Back to MCP Trust Indexm8ven
45
/ 100
1 month ago
glama

Murmur

Encrypted agent-to-agent messaging for AI agents via NATS JetStream, enabling autonomous, secure communication and collaborative workflows.

→ alexfrmn/mur-mur-v2· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 8 credentials: LLM_API_KEY, MURMUR_OPENCLAW_GATEWAY_TOKEN, MURMUR_OPENCLAW_SESSION_KEY, MURMUR_TELEGRAM_BOT_TOKEN, MURMUR_TELEGRAM_SIGNING_PRIVATE_KEY, NATS_TOKEN, OPENAI_API_KEY, TELEGRAM_BOT_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

lowws@8.19.0GHSA-58qx-3vcg-4xpx

ws: Uninitialized memory disclosure

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configACK_TIMEOUT_MS
configAGENT_ID— alice NATS_URL=nats://your-server:4222 NATS_TOKEN=YOUR_SECRET \
configCONSUMER_ID
configCONVERSATION_ID
configDASHBOARD_PORT
configDATA_DIR— "": "/path/to/mur-mur-v2/.data"
configDEDUPE_DB_PATH
configDEMO_EXIT_AFTER_ONE
configDEMO_KEYS_PATH
configDISCORD_WEBHOOK_URL
configFLUSH_INTERVAL_MS
configFLUSH_MAX_ATTEMPTS
🔐 secretLLM_API_KEY
configLLM_BASE_URL
configLLM_MODEL
configLLM_SYSTEM_PROMPT
configMAX_PAYLOAD_BYTES
configMESSAGE
configMETRICS_DB_PATH
configMETRICS_HOST
configMETRICS_PORT— 9464 node scripts/prometheus-exporter.mjs
configMURMUR_CONVERSATION_ID
configMURMUR_DISCORD_WEBHOOK_URL
configMURMUR_ENABLE_MLS
configMURMUR_FROM
configMURMUR_JSON_STORE_LOCKING
configMURMUR_MSG_ID
configMURMUR_OPENCLAW_AGENT
configMURMUR_OPENCLAW_CHANNEL
configMURMUR_OPENCLAW_COMMAND
🔐 secretMURMUR_OPENCLAW_GATEWAY_TOKEN
configMURMUR_OPENCLAW_GATEWAY_URL
configMURMUR_OPENCLAW_HELPER_SCRIPT
configMURMUR_OPENCLAW_SESSION_ID— export ="your-session-id"
🔐 secretMURMUR_OPENCLAW_SESSION_KEY
configMURMUR_OPENCLAW_SESSION_LABEL
configMURMUR_OPENCLAW_TO
configMURMUR_STORE_PATH
🔐 secretMURMUR_TELEGRAM_BOT_TOKEN
configMURMUR_TELEGRAM_CHAT_ID
configMURMUR_TELEGRAM_RECIPIENT_AGENT_ID
configMURMUR_TELEGRAM_SENDER_AGENT_ID
🔐 secretMURMUR_TELEGRAM_SIGNING_PRIVATE_KEY
configMURMUR_TELEGRAM_TOPIC_ID
configMURMUR_TEXT
configMURMUR_WHATSAPP_WEBHOOK_URL
🔐 secretNATS_TOKEN— AGENT_ID=alice NATS_URL=nats://your-server:4222 =YOUR_SECRET \
configNATS_URL— AGENT_ID=alice =nats://your-server:4222 NATS_TOKEN=YOUR_SECRET \
🔐 secretOPENAI_API_KEY
configOPENCLAW_GATEWAY_URL
configOUTBOX_DB_PATH
configRECIPIENT_AGENT_ID
configSENDER_AGENT_ID
configSMOKE_TIMEOUT_MS
configSUBJECT
🔐 secretTELEGRAM_BOT_TOKEN
configTELEGRAM_CHAT_ID
configTELEGRAM_TOPIC_ID
configWAIT_FOR_ACK_MS
configWHATSAPP_WEBHOOK_URL
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 2 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/alexfrmn-mur-mur-v2-1ez231)](https://m8ven.ai/mcp/alexfrmn-mur-mur-v2-1ez231)
commit: 00f19e27ef6617f845bf6a045b7e7030138b2c5b
code hash: 7a7a20018d09091996cc1ab270fa0dbf3f3f4c5826ec371a90e02e3ede9cc154
verified: 6/11/2026, 11:52:49 AM
view raw JSON →