MCP, MCP server
io.github.capan/isochrone
Live: iso.huseyincapan.dev
Compatibility: Not stated.
Grade C
One Medium finding. Read the report before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
SECRETS_PATH_CREDENTIAL
Why this grade
- SECRETS_PATH_CREDENTIAL Medium
Mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc).
scripts/caddy-report.sh, line 19
# The address lives in ~/.ssh/config, never in this repo - same reason the
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
isochrone-backend/index.ts, line 1545
fs.rmSync(osmFile, { force: true });
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
isochrone-backend/index.ts, line 923
const r = await fetch(
isochrone-backend/index.ts, line 961
const r = await fetch(
isochrone-backend/index.ts, line 1259
pr = await fetch(OVERPASS_URL, {
Show more
isochrone-backend/index.ts, line 1338
const osm = await fetch(OVERPASS_URL, {
isochrone-backend/index.ts, line 2416
const r = await fetch(
isochrone-ui/src/MapView.tsx, line 1055
fetch("/api/place-groups")
isochrone-ui/src/MapView.tsx, line 1067
fetch("/api/profiles")
isochrone-ui/src/MapView.tsx, line 1115
fetch("/api/areas"),
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
isochrone-backend/index.ts, line 88
password: process.env.PGPASSWORD ?? "password",
isochrone-backend/index.ts, line 1363
"-W", process.env.PGPASSWORD ?? "password",
scripts/caddy-report.sh, line 19
# The address lives in ~/.ssh/config, never in this repo - same reason the
Show more
isochrone-backend/index.ts, line 1443
env: { ...process.env, PGPASSWORD: process.env.PGPASSWORD ?? "password" },
scripts/precompute-reach.ts, line 96
password: process.env.PGPASSWORD ?? "password",
.dockerignore, line 12
*.zip
.env.example, line 1
# Copy to .env and change the password before exposing anything publicly.
.gitignore, line 2
dist/
.gitignore, line 3
.env
.gitignore, line 5
!.env.example
Dockerfile, line 7
# rather than in the runtime env - compose passes it through from .env.
docs/OPERATIONS.md, line 24
cp .env.example .env # change PGPASSWORD, set SITE_ADDRESS
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
a file was over the read cap and was not fully read.
OBFUSCATION_FILE_OVER_READ_CAP
overpass/osmconvert.c, line 1
// osmconvert 2020-03-31 14:20
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 776e89306d8b. can delete files. can reach a host that is not written as a fixed address. reads a credential or environment file. a file was over the read cap and was not fully read.
Date and source
Date checked:
github.com
Commit graded: 776e89306d8b02f208bb4240b728db2169d1296a
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.