mylar3-mcp (arr-mcps/mylar3-mcp) is an MCP server listed on the M8ven Trust Index. It scores 71 out of 100, grade C. It declares 39 tools. No publisher has claimed this listing.

Limited view

71/100

mylar3-mcp

Item: mylar3-mcp
Rating: 71
Author: M8ven

MCP server that exposes Mylar3's HTTP API as tools, letting an LLM read and manage a comic library including watchlist, wanted issues, upcoming, history, logs, story arcs, and providers.

→ arr-mcps/mylar3-mcp · listed on glama

Limited view. Automated analysis covers part of this stack. Findings reflect what we verified. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

Limited view: static analysis for Python is partially covered.

How we verified

⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every push why connect →

Who stands behind it

arr-mcps

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

Glamanot scored here

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

⏳ This MCP is queued for scoring. Check back in a few minutes.

// key findings

✅

39 tools verified — handlers match their declared behaviour

16 read-only tools verified — handlers contain no write/delete/exec

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 1 credential: MYLAR_API_KEY

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// tools this server exposes39 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

mylar_get_index

List every series on the Mylar3 watchlist (id, name, status, publisher, etc.).

mylar_get_comic

Get one series and its issues: returns {comic, issues, annuals}. `id` is the ComicVine ComicID.

mylar_get_comic_info

Get a single series row from the comics table. `id` is the ComicVine ComicID.

mylar_get_issue_info

Get a single issue row from the issues table. `id` is the IssueID.

mylar_get_read_list

List the issues in the read list, ordered by issue date.

mylar_get_upcoming

List this week's wanted issues. Pass include_downloaded_issues='Y' to also include Snatched/Downloaded.

mylar_get_wanted

List wanted issues. Pass story_arcs='true' to also include Wanted story-arc issues and annuals.

mylar_get_history

List rows from the snatched table (download history), newest first.

mylar_get_logs

Return Mylar3's in-memory log buffer.

mylar_find_comic

Search ComicVine for a series. `name` is required; type_='story_arc' searches arcs, mode can be series/pullseries/want.

mylar_get_story_arc

List story arcs; with `id`, list that arc's issues in reading order. Pass customOnly='1' for custom arcs only.

mylar_get_version

Get Mylar3 version info: git_path, install_type, current_version, latest_version, commits_behind.

mylar_list_providers

List configured newznab/torznab providers: returns {newznabs: [...], torznabs: [...]}.

mylar_seriesjson_listing

List series with/without series.json. Pass missing='1' for only series missing a series.json.

mylar_list_annual_series

List annual issues. Provide list_issues OR group_series; pass show_downloaded to include downloaded.

mylar_get_api

Bootstrap helper: fetch the API key using HTTP basic login credentials. Does not require MYLAR_API_KEY.

mylar_add_comic

Queue adding a series to the watchlist by ComicVine ComicID. Runs in a background thread.

mylar_pause_comic

Pause a series' wanted tracking. `id` is the ComicVine ComicID.

mylar_resume_comic

Resume a paused series. `id` is the ComicVine ComicID.

mylar_refresh_comic

Queue a ComicVine refresh of a series. `id` accepts a single id or comma-separated list.

mylar_change_book_type

Force a series' book type. `booktype`: Print, Digital, TPB, GN, HC, or One-Shot.

mylar_change_status

Bulk-change issue status across a series. Pass id='all' for every series. status_from/status_to are issue statuses.

mylar_recheck_files

Recheck files on disk for a series. `id` accepts a single id, comma-list, or a JSON array.

mylar_queue_issue

Mark an issue Wanted and immediately kick off a search (may snatch/download). `id` is the IssueID.

mylar_unqueue_issue

Mark an issue Skipped (un-queue it). `id` is the IssueID.

mylar_regenerate_covers

Re-fetch series cover images. `id`: single, comma-list, 'all', or 'missing'.

mylar_refresh_seriesjson

Regenerate series.json files. `comicid`: single, list, 'all', 'missing', or 'refresh-missing'.

mylar_add_story_arc

Add/create a story arc. Provide `issues` OR `arclist`. `storyarcname` required when creating; `id` to extend an existing arc.

mylar_force_search

Trigger a wanted-issue search across the library. May snatch/download wanted issues. Runs in-process.

mylar_force_process

Enqueue a post-processing job. Requires nzb_name and nzb_folder. Used by SABnzbd/NZBGet-style callbacks.

mylar_add_provider

Add a newznab or torznab provider. providertype is 'newznab' or 'torznab' (torznab requires categories).

mylar_change_provider

Modify a provider. Provide providertype and either `name` or `prov_id`, plus any fields to change.

mylar_check_github

Check GitHub for updates and return current version data.

mylar_update

Trigger Mylar3 to self-update (may restart the app).

mylar_restart

Restart Mylar3.

mylar_clear_logs

Clear Mylar3's in-memory log buffer.

mylar_del_comic

Delete a series from the watchlist (and its issues). `id` is the ComicVine ComicID. WARNING: pass directory='true' to also delete the comic folder from disk (rmtree).

mylar_del_provider

Remove a provider. Provide providertype and either `name` or `prov_id`.

mylar_shutdown

Shut down Mylar3. This stops the server.

// environment variables

To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.

configMYLAR_URLenv =http://your-mylar-host:8090 \

🔐 secretMYLAR_API_KEYenv =<32-char key> \

configMYLAR_HTTP_ROOT

// quality suggestions

Tool annotations

16/39 tools have annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

39/39 tools missing one or more hints — mylar_get_index (missing: destructiveHint, idempotentHint, openWorldHint); mylar_get_comic (missing: destructiveHint, idempotentHint, openWorldHint); mylar_get_comic_info (missing: destructiveHint, idempotentHint, openWorldHint), +36 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool inputs are validated

27/39 tool handlers declare input schemas (69%)

Declare an inputSchema with zod/joi/yup on every tool definition.

Tool handlers catch errors

Only 0/39 tool handlers wrap calls in try/catch (0%)

Wrap each tool handler body in try/catch and return a structured error response.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail

The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.

// improvement guidance — verified publishers only

We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/arr-mcps/mylar3-mcp)](https://m8ven.ai/mcp/arr-mcps/mylar3-mcp)

Shows your grade and updates automatically. Prefer no grade? Append ?variant=verified to the badge URL.

commit: a72d70d605c9c7f36a5749035525322dd6e482e2

code hash: fc80b18ab44303d3d3adb97612b0c929905d1d74f89ee42badcf902ae016b38c

view raw JSON →

Check MCPs from inside your assistant

Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check

check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern

How to add it →Free · no account needed · works in any MCP client