Grades are a hygiene check, not a security guarantee.

MCP, MCP server

io.github.JasonCZMeng/assay

The quality oracle for the x402 agent economy — x402 being the open protocol that lets machines pay for HTTP APIs with stablecoin micropayments.

Compatibility: Not stated.

Grade C

One Medium finding. Read the findings before installing.

Graded by PlugVetRubric v2

Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.

Rescanned at commit d39fad32c30e, unchanged since the check below.

OBFUSCATION_ENCODED_BLOB

Why this grade

  • OBFUSCATION_ENCODED_BLOB Medium

    Contains a long base64 shaped string in a file that should be readable.

    src/icon.ts, line 16 "iVBORw0KGgoAAAANSUhEUgAAAQAAAAEACAYAAABccqhmAAAACXBIWXMAAAsTAAALEwEAmpwYAAAO/UlEQVR4nO2dW4xV1R3GeTxlDUxnOjcsXmYqYQaMDkbOzIoFCwGlYOTitagDqJEa2yb1kiAi6S0tYo3yUKqNKOiAOW1i+4DYSxR7SbV

Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.

Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.

What was checked

Plain notes from the hygiene checks.

  • Permissions

    Pass

    No shell or command execution found, and no extra permission was declared.

  • Install and update

    Pass

    No install-time script found, and dependencies are pinned or absent.

  • Network

    Concern

    can reach a host that is not written as a fixed address.

    NETWORK_NO_FIXED_HOST

    src/dashboard.ts, line 132

    function getJSON(url) { return fetch(url).then(function (r) { return r.json(); }); }

    src/dashboard.ts, line 134

    return fetch('/api/control/' + path, {

    src/landing.ts, line 288

    <pre>curl https://assay.nominal-labs.com/tier/{url}

    Show more

    src/landing.ts, line 295

    <pre>curl https://assay.nominal-labs.com/score/{url}

    src/landing.ts, line 394

    fetch('/api/status').then(function (r) { return r.json(); }).then(function (s) {

    src/landing.ts, line 401

    fetch('/api/probes?limit=18').then(function (r) { return r.json(); }).then(function (rows) {

    README.md, line 86

    // payFetch = your x402-paying fetch (e.g. wrapFetchWithPayment from @x402/fetch)

    mcp/server.mts, line 21

    const res = await fetch(`${ASSAY_URL}${path}`, { signal: AbortSignal.timeout(10_000) });

    middleware/README.md, line 89

    component breakdown, trend, probe count - using **your own** x402-paying fetch (this

  • Secrets

    Concern

    reads a credential or environment file.

    SECRETS_ENV_READ SECRETS_PATH_DOTENV

    middleware/index.ts, line 11

    // const account = privateKeyToAccount(process.env.WALLET_KEY as `0x${string}`);

    src/config.ts, line 23

    probeWalletKey: process.env.PROBE_WALLET_KEY ?? "",

    src/config.ts, line 25

    anthropicApiKey: process.env.ANTHROPIC_API_KEY ?? "",

    Show more

    src/config.ts, line 36

    controlToken: process.env.CONTROL_TOKEN ?? "1",

    src/config.ts, line 45

    cdpApiKeyId: process.env.CDP_API_KEY_ID ?? "",

    src/config.ts, line 46

    cdpApiKeySecret: process.env.CDP_API_KEY_SECRET ?? "",

    .env.example, line 1

    # Assay configuration - copy to .env and fill in. `.env` is gitignored; never commit it.

    .gitignore, line 3

    dist/

    README.md, line 95

    1. `cp .env.example .env` and fill in (all vars documented in the example):

    deploy/README.md, line 31

    ## 4. Production .env (`/opt/assay/app/.env`, owner assay, mode 600)

    deploy/README.md, line 70

    `CDP_API_KEY_SECRET` in .env; the server selects the CDP facilitator automatically when

    deploy/assay.service, line 13

    EnvironmentFile=/opt/assay/app/.env

    docs/plans/2026-07-04-assay-implementation.md, line 15

    - Secrets only in `.env` (gitignored): `PROBE_WALLET_KEY`, `RECEIVE_WALLET_ADDRESS`, `ANTHROPIC_API_KEY`. Never in code, DB, or logs.

    docs/plans/2026-07-04-assay-implementation.md, line 28

    - Create: `package.json`, `tsconfig.json`, `.gitignore`, `.env.example`, `vitest.config.ts`

  • Agent instructions

    Pass

    No instruction to ignore earlier instructions or to hide a step.

  • Obfuscation

    Concern

    contains an encoded blob in a file that should be readable.

    OBFUSCATION_ENCODED_BLOB

    src/icon.ts, line 16

    "iVBORw0KGgoAAAANSUhEUgAAAQAAAAEACAYAAABccqhmAAAACXBIWXMAAAsTAAALEwEAmpwYAAAO/UlEQVR4nO2dW4xV1R3GeTxlDUxnOjcsXmYqYQaMDkbOzIoFCwGlYOTitagDqJEa2yb1kiAi6S0tYo3yUKqNKOiAOW1i+4DYSxR7SbV

  • Licence

    Pass

    A licence file is present (LICENSE).

  • Maintainer activity

    Pass

    The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit d39fad32c30e. can reach a host that is not written as a fixed address. reads a credential or environment file. contains an encoded blob in a file that should be readable.

Date and source

Date checked:

View source

github.com

Commit graded: d39fad32c30ea5f03bbf9797dbecb1d04054b74d

This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.

Read how this letter is chosen