MCP, MCP server
pizza_doc
File-based architecture-as-code for systems that are too big to hold in your head but too small to deserve a wiki.
Compatibility: Not stated.
Grade C
One Medium finding. Read the report before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
NETWORK_HOST_FROM_INPUT
Why this grade
- NETWORK_HOST_FROM_INPUT Medium
A file takes a URL or endpoint as input and has no fixed host list.
.agents/skills/pd-extract-python/SKILL.md, line 253
- `requests.get/post/put/delete(url)`, `requests.Session().get(url)`.
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
packages/cli/src/commands/change.ts, line 183
if (fs.existsSync(target)) fs.rmSync(target, { force: true })
packages/cli/src/commands/diff.ts, line 57
fs.rmSync(tmp, { recursive: true, force: true })
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Serious
accepts a host from input, with no fixed list in this file.
NETWORK_HOST_FROM_INPUT
.agents/skills/pd-extract-python/SKILL.md, line 253
- `requests.get/post/put/delete(url)`, `requests.Session().get(url)`.
.agents/skills/pd-extract-python/SKILL.md, line 255
- `urllib.request.urlopen(url)`, `http.client.HTTPSConnection(host, port)`.
.agents/skills/pd-extract-typescript/SKILL.md, line 279
- `fetch("https://...")`, `fetch(new URL(...))` - extract the URL host.
Show more
.agents/skills/pd-extract-typescript/SKILL.md, line 280
- `axios.get/post/put(url)`, `axios.create({ baseURL })`.
.claude/skills/pd-extract-python/SKILL.md, line 256
- `requests.get/post/put/delete(url)`, `requests.Session().get(url)`.
.claude/skills/pd-extract-python/SKILL.md, line 258
- `urllib.request.urlopen(url)`, `http.client.HTTPSConnection(host, port)`.
.claude/skills/pd-extract-typescript/SKILL.md, line 283
- `fetch("https://...")`, `fetch(new URL(...))` - extract the URL host.
.claude/skills/pd-extract-typescript/SKILL.md, line 284
- `axios.get/post/put(url)`, `axios.create({ baseURL })`.
packages/cli/skills/pd-extract-python/SKILL.md, line 253
- `requests.get/post/put/delete(url)`, `requests.Session().get(url)`.
packages/cli/skills/pd-extract-python/SKILL.md, line 255
- `urllib.request.urlopen(url)`, `http.client.HTTPSConnection(host, port)`.
packages/cli/skills/pd-extract-typescript/SKILL.md, line 279
- `fetch("https://...")`, `fetch(new URL(...))` - extract the URL host.
packages/cli/skills/pd-extract-typescript/SKILL.md, line 280
- `axios.get/post/put(url)`, `axios.create({ baseURL })`.
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_DOTENV
.gitignore, line 24
.pnpm-store/
.gitignore, line 25
.env
.gitignore, line 27
!.env.example
Show more
docs/site/.gitignore, line 12
# environment variables
docs/site/.gitignore, line 13
.env
packages/core/src/validator/semantic.ts, line 2612
if (m.routeAuth?.env) entry.authEnv = m.routeAuth.env
packages/core/src/validator/semantic.ts, line 2624
if (r.auth?.env) entry.authEnv = r.auth.env
packages/core/src/validator/semantic.ts, line 2755
if (!call || !call.path || !call.method || !call.credential?.env) continue
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
a file was over the read cap and was not fully read. the file cap was reached before every file was read.
OBFUSCATION_FILE_OVER_READ_CAP OBFUSCATION_FILE_CAP_REACHED
pnpm-lock.yaml, line 1
lockfileVersion: '9.0'
packages/core/__fixtures__/invalid/REF_WRONG_KIND_PERSISTED_AS/modules/api/models/User.yaml, line 1
kind: model
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit a01ff3d85d96. can delete files. accepts a host from input, with no fixed list in this file. reads a credential or environment file. a file was over the read cap and was not fully read. the file cap was reached before every file was read.
Date and source
Date checked:
github.com
Commit graded: a01ff3d85d9680363dcef4d6390cf7e7c5b8de07
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.