MCP, MCP server
io.github.ccedacero/nyc-property-intel
MCP server that gives Claude AI access to 20+ NYC public record datasets for real estate due diligence.
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_DOTENV SECRETS_ENV_READ
Why this grade
- PERMISSION_DELETE_FILES Low
Contains a call that can delete files.
download_and_verify.py, line 31
output = subprocess.check_output(['wc', '-l', filepath]).decode('utf-8') - NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
download_and_verify.py, line 22
resp = requests.get(url, timeout=15) - NETWORK_UNNAMED_HOST Low
Calls a fixed host that the description does not name.
download_and_verify.py, line 22
resp = requests.get(url, timeout=15) - SECRETS_PATH_DOTENV Low
Mentions a .env file.
src/nyc_property_intel/config.py, line 3
Reads from environment variables and .env file. All tool modules - SECRETS_ENV_READ Note
Reads an environment variable whose name contains KEY, SECRET, TOKEN, PASSWORD or CREDENTIAL.
scripts/alerting.py, line 22
api_key = os.environ.get("RESEND_API_KEY")
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
download_and_verify.py, line 31
output = subprocess.check_output(['wc', '-l', filepath]).decode('utf-8')
download_and_verify.py, line 51
if os.path.exists(filepath): os.remove(filepath)
download_and_verify.py, line 56
subprocess.run(['caffeinate', '-i', 'curl', '-L', '-#',
Show more
download_live_datasets.py, line 141
os.remove(filepath)
fast_download.sh, line 56
output = subprocess.check_output(['wc', '-l', filepath]).decode('utf-8')
fast_download.sh, line 71
os.remove(filepath)
fast_download.sh, line 82
subprocess.run(curl_cmd, check=True)
resume_311.py, line 25
out = subprocess.check_output(["wc", "-l", path]).decode()
scripts/load_local_datasets.py, line 28
result = subprocess.run(["psql", DB, "-c", sql], capture_output=True, text=True)
scripts/load_local_datasets.py, line 42
result = subprocess.run(["psql", DB, "-c", cmd], capture_output=True, text=True)
scripts/run_backfill.py, line 48
proc = subprocess.run(cmd, check=False)
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address. can reach app.loops.so. The description does not name that host.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
download_and_verify.py, line 22
resp = requests.get(url, timeout=15)
download_and_verify.py, line 55
# Using caffeinate + curl for maximum stability on these massive files
download_live_datasets.py, line 62
resp = requests.get(url, params=params, headers=headers, timeout=120)
Show more
fast_download.sh, line 36
resp = requests.get(url, timeout=15)
fast_download.sh, line 73
# Run curl via subprocess for maximum network speed and reliability
resume_311.py, line 39
r = requests.get(url, params=params,
scripts/check_ai_crawlers.sh, line 18
code=$(curl -s -o /dev/null -w "%{http_code}" -A "$ua" --max-time 15 "$url")
scripts/check_ai_crawlers.sh, line 37
if ! curl -s --max-time 15 "$SITE/robots.txt" | grep -q "Content-Signal"; then
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
scripts/alerting.py, line 22
api_key = os.environ.get("RESEND_API_KEY")
scripts/qa_db.py, line 93
app_token = os.environ.get("SOCRATA_APP_TOKEN", "")
src/nyc_property_intel/config.py, line 3
Reads from environment variables and .env file. All tool modules
Show more
scripts/sync_delta.py, line 897
app_token = os.environ.get("SOCRATA_APP_TOKEN", "")
src/nyc_property_intel/chat.py, line 769
or os.environ.get("ANON_IP_HASH_SECRET", "")
src/nyc_property_intel/config.py, line 19
env_file=".env",
src/nyc_property_intel/geoclient.py, line 285
"Set NYC_GEOCLIENT_SUBSCRIPTION_KEY in your .env file. "
.gitignore, line 17
# Environment variables
.gitignore, line 18
.env
.gitignore, line 20
!.env.example
.gitignore, line 78
.vercel
CONTRIBUTING.md, line 48
- [ ] No secrets or `.env` values in the diff
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 230d1858516e. can delete files. can reach a host that is not written as a fixed address. can reach app.loops.so. The description does not name that host. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: 230d1858516eac0b04a063101a7a405a237d6453
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.