MCP, MCP server
Just MCP Server
👋 A way to let LLMs speak Just
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 26a306381e91, unchanged since the check below.
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
Why this grade
- PERMISSION_DELETE_FILES Low
Contains a call that can delete files.
npm/install.js, line 112
fs.unlinkSync(tarPath); - NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
npm/install.js, line 66
https.get(downloadUrl, (response) => { - SECRETS_PATH_DOTENV Low
Mentions a .env file.
just-mcp-lib/src/environment.rs, line 35
#[snafu(display("Failed to load .env file {}: {}", path.display(), source))]
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
npm/install.js, line 112
fs.unlinkSync(tarPath);
python/just_mcp/__init__.py, line 121
result = subprocess.run(
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
npm/install.js, line 66
https.get(downloadUrl, (response) => {
npm/install.js, line 69
https.get(response.headers.location, (redirectResponse) => {
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_DOTENV
just-mcp-lib/src/environment.rs, line 35
#[snafu(display("Failed to load .env file {}: {}", path.display(), source))]
just-mcp-lib/src/environment.rs, line 81
// Use dotenvy to load the .env file
.cursor/rules/dev_workflow.mdc, line 114
2. **Environment Variables (`.env` / `mcp.json`):**
Show more
.cursor/rules/dev_workflow.mdc, line 116
* Place API keys (one per provider) in a `.env` file in the project root for CLI usage.
.cursor/rules/dev_workflow.mdc, line 122
**If AI commands FAIL in CLI** verify that the API key for the selected provider is present in the `.env` file in the root of the project.
.cursor/rules/taskmaster.mdc, line 81
* **API note:** API keys for selected AI providers (based on their model) need to exist in the mcp.json file to be accessible in MCP context. The API keys must be present in the
.cursor/rules/taskmaster.mdc, line 403
**Set API keys** in your **`.env`** file in the project root (for CLI use) or within the `env` section of your **`.cursor/mcp.json`** file (for MCP/Cursor integration). All other s
.dockerignore, line 43
# Configuration files
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 26a306381e91. can delete files. can reach a host that is not written as a fixed address. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: 26a306381e91baaddddc777bf5a62d54fd5d4654
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.