39
/ 100
1 month ago
glama

Loyal Spark Loyalty Protocol

MCP server for managing on-chain loyalty programs on Base L2. Mint tokens, manage rewards, track balances, tiers and marketplace offers via standard MCP protocol.

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
🚨
Secret credentials may flow to a network call
2 flows detected: LOYALSPARK_ANON_KEY. We can’t prove the destination matches the brand the credential belongs to.
🔐
You'll be asked for 4 credentials: LOYALSPARK_ANON_KEY, LOYAL_SPARK_API_KEY, REGISTER_PRIVATE_KEY, X402_PRIVATE_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies2 medium3 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

mediumvite@5.4.19GHSA-4w7w-66w2-5vf9

Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling

mediumvite@5.4.19GHSA-93m4-6634-74q7

vite allows server.fs.deny bypass via backslash on Windows

lowpostcss@8.5.6GHSA-qx2v-qp2m-jg93

PostCSS has XSS via Unescaped </style> in its CSS Stringify Output

lowvite@5.4.19GHSA-g4jq-h2w9-997c

Vite middleware may serve files starting with the same name with the public directory

lowvite@5.4.19GHSA-jqfw-vq24-v9c3

Vite's `server.fs` settings were not applied to HTML files

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configAGENT_API_BODY
configAGENT_DESCRIPTION
configAGENT_NAME
configAGENT_SCOPES
configHTTP_METHOD
🔐 secretLOYALSPARK_ANON_KEY
🔐 secretLOYAL_SPARK_API_KEY
configMCP_ARGS
configMCP_PATH_PREFIX
configMCP_TOOL
🔐 secretREGISTER_PRIVATE_KEY
configSUPABASE_FUNCTIONS_BASE
configX402_GATEWAY_URL
🔐 secretX402_PRIVATE_KEY
configX402_QUERY
configX402_RESOURCE
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 2 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/aspekt19-unboxed-loyalty-spark-h6tr8s)](https://m8ven.ai/mcp/aspekt19-unboxed-loyalty-spark-h6tr8s)
commit: c64c37948aa9bae92d7cb8d7b839c1fe3c6dd8a7
code hash: 43f4951e21f6c6ebc6c51a75c124cfee21f752d8356c3a519db73338e56f847a
verified: 6/13/2026, 10:04:26 AM
view raw JSON →