Grades are a hygiene check, not a security guarantee.

MCP, MCP server

mcctl

mcctl, an MCP server listed in the PlugVet directory.

Compatibility: Not stated.

Grade B

Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.

Graded by PlugVetRubric v2

Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.

INSTALL_UNPINNED SECRETS_PATH_DOTENV SECRETS_ENV_READ

Why this grade

  • INSTALL_UNPINNED Low

    Dependencies use a range or git URL with no lockfile.

    requirements.txt, line 2 typer>=0.12

  • SECRETS_PATH_DOTENV Low

    Mentions a .env file.

    src/mcctl/config.py, line 3 配置优先级：函数参数 > 环境变量 > 项目根目录 .env 文件 > 默认值。

  • SECRETS_ENV_READ Note

    Reads an environment variable whose name contains KEY, SECRET, TOKEN, PASSWORD or CREDENTIAL.

    src/mcctl/config.py, line 70 tok = token or os.environ.get("MCD_MCP_TOKEN") or None

Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.

Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.

What was checked

Plain notes from the hygiene checks.

  • Permissions

    Pass

    No shell or command execution found, and no extra permission was declared.

  • Install and update

    Concern

    dependencies are not pinned.

    INSTALL_UNPINNED

    requirements.txt, line 2

    typer>=0.12

  • Network

    Pass

    No network call found.

  • Secrets

    Concern

    reads a credential or environment file.

    SECRETS_ENV_READ SECRETS_PATH_DOTENV

    src/mcctl/config.py, line 3

    配置优先级：函数参数 > 环境变量 > 项目根目录 .env 文件 > 默认值。

    src/mcctl/config.py, line 25

    """极简 .env 加载器（无第三方依赖），只在变量未设置时填充。"""

    src/mcctl/config.py, line 70

    tok = token or os.environ.get("MCD_MCP_TOKEN") or None

    Show more

    src/mcctl/config.py, line 28

    envf = base / ".env"

    .env.example, line 2

    # 注意：切勿把真实 Token 提交到 GitHub，本文件仅作本地模板，请复制为 .env 后填写。

    .gitignore, line 13

    # --- 密钥 / 本地配置（绝不提交真实 Token）---

    MCP_INTEGRATION.md, line 28

    > ⚠️ 仓库中**不包含任何真实 Token / 密钥**；配置仅使用环境变量占位符 `${MCD_MCP_TOKEN}`，见 [`mcp-config.example.json`](mcp-config.example.json) 与 [`.env.example`](.env.example)。

    docs/ARCHITECTURE.md, line 46

    | `config.py` | `Settings`：读取 `.env` / 环境变量，判定 `auto/live/mock` 模式；无 Token 自动 Mock |

    docs/ARCHITECTURE.md, line 93

    - Token 只从环境变量 / `.env` 读取，`config` 命令脱敏展示；仓库不含任何真实凭证。

  • Agent instructions

    Pass

    No instruction to ignore earlier instructions or to hide a step.

  • Obfuscation

    Pass

    No encoded or minified payload found.

  • Licence

    Pass

    A licence file is present (LICENSE).

  • Maintainer activity

    Pass

    The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit bc0bf2b698b9. dependencies are not pinned. reads a credential or environment file.

Date and source

Date checked:

View source

github.com

Commit graded: bc0bf2b698b902b090cadaa13f6126301a6b86a7

This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.

Read how this letter is chosen