MCP, MCP server
WOCLUB Cube Playground
Shared voxel world for AI agents.
Compatibility: Not stated.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit cd3143be3f9d, unchanged since the check below.
OBFUSCATION_MINIFIED_PAYLOAD
Why this grade
- OBFUSCATION_MINIFIED_PAYLOAD Medium
Contains a very long line with almost no spaces in a script or style file.
CHANGELOG.md, line 1
# Changelog
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Pass
No shell or command execution found, and no extra permission was declared.
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address. can reach coordinator. The description does not name that host.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
public/examples/build.py, line 26
with urllib.request.urlopen(req, timeout=30) as response:
research/2026-09-09-concurrent-writes.mjs, line 24
const response = await worker.fetch(new Request(origin + path, body ? {metho
research/2026-09-12-uncertain-retry.mjs, line 26
sync body => {const r=await coordinator.fetch(new Request('https://coordinator',{metho
Show more
research/2026-09-12-uncertain-retry.mjs, line 39
const r=await worker.fetch(new Request('https://worldorder.club/api/v1/batch',{
research/2026-09-12-uncertain-retry.mjs, line 43
const cell = async () => (await (await worker.fetch(new Request('https://worldorder.club/api/v1/cube?x=8&y=0&z=8'),env)).json()).cube;
research/2026-09-13-stale-preview.mjs, line 26
sync body => {const r=await coordinator.fetch(new Request('https://coordinator',{metho
research/2026-09-13-stale-preview.mjs, line 42
const r = await worker.fetch(new Request('https://worldorder.club'+(mcp?'/mcp':'/api/v1/'+kind), {
research/2026-09-13-stale-preview.mjs, line 63
const cube=(await (await worker.fetch(new Request('https://worldorder.club/api/v1/cube?x=8&y=0&z=8'),env)).json()).cube;
research/2026-09-13-view-pagination.mjs, line 20
async fetch(url){requests.push(url);return worker.fetch(new Request('https://worldorder.club'+url),{METRICS:kv},{waitUntil(){}});},
research/2026-09-13-view-pagination.mjs, line 28
const second=await (await worker.fetch(new Request('https://worldorder.club'+requests[0]+'&cursor='+encodeURIComponent(first.next_cursor)),{METRICS:kv},{waitUntil(){}})).json();
research/2026-09-14-global-read-budget.mjs, line 30
const invoke = () => worker.fetch(new Request(`https://worldorder.club${route}`), {METRICS: kv}, context);
scripts/verify-global-reads.mjs, line 7
export default {async fetch(req,env,ctx){
scripts/verify-global-reads.mjs, line 19
return worker.fetch(req,env,ctx);
scripts/world-storage.mjs, line 9
const response = await fetch(base+'/internal/world',{method:'POST',headers:{authorization:'Bearer '+token,'content-type':'application/json'},body:JSON.stringify(body)});
scripts/world-storage.mjs, line 17
const r=await fetch(endpoint+path,{headers:{authorization:'Bearer '+process.env.CLOUDFLARE_API_TOKEN}});
src/worker.js, line 1174
curl -fsS https://worldorder.club/examples/langchain_tools.py -o langchain_tools.py
Secrets
Note
reads an environment variable.
SECRETS_ENV_READ
scripts/world-storage.mjs, line 8
const token = process.env.WORLD_ADMIN_TOKEN || (await readFile(new URL('../.run-scratch/world-admin-token', import.meta.url),'utf8')).trim();
scripts/world-storage.mjs, line 17
const r=await fetch(endpoint+path,{headers:{authorization:'Bearer '+process.env.CLOUDFLARE_API_TOKEN}});
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Concern
contains a minified payload.
OBFUSCATION_MINIFIED_PAYLOAD
CHANGELOG.md, line 1
# Changelog
research/2026-09-15-initial-fit.mjs, line 17
const result=vm.runInContext(`(()=>{const size=Math.max(T*overview.unit,1);const faces=overview.cells.map(([i,type,y])=>{const x=(i%200)*5+2.5,z=Math.floor(i/200)*5+2.5;const [sx,s
scripts/generate-log.mjs, line 1
// Regenerate src/generated-log.js (the Russian, two-column /log page) from the
Show more
src/worker.js, line 1160
<style>:root{color-scheme:dark;--ink:#e8f0e8;--muted:#9dafaa;--lime:#b9f36c;--bg:#0e1512;--line:#2b3a33}*{box-sizing:border-box}body{margin:0;background:var(--bg);color:var(--ink);
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit cd3143be3f9d. can reach a host that is not written as a fixed address. can reach coordinator. The description does not name that host. reads an environment variable. contains a minified payload.
Date and source
Date checked:
github.com
Commit graded: cd3143be3f9d933d7fcf2f516a8d6045a7ab81a8
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.