MCP, MCP server
Octagon Mcp Server
Skills-first Claude Code plugin for Octagon market intelligence, prediction market research, and financial analysis workflows.
Compatibility: Not stated.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit a3234633fbcc, unchanged since the check below.
INSTALL_LIFECYCLE_HOOK
Why this grade
- INSTALL_LIFECYCLE_HOOK Medium
A package install hook (preinstall, install, postinstall or prepare) runs a script.
package.json, line 42
prepare
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Pass
No shell or command execution found, and no extra permission was declared.
Install and update
Concern
runs a script at install time.
INSTALL_LIFECYCLE_HOOK
package.json, line 42
prepare
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
src/docs/fetcher.ts, line 83
const response = await fetch(parsedUrl, {
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
install.sh, line 27
# Create .env file if it doesn't exist
install.sh, line 28
if [ ! -f .env ]; then
install.sh, line 29
echo "Creating .env file..."
Show more
install.sh, line 30
cp .env.example .env
install.sh, line 31
echo "Please edit the .env file and add your Octagon API key."
run-server.sh, line 15
# Try to load from .env file
run-server.sh, line 16
if [ -f ".env" ]; then
run-server.sh, line 17
export $(grep -v '^#' .env | xargs)
src/client.ts, line 9
const OCTAGON_API_KEY = process.env.OCTAGON_API_KEY;
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit a3234633fbcc. runs a script at install time. can reach a host that is not written as a fixed address. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: a3234633fbcc523be4b2ed68233c9e967c0c7fa2
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.