MCP, MCP server
mind
Local project memory with recall, provenance, policy, and dreams.
Compatibility: Not stated.
Grade C
One Medium finding. Read the report before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
NETWORK_HOST_FROM_INPUT
Why this grade
- NETWORK_HOST_FROM_INPUT Medium
A file takes a URL or endpoint as input and has no fixed host list.
SKILL.md, line 52
curl -fsSLO https://raw.githubusercontent.com/Da7-Tech/mind/v7.0.0/mind.py
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
bench/autonomy.py, line 256
shutil.rmtree(base, ignore_errors=True)
bench/bench.py, line 106
shutil.rmtree(tmp, ignore_errors=True)
bench/bench.py, line 118
shutil.rmtree(t1, ignore_errors=True)
Show more
bench/bench.py, line 119
shutil.rmtree(t2, ignore_errors=True)
bench/bulk.py, line 62
shutil.rmtree(root, ignore_errors=True)
bench/bulk.py, line 80
shutil.rmtree(root, ignore_errors=True)
bench/fuzz.py, line 107
shutil.rmtree(tmp, ignore_errors=True)
bench/fuzz.py, line 115
subprocess.run([sys.executable, str(here), "init"], cwd=str(proj),
bench/fuzz.py, line 117
r = subprocess.run([sys.executable, str(here), *args], cwd=str(proj),
bench/fuzz.py, line 127
shutil.rmtree(proj, ignore_errors=True)
bench/mutate.py, line 220
result = subprocess.run(
bench/provenance.py, line 51
commit = subprocess.check_output(
bench/provenance.py, line 57
dirty = bool(subprocess.check_output(
bench/soak.py, line 196
return subprocess.run([sys.executable, str(here), *args], cwd=str(proj),
src/mind/20_embedding.py, line 197
self._server_process = subprocess.Popen(
src/mind/20_embedding.py, line 311
proc = subprocess.Popen(
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Serious
accepts a host from input, with no fixed list in this file.
NETWORK_HOST_FROM_INPUT
SKILL.md, line 52
curl -fsSLO https://raw.githubusercontent.com/Da7-Tech/mind/v7.0.0/mind.py
bench/longmemeval.py, line 90
with urllib.request.urlopen(
Secrets
Pass
No read of a credential file or secret environment variable found.
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
a file was over the read cap and was not fully read.
OBFUSCATION_FILE_OVER_READ_CAP
mind.py, line 1
#!/usr/bin/env python3
bench/results/mutation-longmemeval-v7-dev.json, line 1
{
bench/results/mutation-mind-v7-dev.json, line 1
{
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 3b3518304e06. can delete files. accepts a host from input, with no fixed list in this file. a file was over the read cap and was not fully read.
Date and source
Date checked:
github.com
Commit graded: 3b3518304e06d7f4407af0b656baa90ae18ff63b
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.