58
grade D
10 days ago
glama
AroFlo MCP
A production-ready MCP server that enables interaction with the AroFlo API to manage quotes, projects, and labor reporting. It features secure request signing and exposes API documentation as resources for enhanced context and tool surface.
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
// key findings
⚠️
Known vulnerabilities in dependencies: 3 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
✅
9 tools verified — handlers match their declared behaviour
8 read-only tools verified — handlers contain no write/delete/exec
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
🔐
You'll be asked for 1 credential: AROFLO_SECRET_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// required environment variables
This server reads these from
process.env. You'll be asked to provide them before it can run.config
AROFLO_ACCEPT— env =text/json \config
AROFLO_API_BASE_URL— env =https://api.aroflo.com/ \config
AROFLO_HOST_IPconfig
AROFLO_ORG_ENCODED— env =... \config
AROFLO_PENCODED— env =... \🔐 secret
AROFLO_SECRET_KEY— env =... \config
AROFLO_UENCODED— env =... \config
LOG_LEVEL— (default: info)// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 3 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[](https://m8ven.ai/mcp/0x1notme-aroflo-mcp-e3kxoj)commit: ef156158826fa60c2fe3ef5e8e4c63d43a24d79c
code hash: 7d0e93f8bac2ae945640beccaf24e4909a4659ecbfbc11200cf919b8aef78abe
verified: 4/11/2026, 3:05:52 PM