Grades are a hygiene check, not a security guarantee.

MCP, MCP server

Code Mcp

Code Mcp, an MCP server listed in the PlugVet directory.

Compatibility: Not stated.

Grade D

Two or more Medium findings, or a High finding. Only try it in a sandbox.

Graded by PlugVetRubric v2

Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.

Rescanned at commit 4cfc4643541a, unchanged since the check below.

INSTALL_REMOTE_SCRIPT SECRETS_PATH_CREDENTIAL

Why this grade

  • INSTALL_REMOTE_SCRIPT Medium

    Fetches a script from the network and runs it (a pipe to a shell, or an install hook with a URL).

    install.sh, line 4 # Usage: curl -LsSf https://raw.githubusercontent.com/54yyyu/code-mcp/main/install.sh | sh

  • SECRETS_PATH_CREDENTIAL Medium

    Mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc).

    README.md, line 186 --ssh-key ~/.ssh/id_ed25519

Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.

If you think this grade is wrong, email [email protected] with the entry link and your evidence. We aim to acknowledge within two working days and decide within seven. If we confirm an error, we aim to correct it within 24 hours of confirming it. These are aims, not guarantees.

Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.

What was checked

Plain notes from the hygiene checks.

  • Permissions

    Concern

    can delete files.

    PERMISSION_DELETE_FILES

    install.ps1, line 3

    # Usage: Invoke-WebRequest -Uri https://raw.githubusercontent.com/54yyyu/code-mcp/main/install.ps1 | Invoke-Expression

    install.ps1, line 74

    Invoke-RestMethod -Uri https://astral.sh/uv/install.ps1 | Invoke-Expression

    src/code_mcp/edit_utils.py, line 979

    shutil.rmtree(temp_dir)

    Show more

    src/code_mcp/server.py, line 282

    process = subprocess.Popen(

    src/code_mcp/server.py, line 347

    process = subprocess.Popen(

    src/code_mcp/server.py, line 1452

    shutil.rmtree(path)

    src/code_mcp/setup_helper.py, line 110

    result = subprocess.run(

    src/code_mcp/setup_helper.py, line 153

    os.remove(symlink_path)

  • Install and update

    Serious

    install fetches a script from the network. README documents an installer that pipes a download into a shell. The docs document an installer that pipes a download into a shell.

    INSTALL_REMOTE_SCRIPT INSTALL_DOCUMENTED_INSTALLER

    README.md, line 33

    curl -LsSf https://raw.githubusercontent.com/54yyyu/code-mcp/main/install.sh | sh

    README.md, line 67

    curl -LsSf https://raw.githubusercontent.com/54yyyu/code-mcp/remote-edit/install.sh | sh

    install.sh, line 4

    # Usage: curl -LsSf https://raw.githubusercontent.com/54yyyu/code-mcp/main/install.sh | sh

    Show more

    README.md, line 80

    curl -LsSf https://raw.githubusercontent.com/54yyyu/code-mcp/jupyter/install.sh | sh

    README.md, line 178

    curl -sSL https://raw.githubusercontent.com/54yyyu/code-mcp/remote-edit/remote-install.sh | bash -s -- --remote-host user@hostname

    README.md, line 181

    curl -sSL https://raw.githubusercontent.com/54yyyu/code-mcp/remote-edit/remote-install.sh | bash -s -- \

    install.sh, line 76

    curl -LsSf https://astral.sh/uv/install.sh | sh

    requirements.txt, line 2

    mcp[cli]>=0.1.0

  • Network

    Pass

    No network call found.

  • Secrets

    Concern

    reads a credential or environment file.

    SECRETS_PATH_CREDENTIAL

    .gitignore, line 32

    ENV/

    README.md, line 186

    --ssh-key ~/.ssh/id_ed25519

    README.md, line 204

    --ssh-key ~/.ssh/id_ed25519

  • Agent instructions

    Pass

    No instruction to ignore earlier instructions or to hide a step.

  • Obfuscation

    Pass

    No encoded or minified payload found.

  • Licence

    Pass

    A licence file is present (LICENSE).

  • Maintainer activity

    Note

    the latest commit is more than 365 days old.

    MAINTAINER_STALE

    No file path was stored.

    2025-03-21T18:57:08-04:00

Get the full report on this tool, £49

Note

Hygiene check of commit 4cfc4643541a. can delete files. install fetches a script from the network. README documents an installer that pipes a download into a shell. The docs document an installer that pipes a download into a shell. reads a credential or environment file. the latest commit is more than 365 days old.

Date and source

Date checked:

View source

github.com

Commit graded: 4cfc4643541a110c906d93635b391bf7e357f4a8

This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.

Read how this letter is chosen