MCPVet
Low
Outbound network 1
Environment variables (config / keys) 1
Shell / command execution 1
Sensitive credential files 2
AI review
The extension fetches web content as advertised and does not contain hidden instructions or exfiltration logic. The test file references to file:///etc/passwd are benign unit tests for URL validation, not actual exploitation. The use of child_process is limited to invoking yt-dlp for YouTube transcripts, which is a legitimate dependency.
- low Test file references to local file paths — src/Fetcher.test.ts:185 and src/cli.test.ts:226 use 'file:///etc/passwd' as test input. This is a standard test pattern to verify that file:// URLs are rejected or handled safely. No actual file access occurs outside tests.
- low Use of child_process for yt-dlp — src/Fetcher.ts:210 imports execFileSync/execSync from child_process. This is used only to invoke yt-dlp for YouTube transcript fetching, as documented. No arbitrary command execution or data exfiltration is present.
- low Environment variable for default limit — src/types.ts:3 reads process.env.DEFAULT_LIMIT. This is a documented configuration option for setting the default response length. It does not expose secrets or credentials.
Model: deepseek-chat
Static findings
Sensitive credential files · Reads sensitive credential files
info
src/Fetcher.test.ts:185
const result = await Fetcher.html({ url: "file:///etc/passwd" });
info
src/cli.test.ts:226
parseArgs(["html", "file:///etc/passwd"]);
Shell / command execution · Executes shell / system commands
medium
src/Fetcher.ts:210
const { execFileSync, execSync } = await import("child_process");
Outbound network · Makes outbound network requests
low
src/Fetcher.ts:64
response = await fetch(url, {
Environment variables (config / keys) · Reads environment variables (config / API keys)
low
src/types.ts:3
const parsedLimit = Number.parseInt(process.env.DEFAULT_LIMIT ?? "5000");
Scanning every extension your team installs?
Pro & Team add monitoring, private scans, and a CI gate for unsafe extensions.
MCPVet is a heuristic aid, not a security guarantee. A clean grade does not prove an extension is safe; always review code and instructions you don't trust.