MCP, MCP server
io.github.capabilityhostprotocol/chp
CHP is the open protocol for declaring, governing, and proving what agents, tools, and systems do — the single signed plane where a human approval, an agent's action, and a system call become the same governed, tamper-evident, replayable event.
Compatibility: Not stated.
Grade C
One Medium finding. Read the report before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
INSTALL_REMOTE_SCRIPT
Why this grade
- INSTALL_REMOTE_SCRIPT Medium
Fetches a script from the network and runs it (a pipe to a shell, or an install hook with a URL).
packages/chp-adapter-host/chp_adapter_host/bootstrap.py, line 157
# Docker from its OFFICIAL SIGNED repository - NOT `curl https://get.docker.com | sh` (unpinned,
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
conformance/runner.py, line 2219
subprocess.run(["ssh-keygen", "-Y", "sign", "-f", str(kf),
examples/distributed-fleet-demo/run_demo.py, line 43
r = subprocess.run(
packages/chp-adapter-ci/chp_adapter_ci/adapter.py, line 113
result = subprocess.run(
Show more
packages/chp-adapter-filesystem/chp_adapter_filesystem/adapter.py, line 480
proc = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
packages/chp-adapter-git/chp_adapter_git/adapter.py, line 70
subprocess.run(prefix + step, check=True, capture_output=True, timeout=300)
packages/chp-adapter-git/chp_adapter_git/adapter.py, line 97
result = subprocess.run(
packages/chp-adapter-host/chp_adapter_host/adapter.py, line 122
proc = subprocess.Popen(
packages/chp-adapter-host/chp_adapter_host/adapter.py, line 147
out = subprocess.run(args, capture_output=True, text=True, timeout=timeout, env=_facts_env())
packages/chp-adapter-mlx/chp_adapter_mlx/adapter.py, line 231
os.remove(pidfile)
packages/chp-adapter-mlx/chp_adapter_mlx/adapter.py, line 710
os.remove(pidfile)
packages/chp-adapter-safety/chp_adapter_safety/_tpm_collector.py, line 174
shutil.rmtree(workdir, ignore_errors=True)
Install and update
Serious
install fetches a script from the network. The docs document an installer that pipes a download into a shell.
INSTALL_REMOTE_SCRIPT INSTALL_DOCUMENTED_INSTALLER
packages/chp-adapter-host/chp_adapter_host/bootstrap.py, line 157
# Docker from its OFFICIAL SIGNED repository - NOT `curl https://get.docker.com | sh` (unpinned,
packages/chp-adapter-host/chp_adapter_host/bootstrap.py, line 188
install={"apt": "curl -fsSL https://ollama.com/install.sh | sh",
packages/chp-adapter-host/chp_adapter_host/bootstrap.py, line 189
"dnf": "curl -fsSL https://ollama.com/install.sh | sh",
Show more
packages/chp-adapter-vllm/README.md, line 25
curl -fsSL https://raw.githubusercontent.com/vllm-project/vllm-metal/main/install.sh | bash
scripts/bootstrap-linux.sh, line 5
# curl -sSL https://raw.githubusercontent.com/capabilityhostprotocol/chp-core/main/scripts/bootstrap-linux.sh | bash -s -- [ROLE]
scripts/bootstrap-mac.sh, line 5
# curl -sSL https://raw.githubusercontent.com/capabilityhostprotocol/chp-core/main/scripts/bootstrap-mac.sh | bash -s -- [ROLE]
Network
Concern
can reach a host that is not written as a fixed address. can reach download.docker.com. The description does not name that host. can reach gvisor.dev. The description does not name that host.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
conformance/runner.py, line 1533
with urllib.request.urlopen(req, timeout=30) as r:
conformance/runner.py, line 1574
with urllib.request.urlopen(req, timeout=30) as r:
conformance/runner.py, line 1657
with urllib.request.urlopen(req, timeout=30) as r:
Show more
conformance/runner.py, line 1972
