MCP, MCP server
Stitch Mcp Auto
Stitch Mcp Auto, an MCP server listed in the PlugVet directory.
Compatibility: Not stated.
Grade D
Two or more Medium findings, or a High finding. Only try it in a sandbox.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 0d62990b876c, unchanged since the check below.
INSTALL_REMOTE_SCRIPT SECRETS_PATH_CREDENTIAL
Why this grade
- INSTALL_REMOTE_SCRIPT Medium
Fetches a script from the network and runs it (a pipe to a shell, or an install hook with a URL).
README.ko.md, line 128
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash - SECRETS_PATH_CREDENTIAL Medium
Mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc).
auth.js, line 70
setupMethodB: 'Method B: Download credentials.json',
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
If you think this grade is wrong, email [email protected] with the entry link and your evidence. We aim to acknowledge within two working days and decide within seven. If we confirm an error, we aim to correct it within 24 hours of confirming it. These are aims, not guarantees.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
auth.js, line 469
fs.unlinkSync(TOKEN_PATH);
Install and update
Serious
install fetches a script from the network. README documents an installer that pipes a download into a shell.
INSTALL_REMOTE_SCRIPT INSTALL_DOCUMENTED_INSTALLER
README.ko.md, line 128
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash
README.ko.md, line 168
curl https://sdk.cloud.google.com | bash
README.ko.md, line 175
curl -sSL https://sdk.cloud.google.com | bash -s -- --disable-prompts --install-dir=$HOME
Show more
README.md, line 128
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash
README.md, line 168
curl https://sdk.cloud.google.com | bash
README.md, line 175
curl -sSL https://sdk.cloud.google.com | bash -s -- --disable-prompts --install-dir=$HOME
Network
Concern
can reach oauth2.googleapis.com. The description does not name that host. can reach a host that is not written as a fixed address. can reach stitch.googleapis.com. The description does not name that host.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
auth.js, line 399
const tokenResponse = await fetch('https://oauth2.googleapis.com/token', {
setup.js, line 565
fetch('/start-login').then(() => {
setup.js, line 600
fetch('/check-auth')
Show more
setup.js, line 679
fetch('/check-api')
setup.js, line 691
fetch('/check-api').then(r => r.json()).then(data => {
setup.js, line 745
fetch('/start-antigravity-auth').then(() => {
setup.js, line 750
fetch('/check-antigravity-auth')
setup.js, line 1451
const tokenResponse = await fetch(ANTIGRAVITY_ENDPOINTS.token, {
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_CREDENTIAL
auth.js, line 70
setupMethodB: 'Method B: Download credentials.json',
auth.js, line 151
setupMethodB: '방법 B: credentials.json 파일 다운로드',
auth.js, line 263
${CONFIG_DIR}/credentials.json
Show more
.gitignore, line 4
# Environment variables and keys
.npmignore, line 13
.stitch-project.json
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
a file was over the read cap and was not fully read.
OBFUSCATION_FILE_OVER_READ_CAP
index.js, line 1
#!/usr/bin/env node
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 0d62990b876c. can delete files. install fetches a script from the network. README documents an installer that pipes a download into a shell. can reach oauth2.googleapis.com. The description does not name that host. can reach a host that is not written as a fixed address. can reach stitch.googleapis.com. The description does not name that host. reads a credential or environment file. a file was over the read cap and was not fully read.
Date and source
Date checked:
github.com
Commit graded: 0d62990b876ce504882688bf34b2173e931ca22a
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.