFound)
sdks/javascript/examples/basic.js, line 7
console.error('b4n1web binary not found. Install: curl -sL https://b4n1.com/install | bash');
Show more
sdks/javascript/src/browser.ts, line 40
`For MCP server: curl -sL https://raw.githubusercontent.com/B4N1-com/b4n1-web/master/scripts/install.sh | bash`
sdks/javascript/src/errors.ts, line 2
constructor(message = 'B4n1Web binary not found. Please install it first:\n curl -sL https://raw.githubusercontent.com/B4N1-com/b4n1-web/master/scripts/install.sh | bash') {
sdks/javascript/src/types.ts, line 46
constructor(message = 'B4n1Web binary not found. Please install it first:\n curl -sL https://raw.githubusercontent.com/B4N1-com/b4n1-web/master/scripts/install.sh | bash') {
sdks/python/b4n1web/__init__.py, line 6
curl -sL https://raw.githubusercontent.com/B4N1-com/b4n1-web/master/scripts/install.sh | bash
sdks/python/b4n1web/__main__.py, line 76
print(" curl -sL https://raw.githubusercontent.com/B4N1-com/b4n1-web/master/scripts/install.sh | bash")
sdks/python/b4n1web/errors.py, line 12
" curl -sL https://raw.githubusercontent.com/B4N1-com/b4n1-web/master/scripts/install.sh | bash"
sdks/csharp/examples/Basic.cs, line 5
// curl -sL https://b4n1.com/install | bash
sdks/csharp/src/Models.cs, line 63
"B4n1Web binary not found. Please install it first:\n curl -sL https://raw.githubusercontent.com/B4N1-com/b4n1-web/master/scripts/install.sh | bash")
sdks/java/src/main/java/com/b4n1/web/BinaryNotFoundException.java, line 8
super("B4n1Web binary not found. Please install it first:\n curl -sL https://raw.githubusercontent.com/B4N1-com/b4n1-web/master/scripts/install.sh | bash");
sdks/php/bin/b4n1web, line 41
fwrite(STDERR, " Install: curl -sL https://raw.githubusercontent.com/B4N1-com/b4n1-web/master/scripts/install.sh | bash\n");
README.md, line 54
curl -sL https://raw.githubusercontent.com/B4N1-com/b4n1-web/master/scripts/install.sh | bash
i18n/README.ar.md, line 75
curl -sL https://raw.githubusercontent.com/B4N1-com/b4n1-web/master/scripts/install.sh | bash
i18n/README.de.md, line 75
curl -sL https://raw.githubusercontent.com/B4N1-com/b4n1-web/master/scripts/install.sh | bash
i18n/README.es.md, line 75
curl -sL https://raw.githubusercontent.com/B4N1-com/b4n1-web/master/scripts/install.sh | bash
i18n/README.fr.md, line 75
curl -sL https://raw.githubusercontent.com/B4N1-com/b4n1-web/master/scripts/install.sh | bash
i18n/README.hi.md, line 75
curl -sL https://raw.githubusercontent.com/B4N1-com/b4n1-web/master/scripts/install.sh | bash
i18n/README.it.md, line 75
curl -sL https://raw.githubusercontent.com/B4N1-com/b4n1-web/master/scripts/install.sh | bash
i18n/README.ja.md, line 75
curl -sL https://raw.githubusercontent.com/B4N1-com/b4n1-web/master/scripts/install.sh | bash
i18n/README.ko.md, line 75
curl -sL https://raw.githubusercontent.com/B4N1-com/b4n1-web/master/scripts/install.sh | bash
i18n/README.pt-BR.md, line 75
curl -sL https://raw.githubusercontent.com/B4N1-com/b4n1-web/master/scripts/install.sh | bash
i18n/README.ru.md, line 75
curl -sL https://raw.githubusercontent.com/B4N1-com/b4n1-web/master/scripts/install.sh | bash
i18n/README.zh-CN.md, line 75
curl -sL https://raw.githubusercontent.com/B4N1-com/b4n1-web/master/scripts/install.sh | bash
sdks/javascript/README.md, line 121
print(" curl -sL https://b4n1.com/install | bash")
sdks/python/README.md, line 120
print(" curl -sL https://b4n1.com/install | bash")
sdks/python/b4n1web/README.md, line 106
print(" curl -sL https://b4n1.com/install | bash")
Network
Concern
can reach a host that is not written as a fixed address. can reach api.github.com. The description does not name that host.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
scripts/install.sh, line 8
VERSION=$(curl -s https://api.github.com/repos/B4N1-com/b4n1-web/releases/latest | grep -o '"tag_name": "[^"]*"' | cut -d'"' -f4 | sed 's/v//')
scripts/install.sh, line 75
if ! curl -sL --fail "$download_url" -o "$temp_dir/b4n1web.tar.gz" 2>/dev/null; then
sdks/python/b4n1web/__main__.py, line 62
resp = requests.get(
Show more
sdks/python/b4n1web/__main__.py, line 81
resp = requests.get(download_url, timeout=120)
sdks/ruby/lib/b4n1web/binary.rb, line 58
ENV.fetch("PATH", "").split(File::PATH_SEPARATOR).each do |dir|
sdks/ruby/lib/b4n1web/binary.rb, line 68
"b4n1web binary not found. Install it (curl -sL " \
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_DOTENV
CHANGELOG.md, line 192
- **Critical**: `.env` removed from git history (contained live API keys: PyPI, NuGet, Sonatype)
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
a file was over the read cap and was not fully read.
OBFUSCATION_FILE_OVER_READ_CAP
sdks/java/src/main/resources/b4n1web-linux-amd64, line 1
ELF>�'@���@8
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 68a7b5c6b6f3. requests shell access. The manifest names this permission. install fetches a script from the network. can reach a host that is not written as a fixed address. can reach api.github.com. The description does not name that host. reads a credential or environment file. a file was over the read cap and was not fully read.
Date and source
Date checked:
github.com
Commit graded: 68a7b5c6b6f30d4d6900c0dd9a5efbc166e67cc4
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.