43
/ 100
2 days ago
glama
Phantom Secrets MCP Server
Enables AI coding tools to securely manage secrets via MCP tools for vault operations, diagnostics, and cloud sync, ensuring real keys never enter the LLM context.
Is this your MCP?
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
// key findings
🚨
Secret credentials may flow to a network call
1 flow detected: VERCEL_INTEGRATION_CLIENT_SECRET. We can’t prove the destination matches the brand the credential belongs to.
🔐
You'll be asked for 5 credentials: NEXT_PUBLIC_POSTHOG_KEY, NEXT_PUBLIC_SUPABASE_ANON_KEY, STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET, SUPABASE_SERVICE_ROLE_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// required environment variables
This server reads these from
process.env. You'll be asked to provide them before it can run.config
NEXT_PUBLIC_POSTHOG_HOST🔐 secret
NEXT_PUBLIC_POSTHOG_KEY🔐 secret
NEXT_PUBLIC_SUPABASE_ANON_KEYconfig
NEXT_PUBLIC_SUPABASE_URLconfig
STRIPE_PRO_PRICE_ID🔐 secret
STRIPE_SECRET_KEY🔐 secret
STRIPE_WEBHOOK_SECRET🔐 secret
SUPABASE_SERVICE_ROLE_KEY// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 1 concrete improvement we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[](https://m8ven.ai/mcp/ashlrai-phantom-secrets-1ibeq3)commit: 63dd9a5308087fb9ed4aa4cd0a373e466c53c42d
code hash: 48f744bd59ecca24f7e3dc13a2c797041c70c30eb9d260ab9297ebbe370d56df
verified: 7/29/2026, 9:00:28 AM