MCP, MCP server
claudemap
Welcome to...
Compatibility: Not stated.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit c0a9b93b4d1e, unchanged since the check below.
OBFUSCATION_MINIFIED_PAYLOAD
Why this grade
- OBFUSCATION_MINIFIED_PAYLOAD Medium
Contains a very long line with almost no spaces in a script or style file.
stitch-base.js, line 1
"use strict";this.default_Nemo=this.default_Nemo||{};(function(_){var window=this;
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
scripts/build-site.js, line 186
fs.rmSync(runtimeGraphPath, { force: true })
scripts/build-site.js, line 192
fs.rmSync(runtimeStatePath, { force: true })
scripts/build-site.js, line 197
fs.rmSync(runtimeManifestPath, { force: true })
Show more
scripts/build-site.js, line 203
fs.rmSync(TEMP_BUILD_CONFIG_PATH, { force: true })
scripts/install-claudemap.js, line 324
fs.rmSync(markerPath, { force: true })
scripts/install-claudemap.js, line 381
fs.rmSync(absoluteManagedPath, {
scripts/install-claudemap.js, line 445
fs.rmSync(absoluteLegacyRoot, {
scripts/package-claudemap-skill.js, line 529
fs.rmSync(artifactRoot, { recursive: true, force: true })
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
app/src/lib/mapApi.js, line 88
response = await window.fetch(createApiUrl(API_ACTIVE_MAP_ENDPOINT), {
app/src/lib/runtimeAssets.js, line 112
const response = await window.fetch(runtimeGraphUrl, {
app/src/lib/runtimeAssets.js, line 132
const response = await window.fetch(runtimeStateUrl, {
Show more
app/src/lib/runtimeAssets.js, line 152
const response = await window.fetch(manifestUrl, {
docs/assets/index-CiCdjGNe.js, line 2
(s){if(s.ep)return;s.ep=!0;const o=n(s);fetch(s.href,o)}})();const He="modulepreload",
skill/lib/launcher.js, line 29
const request = http.get(url, (response) => {
stitch-base.js, line 449
oy.prototype.send=function(a){if(this.readyState!=1)throw this.abort(),Error("ba");if(this.H.signal.aborted)throw this.abort(),Error("ca");this.A=!0;const b={headers:this.J,method:
stitch-base.js, line 562
200||d>=300)return a;throw e;}case "text":return(new TextDecoder).decode(b);case "blob":return new Blob([b],{type:c});case "arraybuffer":return b.buffer}},vD=class{constructor(){le
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_DOTENV
skill/lib/file-walker.js, line 18
'.env',
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Concern
contains a minified payload.
OBFUSCATION_MINIFIED_PAYLOAD
stitch-base.js, line 1
"use strict";this.default_Nemo=this.default_Nemo||{};(function(_){var window=this;
contracts/claudemap-seed-map.json, line 1
{
docs/assets/GraphRuntime-gkfdZl0c.js, line 7
Lines: ${t.lineCount}`}function Qe(t){if(typeof document>"u")return!1;const e=document.createElement("textarea");e.value=t,e.setAttribute("readonly",""),e.style.position="fixed",e.
Show more
docs/assets/app-vendor-BpAWB8cn.js, line 17
*/var Ec=nt,xc=Symbol.for("react.element"),Cc=Symbol.for("react.fragment"),_c=Object.prototype.hasOwnProperty,zc=Ec.__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED.ReactCurrentO
docs/assets/app-vendor-BpAWB8cn.js, line 38
`).replace(Yf,"")}function dr(e,t,n){if(t=fi(t),fi(e)!==t&&n)throw Error(y(425))}function Ar(){}var pu=null,mu=null;function hu(e,t){return e==="textarea"||e==="noscript"||typeof t
docs/assets/app-vendor-BpAWB8cn.js, line 40
`+u.stack}return{value:e,source:t,stack:l,digest:null}}function Bl(e,t,n){return{value:e,source:null,stack:n??null,digest:t??null}}function Cu(e,t){try{console.error(t.value)}catch
docs/assets/claudemap-seed-map-gfjtPN-V.js, line 1
const e={repoName:"claudemap",branch:"main",creditLabel:"ClaudeMap self-map",generatedAt:"2026-04-19T19:09:05.593Z",source:"manual"},s=[{id:"experience",label:"Map Experience",type
docs/assets/graph-vendor-DP94cCHk.js, line 1
import{r as zn,g as _ln,R as W$n,j as Fn,c as Dfn}from"./app-vendor-BpAWB8cn.js";function ll(d){if(typeof d=="string"||typeof d=="number")return""+d;let v="";if(Array.isArray(d))fo
docs/assets/index-CiCdjGNe.js, line 2
import{a as _e,r as m,j as d,C as Te,b as De,d as je,e as Le,R as Fe}from"./app-vendor-BpAWB8cn.js";(function(){const t=document.createElement("link").relList;if(t&&t.supports&&t.s
docs/graph/claudemap-runtime.json, line 1
{
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit c0a9b93b4d1e. can delete files. can reach a host that is not written as a fixed address. reads a credential or environment file. contains a minified payload.
Date and source
Date checked:
github.com
Commit graded: c0a9b93b4d1ed9b9a1b5cd4eaa2b1e4a95cb98e9
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.