MCP, MCP server
Moo Tasks
Moo Tasks, an MCP server listed in the PlugVet directory.
Compatibility: Not stated.
Grade C
One Medium finding. Read the report before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
INSTALL_LIFECYCLE_HOOK
Why this grade
- INSTALL_LIFECYCLE_HOOK Medium
A package install hook (preinstall, install, postinstall or prepare) runs a script.
package.json, line 13
postinstall
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Pass
No shell or command execution found, and no extra permission was declared.
Install and update
Concern
runs a script at install time.
INSTALL_LIFECYCLE_HOOK
package.json, line 13
postinstall
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
fetch_tasks.mjs, line 13
await $fetch('http://localhost:3000/api/auth/register', {
app/composables/useBoardToken.ts, line 32
await $fetch(`/api/boards/${boardId}/token`, { method: 'DELETE' })
app/composables/useBoardToken.ts, line 42
await $fetch(`/api/boards/${boardId}/member-token`, { method: 'DELETE' })
Show more
app/composables/useBoards.ts, line 43
await $fetch(`/api/invitations/${id}/accept`, { method: 'POST' })
app/composables/useBoards.ts, line 48
await $fetch(`/api/invitations/${id}/reject`, { method: 'POST' })
app/composables/useBoards.ts, line 53
await $fetch(`/api/invitations/${id}`, { method: 'DELETE' })
app/composables/useBoards.ts, line 64
await $fetch(`/api/boards/${id}`, { method: 'DELETE' })
app/composables/useBoards.ts, line 69
await $fetch(`/api/boards/${id}/members/${userId}`, { method: 'DELETE' })
app/composables/useBoards.ts, line 74
await $fetch(`/api/boards/${id}/favorite`, { method: 'PATCH', body: { isFavorite } })
Dockerfile, line 34
CMD node -e "fetch('http://localhost:3000/').then(r => { if (!r.ok) process.exit(1) }).catch(() => process.exit(1))"
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
drizzle.config.ts, line 8
/${process.env.DB_USER || 'mootasks'}:${process.env.DB_PASSWORD || 'password'}@${process.env.DB_HOST ||
nuxt.config.ts, line 20
password: process.env.NUXT_SESSION_PASSWORD || 'default-session-password-at-least-32-chars-long',
server/db/index.ts, line 28
password: process.env.DB_PASSWORD || 'password',
Show more
server/utils/board-mcp.ts, line 701
2. Create a \`.env\` file from \`.env.example\`.
server/utils/board-mcp.ts, line 710
3. Configure \`.env\`.
server/utils/global-mcp.ts, line 33
2. Create a \`.env\` file from \`.env.example\`.
server/utils/global-mcp.ts, line 42
3. Configure \`.env\`.
server/utils/mailer.ts, line 17
pass: process.env.SMTP_PASSWORD,
server/utils/session.ts, line 61
password: config.session?.password || process.env.NUXT_SESSION_PASSWORD || 'default-session-password-at-least-32-chars-long',
.dockerignore, line 10
db.sqlite-shm
.dockerignore, line 11
.env
.dockerignore, line 13
!.env.example
.gitignore, line 25
# Local env files
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Concern
contains an encoded blob in a file that should be readable.
OBFUSCATION_ENCODED_BLOB
package-lock.json, line 1
{
README.md, line 24
<img src="https://img.shields.io/badge/MCP-Toolkit-8B5CF6?logo=data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAyNCAyNCIgZmlsbD0id2h
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 9c9345dac60b. runs a script at install time. can reach a host that is not written as a fixed address. reads a credential or environment file. contains an encoded blob in a file that should be readable.
Date and source
Date checked:
github.com
Commit graded: 9c9345dac60b66f85f5aae00aaeb6d287f2ca1f3
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.