MCP, MCP server
Local Stt Mcp
A high-performance Model Context Protocol (MCP) server providing local speech-to-text transcription using whisper.cpp, optimized for Apple Silicon.
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 6cca78109a4e, unchanged since the check below.
PERMISSION_DELETE_FILES SECRETS_PATH_DOTENV NETWORK_NAMED_HOST SECRETS_ENV_READ OBFUSCATION_FILE_OVER_READ_CAP
Why this grade
- PERMISSION_DELETE_FILES Low
Contains a call that can delete files.
mcp-server/src/utils/diarization-python.ts, line 291
await fs.unlink(scriptPath).catch(() => {}); // Ignore cleanup errors - SECRETS_PATH_DOTENV Low
Mentions a .env file.
.gitignore, line 26
.env - NETWORK_NAMED_HOST Note
Calls a fixed host that the description names.
mcp-server/src/tools/list-models.ts, line 105
base_en: 'curl -L -O https://huggingface.co/ggerganov/whisper.cpp/resolve/main/ggml-base.en.bin', - SECRETS_ENV_READ Note
Reads an environment variable whose name contains KEY, SECRET, TOKEN, PASSWORD or CREDENTIAL.
mcp-server/src/utils/diarization-python.ts, line 147
...(process.env.HF_TOKEN && { HF_TOKEN: process.env.HF_TOKEN }), - OBFUSCATION_FILE_OVER_READ_CAP Note
A file was over the read cap and was not fully read.
input/sample_meeting_40_seconds.wav, line 1
RIFFA
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
mcp-server/src/utils/diarization-python.ts, line 291
await fs.unlink(scriptPath).catch(() => {}); // Ignore cleanup errors
mcp-server/src/utils/diarization-python.ts, line 296
await fs.unlink(scriptPath).catch(() => {});
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Note
can reach huggingface.co.
NETWORK_NAMED_HOST
mcp-server/src/tools/list-models.ts, line 105
base_en: 'curl -L -O https://huggingface.co/ggerganov/whisper.cpp/resolve/main/ggml-base.en.bin',
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
mcp-server/src/utils/diarization-python.ts, line 147
...(process.env.HF_TOKEN && { HF_TOKEN: process.env.HF_TOKEN }),
mcp-server/src/utils/diarization-python.ts, line 204
hf_token = os.environ.get('HF_TOKEN')
.gitignore, line 26
.env
Show more
mcp-server/src/utils/diarization-python.ts, line 390
hf_token = os.environ.get('HF_TOKEN')
.gitignore, line 25
# Environment variables and secrets
.gitignore, line 28
!.env.example
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
a file was over the read cap and was not fully read.
OBFUSCATION_FILE_OVER_READ_CAP
input/sample_meeting_40_seconds.wav, line 1
RIFFA
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Note
the latest commit is more than 365 days old.
MAINTAINER_STALE
No file path was stored.
2025-06-03T17:18:33+01:00
Note
Hygiene check of commit 6cca78109a4e. can delete files. can reach huggingface.co. reads a credential or environment file. a file was over the read cap and was not fully read. the latest commit is more than 365 days old.
Date and source
Date checked:
github.com
Commit graded: 6cca78109a4e46061072b8163e3fbb4cd9c54578
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.