MCP, MCP server
TestGraph
TestGraph is an experimental shared knowledge and experience graph for AI assistants. It lets independent AI clients contribute to the same graph while preserving the original human evidence, model attribution, disagreement, confidence and the path by which a conclusion was r
Compatibility: Not stated.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 014f6c53175e, unchanged since the check below.
OBFUSCATION_MINIFIED_PAYLOAD
Why this grade
- OBFUSCATION_MINIFIED_PAYLOAD Medium
Contains a very long line with almost no spaces in a script or style file.
alembic/versions/0001_initial.py, line 9
op.create_table("subjects",sa.Column("id",sa.Uuid(),primary_key=True),sa.Column("subject_type",sa.String(50),nullable=False),sa.Column("name",sa.String(240),nullable=False),sa.Colu
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Pass
No shell or command execution found, and no extra permission was declared.
Install and update
Concern
dependencies are not pinned.
INSTALL_UNPINNED
requirements.txt, line 1
fastapi>=0.128,<1
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
app/api/actions_v2.py, line 53
def fetch(experience_id:uuid.UUID,authorization:str|None=Header(None,alias="Authorization"),db:Session=Depends(get_db)):
app/services/tg_ai_resolver.py, line 48
response = httpx.post(
scripts/import_uci_recipe_reviews.py, line 76
with urllib.request.urlopen(request, timeout=60) as response:
Show more
app/static/live.html, line 80
async function load(){try{const [vocabularyResponse,experienceResponse]=await Promise.all([fetch('/api/v2/vocabulary'),fetch('/api/v2/public/experiences?limit=100')]);if(!vocabular
app/static/recipe_reviews.html, line 1
<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Recipe Reviews</title><style>body{font-family:system-ui;m
app/static/reviews.html, line 72
const response=await fetch(`${path}?limit=100&offset=${offset}`);
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
app/core/config.py, line 47
model_config = SettingsConfigDict(env_file=".env", case_sensitive=False)
scripts/run_kill_test.py, line 20
return OpenAIProvider(os.getenv("OPENAI_API_KEY", ""), model)
scripts/run_kill_test.py, line 23
return AnthropicProvider(os.getenv("ANTHROPIC_API_KEY", ""), model)
Show more
.gitignore, line 33
# Local environment files
.gitignore, line 34
.env
.gitignore, line 36
!.env.example
README.md, line 284
cp .env.example .env
README.md, line 292
Replace all placeholder secrets in `.env`. Never reuse development/example credentials in a public deployment.
RELEASE_CHECKLIST.md, line 26
- [x] Confirm `.env` and local databases are ignored by Git.
SECURITY.md, line 7
Never commit API keys, OAuth connection codes, access or refresh tokens, database credentials, owner identifiers, Railway variables, `.env` files, or production session material.
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Concern
contains a minified payload.
OBFUSCATION_MINIFIED_PAYLOAD
alembic/versions/0001_initial.py, line 9
op.create_table("subjects",sa.Column("id",sa.Uuid(),primary_key=True),sa.Column("subject_type",sa.String(50),nullable=False),sa.Column("name",sa.String(240),nullable=False),sa.Colu
alembic/versions/0001_initial.py, line 11
op.create_table("experiences",sa.Column("id",sa.Uuid(),primary_key=True),sa.Column("owner_id",sa.Uuid(),sa.ForeignKey("users.id"),nullable=False),sa.Column("subject_id",sa.Uuid(),s
alembic/versions/0001_initial.py, line 12
op.create_table("profile_signals",sa.Column("id",sa.Uuid(),primary_key=True),sa.Column("user_id",sa.Uuid(),sa.ForeignKey("users.id"),nullable=False),sa.Column("dimension",sa.String
Show more
alembic/versions/0001_initial.py, line 15
op.create_table("audit_events",sa.Column("id",sa.Uuid(),primary_key=True),sa.Column("actor_id",sa.String(200),nullable=False),sa.Column("client_id",sa.String(120),nullable=False),s
app/api/uci_reviews.py, line 226
body{{font-family:system-ui;margin:0;background:#f5f6f8;color:#172033}}header{{position:sticky;top:0;background:#fff;padding:14px;border-bottom:1px solid #ddd;z-index:2}}h1{{font-s
data/uci_recipe_reviews_100.json, line 1
{
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 014f6c53175e. dependencies are not pinned. can reach a host that is not written as a fixed address. reads a credential or environment file. contains a minified payload.
Date and source
Date checked:
github.com
Commit graded: 014f6c53175e5fe0f21cc3a02ea6d003560532f8
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.