MCP, MCP server
pickleshell
PickleShell
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV SECRETS_ENV_READ
Why this grade
- PERMISSION_DELETE_FILES Low
Contains a call that can delete files.
gateway/test-agent-command.js, line 142
fs.rmSync(tempDir, { recursive: true, force: true }); - NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
gateway/test-settings-http.js, line 24
te, init = {}) { const response = await fetch(`${url}${route}`, { ...init, headers: { - SECRETS_PATH_DOTENV Low
Mentions a .env file.
gateway/test-deployment-assets.js, line 70
assertIncludes(read("mcp-server/.env.example"), "PLAYWRIGHT_BROWSERS_PATH=/var/cache/pickleshell/ms-playwright", "MCP env example"); - SECRETS_ENV_READ Note
Reads an environment variable whose name contains KEY, SECRET, TOKEN, PASSWORD or CREDENTIAL.
gateway/test-codex.js, line 33
process.env.CODEX_API_KEY = '
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
gateway/test-agent-command.js, line 142
fs.rmSync(tempDir, { recursive: true, force: true });
gateway/test-codex-mcp.js, line 406
fs.rmSync(tempDir, { recursive: true, force: true });
gateway/test-codex.js, line 201
fs.rmSync(tempDir, { recursive: true, force: true });
Show more
gateway/test-config.js, line 304
fs.rmSync(tempDir, { recursive: true, force: true });
gateway/test-e2e.js, line 358
fs.rmSync(tempDir, { recursive: true, force: true });
gateway/test-execution-profile.js, line 118
main().then(() => { fs.rmSync(temp, { recursive: true, force: true });
gateway/test-execution-provider.js, line 163
main().then(() => { fs.rmSync(temp, { recursive: true, force: true });
gateway/test-file-transfer.js, line 271
fs.rmSync(WORKSPACE, { recursive: true, force: true });
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
gateway/test-settings-http.js, line 24
te, init = {}) { const response = await fetch(`${url}${route}`, { ...init, headers: {
gateway/test-settings-http.js, line 25
i = 0; i < 100; i++) { try { if ((await fetch(`${url}/health`, { headers: auth })).ok)
gateway/test-settings-http.js, line 30
assert.equal((await fetch(`${url}/settings`)).status, 401, 'global settings requires auth');
Show more
gateway/test.js, line 26
const response = await fetch(`${baseUrl}${path}`, {
mcp-server/src/gateway-client.ts, line 37
const response = await fetch(`${this.config.url}${path}`, {
mcp-server/src/gateway-client.ts, line 92
const response = await fetch(`${this.config.url}/chat`, {
mcp-server/src/gateway-client.ts, line 121
const response = await fetch(`${this.config.url}/terminal/${operation}`, {
mcp-server/src/gateway-client.ts, line 154
const response = await fetch(`${this.config.url}/status?${params}`, {
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
gateway/test-codex.js, line 33
process.env.CODEX_API_KEY = '
gateway/test-deployment-assets.js, line 70
assertIncludes(read("mcp-server/.env.example"), "PLAYWRIGHT_BROWSERS_PATH=/var/cache/pickleshell/ms-playwright", "MCP env example");
gateway/test.js, line 3
process.env.PICKLESHELL_API_KEY ||
Show more
gateway/test.js, line 4
process.env.LOCAL_AGENT_API_KEY;
gateway/src/runtime/adapters/codex-exec.js, line 22
Do not read secrets, private keys, .env files, credentials, or unrelated directories.
gateway/src/runtime/adapters/opencode.js, line 43
Do not read secrets, private keys, .env files, credentials, or unrelated directories.
mcp-server/test-client-config-schema.ts, line 51
const origKey = process.env.PICKLESHELL_API_KEY;
mcp-server/test-client-config-schema.ts, line 53
const origAltKey = process.env.LOCALAGENT_API_KEY;
mcp-server/test-client-config-schema.ts, line 59
process.env.PICKLESHELL_API_KEY = "
mcp-server/test-client-config-schema.ts, line 69
delete process.env.PICKLESHELL_API_KEY;
mcp-server/test-client-config-schema.ts, line 70
delete process.env.LOCALAGENT_API_KEY;
.gitignore, line 8
coverage/
AGENTS.md, line 192
- Never commit `.env`, `config.json`, tunnel profiles, API keys, control-plane
docs/deployment.md, line 157
/opt/pickleshell/gateway/.env.example \
docs/terminal-pty-design.md, line 496
service tokens, `.env` values, and arbitrary inherited variables. Set
gateway/.gitignore, line 1
node_modules/
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 9b3ed0a6d385. can delete files. can reach a host that is not written as a fixed address. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: 9b3ed0a6d3857372ed7ab8bd731e7e86090c4e23
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.