Grades are a hygiene check, not a security guarantee.

MCP, MCP server

Teamcity Mcp

A Model Control Protocol (MCP) server that bridges AI coding assistants with JetBrains TeamCity CI/CD server, exposing TeamCity operations as MCP tools.

Compatibility: Not stated.

Grade B

Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.

Graded by PlugVetRubric v2

Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.

Rescanned at commit cb6ad7713dde.

PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV SECRETS_ENV_READ OBFUSCATION_FILE_OVER_READ_CAP OBFUSCATION_FILE_CAP_REACHED

Why this grade

  • PERMISSION_DELETE_FILES Low

    Contains a call that can delete files.

    scripts/build.cjs, line 28 fs.rmSync(distPath, { recursive: true, force: true });

  • NETWORK_NO_FIXED_HOST Low

    Makes a network call whose host is not written as a fixed address.

    docs/investigations/teamcity-artifact-streaming.md, line 33 - `axios.get(url, { responseType: 'stream' })` against the same endpoint returns a Node `Readable` stream. Sample run:

  • SECRETS_PATH_DOTENV Low

    Mentions a .env file.

    jest.config.js, line 9 // Load .env before any other setup so tests see env vars

  • SECRETS_ENV_READ Note

    Reads an environment variable whose name contains KEY, SECRET, TOKEN, PASSWORD or CREDENTIAL.

    scripts/codecov-bundle.cjs, line 14 const uploadToken = process.env.CODECOV_TOKEN;

  • OBFUSCATION_FILE_OVER_READ_CAP Note

    A file was over the read cap and was not fully read.

    package-lock.json, line 1 {

  • OBFUSCATION_FILE_CAP_REACHED Note

    The 400 file cap was reached before every file was read.

    package-lock.json, line 1 {

Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.

Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.

What was checked

Plain notes from the hygiene checks.

  • Permissions

    Concern

    can delete files.

    PERMISSION_DELETE_FILES

    scripts/build.cjs, line 28

    fs.rmSync(distPath, { recursive: true, force: true });

    src/swagger/swagger-cache.ts, line 115

    await fs.unlink(filePath);

    src/swagger/swagger-cache.ts, line 125

    await fs.unlink(path.join(this.cacheDir, file));

  • Install and update

    Pass

    No install-time script found, and dependencies are pinned or absent.

  • Network

    Concern

    can reach a host that is not written as a fixed address.

    NETWORK_NO_FIXED_HOST

    docs/investigations/teamcity-artifact-streaming.md, line 33

    - `axios.get(url, { responseType: 'stream' })` against the same endpoint returns a Node `Readable` stream. Sample run:

    docs/teamcity-unified-client.md, line 72

    const response = await axios.get(url, { responseType: 'arraybuffer' });

    src/tools.ts, line 367

    const response = await axios.get(request.downloadUrl, { responseType });

    Show more

    src/tools.ts, line 917

    maxPages: { type: 'number', description: 'Max pages to fetch (when all=true)' },

    src/tools.ts, line 1038

    maxPages: { type: 'number', description: 'Max pages to fetch (when all=true)' },

    src/tools.ts, line 1984

    maxPages: { type: 'number', description: 'Max pages to fetch (when all=true)' },

    src/tools.ts, line 2097

    maxPages: { type: 'number', description: 'Max pages to fetch (when all=true)' },

    src/tools.ts, line 2169

    maxPages: { type: 'number', description: 'Max pages to fetch (when all=true)' },

  • Secrets

    Concern

    reads a credential or environment file.

    SECRETS_ENV_READ SECRETS_PATH_DOTENV

    scripts/codecov-bundle.cjs, line 14

    const uploadToken = process.env.CODECOV_TOKEN;

    scripts/fetch-swagger-spec.ts, line 48

    const token = process.env['TEAMCITY_TOKEN'];

    jest.config.js, line 9

    // Load .env before any other setup so tests see env vars

    Show more

    scripts/verify-integration-env.cjs, line 13

    const token = process.env.TEAMCITY_TOKEN || process.env.TEAMCITY_API_TOKEN;

    src/index.ts, line 57

    process.env['TEAMCITY_TOKEN'] = cliArgs.token;

    src/config/index.ts, line 92

    const tcToken = env.TEAMCITY_TOKEN ?? process.env['TEAMCITY_API_TOKEN'];

    scripts/verify-integration-env.cjs, line 3

    // Loads .env and ensures required TeamCity variables are present.

    scripts/verify-integration-env.cjs, line 19

    'Please set TEAMCITY_URL and TEAMCITY_TOKEN (or TEAMCITY_SERVER_URL and TEAMCITY_API_TOKEN) in your environment or .env file.',

    src/index.ts, line 48

    // Load .env file (lowest priority - only fills gaps)

    src/index.ts, line 110

    ' - .env file\n' +

    src/utils/cli-args.ts, line 20

    /** Path to .env format config file */

    src/utils/cli-args.ts, line 160

    --config <path> Path to .env format configuration file

    src/utils/cli-args.ts, line 169

    4. .env file in current directory

  • Agent instructions

    Pass

    No instruction to ignore earlier instructions or to hide a step.

  • Obfuscation

    Note

    a file was over the read cap and was not fully read. the file cap was reached before every file was read.

    OBFUSCATION_FILE_OVER_READ_CAP OBFUSCATION_FILE_CAP_REACHED

    package-lock.json, line 1

    {

    src/tools.ts, line 1

    /**

    src/teamcity-client/api/build-api.ts, line 1

    /* tslint:disable */

    Show more

    src/teamcity-client/api/build-type-api.ts, line 1

    /* tslint:disable */

    src/teamcity-client/api/project-api.ts, line 1

    /* tslint:disable */

    src/utils/lru-cache.ts, line 1

    interface CacheEntry<T> {

  • Licence

    Pass

    A licence file is present (LICENSE).

  • Maintainer activity

    Pass

    The latest commit is within the last 365 days.

Note

Hygiene check of commit cb6ad7713dde. can delete files. can reach a host that is not written as a fixed address. reads a credential or environment file. a file was over the read cap and was not fully read. the file cap was reached before every file was read.

Date and source

Date checked:

View source

github.com

Commit graded: cb6ad7713dde3ffce568e9fbe1f3e5464b3e3455

This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.

Read how this letter is chosen