MCP, MCP server
Kloakt
Kloakt
Compatibility: Not stated.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 6159897c0b64, unchanged since the check below.
NETWORK_HOST_FROM_INPUT
Why this grade
- NETWORK_HOST_FROM_INPUT Medium
A file takes a URL or endpoint as input and has no fixed host list.
install.sh, line 24
if command -v curl >/dev/null 2>&1; then
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
If you think this grade is wrong, email [email protected] with the entry link and your evidence. We aim to acknowledge within two working days and decide within seven. If we confirm an error, we aim to correct it within 24 hours of confirming it. These are aims, not guarantees.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Note
requests shell access. The manifest names this permission.
PERMISSION_SHELL_DECLARED
kloakt.py, line 88
result = subprocess.run(
kloakt.py, line 137
result = subprocess.run(
kloakt.py, line 162
result = subprocess.run(
Show more
kloakt.py, line 188
result = subprocess.run(
kloakt.py, line 367
result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
kloakt.py, line 394
result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
kloakt.py, line 413
result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
kloakt.py, line 451
subprocess.Popen(
Install and update
Note
README documents an installer that pipes a download into a shell. The docs document an installer that pipes a download into a shell.
INSTALL_DOCUMENTED_INSTALLER
README.md, line 34
curl -fsSL https://raw.githubusercontent.com/KultMember6Banger/kloakt/main/install.sh | sh
install.sh, line 5
# curl -fsSL https://raw.githubusercontent.com/KultMember6Banger/kloakt/main/install.sh | sh
Network
Serious
accepts a host from input, with no fixed list in this file.
NETWORK_HOST_FROM_INPUT
install.sh, line 24
if command -v curl >/dev/null 2>&1; then
install.sh, line 25
DL="curl -fsSL"
install.sh, line 26
DL_O="curl -fsSL -o"
Show more
install.sh, line 27
elif command -v wget >/dev/null 2>&1; then
install.sh, line 28
DL="wget -qO-"
install.sh, line 29
DL_O="wget -qO"
install.sh, line 31
err "need either curl or wget"
kloakt.py, line 147
def fetch(
mcp_server.py, line 203
"description": "Hard cap on pages to fetch (default: 10)",
mcp_server.py, line 483
result = fetch(
README.md, line 205
html = fetch("https://example.com", dump="html")
README.md, line 206
title = fetch("https://example.com", eval_js="document.title")
Secrets
Pass
No read of a credential file or secret environment variable found.
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 6159897c0b64. requests shell access. The manifest names this permission. README documents an installer that pipes a download into a shell. The docs document an installer that pipes a download into a shell. accepts a host from input, with no fixed list in this file.
Date and source
Date checked:
github.com
Commit graded: 6159897c0b647232f0f361a02d0929a796fa07a9
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.