Grades are a hygiene check, not a security guarantee.

MCP, MCP server

gitmem

gitmem, an MCP server listed in the PlugVet directory.

Compatibility: Not stated.

Grade D

Two or more Medium findings, or a High. Only try it in a sandbox.

Graded by PlugVetRubric v2

Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.

Pattern found, check before installing

The checks matched a pattern that needs a closer look. It does not mean the code is harmful. Read the quoted lines below.

  • NETWORK_HOST_FROM_INPUT High

    host from input plus a credential path in operative code

NETWORK_HOST_FROM_INPUT INSTALL_REMOTE_SCRIPT SECRETS_PATH_CREDENTIAL

Why this grade

  • NETWORK_HOST_FROM_INPUT High

    A file takes a URL or endpoint as input and has no fixed host list.

    bin/gitmem.js, line 252 const response = await fetch(restUrl, {

  • INSTALL_REMOTE_SCRIPT Medium

    Fetches a script from the network and runs it (a pipe to a shell, or an install hook with a URL).

    testing/clean-room/Dockerfile.cursor-local, line 32 RUN curl https://cursor.com/install -fsS | bash

  • SECRETS_PATH_CREDENTIAL Medium

    Mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc).

    hooks/scripts/credential-guard.sh, line 54 CREDENTIAL_FILES_PATTERN='(mcp-config\.json|\.env($|\.)|\.credentials\.json|credentials\.json|\.netrc|\.npmrc|\.pypirc|id_rsa|id_ed25519|\.pem$|\.key$)'

Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.

If you think this grade is wrong, email [email protected] with the entry link and your evidence. We aim to acknowledge within two working days and decide within seven. If we confirm an error, we aim to correct it within 24 hours of confirming it. These are aims, not guarantees.

Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.

What was checked

Plain notes from the hygiene checks.

  • Permissions

    Concern

    can delete files.

    PERMISSION_DELETE_FILES

    src/commands/migrate-local.ts, line 329

    fs.unlinkSync(livePath);

    src/services/active-sessions.ts, line 41

    fs.unlinkSync(tmpPath);

    src/services/active-sessions.ts, line 515

    fs.rmSync(dirPath, { recursive: true, force: true });

    Show more

    src/services/active-sessions.ts, line 535

    fs.rmSync(sessionDir, { recursive: true, force: true });

    src/services/file-lock.ts, line 99

    fs.unlinkSync(lockPath);

    src/services/file-lock.ts, line 132

    fs.unlinkSync(lockPath);

    src/services/license.ts, line 145

    fs.unlinkSync(cachePath);

    src/services/vector-disk-cache.ts, line 247

    try { if (fs.existsSync(tmp)) fs.unlinkSync(tmp); } catch { /* best effort */ }

  • Install and update

    Serious

    install fetches a script from the network.

    INSTALL_REMOTE_SCRIPT

    testing/clean-room/Dockerfile.cursor-local, line 32

    RUN curl https://cursor.com/install -fsS | bash

    testing/clean-room/Dockerfile.cursor-npm, line 32

    RUN curl https://cursor.com/install -fsS | bash

  • Network

    Serious

    accepts a host from input, with no fixed list in this file.

    NETWORK_HOST_FROM_INPUT

    bin/gitmem.js, line 252

    const response = await fetch(restUrl, {

    scripts/gitmem-admin.mjs, line 47

    const response = await fetch(API_BASE, {

    src/commands/activate.ts, line 87

    const response = await fetch(`${url}/rest/v1/`, {

    Show more

    src/commands/activate.ts, line 110

    const response = await fetch(`${url}/rest/v1/${table}?select=id&limit=0`, {

    src/commands/activate.ts, line 221

    const response = await fetch(

    src/commands/check.ts, line 146

    const response = await fetch(restUrl, {

    src/commands/check.ts, line 186

    const response = await fetch("https://api.openai.com/v1/models", {

    src/commands/check.ts, line 216

    const response = await fetch("https://openrouter.ai/api/v1/models", {

    scripts/git-69-panel-repro.mts, line 165

    const res = await fetch(

  • Secrets

    Concern

    reads a credential or environment file.

    SECRETS_ENV_READ SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV

    bin/gitmem.js, line 104

    const supabaseKey = process.env.SUPABASE_SERVICE_ROLE_KEY;

    bin/init-wizard.js, line 270

    process.env.SUPABASE_SERVICE_ROLE_KEY || "<your-service-role-key>",

    hooks/scripts/credential-guard.sh, line 54

    CREDENTIAL_FILES_PATTERN='(mcp-config\.json|\.env($|\.)|\.credentials\.json|credentials\.json|\.netrc|\.npmrc|\.pypirc|id_rsa|id_ed25519|\.pem$|\.key$)'

    Show more

    bin/init-wizard.js, line 272

    process.env.OPENAI_API_KEY || "<your-openai-key-or-remove>",

    hooks/scripts/credential-guard.sh, line 9

    # - Read: Direct reads of known credential files (mcp-config.json, .env, etc.)

    hooks/scripts/recall-check.sh, line 10

    # Consequential = git push, npm publish, deploy, .sql, .env files.

    scripts/gitmem-admin.mjs, line 25

    const envToken = process.env.SUPABASE_ACCESS_TOKEN;

    src/commands/activate.ts, line 133

    const envToken = process.env.SUPABASE_ACCESS_TOKEN;

    src/commands/activate.ts, line 274

    let apiKey = args[0] || process.env.GITMEM_API_KEY || (config.api_key as string) || "";

    src/commands/check.ts, line 82

    const supabaseKey = process.env.SUPABASE_SERVICE_ROLE_KEY;

    src/commands/check.ts, line 83

    const openaiKey = process.env.OPENAI_API_KEY;

    .gitignore, line 4

    .DS_Store

    AGENTS.md.template, line 130

    - **Credential safety**: Never read `.env`, API keys, or credential files in full. Use existence checks only.

    CLAUDE.md.template, line 18

    1. **NEVER read credential files in full.** Files like `mcp-config.json`, `.env`, `.credentials.json`, `.netrc`, `.npmrc`, SSH keys, or `.pem`/`.key` files must not be read with th

    copilot-instructions.template, line 15

    1. **NEVER read credential files in full.** Files like `mcp-config.json`, `.env`, `.credentials.json`, `.netrc`, `.npmrc`, SSH keys, or `.pem`/`.key` files must not be read or dump

    cursorrules.template, line 17

    1. **NEVER read credential files in full.** Files like `mcp-config.json`, `.env`, `.credentials.json`, `.netrc`, `.npmrc`, SSH keys, or `.pem`/`.key` files must not be read or dump

  • Agent instructions

    Pass

    No instruction to ignore earlier instructions or to hide a step.

  • Obfuscation

    Note

    a file was over the read cap and was not fully read. the file cap was reached before every file was read.

    OBFUSCATION_FILE_OVER_READ_CAP OBFUSCATION_FILE_CAP_REACHED

    apps/docs/package-lock.json, line 1

    {

    tests/unit/services/session-refresh-project.test.ts, line 1

    /**

  • Licence

    Pass

    A licence file is present (LICENSE).

  • Maintainer activity

    Pass

    The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 430d7431be1c. can delete files. install fetches a script from the network. accepts a host from input, with no fixed list in this file. reads a credential or environment file. a file was over the read cap and was not fully read. the file cap was reached before every file was read.

Date and source

Date checked:

View source

github.com

Commit graded: 430d7431be1c375a94b0050d7682c58f2c45f30b

This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.

Read how this letter is chosen