MCP, MCP server
bureau
Your agents get better with every task: Bureau briefs them and keeps what they learn.
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_DOTENV SECRETS_ENV_READ
Why this grade
- PERMISSION_DELETE_FILES Low
Contains a call that can delete files.
hub/lib/store.js, line 162
try { fs.unlinkSync(bak(BACKUP_KEEP)); } catch { } - NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
connectors/claude-code/hub.sh, line 24
curl -s -m 15 -X "$M" "$B$P" -H "Authorization: Bearer $T" -H "Content-Type: application/json" -d "$D" - NETWORK_UNNAMED_HOST Low
Calls a fixed host that the description does not name.
connectors/claude-code/hub.sh, line 24
curl -s -m 15 -X "$M" "$B$P" -H "Authorization: Bearer $T" -H "Content-Type: application/json" -d "$D" - SECRETS_PATH_DOTENV Low
Mentions a .env file.
hub/server.js, line 4
// hub/.env first: lib/store.js and lib/knowledge.js read their dirs at load - SECRETS_ENV_READ Note
Reads an environment variable whose name contains KEY, SECRET, TOKEN, PASSWORD or CREDENTIAL.
hub/server.js, line 21
const TOKEN = process.env.BUREAU_TOKEN || '';
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
hub/lib/store.js, line 162
try { fs.unlinkSync(bak(BACKUP_KEEP)); } catch { }
hub/lib/store.js, line 176
try { fs.unlinkSync(path.join(DATA_DIR, n)); } catch { }
hub/lib/store.js, line 234
const release = () => { try { if (mine()) fs.unlinkSync(LOCK_FILE); } catch { } };
Show more
hub/lib/work.js, line 81
fs.rmSync(dir, { recursive: true, force: true, maxRetries: 3 });
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address. can reach example.com. The description does not name that host.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
connectors/claude-code/hub.sh, line 24
curl -s -m 15 -X "$M" "$B$P" -H "Authorization: Bearer $T" -H "Content-Type: application/json" -d "$D"
connectors/claude-code/hub.sh, line 26
curl -s -m 15 -X "$M" "$B$P" -H "Authorization: Bearer $T"
hub/server.js, line 586
// raw=1 serves bytes with the right content-type (browsers, curl -o);
Show more
hub/lib/discord.js, line 65
await fetch(WEBHOOK, {
hub/lib/poke.js, line 92
await fetch(sub.url, {
hub/lib/poke.js, line 132
await fetch(sub.url, {
hub/public/v2/awaiting-merge.js, line 39
// https://example.com fetch resets the connection; curl through the
hub/public/v2/awaiting-merge.js, line 215
inflight[repoKey] = fetch(url, { headers: { Accept: 'application/vnd.github+json' }, signal: controller ? controller.signal : undefined })
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
hub/server.js, line 4
// hub/.env first: lib/store.js and lib/knowledge.js read their dirs at load
hub/server.js, line 21
const TOKEN = process.env.BUREAU_TOKEN || '';
hub/server.js, line 23
if (!TOKEN) console.warn(`WARNING: BUREAU_TOKEN not set: API is UNPROTECTED. Set it in hub/.env, e.g. from ${TOKEN_HINT}`);
Show more
hub/server.js, line 24
// the placeholder in .env.example (test/storage.sh keeps the two in step)
hub/server.js, line 25
AU_TOKEN is still the example token from .env.example: anyone who has read the repo c
hub/start.sh, line 5
# The hub itself loads ./.env and maps a host-injected IP to its listen
hub/lib/env.js, line 12
// real .env files lean on it (a BUREAU_POKES built from POKE_* lines above
.dockerignore, line 17
hub/work/
.dockerignore, line 19
**/.env
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit bd42dde84010. can delete files. can reach a host that is not written as a fixed address. can reach example.com. The description does not name that host. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: bd42dde840102583458712156a0e29ce518c9210
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.