MCP, MCP server
CogniRepo
mcp-name: io.github.ashlesh-t/cognirepo Persistent memory and context for any AI tool.
Compatibility: Not stated.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
OBFUSCATION_ENCODED_BLOB
Why this grade
- OBFUSCATION_ENCODED_BLOB Medium
Contains a long base64 shaped string in a file that should be readable.
interface/cli/main.py, line 1
# SPDX-FileCopyrightText: 2026 Ashlesha T
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
core/vector_db/factory.py, line 187
res = subprocess.run(
data/graph/org_graph.py, line 121
os.remove(path)
intelligence/indexer/ast_indexer.py, line 313
return subprocess.check_output(cmd, stderr=subprocess.DEVNULL).decode().strip()
Show more
intelligence/indexer/ast_indexer.py, line 1521
proc = subprocess.run(
intelligence/indexer/ast_indexer.py, line 2825
os.remove(_queue_path)
intelligence/indexer/ast_indexer.py, line 2828
os.remove(_prog)
intelligence/indexer/doc_ingester.py, line 225
result = subprocess.run(
intelligence/indexer/doc_ingester.py, line 250
result = subprocess.run(
intelligence/indexer/doc_ingester.py, line 269
result = subprocess.run(
intelligence/indexer/doc_ingester.py, line 395
proc = subprocess.run(
interface/cli/daemon.py, line 566
def spawn_detached_watcher(repo_path: str, log_path: str) -> "subprocess.Popen":
interface/cli/init_project.py, line 952
shutil.rmtree(cr_dir)
interface/server/mcp_server.py, line 278
os.remove(lock_path) # orphaned lock - a reindex never takes 30 min lock-held
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
intelligence/indexer/http_call_scanner.py, line 34
# JS/TS: fetch("/path") or axios.get("/path")
interface/cli/key_probes.py, line 60
with urllib.request.urlopen(req, timeout=timeout) as resp: # nosec B310
interface/cli/key_probes.py, line 77
with urllib.request.urlopen(url, timeout=timeout) as resp: # nosec B310
Show more
interface/cli/key_probes.py, line 97
with urllib.request.urlopen(req, timeout=timeout) as resp: # nosec B310
interface/cli/key_probes.py, line 117
with urllib.request.urlopen(req, timeout=timeout) as resp: # nosec B310
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
intelligence/indexer/ast_indexer.py, line 1926
".cfg", ".ini", ".lock", ".gitignore", ".env",
intelligence/orchestrator/router.py, line 261
if os.environ.get("ANTHROPIC_API_KEY"):
intelligence/orchestrator/router.py, line 263
if os.environ.get("GEMINI_API_KEY") or os.environ.get("GOOGLE_API_KEY"):
Show more
intelligence/orchestrator/router.py, line 265
if os.environ.get("GROK_API_KEY"):
intelligence/orchestrator/router.py, line 267
if os.environ.get("OPENAI_API_KEY"):
intelligence/orchestrator/model_adapters/anthropic_adapter.py, line 74
api_key = os.environ.get("ANTHROPIC_API_KEY", "")
intelligence/orchestrator/model_adapters/gemini_adapter.py, line 58
api_key = os.environ.get("GEMINI_API_KEY", os.environ.get("GOOGLE_API_KEY", ""))
intelligence/orchestrator/model_adapters/grok_adapter.py, line 52
api_key = os.environ.get("GROK_API_KEY", "")
interface/cli/env_wizard.py, line 8
EnvWizard - interactive .env setup wizard for first-run experience.
interface/cli/env_wizard.py, line 15
guided_flow() - hidden-input prompts per key, write to .env
interface/cli/env_wizard.py, line 24
- .env file is NOT committed - wizard warns if .env is not in .gitignore
interface/cli/env_wizard.py, line 49
return Path(project_dir) / ".env"
interface/cli/env_wizard.py, line 53
"""Parse .env file into a dict (key=value, no shell expansion)."""
interface/cli/env_wizard.py, line 68
"""Write or update a key in .env (preserving other entries)."""
interface/cli/env_wizard.py, line 74
# Fallback: append to .env manually
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Concern
contains an encoded blob in a file that should be readable.
OBFUSCATION_ENCODED_BLOB
interface/cli/main.py, line 1
# SPDX-FileCopyrightText: 2026 Ashlesha T
tests/test_hook_status.py, line 1
# SPDX-FileCopyrightText: 2026 Ashlesha T
interface/tools/README.md, line 4
nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit d3147abfbe40. can delete files. can reach a host that is not written as a fixed address. reads a credential or environment file. contains an encoded blob in a file that should be readable.
Date and source
Date checked:
github.com
Commit graded: d3147abfbe40ced2f7d153fc52fb342a192bfa12
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.