MCP, MCP server
Mcp Token Savers
Repo renamed 2026-05-24: g-shevchenko/hwai-mcp-stack → g-shevchenko/mcp-token-savers.
Compatibility: Not stated.
Grade C
One Medium finding. Read the report before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
NETWORK_HOST_FROM_INPUT
Why this grade
- NETWORK_HOST_FROM_INPUT Medium
A file takes a URL or endpoint as input and has no fixed host list.
act-receipts/examples/jitter_endpoint.py, line 12
curl http://127.0.0.1:3030/test/jitter | head
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
benchmarks/code-diet/corpus_v2/real_ai/pbt-runner-mcp/src/index.ts, line 423
await fs.rm(tmpDir, { recursive: true, force: true }).catch(() => {});
benchmarks/code-diet/scripts/build-clean-corpus.mjs, line 45
fs.rmSync(OUT, { recursive: true, force: true });
benchmarks/code-diet/scripts/build-injected-corpus.mjs, line 86
fs.rmSync(OUT, { recursive: true, force: true });
Show more
benchmarks/code-diet/scripts/build-real-ai-corpus.mjs, line 50
fs.rmSync(OUT, { recursive: true, force: true });
mcp/source/services/mcp-token-router/runners/contextprep_runner.py, line 72
r = subprocess.run(
mcp/source/services/mcp-token-router/runners/sophon_runner.py, line 76
r = subprocess.run(
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Serious
accepts a host from input, with no fixed list in this file.
NETWORK_HOST_FROM_INPUT
act-receipts/examples/jitter_endpoint.py, line 12
curl http://127.0.0.1:3030/test/jitter | head
benchmarks/code-diet/corpus_v2/real_ai/context-prep-mcp/src/prep-url.ts, line 378
response = await fetch(url.toString(), {
benchmarks/code-diet/corpus_v2/real_ai/context-prep-mcp/src/scraper-core-client.ts, line 90
const response = await fetch(`${config.scraperCoreUrl}/fetch`, {
Show more
mcp/install.sh, line 35
/bin/bash -lc "$(curl -fsSL https://raw.githubusercontent.com/g-shevchenko/hwai-mcp-stack/main/install.sh)"
mcp/source/services/context-prep-mcp/benchmarks/run_http_benchmark.py, line 31
with urllib.request.urlopen(req, timeout=30) as res:
mcp/source/services/context-prep-mcp/bin/context-prep-watchdog.sh, line 35
if ! body="$(curl -fsS --max-time 8 "${HEALTH_URL}")"; then
mcp/source/services/context-prep-mcp/src/prep-url.ts, line 378
response = await fetch(url.toString(), {
mcp/source/services/context-prep-mcp/src/scraper-core-client.ts, line 90
const response = await fetch(`${config.scraperCoreUrl}/fetch`, {
mcp/source/services/playwright-trace-mcp/scripts/generate-real-fixtures.mjs, line 43
fetch("/api/save?debug=true", { method: "POST", body: "{}" }),
mcp/source/services/playwright-trace-mcp/scripts/generate-real-fixtures.mjs, line 44
fetch("/api/slow-report", { method: "GET" })
mcp/source/services/repo-hygiene-mcp/scripts/benchmark-local.mjs, line 141
["import requests", "", "def post_it(payload):", ' return requests.post("u", json=payload).json()', ""].join("\n"),
mcp/source/services/repo-hygiene-mcp/scripts/benchmark-local.mjs, line 248
!depthCombined.includes("requests.post") && !depthCombined.includes("flags.append"),
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
benchmark/anti_pattern_audit.py, line 85
regex=re.compile(r"process\.env\.[A-Z_]+\s*\+\s*system|env\(.*\)\s*\+\s*"),