with urllib.request.urlopen(req, timeout=30) as resp:
conformance/runner.py, line 2008
with urllib.request.urlopen(req, timeout=30) as resp:
conformance/runner.py, line 2076
with urllib.request.urlopen(req, timeout=30) as resp:
conformance/runner.py, line 2177
with urllib.request.urlopen(req, timeout=30) as resp:
conformance/runner.py, line 2263
with urllib.request.urlopen(req, timeout=30) as resp:
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
conformance/runner.py, line 1766
scoped_key = os.environ.get("CHP_CONFORMANCE_SCOPED_KEY")
conformance/runner.py, line 3155
default=os.environ.get("CHP_HOST_API_KEY"),
examples/chp-develops-chp/agent.py, line 171
key = os.environ.get("CHP_GATEWAY_KEY") or os.environ.get("CHP_HOST_API_KEY")
Show more
examples/chp-develops-chp/mesh_lib.py, line 52
key = key or os.environ.get("CHP_GATEWAY_KEY") or os.environ.get("CHP_HOST_API_KEY")
examples/distributed-fleet-demo/run_demo.py, line 40
key = os.environ.get("CHP_HOST_API_KEY")
examples/local-adapter-host/host_definition.py, line 8
Config (see .env.example):
examples/local-adapter-host/host_definition.py, line 56
authed = bool(os.environ.get("GITHUB_TOKEN") or os.environ.get("GH_TOKEN"))
examples/local-adapter-host/host_definition.py, line 72
path = Path(os.environ.get("CHP_WEBHOOK_SECRETS") or (HERE / "webhook.secrets.json"))
examples/local-adapter-host/host_definition.py, line 89
if not (os.environ.get("SLACK_BOT_TOKEN") or os.environ.get("SLACK_SIGNING_SECRET")):
packages/chp-host/chp_host/cli.py, line 931
env_file = chp_dir / f"{host_id}.env"
packages/chp-host/chp_host/service.py, line 54
EnvironmentFile=-%h/.chp/{host_id}.env
packages/chp-host/chp_host/service.py, line 91
env_stub = Path.home() / ".chp" / f"{host_id}.env"
packages/chp-host/chp_host/service.py, line 268
~/.chp/{host_id}.env stub (systemd) at service startup.
packages/chp-host-ts/src/host.ts, line 483
childCorrelation: () => ({ ...env.correlation!, causation_id: env.invocation_id! }),
.gitignore, line 8
*.tgz
.gitignore, line 9
.env
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Concern
contains an encoded blob in a file that should be readable.
OBFUSCATION_ENCODED_BLOB
packages/chp-host-ts/test/mandate.test.ts, line 1
import { describe, it, expect } from 'vitest';
spec/test-vectors/dsse-attestation.json, line 3
"payload": "eyJfdHlwZSI6ICJodHRwczovL2luLXRvdG8uaW8vU3RhdGVtZW50L3YxIiwgInByZWRpY2F0ZSI6IHsiYXNzdXJhbmNlIjogInNpZ25lZCIsICJjYW5vbmljYWxpemF0aW9uIjogImNocC1zdGFibGUtdjEiLCAiY3JlYXRl
spec/test-vectors/rekor-anchor.json, line 16
"entry_body": "eyJhcGlWZXJzaW9uIjogIjAuMC4yIiwgImtpbmQiOiAiaW50b3RvIiwgInNwZWMiOiB7ImNvbnRlbnQiOiB7ImVudmVsb3BlIjogImV5SndZWGxzYjJGa0lqb2laWGxLWm1SSWJIZGFVMGsyU1VOS2IyUklVbmRqZW05M
Show more
spec/test-vectors/rekor-anchor.json, line 25
"payload": "eyJfdHlwZSI6ICJodHRwczovL2luLXRvdG8uaW8vU3RhdGVtZW50L3YxIiwgInByZWRpY2F0ZSI6IHsiYXNzdXJhbmNlIjogInNpZ25lZCIsICJjYW5vbmljYWxpemF0aW9uIjogImNocC1zdGFibGUtdjEiLCAiY3JlYXRl
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 420cdd96bb91. can delete files. install fetches a script from the network. The docs document an installer that pipes a download into a shell. can reach a host that is not written as a fixed address. can reach download.docker.com. The description does not name that host. can reach gvisor.dev. The description does not name that host. reads a credential or environment file. contains an encoded blob in a file that should be readable.
Date and source
Date checked:
github.com
Commit graded: 420cdd96bb91fb965a406635342fb9c1de682cbc
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.