MCP, MCP server
Opportunity Radar
Ask out loud what public funding you can actually apply for — and get an answer with real numbers, or none at all.
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
PERMISSION_DELETE_FILES INSTALL_UNPINNED NETWORK_NO_FIXED_HOST
Why this grade
- PERMISSION_DELETE_FILES Low
Contains a call that can delete files.
demo/build_video.py, line 19
err = subprocess.run([FF, "-i", str(p)], capture_output=True, text=True).stderr - INSTALL_UNPINNED Low
Dependencies use a range or git URL with no lockfile.
requirements.txt, line 3
boto3>=1.34.0 - NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
demo/capture.py, line 60
targets = json.load(urllib.request.urlopen(f"http://127.0.0.1:{port}/json", timeout=2))
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
demo/build_video.py, line 19
err = subprocess.run([FF, "-i", str(p)], capture_output=True, text=True).stderr
demo/build_video.py, line 40
subprocess.run([FF, "-y", "-loglevel", "error", "-loop", "1", "-i", str(tmp),
demo/build_video.py, line 50
subprocess.run([FF, "-y", "-loglevel", "error", "-ss", f"{start:.2f}", "-i", str(src),
Show more
demo/build_video.py, line 102
subprocess.run([FF, "-y", "-loglevel", "error", "-f", "concat", "-safe", "0",
demo/build_video.py, line 118
subprocess.run([FF, "-y", "-loglevel", "error", "-i", str(video), *ain,
demo/capture.py, line 43
shutil.rmtree(FRAMES)
demo/capture.py, line 48
proc = subprocess.Popen([
demo/capture.py, line 113
shutil.rmtree(profile, ignore_errors=True)
demo/capture.py, line 134
subprocess.run([ff, "-hide_banner", "-loglevel", "error", "-y",
demo/shot.py, line 14
proc = subprocess.Popen([CHROME, "--headless=new", f"--remote-debugging-port={port}",
Install and update
Concern
dependencies are not pinned.
INSTALL_UNPINNED
requirements.txt, line 3
boto3>=1.34.0
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
demo/capture.py, line 60
targets = json.load(urllib.request.urlopen(f"http://127.0.0.1:{port}/json", timeout=2))
demo/shot.py, line 21
t = json.load(urllib.request.urlopen(f"http://127.0.0.1:{port}/json", timeout=2))
radar/agent.py, line 91
with urllib.request.urlopen(req, timeout=60) as r:
Show more
radar/rank.py, line 81
with urllib.request.urlopen(f"{OLLAMA_HOST}/api/tags", timeout=3) as r:
radar/rank.py, line 94
with urllib.request.urlopen(req, timeout=90) as r:
radar/sources.py, line 44
with urllib.request.urlopen(req, timeout=TIMEOUT) as resp:
web/index.html, line 164
const r = await fetch("/ask", {
Secrets
Pass
No read of a credential file or secret environment variable found.
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit a619d4cf28c2. can delete files. dependencies are not pinned. can reach a host that is not written as a fixed address.
Date and source
Date checked:
github.com
Commit graded: a619d4cf28c2ecfcd6ae98ae0c1276a7db5fbd27
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.