MCP, MCP server
io.github.DojoGenesis/mcp
The methodology layer for Claude Code -- the first MCP server that makes Claude measurably better at software development decisions by encoding 99 first-party working methods across 10 behavioral plugins as active cognitive scaffolds.
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 61b731af8167.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_DOTENV PERMISSION_SHELL_DECLARED SECRETS_ENV_READ
Why this grade
- NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
internal/skills/bundled/skill-forge/mcp-cloudflare-builder/SKILL.md, line 81
const response = await fetch(`https://api.weather.com/${city}`); - NETWORK_UNNAMED_HOST Low
Calls a fixed host that the description does not name.
internal/skills/bundled/skill-forge/mcp-cloudflare-builder/SKILL.md, line 81
const response = await fetch(`https://api.weather.com/${city}`); - SECRETS_PATH_DOTENV Low
Mentions a .env file.
internal/skills/bundled/dojo-craft/claude-md-guardian/SKILL.md, line 99
- **Outdated ports/URLs:** Rule names a specific port or URL. Cross-reference with `wrangler.toml`, `settings.json`, `.env`, and config files. - PERMISSION_SHELL_DECLARED Note
Runs shell commands, and the manifest or description says so.
internal/dojo/handler_craft.go, line 160
cmd := exec.Command("git", args...) - SECRETS_ENV_READ Note
Reads an environment variable whose name contains KEY, SECRET, TOKEN, PASSWORD or CREDENTIAL.
internal/config/config.go, line 35
GatewayToken: os.Getenv("DOJO_GATEWAY_TOKEN"),
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Note
requests shell access. The manifest names this permission.
PERMISSION_SHELL_DECLARED
internal/dojo/handler_craft.go, line 160
cmd := exec.Command("git", args...)
scripts/bridge/dojo_memory_search.py, line 94
result = subprocess.run(
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address. can reach api.weather.com. The description does not name that host.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
internal/skills/bundled/skill-forge/mcp-cloudflare-builder/SKILL.md, line 81
const response = await fetch(`https://api.weather.com/${city}`);
internal/skills/bundled/skill-forge/mcp-cloudflare-builder/SKILL.md, line 97
fetch(request: Request, env: Env, ctx: ExecutionContext) {
internal/skills/bundled/skill-forge/mcp-cloudflare-builder/SKILL.md, line 100
return MyMCP.serveSSE("/mcp").fetch(request, env, ctx);
Show more
internal/skills/bundled/skill-forge/mcp-server-builder/SKILL.md, line 96
response = requests.get(f"{BASE_URL}/users/{user_id}", headers=AUTH_HEADERS)
internal/skills/bundled/skill-forge/mcp-server-builder/SKILL.md, line 109
const res = await fetch(`${BASE_URL}/users/${user_id}`, { headers: AUTH_HEADERS });
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
internal/config/config.go, line 35
GatewayToken: os.Getenv("DOJO_GATEWAY_TOKEN"),
internal/config/config.go, line 41
APIKeysRaw: os.Getenv("DOJO_MCP_API_KEYS"),
internal/skills/bundled/dojo-craft/claude-md-guardian/SKILL.md, line 99
- **Outdated ports/URLs:** Rule names a specific port or URL. Cross-reference with `wrangler.toml`, `settings.json`, `.env`, and config files.
Show more
internal/skills/bundled/system-health/documentation-audit/SKILL.md, line 69
| Configuration docs | `.env.example`, config documentation |
internal/skills/bundled/system-health/documentation-audit/SKILL.md, line 225
1. **Inventory:** Found 8 documentation files: README.md, ARCHITECTURE.md, CONTRIBUTING.md, 3 API docs in `docs/api/`, .env.example, and inline JSDoc across 42 source files.
internal/skills/bundled/system-health/documentation-audit/SKILL.md, line 231
- .env.example missing 3 environment variables added in the refactor
internal/skills/bundled/system-health/documentation-audit/SKILL.md, line 235
- Drifted: 4 (README, ARCHITECTURE.md, .env.example, 1 API doc)
internal/skills/bundled/system-health/health-audit/SKILL.md, line 246
- Security: YELLOW -- Dependencies have 1 high-severity CVE. Secrets in `.env` files, no vault.
scripts/bridge/migrations/0002_dojo_mcp_ro_role.sql, line 20
-- /opt/dojo/.env as part of DOJO_MEMORY_DB_URL for the mcp-http service.
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 61b731af8167. requests shell access. The manifest names this permission. can reach a host that is not written as a fixed address. can reach api.weather.com. The description does not name that host. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: 61b731af8167d3892892fc1ffefa75dd675fc644
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.