MCP, MCP server
MarsNMe
MarsNMe, an MCP server listed in the PlugVet directory.
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit c79a686b5315, unchanged since the check below.
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV SECRETS_ENV_READ
Why this grade
- PERMISSION_DELETE_FILES Low
Contains a call that can delete files.
scripts/dream_runner.py, line 324
result = subprocess.run( - NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
server.mjs, line 1224
const response = await fetch(`${SUPABASE_BASE_URL}${path}`, { - SECRETS_PATH_DOTENV Low
Mentions a .env file.
cloudflare-routing-worker/scripts/deploy.sh, line 4
# Deploy script that injects KV_NAMESPACE_ID from .env into wrangler.jsonc - SECRETS_ENV_READ Note
Reads an environment variable whose name contains KEY, SECRET, TOKEN, PASSWORD or CREDENTIAL.
server.mjs, line 190
const SUPABASE_ANON_KEY = String(process.env.SUPABASE_ANON_KEY || '').trim();
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
scripts/dream_runner.py, line 324
result = subprocess.run(
scripts/dream_runner.py, line 366
shutil.rmtree(repo_path)
scripts/dream_runner.py, line 400
shutil.rmtree(repo_path)
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
server.mjs, line 1224
const response = await fetch(`${SUPABASE_BASE_URL}${path}`, {
server.mjs, line 3726
const response = await fetch(JINA_EMBEDDING_API_URL, {
stdio.mjs, line 54
const req = http.request(
Show more
cloudflare-routing-worker/scripts/smoke-report.sh, line 20
curl -sS -o /tmp/marsnme_resp_body -w "%{http_code}" "$url"
cloudflare-routing-worker/scripts/smoke-report.sh, line 22
curl -sS -o /tmp/marsnme_resp_body -w "%{http_code}" "$url" \
cloudflare-routing-worker/scripts/smoke-route.sh, line 14
curl -sS -i "$BASE_URL/__health" | sed -n '1,20p'
cloudflare-routing-worker/scripts/smoke-route.sh, line 17
curl -sS -i "$BASE_URL/__metrics" | sed -n '1,20p'
cloudflare-routing-worker/scripts/smoke-route.sh, line 20
curl -sS -i "$BASE_URL/unknown-user-zzz/mcp" \
cloudflare-routing-worker/src/index.test.ts, line 202
const res = await worker.fetch(new Request("https://mcp.marsnme.com/setup", { method: "GET" }), makeEnv(kv));
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
server.mjs, line 190
const SUPABASE_ANON_KEY = String(process.env.SUPABASE_ANON_KEY || '').trim();
server.mjs, line 218
const OAUTH_TOKEN_TTL_SECONDS = Number.parseInt(process.env.OAUTH_TOKEN_TTL_SECONDS || '3600', 10);
cloudflare-routing-worker/scripts/deploy.sh, line 4
# Deploy script that injects KV_NAMESPACE_ID from .env into wrangler.jsonc
Show more
server.mjs, line 220
process.env.OAUTH_REFRESH_TOKEN_TTL_SECONDS || '2592000',
server.mjs, line 224
const STATIC_CLIENT_SECRET = (process.env.MCP_CLIENT_SECRET || '').trim();
server.mjs, line 225
const JINA_API_KEY = (process.env.JINA_API_KEY || '').trim();
server.mjs, line 1041
String(process.env.SUPABASE_SERVICE_ROLE_KEY || '').trim() ||
server.mjs, line 1042
String(process.env.SUPABASE_SERVICE_KEY || '').trim();
cloudflare-routing-worker/scripts/deploy.sh, line 9
# Load KV_NAMESPACE_ID from .env if exists
cloudflare-routing-worker/scripts/deploy.sh, line 10
if [[ -f .env ]]; then
cloudflare-routing-worker/scripts/deploy.sh, line 11
export $(grep -v '^#' .env | xargs)
cloudflare-routing-worker/scripts/deploy.sh, line 15
echo "ERROR: KV_NAMESPACE_ID not set. Check .env or export it." >&2
scripts/dream_runner.py, line 111
f"{DREAM_PROFILE_ROOT}/{PROFILE}/.env"
scripts/dream_runner.py, line 113
or f"{DREAM_PROFILE_ROOT}/{PROFILE}/.env"
cloudflare-routing-worker/.gitignore, line 1
.env
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit c79a686b5315. can delete files. can reach a host that is not written as a fixed address. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: c79a686b531532cdcec9cbd05d6b31a7fb6a53df
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.