Activepieces

Dynamic server to which you can add apps (Google Calendar, Notion, etc) or advanced Activepieces Flows (Refund logic, a research and enrichment logic, etc).

→ activepieces/activepieces· npm: @activepieces/piece-mcp· 49K installs· listed on pulsemcp

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

PulseMCP mcp.so github_topic

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

⚠️

Known vulnerabilities in dependencies: 1 high

Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 1 credential: AP_API_KEY

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// known CVEs in dependencies1 high8 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

highnodemailer@8.0.5GHSA-p6gq-j5cr-w38f

Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message

lowfast-xml-parser@5.5.6GHSA-gh4j-gqv2-49f6

fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters

lowfast-xml-parser@5.5.6GHSA-jp2q-39xq-3w4g

Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser

lowjs-yaml@4.1.1GHSA-h67p-54hq-rp68

JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases

lownodemailer@8.0.5GHSA-268h-hp4c-crq3

Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection

Depend on this server? Get alerted when its CVEs change.Watch this server free →

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

🔐 secretAP_API_KEY

configIMAGE_NAME

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 2 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/activepieces-piece-mcp-1ds22o)](https://m8ven.ai/mcp/activepieces-piece-mcp-1ds22o)

commit: 376d65012478f93148a55f70f00516c68d78271f

code hash: 4fb46f9d76703903e272e9c6e78ed3904ab94d42f2d71e6e3828558d3a9bd4bc

verified: 7/5/2026, 9:13:53 AM

view raw JSON →