MCP, MCP server
io.github.Nishant-Chaudhary5338/mcp-react-toolkit
MCP servers for React + TypeScript development automation.
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit eff1a17db3d2, unchanged since the check below.
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV SECRETS_ENV_READ OBFUSCATION_FILE_OVER_READ_CAP OBFUSCATION_FILE_CAP_REACHED
Why this grade
- PERMISSION_DELETE_FILES Low
Contains a call that can delete files.
tools/code-modernizer/src/utils/file-ops.test.ts, line 10
await fs.rm(tmpDir, { recursive: true, force: true }); - NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
client/src/api/client.ts, line 15
const res = await fetch(`${BASE}/call`, { - SECRETS_PATH_DOTENV Low
Mentions a .env file.
client/src/data/tools.ts, line 400
ts/ejection/CRACO, REACT_APP_ env vars + .env files, %PUBLIC_URL%/homepage, proxy, je - SECRETS_ENV_READ Note
Reads an environment variable whose name contains KEY, SECRET, TOKEN, PASSWORD or CREDENTIAL.
tools/codemod-runner/src/core.ts, line 20
'cra-env-to-vite': { find: 'process\\.env\\.REACT_APP_([A-Z0-9_]+)', replace: 'import.meta.env.VITE_$1', flags: 'g' }, - OBFUSCATION_FILE_OVER_READ_CAP Note
A file was over the read cap and was not fully read.
package-lock.json, line 1
{ - OBFUSCATION_FILE_CAP_REACHED Note
The 400 file cap was reached before every file was read.
package-lock.json, line 1
{
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
tools/code-modernizer/src/utils/file-ops.test.ts, line 10
await fs.rm(tmpDir, { recursive: true, force: true });
tools/component-factory/src/index.ts, line 310
if (fs.existsSync(resolvedDir)) fs.rmSync(resolvedDir, { recursive: true, force: true });
tools/component-fixer/src/index.test.ts, line 16
fs.rmSync(tmpDir, { recursive: true, force: true });
Show more
tools/dep-auditor/src/index.test.ts, line 19
fs.rmSync(tmpDir, { recursive: true, force: true });
tools/legacy-analyzer/src/index.test.ts, line 25
fs.rmSync(tmpDir, { recursive: true, force: true });
tools/lighthouse-runner/src/index.test.ts, line 17
fs.rmSync(tmpDir, { recursive: true, force: true });
tools/monorepo-manager/src/utils.test.ts, line 29
for (const d of tmpDirs) if (fs.existsSync(d)) fs.rmSync(d, { recursive: true });
tools/quality-pipeline/src/index.ts, line 120
fs.unlinkSync(outFile);
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
client/src/api/client.ts, line 15
const res = await fetch(`${BASE}/call`, {
demo/legacy-app/src/hooks/useUsers.js, line 32
fetch(`/api/users/${id}`)
demo/legacy-app/src/utils/api.js, line 4
const response = await fetch(`${BASE_URL}/users`);
Show more
demo/legacy-app/src/utils/api.js, line 10
const response = await fetch(`${BASE_URL}/users/${id}`);
demo/legacy-app/src/utils/api.js, line 16
const response = await fetch(`${BASE_URL}/users`, {
tools/api-client-generator/src/core.ts, line 109
const res = await fetch(url, {
tools/generate-tests/src/analyzer.test.ts, line 40
const src = `export async function fetchUser(id: string) { return fetch('/users/' + id) }`;
tools/legacy-analyzer/src/tools/03-analyze-components.ts, line 47
if (content.includes('fetch(') || content.includes('axios.') || importSources.some((s) => s.includes('api'))) {
client/src/article.md, line 217
const res = await fetch('http://localhost:5001/api/scaffold', {
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
client/src/data/tools.ts, line 400
ts/ejection/CRACO, REACT_APP_ env vars + .env files, %PUBLIC_URL%/homepage, proxy, je
client/src/data/tools.ts, line 502
description: 'Generate a Zod-validated, typed env module (Vite or Next) from env var names or an .env.example - throws on boot with a readable error. Zod at the env boundary.',
tools/codemod-runner/src/core.ts, line 20
'cra-env-to-vite': { find: 'process\\.env\\.REACT_APP_([A-Z0-9_]+)', replace: 'import.meta.env.VITE_$1', flags: 'g' },
Show more
tools/cra-to-vite/src/index.ts, line 55
const envFiles = ['.env', '.env.local', '.env.development', '.env.production', '.env.test'].filter((f) => exists(root, f));
tools/craconfig-analyzer/src/core.test.ts, line 6
expect(extractEnvVars('process.env.REACT_APP_API_URL; process.env.REACT_APP_KEY; process.env.REACT_APP_API_URL')).toEqual(['REACT_APP_API_URL', 'REACT_APP_KEY']);
tools/craconfig-analyzer/src/core.test.ts, line 23
envFiles: ['.env', '.env.production'],
tools/craconfig-analyzer/src/core.test.ts, line 29
expect(p.envFiles).toEqual(['.env', '.env.production']);
tools/craconfig-analyzer/src/core.ts, line 4
// skips: react-scripts/ejection/CRACO, REACT_APP_ env vars + .env files,
tools/craconfig-analyzer/src/core.ts, line 54
for (const m of sources.matchAll(/process\.env\.(REACT_APP_[A-Z0-9_]+)/g)) names.add(m[1]);
tools/env-var-migrator/src/core.test.ts, line 6
const r = migrateSource('const u = process.env.REACT_APP_API_URL; const k = process.env.REACT_APP_KEY;');
tools/playwright-scaffolder/src/core.ts, line 107
await page.getByLabel('Password').fill(process.env.E2E_PASSWORD ?? 'secret123');
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
a file was over the read cap and was not fully read. the file cap was reached before every file was read.
OBFUSCATION_FILE_OVER_READ_CAP OBFUSCATION_FILE_CAP_REACHED
package-lock.json, line 1
{
tools/shared/src/ToolRegistry.ts, line 1
// ============================================================================
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit eff1a17db3d2. can delete files. can reach a host that is not written as a fixed address. reads a credential or environment file. a file was over the read cap and was not fully read. the file cap was reached before every file was read.
Date and source
Date checked:
github.com
Commit graded: eff1a17db3d2c1c90f6fe6b04838273ec66af2f6
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.