MCP, MCP server
io.github.akarazhev/bitcoin-risk-brief
Bitcoin Risk Brief is a free, open-source product that turns canonical daily BTC/USD data into a transparent risk score, freshness state, and scenario price ladder.
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV SECRETS_ENV_READ OBFUSCATION_FILE_OVER_READ_CAP
Why this grade
- PERMISSION_DELETE_FILES Low
Contains a call that can delete files.
scripts/check_backup_freshness.py, line 115
result = subprocess.run( - NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
backend/app/repository.py, line 97
rows = await pool.fetch( - SECRETS_PATH_DOTENV Low
Mentions a .env file.
scripts/import_provenance_packet.py, line 237
if ".env" in value: - SECRETS_ENV_READ Note
Reads an environment variable whose name contains KEY, SECRET, TOKEN, PASSWORD or CREDENTIAL.
backend/app/config.py, line 12
turnstile_secret: str = os.getenv("TURNSTILE_SECRET", "").strip() - OBFUSCATION_FILE_OVER_READ_CAP Note
A file was over the read cap and was not fully read.
collector/btc-csv/btc_usd_daily.csv, line 1
timeOpen;timeClose;timeHigh;timeLow;open;high;low;close;volume;marketCap;circulatingSupply;timestamp
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
scripts/check_backup_freshness.py, line 115
result = subprocess.run(
server-kit/prepare_usb_kit.py, line 80
output = subprocess.check_output(
server-kit/prepare_usb_kit.py, line 142
shutil.rmtree(path)
Show more
server-kit/prepare_usb_kit.py, line 202
return subprocess.check_output(
server-kit/prepare_usb_kit.py, line 255
shutil.rmtree(kit_dir)
docs/superpowers/plans/2026-07-05-usb-update-install-kit-v2-implementation.md, line 241
subprocess.run(["git", "init"], cwd=self.source, check=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
docs/superpowers/plans/2026-07-05-usb-update-install-kit-v2-implementation.md, line 242
subprocess.run(["git", "add", "."], cwd=self.source, check=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
docs/superpowers/plans/2026-07-05-usb-update-install-kit-v2-implementation.md, line 243
subprocess.run(
docs/superpowers/plans/2026-07-05-usb-update-install-kit-v2-implementation.md, line 250
self.commit = subprocess.check_output(["git", "rev-parse", "HEAD"], cwd=self.source, text=True).strip()
docs/superpowers/plans/2026-07-05-usb-update-install-kit-v2-implementation.md, line 253
return subprocess.run(
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
backend/app/repository.py, line 97
rows = await pool.fetch(
backend/app/repository.py, line 115
rows = await pool.fetch(
backend/app/repository.py, line 126
rows = await pool.fetch(
Show more
collector/collector/db_writer.py, line 81
rows = await pool.fetch(
docs/agents/agent-access-pack.md, line 41
curl --fail-with-body \
docs/agents/agent-access-pack.md, line 58
curl --fail-with-body https://bitcoinriskbrief.minihub.app/api/health
docs/agents/agent-access-pack.md, line 71
curl --fail-with-body \
docs/agents/agent-access-pack.md, line 106
curl --fail-with-body https://bitcoinriskbrief.minihub.app/api/risk/latest
docs/agents/agent-access-pack.md, line 137
curl --fail-with-body \
docs/agents/agent-access-pack.md, line 159
curl --fail-with-body https://bitcoinriskbrief.minihub.app/api/risk/levels
docs/agents/agent-access-pack.md, line 188
curl --fail-with-body https://bitcoinriskbrief.minihub.app/api/brief/latest
docs/agents/agent-access-pack.md, line 224
curl --fail-with-body \
server-kit/scripts/06-debug-bitcoin-risk-service.sh, line 180
run_check curl -fsS "http://127.0.0.1:${FRONTEND_PORT}/api/health"
server-kit/scripts/06-debug-bitcoin-risk-service.sh, line 181
run_check curl -fsS "http://127.0.0.1:${FRONTEND_PORT}/api/readiness"
podman-compose.yml, line 48
- python -c 'import urllib.request; urllib.request.urlopen("http://localhost:8000/api/health")'
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
backend/app/config.py, line 12
turnstile_secret: str = os.getenv("TURNSTILE_SECRET", "").strip()
collector/collector/config.py, line 13
coinmarketcap_api_key: str = os.getenv("COINMARKETCAP_API_KEY", "")
scripts/import_provenance_packet.py, line 237
if ".env" in value:
Show more
collector/collector/config.py, line 19
telegram_bot_token: str = os.getenv("TELEGRAM_BOT_TOKEN", "")
frontend/scripts/require-turnstile-sitekey.mjs, line 1
const sitekey = process.env.VITE_TURNSTILE_SITE_KEY?.trim()
scripts/cloudflare_edge_rules.py, line 430
default=os.getenv("CLOUDFLARE_API_TOKEN"),
scripts/cloudflare_edge_rules.py, line 450
default=os.getenv("CLOUDFLARE_API_TOKEN"),
scripts/import_provenance_packet.py, line 26
r"(secret|token|password|api[_-]?key|\.env|waitlist|contact|email|phone|dashboard|"
scripts/import_provenance_packet.py, line 31
r"(secret|token|password|api[\s_-]?key|bearer|private[\s_-]?key|\.env|"
scripts/import_provenance_packet.py, line 238
return ".env reference"
scripts/launch_snapshot_packet.py, line 40
r"(secret|token|password|api[_-]?key|\.env|email|phone|contact|dashboard|raw[_-]?(logs?|dumps?)|"
scripts/launch_snapshot_packet.py, line 45
r"(secret|token|password|api[\s_-]?key|bearer|private[\s_-]?key|\.env|"
scripts/launch_snapshot_packet.py, line 229
if ".env" in value:
scripts/launch_snapshot_packet.py, line 230
return ".env reference"
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
a file was over the read cap and was not fully read.
OBFUSCATION_FILE_OVER_READ_CAP
collector/btc-csv/btc_usd_daily.csv, line 1
timeOpen;timeClose;timeHigh;timeLow;open;high;low;close;volume;marketCap;circulatingSupply;timestamp
docs/operations/production-evidence-log.md, line 1
# Production Evidence Log
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 7cd43c183ee8. can delete files. can reach a host that is not written as a fixed address. reads a credential or environment file. a file was over the read cap and was not fully read.
Date and source
Date checked:
github.com
Commit graded: 7cd43c183ee860cf6d0e5ce3fb30b24264a8c4f0
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.