Grades are a hygiene check, not a security guarantee.

MCP, MCP server

io.github.Morous-Dev/engram-cc

Universal AI session memory substrate. One install.

Compatibility: Not stated.

Grade C

One Medium finding. Read the findings before installing.

Graded by PlugVetRubric v2

Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.

Rescanned at commit 3afdfb0d03b0, unchanged since the check below.

INSTALL_LIFECYCLE_HOOK

Why this grade

  • INSTALL_LIFECYCLE_HOOK Medium

    A package install hook (preinstall, install, postinstall or prepare) runs a script.

    package.json, line 33 postinstall

Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.

Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.

What was checked

Plain notes from the hygiene checks.

  • Permissions

    Pass

    No shell or command execution found, and no extra permission was declared.

  • Install and update

    Concern

    runs a script at install time.

    INSTALL_LIFECYCLE_HOOK

    package.json, line 33

    postinstall

  • Network

    Concern

    can reach a host that is not written as a fixed address. can reach api. The description does not name that host.

    NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST

    benchmark/test-extract-brutal.mjs, line 65

    const res = await fetch(url, { signal: AbortSignal.timeout(TIMEOUT) });

    benchmark/test-extract-real-decisions.mjs, line 88

    const res = await fetch(url, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });

    benchmark/test-extract.mjs, line 368

    const evs2 = extractEvents(ev("Bash", { command: "curl http://api/status" }, jsonResp));

    Show more

    benchmark/test-lifecycle-real.mjs, line 59

    // WildChat rows to fetch (coding convs ≈ 25%, so 400 rows ≈ 100 coding convs)

    benchmark/test-lifecycle-real.mjs, line 94

    const res = await fetch(url, { signal: AbortSignal.timeout(FETCH_TIMEOUT) });

    benchmark/test-lifetime-retention.mjs, line 73

    const res = await fetch(url, { signal: AbortSignal.timeout(FETCH_TIMEOUT) });

    src/cli/download-model.ts, line 156

    * Download a GGUF model via Node.js fetch (requires Node 18+).

    src/cli/download-model.ts, line 172

    const res = await fetch(url, { redirect: "follow" });

  • Secrets

    Concern

    reads a credential or environment file.

    SECRETS_ENV_READ SECRETS_PATH_DOTENV

    benchmark/realistic-cycles.mjs, line 94

    ev.fileWrite(".env.local"),

    benchmark/realistic-cycles.mjs, line 563

    ev.fileEdit(".env.local"),

    benchmark/realistic-cycles.mjs, line 564

    ev.fileWrite(".env.example"),

    Show more

    benchmark/realistic-cycles.mjs, line 845

    " const event = stripe.webhooks.constructEvent(req.body, sig, process.env.STRIPE_WEBHOOK_SECRET);",

    benchmark/realistic-cycles.mjs, line 983

    ev.fileWrite(".env.railway"),

    benchmark/realistic-cycles.mjs, line 994

    ev.fileEdit(".env.railway"),

    benchmark/realistic-cycles.mjs, line 996

    ev.fileEdit(".env.railway"),

    benchmark/realistic-cycles.mjs, line 998

    ev.fileEdit(".env.railway"),

    benchmark/scenario-02-continuation.mjs, line 103

    ev.fileEdit('.env'),

    src/compression/tier4.ts, line 257

    const groqKey = process.env["GROQ_API_KEY"] ?? "";

    src/compression/tier4.ts, line 270

    const anthropicKey = process.env["ANTHROPIC_API_KEY"] ?? "";

  • Agent instructions

    Pass

    No instruction to ignore earlier instructions or to hide a step.

  • Obfuscation

    Pass

    No encoded or minified payload found.

  • Licence

    Pass

    A licence file is present (LICENSE).

  • Maintainer activity

    Pass

    The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 3afdfb0d03b0. runs a script at install time. can reach a host that is not written as a fixed address. can reach api. The description does not name that host. reads a credential or environment file.

Date and source

Date checked:

View source

github.com

Commit graded: 3afdfb0d03b0958f8757a8c396a683dc42357110

This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.

Read how this letter is chosen