MCP, MCP server
io.github.Luckycat133/traecnclaw
Generated from canonical TRAECNclaw 0.6.0 at commit 40bcf7707ed9b0ff7938aea8e511d0b87d300705.
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 8757117a3980, unchanged since the check below.
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV SECRETS_ENV_READ
Why this grade
- PERMISSION_DELETE_FILES Low
Contains a call that can delete files.
.agents/hooks/project_context.py, line 50
result = subprocess.run(['git', '-c', 'core.fsmonitor=false', - NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
.agents/skills/mcp-builder/reference/node_mcp_server.md, line 474
const response = await axios.get(`${API_URL}/resource/${resourceId}`); - SECRETS_PATH_DOTENV Low
Mentions a .env file.
.codex/skills/traecnclaw-mcp/scripts/start-mcp.js, line 107
// Chdir to repo root so .env and relative file reads resolve correctly. - SECRETS_ENV_READ Note
Reads an environment variable whose name contains KEY, SECRET, TOKEN, PASSWORD or CREDENTIAL.
.agents/skills/mcp-builder/reference/node_mcp_server.md, line 707
if (!process.env.EXAMPLE_API_KEY) {
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
.agents/hooks/project_context.py, line 50
result = subprocess.run(['git', '-c', 'core.fsmonitor=false',
.agents/hooks/test_project_context.py, line 26
subprocess.run(['git', 'init', '-q', str(self.root)], check=True,
.agents/hooks/test_project_context.py, line 53
result = subprocess.run(['sh', '-c', command] if command else [sys.executable, str(self.runner)],
Show more
.agents/hooks/test_project_context.py, line 73
subprocess.run(['git', '-C', str(self.root), 'add', self.target], check=True)
.codex/hooks/test_project_context.py, line 33
subprocess.run(['sh', '-n', '-c', self.command], check=True)
.codex/hooks/test_project_context.py, line 52
run = subprocess.run(args,cwd=cwd or self.root,input=data if isinstance(data,str) else json.dumps(data),capture_output=True,text=True,timeout=3)
.codex/skills/traecnclaw-mcp/scripts/setup-mcp.js, line 56
fs.unlinkSync(tempPath);
.codex/skills/traecnclaw-mcp/scripts/setup-mcp.js, line 67
fs.unlinkSync(tempPath);
.codex/skills/traecnclaw-mcp/scripts/setup-mcp.test.js, line 68
fs.rmSync(outputDir, { recursive: true, force: true });
.codex/skills/traecnclaw-mcp/scripts/setup-mcp.test.js, line 90
fs.rmSync(isolatedRoot, { recursive: true, force: true });
.codex/skills/traecnclaw-mcp/scripts/start-mcp.test.js, line 98
fs.rmSync(dir, { recursive: true, force: true });
.codex/skills/traecnclaw-mcp/scripts/start-mcp.test.js, line 112
fs.rmSync(repoDir, { recursive: true, force: true });
.codex/skills/traecnclaw-mcp/scripts/start-mcp.test.js, line 124
fs.rmSync(repoDir, { recursive: true, force: true });
.codex/skills/traecnclaw-mcp/scripts/start-mcp.test.js, line 137
fs.rmSync(repoDir, { recursive: true, force: true });
.claude/hooks/test_project_context.py, line 25
p=subprocess.run([sys.executable,str(self.script)],input=payload,cwd=str(cwd or self.root),stdout=subprocess.PIPE,stderr=subprocess.PIPE,timeout=3)
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
.agents/skills/mcp-builder/reference/node_mcp_server.md, line 474
const response = await axios.get(`${API_URL}/resource/${resourceId}`);
.agents/skills/mcp-builder/reference/node_mcp_server.md, line 480
return axios.get(`${API_URL}/resource/${resourceId}`)
.agents/skills/mcp-builder/reference/python_mcp_server.md, line 260
response = requests.get(f"{API_URL}/resource/{resource_id}") # Blocks
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
.agents/skills/mcp-builder/reference/node_mcp_server.md, line 707
if (!process.env.EXAMPLE_API_KEY) {
.agents/skills/mcp-builder/reference/node_mcp_server.md, line 719
if (!process.env.EXAMPLE_API_KEY) {
.codex/skills/traecnclaw-mcp/scripts/start-mcp.js, line 107
// Chdir to repo root so .env and relative file reads resolve correctly.
Show more
.codex/skills/traecnclaw-mcp/scripts/start-mcp.js, line 48
if (env.NODE_PATH) searchPaths.push(...env.NODE_PATH.split(path.delimiter).filter(Boolean));
.codex/skills/traecnclaw-mcp/SKILL.md, line 121
- Never expose `.env`, tokens, authorization headers, or TraeCN profile data.
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 8757117a3980. can delete files. can reach a host that is not written as a fixed address. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: 8757117a39801649ca91cbc50ea1537534e83783
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.