MCP, MCP server
envpreflight
Check your machine can actually run this project — before you waste a day finding out it can't.
Compatibility: Not stated.
Grade C
One Medium finding. Read the report before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
INSTALL_REMOTE_SCRIPT
Why this grade
- INSTALL_REMOTE_SCRIPT Medium
Fetches a script from the network and runs it (a pipe to a shell, or an install hook with a URL).
packages/core/src/checks/runtime.ts, line 555
fix: `curl -fsSL https://bun.sh/install | bash`,
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
packages/cli/src/fix.test.ts, line 22
await fs.rm(tempDir, { recursive: true, force: true });
packages/cli/src/init.test.ts, line 21
await fs.rm(tempDir, { recursive: true, force: true });
packages/cli/src/render.github.test.ts, line 16
await fs.rm(tempDir, { recursive: true, force: true });
Show more
packages/cli/src/undo.test.ts, line 18
await fs.rm(tempDir, { recursive: true, force: true });
packages/core/src/config.test.ts, line 15
await fs.rm(tempDir, { recursive: true, force: true });
packages/core/src/index.workspaces.test.ts, line 15
await fs.rm(tempDir, { recursive: true, force: true });
packages/core/src/workspaces.test.ts, line 15
await fs.rm(tempDir, { recursive: true, force: true });
Install and update
Serious
install fetches a script from the network.
INSTALL_REMOTE_SCRIPT
packages/core/src/checks/runtime.ts, line 555
fix: `curl -fsSL https://bun.sh/install | bash`,
packages/core/src/checks/runtime.ts, line 601
fix: `curl -fsSL https://deno.land/install.sh | sh`,
Network
Pass
No network call found.
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_DOTENV
docs/src/app/page.tsx, line 122
span> <span style={{ color: '#E5E5E5' }}>.env </span> <span style={{ color:
docs/src/app/page.tsx, line 165
Compares key diffs between <code>.env.example</code> and <code>.env</code>. Never parses, reads, logs, or transmits secret values. Complete privacy by design.
packages/cli/src/fix.test.ts, line 46
message: 'Missing PORT in .env',
Show more
packages/cli/src/fix.test.ts, line 47
fix: 'echo "PORT=3000" >> .env',
packages/cli/src/fix.test.ts, line 109
expect(executed).toContain('echo "PORT=3000" >> .env');
packages/cli/src/fix.test.ts, line 126
expect(executed).toEqual(['nvm install 20', 'echo "PORT=3000" >> .env']);
packages/cli/src/fix.ts, line 49
if (id.startsWith('env') || id.includes(':env.') || fix.includes('.env')) {
packages/cli/src/fix.ts, line 57
filePath: '.env',
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 6c76c501ea83. can delete files. install fetches a script from the network. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: 6c76c501ea83815d6e7902da9b2891113bf727d2
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.