Grades are a hygiene check, not a security guarantee.

MCP, MCP server

Nexus Shell Releases

Nexus Shell is a native macOS SSH client for managing server connections, terminal sessions, files, containers, and monitoring from one app.

Compatibility: Not stated.

Grade C

One Medium finding. Read the report before installing.

Graded by PlugVetRubric v2

Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.

SECRETS_PATH_CREDENTIAL

Why this grade

  • SECRETS_PATH_CREDENTIAL Medium

    Mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc).

    docs/jump-host-on-mac.md, line 16 IdentityFile ~/.ssh/your-existing-jump-key

Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.

Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.

What was checked

Plain notes from the hygiene checks.

  • Permissions

    Concern

    can delete files.

    PERMISSION_DELETE_FILES

    docs/fixtures/sftp-write-permissions-lab.mjs, line 62

    fs.rmSync(labDir, {recursive: true});

    examples/mac-filename-case-lab.mjs, line 46

    } finally {fs.rmSync(dir,{recursive:true,force:true});}

    examples/sftp-resume-lab.mjs, line 40

    fs.rmSync(root,{recursive:true,force:true});

    Show more

    examples/verify-sftp-startup.mjs, line 59

    fs.rmSync(directory,{recursive:true,force:true});

    examples/verify-sftp-transfer-check.py, line 26

    result = subprocess.run(["shasum", "-a", "256", "-c", "SHA256SUMS"], cwd=destination, capture_output=True, text=True)

  • Install and update

    Pass

    No install-time script found, and dependencies are pinned or absent.

  • Network

    Concern

    can reach a host that is not written as a fixed address.

    NETWORK_NO_FIXED_HOST

    examples/verify-tmux-continuity.mjs, line 20

    const response=await fetch(sourceURL);assert.equal(response.status,200);

    examples/verify-tunnel-health-layers.mjs, line 17

    const socket=track(net.connect({host:'127.0.0.1',port}));

    examples/verify-tunnel-health-layers.mjs, line 39

    const upstream=track(net.connect({host:'127.0.0.1',port:missing}));

  • Secrets

    Concern

    reads a credential or environment file.

    SECRETS_PATH_CREDENTIAL

    docs/jump-host-on-mac.md, line 9

    Save the example in a new file such as `nexus-jump-example.conf`, replace every placeholder with your approved settings, and review it. It is not an instruction to overwrite `~/.ss

    docs/jump-host-on-mac.md, line 16

    IdentityFile ~/.ssh/your-existing-jump-key

    docs/jump-host-on-mac.md, line 23

    IdentityFile ~/.ssh/your-existing-target-key

    Show more

    docs/ssh-host-key-changed.md, line 9

    3. On your Mac, inspect the configured hostname, HostKeyAlias and UserKnownHostsFile. For the ordinary trust file and port 2222, `ssh-keygen -F '[server.example]:2222' -f ~/.ssh/kn

    docs/ssh-host-key-changed.md, line 10

    4. Only after independent verification, preserve a backup and use `ssh-keygen -R '[server.example]:2222' -f ~/.ssh/known_hosts` to remove that stale host/port entry. Reconnect usin

    docs/ssh-key-selection-on-mac.md, line 25

    IdentityFile ~/.ssh/id_ed25519_project

    docs/zh-CN/ssh-host-key-changed.md, line 9

    3. 在 Mac 本地核对实际 trust 文件与主机别名。普通 known_hosts 的 2222 端口示例为 `ssh-keygen -F '[server.example]:2222' -f ~/.ssh/known_hosts`，哈希过的主机名也能查找。

    docs/zh-CN/ssh-host-key-changed.md, line 10

    4. 只有独立核验匹配后，先保留备份，再用 `ssh-keygen -R '[server.example]:2222' -f ~/.ssh/known_hosts` 移除该主机和端口的旧记录。按原登录密钥/跳板配置重连，再次核对指纹后接受。默认22端口通常只用主机名；集中管理的CA或信任文件应由管理员处理。

  • Agent instructions

    Pass

    No instruction to ignore earlier instructions or to hide a step.

  • Obfuscation

    Pass

    No encoded or minified payload found.

  • Licence

    Note

    no licence file found.

    LICENCE_MISSING

    No file path was stored.

    no licence file found.

  • Maintainer activity

    Pass

    The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 042d523f0f6c. can delete files. can reach a host that is not written as a fixed address. reads a credential or environment file. no licence file found.

Date and source

Date checked:

View source

github.com

Commit graded: 042d523f0f6cc81cf19902962d35ee3ba991a68e

This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.

Read how this letter is chosen