MCP, MCP server
Nikita
English summary. Nikita is a service for 1C:Enterprise administrators that parses 1C event logs (the registration log, .lgf/.lgp text and .lgd SQLite formats) and exports them to ClickHouse for SQL analytics, with optional Solr full-text search and Redis buffering.
Compatibility: Not stated.
Grade C
One Medium finding. Read the report before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
OBFUSCATION_ENCODED_BLOB
Why this grade
- OBFUSCATION_ENCODED_BLOB Medium
Contains a long base64 shaped string in a file that should be readable.
dlls/libcrypto-1_1-x64.dll, line 1
MZ� �� � @ � � �!�L�!This program cannot be run in DOS mode.
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Note
requests shell access. The manifest names this permission.
PERMISSION_SHELL_DECLARED
Nikita.py, line 260
services_output = subprocess.check_output(
Nikita.py, line 281
service_info = subprocess.check_output(
src/redis_manager.py, line 51
self.process = subprocess.Popen(args)
Show more
src/solr.py, line 67
version_output = subprocess.check_output(
src/solr.py, line 169
g.execution.solr.pid = subprocess.Popen(
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
src/cherry.py, line 814
fetch('/set_debug')
src/cherry.py, line 853
fetch('/set_debug?enabled=' + enabled)
src/cherry.py, line 880
fetch(`/debug_logs?filter_text=${filterVal}&limit=${limitVal}`)
Show more
src/reader.py, line 61
r = requests.post(url, data=json_data, headers=headers)
src/sender.py, line 333
response = requests.post(url=url, json=solr_docs, timeout=30)
src/solr.py, line 181
solr_wakes = requests.get(g.execution.solr.url_main, timeout=5)
src/solr.py, line 212
bc_ret = requests.get(bc_url, timeout=10).status_code
src/solr.py, line 218
field_response = requests.get(
docs/admin/monitoring.md, line 212
response = requests.get('http://localhost:8984/stats_api')
docs/admin/monitoring.md, line 356
stats = requests.get('http://localhost:8984/stats_api', timeout=5).json()
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
AGENTS.md, line 38
cp env.example .env # set C1_SRVINFO_PATH or IBASE_N*, ClickHouse settings
Nikita.py, line 120
t.debug_print(" Проверьте наличие переменных IBASE_0, IBASE_0_JR и т.д. в файле .env")
Nikita.py, line 580
t.debug_print(" 1. Укажите базы в .env:")
Show more
src/cherry.py, line 1250
# Сохраняем в .env файл
src/cherry.py, line 1251
env_path = os.path.join(g.execution.self_dir, '.env')
src/cherry.py, line 1253
# Читаем текущий .env файл
src/cherry.py, line 1274
t.debug_print(f"✓ Отладка {'включена' if new_debug_state else 'выключена'} и сохранена в .env", "cherry")
src/cherry.py, line 1276
t.debug_print(f"⚠ Не удалось сохранить в .env: {str(env_err)}, но отладка {'включена' if new_debug_state else 'выключена'}", "cherry")
src/globals.py, line 128
password = os.getenv('CLICKHOUSE_PASSWORD', '')
src/globals.py, line 136
clickhouse_password = os.getenv('MCP_CLICKHOUSE_PASSWORD', '')
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Concern
contains an encoded blob in a file that should be readable.
OBFUSCATION_ENCODED_BLOB
dlls/libcrypto-1_1-x64.dll, line 1
MZ� �� � @ � � �!�L�!This program cannot be run in DOS mode.
dlls/libssl-1_1-x64.dll, line 1
MZ� �� � @ � � �!�L�!This program cannot be run in DOS mode.
dlls/sqlite3.dll, line 1
MZ� �� � @ � � � �!�L�!This program cannot be run in DOS mode.
Show more
docs/dev/Nikita.py.xmind, line 1
PK
licenses/installer.java.license.rtf, line 56
00d0c9ea79f9bace118c8200aa004ba90b0200000003000000e0c9ea79f9bace118c8200aa004ba90ba8000000680074007400700073003a002f002f007700770077002e006f007200610063006c0065002e0063006f006d002f
licenses/installer.java.license.rtf, line 111
2f7468656d65312e786d6c504b01022d00140006000800000021000dd1909fb60000001b0100002700000000000000000000000000c80a00007468656d652f7468656d652f5f72656c732f7468656d654d616e616765722e786d
licenses/installer.java.license.rtf, line 115
656e74323d22616363656e74322220616363656e74333d22616363656e74332220616363656e74343d22616363656e74342220616363656e74353d22616363656e74352220616363656e74363d22616363656e74362220686c69
licenses/installer.java.license.rtf, line 196
d0cf11e0a1b11ae1000000000000000000000000000000003e000300feff0900060000000000000000000000010000000100000000000000001000000200000001000000feffffff0000000000000000ffffffffffffffffffff
licenses/installer.java.license.rtf, line 197
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
licenses/installer.java.license.rtf, line 198
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
licenses/installer.java.license.rtf, line 199
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
licenses/installer.java.license.rtf, line 200
fffffffffffffffffdffffff04000000feffffff05000000fefffffffeffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 3f353f4f5498. requests shell access. The manifest names this permission. can reach a host that is not written as a fixed address. reads a credential or environment file. contains an encoded blob in a file that should be readable.
Date and source
Date checked:
github.com
Commit graded: 3f353f4f5498e0921af6f4fea7d0c4bc1f24f961
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.