Back to MCP Trust Indexm8ven
35
/ 100
1 month ago
glama

suitecrm-mcp

Open-source MCP gateway connecting AI agents like Claude Desktop and Claude Code to SuiteCRM. 24 CRM tools over SSE with OAuth2/OIDC auth, multi-entity support, ACL enforcement, and Prometheus/Grafana observability.

→ Anirudhx7/suitecrm-mcp· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
🚨
Secret credentials may flow to a network call
2 flows detected: AUTH0_DOMAIN. We can’t prove the destination matches the brand the credential belongs to.
🔐
You'll be asked for 3 credentials: AUTH0_CLIENT_SECRET, SUITECRM_CLIENT_SECRET, SUITECRM_DB_PASS
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configACL_ALLOW_ALL
configACL_ALLOW_DISABLED
configACL_ALLOW_GROUP
configACL_ALLOW_OWNER
configAUTH0_AUDIENCE— AUTH0_DOMAIN and - one Auth0 app handles all entities
configAUTH0_CLIENT_ID— your-client-id
🔐 secretAUTH0_CLIENT_SECRET— your-client-secret
configAUTH0_DOMAIN— your-tenant.auth0.com
configBIND_HOST— No 127.0.0.1 Interface to bind the gateway server to
configCB_INFRA_THRESHOLD
configCB_PROBE_INTERVAL_MS
configCRM_HOSTS_FILE
configCRM_TIMEOUT_MS— No 30000 CRM REST API request timeout in ms
configENTITIES_FILE
configGATEWAY_PUBLIC_URL— Edit docker-compose.yml and fill in SUITECRM_ENDPOINT, AUTH0_ vars, and , then:
configMETRICS_BIND— "0.0.0.0" # 0.0.0.0 required so the Prometheus container can reach it by service name
configMETRICS_PORT— No 9090 Prometheus metrics server port
configOAUTH_GROUPS_CLAIM
configPORT— and the host port mapping - each entity needs its own port (3101, 3102, ...)
configPROFILES_FILE
configREDIS_URL— Yes redis://127.0.0.1:6379 Connection string for Redis session store
configREQUIRED_GROUP— crm1_users
configSESSION_TTL_DAYS— No (auth svc) 30 Session token lifetime in days (auth service only)
configSUITECRM_API_VERSION
configSUITECRM_AUTH_ENDPOINT
configSUITECRM_CLIENT_ID
🔐 secretSUITECRM_CLIENT_SECRET
configSUITECRM_CODE— short identifier used in tool names and URL routing (e.g. crm1 gives tools named suitecrm_crm1_search, suitecrm_crm1_get, etc.)
configSUITECRM_DB_HOST
configSUITECRM_DB_NAME
🔐 secretSUITECRM_DB_PASS
configSUITECRM_DB_PORT
configSUITECRM_DB_USER
configSUITECRM_ENDPOINT— Edit docker-compose.yml and fill in , AUTH0_ vars, and GATEWAY_PUBLIC_URL, then:
configSUITECRM_PREFIX— Replace {prefix} with your configured (default: suitecrm).
configTRUST_PROXY— No - Set to 1 when running behind nginx or another reverse proxy
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 3 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/anirudhx7-suitecrm-mcp-4djxbb)](https://m8ven.ai/mcp/anirudhx7-suitecrm-mcp-4djxbb)
commit: d46a37e01aa174748c78d5fac8065ebb5cca9f55
code hash: 19377645f9f3d71c3511807ae1ceccd9e3ed4c89c7eee1b2c970df3a18cd799e
verified: 6/15/2026, 12:46:02 PM
view raw JSON →