MCP, MCP server
Tintins Chess Analysis
A chess coach you can actually talk to, and one that doesn't make things up.
Compatibility: Not stated.
Grade C
One Medium finding. Read the report before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
INSTALL_REMOTE_SCRIPT
Why this grade
- INSTALL_REMOTE_SCRIPT Medium
Fetches a script from the network and runs it (a pipe to a shell, or an install hook with a URL).
scripts/build_app.sh, line 294
command -v uv >/dev/null 2>&1 || die "'uv' was installed but isn't on PATH. Open a Terminal, run: curl -LsSf https://astral.sh/uv/0.12.20/install.sh | sh"
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
scripts/apply_update.py, line 150
shutil.rmtree(backup_dir, ignore_errors=True)
scripts/apply_update.py, line 152
shutil.rmtree(backup_dir, ignore_errors=True)
scripts/build_puzzle_shards.py, line 76
proc = subprocess.Popen([zstd, "-dc", path], stdout=subprocess.PIPE)
Show more
scripts/build_puzzle_shards.py, line 90
os.remove(path)
scripts/collect_traffic_stats.py, line 36
out = subprocess.run(
scripts/download_stockfish.py, line 234
proc = subprocess.run(
scripts/download_stockfish.py, line 287
os.remove(dest)
scripts/download_stockfish.py, line 293
shutil.rmtree(tmp, ignore_errors=True)
server/claude_bridge.py, line 1350
proc = subprocess.run(
server/claude_bridge.py, line 1439
proc = subprocess.run(
server/claude_bridge.py, line 1526
proc = subprocess.run(
server/config.py, line 150
out = subprocess.run(
server/core/analysis_cache.py, line 145
os.remove(p)
server/core/puzzle_rating.py, line 218
os.remove(tmp)
server/core/puzzle_shards.py, line 221
os.remove(path)
server/core/updates.py, line 218
return subprocess.run(
Install and update
Serious
install fetches a script from the network. README documents an installer that pipes a download into a shell. The docs document an installer that pipes a download into a shell.
INSTALL_REMOTE_SCRIPT INSTALL_DOCUMENTED_INSTALLER
README.md, line 533
curl -fsSL https://claude.ai/install.sh | bash
scripts/build_app.sh, line 294
command -v uv >/dev/null 2>&1 || die "'uv' was installed but isn't on PATH. Open a Terminal, run: curl -LsSf https://astral.sh/uv/0.12.20/install.sh | sh"
requirements.txt, line 11
python-chess>=1.999 # verified: 1.999 (imports as `chess`)
Show more
docs/index.html, line 344
curl -fsSL https://claude.ai/install.sh | bash
Network
Concern
can reach astral.sh. The description does not name that host. can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
install.sh, line 58
curl -LsSf -o "$UV_TMP" "https://astral.sh/uv/$UV_VERSION/install.sh"
scripts/build_app.sh, line 234
if curl -fsSL -o "$tmp/sf.tar" "https://github.com/official-stockfish/Stockfish/releases/download/$tag/$asset.tar" \
scripts/build_app.sh, line 254
if curl -fsS "${URL}/api/app-config" >/dev/null 2>&1; then
Show more
scripts/build_app.sh, line 287
{ curl -LsSf -o "$UV_TMP" "https://astral.sh/uv/$UV_VERSION/install.sh" \
scripts/download_stockfish.py, line 162
with urllib.request.urlopen(req, timeout=180) as resp, open(dest_file, "wb") as out:
scripts/update_stockfish_checksums.py, line 40
with urllib.request.urlopen(req, timeout=300) as resp:
scripts/vendor_frontend_assets.py, line 69
resp = httpx.get(url, follow_redirects=True, timeout=30.0)
server/config.py, line 619
# Allow the background shard fetch (P3). 0 = baseline-only / fully offline. On first puzzle use the
server/mcp_server.py, line 129
max: How many recent games to fetch (default 3).
Secrets
Note
reads an environment variable.
SECRETS_ENV_READ
server/config.py, line 413
LICHESS_TOKEN: str = os.environ.get("LICHESS_TOKEN", "").strip()
server/config.py, line 595
LOCAL_LLM_API_KEY: str = os.environ.get("CHESS_LOCAL_LLM_API_KEY", "").strip()
server/config.py, line 596
LOCAL_LLM_API_KEY_HEADER: str = os.environ.get("CHESS_LOCAL_LLM_API_KEY_HEADER", "").strip()
Show more
server/config.py, line 604
ANTHROPIC_API_KEY: str = os.environ.get("CHESS_ANTHROPIC_API_KEY", "").strip()
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
a file was over the read cap and was not fully read.
OBFUSCATION_FILE_OVER_READ_CAP
frontend/main.js, line 1
// Vendored locally (frontend/vendor) so the board works fully offline - no CDN dependency.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit eca4edbcd6c3. can delete files. install fetches a script from the network. README documents an installer that pipes a download into a shell. The docs document an installer that pipes a download into a shell. can reach astral.sh. The description does not name that host. can reach a host that is not written as a fixed address. reads an environment variable. a file was over the read cap and was not fully read.
Date and source
Date checked:
github.com
Commit graded: eca4edbcd6c3b2411e2d58d2f17dd485a54b6180
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.