MCP, MCP server
robot_MCP
A companion repository to my video about MCP server for the robot: - MCP Server for LLM-based AI agents (Claude Desktop, Cursor, Windsurf, etc.) to control the robot - Direct keyboard control for manual operation - CLI AI Agent can use it directly to control the robot
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 508771837546, unchanged since the check below.
INSTALL_UNPINNED SECRETS_PATH_DOTENV PERMISSION_SHELL_DECLARED SECRETS_ENV_READ
Why this grade
- INSTALL_UNPINNED Low
Dependencies use a range or git URL with no lockfile.
requirements.txt, line 2
anthropic - SECRETS_PATH_DOTENV Low
Mentions a .env file.
agent.py, line 6
Configuration via .env file: - PERMISSION_SHELL_DECLARED Note
Runs shell commands, and the manifest or description says so.
check_positions.py, line 21
os.system('cls' if os.name == 'nt' else 'clear') - SECRETS_ENV_READ Note
Reads an environment variable whose name contains KEY, SECRET, TOKEN, PASSWORD or CREDENTIAL.
llm_providers/claude_provider.py, line 18
api_key = os.getenv("ANTHROPIC_API_KEY")
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Note
requests shell access. The manifest names this permission.
PERMISSION_SHELL_DECLARED
check_positions.py, line 21
os.system('cls' if os.name == 'nt' else 'clear')
Install and update
Concern
dependencies are not pinned.
INSTALL_UNPINNED
requirements.txt, line 2
anthropic
Network
Pass
No network call found.
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
agent.py, line 6
Configuration via .env file:
agent.py, line 7
Create a .env file in the same directory with:
llm_providers/claude_provider.py, line 18
api_key = os.getenv("ANTHROPIC_API_KEY")
Show more
agent.py, line 18
python agent.py # Uses .env defaults
agent.py, line 289
help="MCP server IP (or set MCP_SERVER_IP in .env)")
agent.py, line 293
help="MCP server port (or set MCP_PORT in .env)")
llm_providers/gemini_provider.py, line 19
api_key = os.getenv("GEMINI_API_KEY")
llm_providers/openai_provider.py, line 20
self.api_key = os.getenv("OPENAI_API_KEY")
.gitignore, line 130
# Environments
README.md, line 151
Create a `.env` file in the project root with your API keys:
README.md, line 209
- `--api-key`: API key override (uses .env file by default)
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Note
the latest commit is more than 365 days old.
MAINTAINER_STALE
No file path was stored.
2025-08-12T22:12:19+07:00
Note
Hygiene check of commit 508771837546. requests shell access. The manifest names this permission. dependencies are not pinned. reads a credential or environment file. the latest commit is more than 365 days old.
Date and source
Date checked:
github.com
Commit graded: 5087718375468bf3137e85740728628ba2fed252
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.