grade F

14 days ago

glama

Maple

A unified MCP server providing observability, safety control, and behavior evolution for high-agency AI agents through tracing, replaying, and auditing. It features real-time firewall guardrails and ML-driven anomaly detection to monitor, block, or fork agent actions based on risk.

→ alnosarus/copymaple · listed on glama

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

⚠️

Known vulnerabilities in dependencies: 2 high

Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

🔐

You'll be asked for 13 credentials: ANTHROPIC_API_KEY, MAPLE_ADMIN_PASSWORD, MAPLE_ANTHROPIC_API_KEY, MAPLE_API_KEY, MAPLE_DEV_PASSWORD, MAPLE_GPT_OAUTH_CLIENT_SECRET, MAPLE_OPENAI_API_KEY, MAPLE_SMITHERY_API_KEY, OPENAI_API_KEY, OPENCLAW_BRIDGE_TOKEN, OPENCLAW_GATEWAY_SESSION_KEY, OPENCLAW_GATEWAY_TOKEN, SLACK_BOT_TOKEN

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

🔐 secretANTHROPIC_API_KEY— If OPENAI_API_KEY and/or are set, Maple enables AI mode with automatic fallback.

configGOOGLE_CLIENT_ID

configHACKATHON_TOOLHUB_HOST

configMAPLE_ADMIN_EMAIL

🔐 secretMAPLE_ADMIN_PASSWORD

configMAPLE_ADMIN_USERNAME

configMAPLE_ALLOW_BRIDGE_OVERRIDE— Optional local-only override: =true.

configMAPLE_ALLOW_NO_AUTH— Optional local-only bypass: =true (not recommended).

🔐 secretMAPLE_ANTHROPIC_API_KEY

🔐 secretMAPLE_API_KEY— local-demo-key npm run trace:demo

configMAPLE_AUTH_ALLOW_SELF_SIGNUP

configMAPLE_DB_PATH

configMAPLE_DEMO_DELAY

configMAPLE_DEMO_SESSION

configMAPLE_DEMO_SOURCE

configMAPLE_DEMO_URL

configMAPLE_DEV_EMAIL

🔐 secretMAPLE_DEV_PASSWORD

configMAPLE_DEV_USERNAME

configMAPLE_DOWNSTREAM_TOOLS_CACHE_TTL_MS

configMAPLE_ENABLE_DEMO_ROUTES

configMAPLE_ENABLE_JUDGE_UI

configMAPLE_ENABLE_LEGACY_SMITHERY_ROUTES

configMAPLE_FIREWALL_CHAT_ANTHROPIC_MODEL— claude-sonnet-4-6

configMAPLE_FIREWALL_CHAT_OPENAI_MODEL— gpt-4o-mini

configMAPLE_FIREWALL_CHAT_PRIMARY— openai # openai anthropic

configMAPLE_FIREWALL_CHAT_TIMEOUT_MS

configMAPLE_FIREWALL_DEFAULT_ACTION— allow # allow deny log_only

configMAPLE_FIREWALL_ENABLED

configMAPLE_FIREWALL_LOG_DIR— ~/.maple/firewall-logs

configMAPLE_GPT_OAUTH_CLIENT_ID

🔐 secretMAPLE_GPT_OAUTH_CLIENT_SECRET

configMAPLE_LOCK_BRIDGE_TARGET— Set =true to deny per-request bridgeUrl / token overrides.

configMAPLE_LOG_BODY_MAX_CHARS

configMAPLE_LOG_INCLUDE_BODIES

configMAPLE_LOG_LEVEL

configMAPLE_LOG_REQUESTS

configMAPLE_MAX_SHARED_TRACES

configMAPLE_MCPSO_BASE_URL

configMAPLE_MCPSO_CACHE_TTL_MS

configMAPLE_MCPSO_ENABLED

configMAPLE_MCPSO_TIMEOUT_MS

configMAPLE_MCP_EXECUTION_ORDER

configMAPLE_MCP_FIREWALL_DEFAULT_APP

configMAPLE_MCP_MARKETPLACE_AUTO_CONNECT

configMAPLE_MCP_MARKETPLACE_ENABLED

configMAPLE_MCP_PROXY_ALLOWED_HOSTS

configMAPLE_MCP_PROXY_ALLOW_DYNAMIC_TARGETS

configMAPLE_MCP_PROXY_ALLOW_HTTP

configMAPLE_MCP_PROXY_ALLOW_PRIVATE_TARGETS

configMAPLE_MCP_PROXY_DEFAULT_TARGET_URL

configMAPLE_MCP_ROUTE_LOCK

🔐 secretMAPLE_OPENAI_API_KEY

configMAPLE_SESSION_OWNER_SCOPE

configMAPLE_SESSION_POLL

configMAPLE_SESSION_POLL_MS

configMAPLE_SESSION_TTL_SECONDS

configMAPLE_SMITHERY_API_BASE_URL

🔐 secretMAPLE_SMITHERY_API_KEY

configMAPLE_SMITHERY_ENABLED

configMAPLE_SMITHERY_TIMEOUT_MS

configMAPLE_TOOLHUB_PORT

configMAPLE_TOOLHUB_TIMEOUT_MS

configMAPLE_TRACE_SESSION_ID

configMCP_URL

🔐 secretOPENAI_API_KEY— If and/or ANTHROPIC_API_KEY are set, Maple enables AI mode with automatic fallback.

configOPENCLAW_BRIDGE_MODE

configOPENCLAW_BRIDGE_PORT

configOPENCLAW_BRIDGE_REQUIRE_AUTH

🔐 secretOPENCLAW_BRIDGE_TOKEN— your_token

configOPENCLAW_BRIDGE_URL— In production, and OPENCLAW_BRIDGE_TOKEN must be explicitly set.

configOPENCLAW_GATEWAY_HISTORY_LIMIT

🔐 secretOPENCLAW_GATEWAY_SESSION_KEY

🔐 secretOPENCLAW_GATEWAY_TOKEN

configOPENCLAW_GATEWAY_WS_URL

configOPENCLAW_SESSIONS_DIR

configPORT— Railway provides automatically; do not hardcode it.

🔐 secretSLACK_BOT_TOKEN— Bot mode: set and optionally SLACK_DEFAULT_CHANNEL

configSLACK_DEFAULT_CHANNEL— Bot mode: set SLACK_BOT_TOKEN and optionally

configSLACK_WEBHOOK_URL— Incoming webhook mode: set

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/alnosarus-copymaple-13fsj5)](https://m8ven.ai/mcp/alnosarus-copymaple-13fsj5)

commit: c3fc9fc5c80b94efa1f4ca4df23d79aa2bef6e0a

code hash: bf9bce3c7dd80d6ce631a9977c522102acacbb7db256dd581f2303a6cd2004d5

verified: 4/11/2026, 3:02:07 PM

view raw JSON →