MCP, MCP server
tailored
Tailored is a local web app that turns job-posting URLs into customized, well-structured resumes and cover letters.
Compatibility: Not stated.
Grade C
One Medium finding. Read the report before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
NETWORK_HOST_FROM_INPUT
Why this grade
- NETWORK_HOST_FROM_INPUT Medium
A file takes a URL or endpoint as input and has no fixed host list.
backend/mcp_ops.py, line 611
"reason must not be empty - say what refused the fetch (a 403, a "
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
backend/app/api/applications.py, line 156
shutil.rmtree(target)
backend/app/services/removal.py, line 170
shutil.rmtree(staging)
backend/app/services/removal.py, line 211
shutil.rmtree(staging)
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Serious
accepts a host from input, with no fixed list in this file.
NETWORK_HOST_FROM_INPUT
backend/mcp_ops.py, line 611
"reason must not be empty - say what refused the fetch (a 403, a "
frontend/src/api.ts, line 27
const res = await fetch(`${API}${path}`, init);
frontend/src/api.ts, line 222
const res = await fetch(`${API}/applications/${id}/preview?edit=1`);
Show more
scripts/vendor_fonts.py, line 105
resp = httpx.get(url, headers={"User-Agent": UA}, timeout=30.0)
scripts/vendor_fonts.py, line 118
data = httpx.get(src.group(1), headers={"User-Agent": UA}, timeout=30.0)
scripts/vendor_fonts.py, line 174
resp = httpx.get(licence_url, headers={"User-Agent": UA}, timeout=30.0)
docs/superpowers/plans/2026-07-22-tailored-resume-builder.md, line 9266
const res = await fetch(`${API}${path}`, init);
docs/superpowers/plans/2026-07-26-mcp-queue-and-browser-escalation.md, line 635
"reason must not be empty - say what refused the fetch (a 403, a "
docs/superpowers/plans/2026-09-21-person-picker.md, line 12711
with urllib.request.urlopen("http://127.0.0.1:8547/api/profiles/1") as r:
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
CLAUDE.md, line 18
copy .env.example .env # macOS/Linux: cp; then set ANTHROPIC_API_KEY, or run demo mode
run.py, line 1
"""Tailored launcher: loads .env, starts the server, opens the browser.
run.py, line 36
load_dotenv(PROJECT_ROOT / ".env")
Show more
start_tailored.sh, line 168
key = os.environ.get('ANTHROPIC_API_KEY', '').strip()
start_tailored.sh, line 180
if [ "$HAVE_KEY" = "0" ] && [ ! -f ".env" ] && [ -f ".env.example" ]; then
start_tailored.sh, line 181
cp ".env.example" ".env"
start_tailored.sh, line 202
"${EDITOR:-nano}" ".env"
start_tailored.sh, line 252
echo " - Check that .env has a valid ANTHROPIC_API_KEY, or delete .env to use demo mode"
backend/mcp_server.py, line 28
load_dotenv(PROJECT_ROOT / ".env")
backend/app/config.py, line 33
self.anthropic_api_key: str | None = os.environ.get("ANTHROPIC_API_KEY") or None
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
a file was over the read cap and was not fully read.
OBFUSCATION_FILE_OVER_READ_CAP
docs/superpowers/plans/2026-07-22-tailored-resume-builder.md, line 1
# Tailored - Resume & Cover Letter Builder Implementation Plan
docs/superpowers/plans/2026-09-21-person-picker.md, line 1
# Person Picker Implementation Plan
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit a17bdf43974f. can delete files. accepts a host from input, with no fixed list in this file. reads a credential or environment file. a file was over the read cap and was not fully read.
Date and source
Date checked:
github.com
Commit graded: a17bdf43974f2c132e288e72c792037dad510330
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.