benchmarks/code-diet/corpus_v2/clean/hwai-language-graph/config.ts, line 43
measurementUsdPer1MTokens: readPositiveFloat(process.env.LANGUAGE_GRAPH_USD_PER_1M_TOKENS, 3),
benchmarks/code-diet/corpus_v2/clean/hwai-repo-hygiene/config.ts, line 45
measurementUsdPer1MTokens: readPositiveFloat(process.env.REPO_HYGIENE_USD_PER_1M_TOKENS, 3),
Show more
benchmarks/code-diet/corpus_v2/injected/cd02-5-hwai-language-graph__config.ts, line 43
measurementUsdPer1MTokens: readPositiveFloat(process.env.LANGUAGE_GRAPH_USD_PER_1M_TOKENS, 3),
benchmarks/code-diet/corpus_v2/injected/cd05-8-hwai-repo-hygiene__config.ts, line 45
measurementUsdPer1MTokens: readPositiveFloat(process.env.REPO_HYGIENE_USD_PER_1M_TOKENS, 3),
benchmarks/code-diet/corpus_v2/injected/control-hwai-language-graph__config.ts, line 43
measurementUsdPer1MTokens: readPositiveFloat(process.env.LANGUAGE_GRAPH_USD_PER_1M_TOKENS, 3),
benchmarks/code-diet/corpus_v2/real_ai/contract-schema-mcp/src/contracts.ts, line 79
const CONTRACT_EXTENSIONS = new Set([".json", ".yaml", ".yml", ".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".env", ".example", ".sample"]);
benchmarks/code-diet/corpus_v2/real_ai/contract-schema-mcp/src/contracts.ts, line 528
for (const match of text.matchAll(/process\.env\.([A-Z][A-Z0-9_]{1,})/g)) {
benchmarks/code-diet/corpus_v2/real_ai/contract-schema-mcp/src/contracts.ts, line 533
for (const match of text.matchAll(/process\.env\[['"]([A-Z][A-Z0-9_]{1,})['"]]/g)) {
benchmarks/code-diet/corpus_v2/real_ai/contract-schema-mcp/src/contracts.ts, line 538
for (const match of text.matchAll(/\b(?:const|let|var)\s*\{([^}]+)}\s*=\s*process\.env\b/g)) {
benchmarks/code-diet/corpus_v2/real_ai/contract-schema-mcp/src/contracts.ts, line 552
return /^\.?env(\.|-)?(example|sample|template|local\.example)$/.test(base) || base.endsWith(".env.example");
benchmarks/code-diet/corpus_v2/real_ai/language-graph-mcp/src/config.ts, line 43
measurementUsdPer1MTokens: readPositiveFloat(process.env.LANGUAGE_GRAPH_USD_PER_1M_TOKENS, 3),
benchmarks/code-diet/corpus_v2/real_ai/repo-history-mcp/src/config.ts, line 44
measurementUsdPer1MTokens: readPositiveFloat(process.env.REPO_HISTORY_USD_PER_1M_TOKENS, 3),
benchmarks/code-diet/corpus_v2/real_ai/repo-quality-gate-mcp/src/config.ts, line 55
measurementUsdPer1MTokens: readPositiveFloat(process.env.REPO_QUALITY_GATE_USD_PER_1M_TOKENS, 3),
benchmarks/code-diet/corpus_v2/real_ai/retrieval-mcp/src/path-policy.ts, line 32
"!**/.env",
benchmarks/code-diet/corpus_v2/real_ai/retrieval-mcp/src/path-policy.ts, line 33
"!**/.env.*",
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
the file cap was reached before every file was read.
OBFUSCATION_FILE_CAP_REACHED
mcp/source/services/contract-schema-mcp/scripts/local-stdio.sh, line 1
#!/usr/bin/env bash
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 53992a88bf98. can delete files. accepts a host from input, with no fixed list in this file. reads a credential or environment file. the file cap was reached before every file was read.
Date and source
Date checked:
github.com
Commit graded: 53992a88bf985e3b7b5a5ccb18a981597e0f6395
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.