/ 100

18 days ago

glama

meta-mcp-manager

Item: meta-mcp-manager
Rating: 69
Author: M8ven

Federates multiple MCP servers into a single endpoint with search, call, and admin tools, plus inbound/outbound OAuth.

→ arthurkatcher/meta-mcp-manager · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 6 credentials: META_API_KEY, META_REQUIRE_API_KEY, META_OAUTH_PASSWORD, META_ALLOW_API_KEY, META_DCR_TOKEN, META_TOKEN_KEY

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configMETA_URL— =http://127.0.0.1:8080/mcp META_API_KEY=... python scripts/hardcore_eval_real.py

🔐 secretMETA_API_KEY— export ="$(openssl rand -hex 16)"

configEVAL_REPORT

configMETA_HOST— / META_PORT Bind address

configMETA_PORT— META_HOST / Bind address

configMETA_DATA_DIR— SQLite, vaults, logs

configMETA_CONFIG— Path to mcp.json

configMETA_LOG_LEVEL

configMETA_CONNECT_CONCURRENCY

🔐 secretMETA_REQUIRE_API_KEY— Require auth on /mcp (default true)

configMETA_PUBLIC_URL— export =https://your.domain.example

configMETA_PUBLIC_BASE_URL

configMETA_OAUTH_ENABLED— Inbound OAuth AS (default true)

🔐 secretMETA_OAUTH_PASSWORD— export ="$META_API_KEY" # or a separate consent password

🔐 secretMETA_ALLOW_API_KEY— Accept API key on /mcp (default true)

configMETA_STRICT_STDIO— Require absolute stdio commands (default false)

configMETA_STDIO_ALLOW_PREFIXES— separated path prefixes allowed when strict

configMETA_ALLOW_PRIVATE_URLS— SSRF =false when not needing localhost MCPs

configMETA_RATE_CALL_TOOL— call_tool 60

configMETA_RATE_MANAGE— manage_ 30

configMETA_RATE_CATALOG— catalog (search / list_ / stats) 180

configMETA_RATE_WINDOW_SEC— Window: (default 60). Set a limit to 0 to disable that bucket. Exceeded tools return error: rate_limited.

configMETA_DCR_ENABLED— Disable DCR =false

🔐 secretMETA_DCR_TOKEN— DCR lock =… and/or META_DCR_REDIRECT_ALLOWLIST=claude.ai,.openai.com

configMETA_DCR_REDIRECT_ALLOWLIST— DCR lock META_DCR_TOKEN=… and/or =claude.ai,.openai.com

configMETA_REQUIRE_INVOKE_SCOPE— meta:invoke call_tool when =true

configMETA_ACTIVITY_RETENTION_DAYS— Activity retention =30 (default)

🔐 secretMETA_TOKEN_KEY

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/arthurkatcher-meta-mcp-manager-s8zvbe)](https://m8ven.ai/mcp/arthurkatcher-meta-mcp-manager-s8zvbe)

commit: cce72c61ba5bf34d7819f2f95a3aaf3d01f981ae

code hash: 41ec0b6a4fc6660f8b2acaa229359fd2304ee72404704d5a19741ca149d6bfe5

verified: 7/13/2026, 9:55:42 AM

view raw JSON →