MCP, MCP server
Lachesis
Lachesis, an MCP server listed in the PlugVet directory.
Compatibility: Not stated.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit e464ccfb7a42, unchanged since the check below.
OBFUSCATION_MINIFIED_PAYLOAD
Why this grade
- OBFUSCATION_MINIFIED_PAYLOAD Medium
Contains a very long line with almost no spaces in a script or style file.
lachesis/core/graph_pb2.py, line 27
DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x0bgraph.proto\x12\x0elachesis.graph\"\xf2\x01\n\x05Value\x12\x0e\n\x04text\x18\x01 \x01(\tH\x00\x12\x11\n\x07integer
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
lachesis/cache.py, line 183
shutil.rmtree(self.directory)
lachesis/kuzu_store.py, line 1181
shutil.rmtree(target_db_dir) if os.path.isdir(target_db_dir) else os.remove(target_db_dir)
lachesis/kuzu_store.py, line 2438
shutil.rmtree(store_dir, ignore_errors=True)
Show more
lachesis/kuzu_store.py, line 2471
shutil.rmtree(index_spill_dir, ignore_errors=True)
lachesis/kuzu_store.py, line 2487
shutil.rmtree(target_db_dir) if os.path.isdir(target_db_dir) else os.remove(target_db_dir)
lachesis/test_pipeline_inventory.py, line 40
advisory.write_text("import os\ndef v(x):\n os.system(x)\n", encoding="utf-8")
lachesis/test_session.py, line 274
os.remove(sidecar)
lachesis/test_session.py, line 359
os.remove(sidecar)
lachesis/cli/analyze.py, line 61
shutil.rmtree(path, ignore_errors=True)
lachesis/cli/doctor.py, line 44
done = subprocess.run(command, capture_output=True, text=True, timeout=10)
lachesis/cli/main.py, line 344
out = subprocess.run(["git", "-C", str(source), *a],
lachesis/cli/source.py, line 102
proc = subprocess.run(
lachesis/cli/test_cli_version.py, line 21
result = subprocess.run(
lachesis/core/runner.py, line 102
process = subprocess.Popen(
lachesis/flow/native_lifetime.py, line 123
completed = subprocess.run(argv, env=child_env)
lachesis/frontends/typescript/build_graph_impl.mjs, line 1685
// npm package (`got.get`, `child_process.exec`, `undici.fetch`); the native binder
Install and update
Note
The docs document an installer that pipes a download into a shell.
INSTALL_DOCUMENTED_INSTALLER
pyproject.toml, line 132
before-all = "curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal"
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
lachesis/frontends/python/bodies.py, line 631
# binder match those the same way it already matches `httpx.get(...)`.
lachesis/frontends/python/fixtures/app/dynamic.py, line 26
return handle_holder.fetch(key)
lachesis/frontends/python/fixtures/app/dynamic.py, line 30
def fetch(self, key):
Show more
lachesis/frontends/python/fixtures/app/dynamic.py, line 32
first = super().fetch(key)
lachesis/frontends/python/fixtures/app/dynamic.py, line 34
return super().fetch(key)
lachesis/frontends/python/fixtures/app/dynamic.py, line 40
return self.fetch(key)
lachesis/frontends/python/fixtures/app/repository.py, line 16
def fetch(self, key):
lachesis/frontends/python/fixtures/app/repository.py, line 36
def fetch(self, key):
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_DOTENV
.gitignore, line 59
# Local secrets (PyPI token, etc.) -- never commit
.gitignore, line 60
.env
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Concern
contains a minified payload.
OBFUSCATION_MINIFIED_PAYLOAD
lachesis/core/graph_pb2.py, line 27
DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x0bgraph.proto\x12\x0elachesis.graph\"\xf2\x01\n\x05Value\x12\x0e\n\x04text\x18\x01 \x01(\tH\x00\x12\x11\n\x07integer
lachesis/core/lifetime_pb2.py, line 27
DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x0elifetime.proto\x12\x11lachesis.lifetime\"\'\n\x04Path\x12\x0c\n\x04root\x18\x01 \x01(\t\x12\x11\n\tselectors\x18\x
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit e464ccfb7a42. can delete files. The docs document an installer that pipes a download into a shell. can reach a host that is not written as a fixed address. reads a credential or environment file. contains a minified payload.
Date and source
Date checked:
github.com
Commit graded: e464ccfb7a420b0d9ff7555df4d70b27dcf40fe9
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.