remogram-mcp

Item: remogram-mcp
Rating: 41
Author: M8ven

MCP server that provides forge facts (git-resolved refs and forge-reported PR SHAs) for PR reconciliation, viewing, and merge planning via JSON output.

→ attebury/remogram · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

🚨

Known vulnerabilities in dependencies: 1 critical

Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.

🔐

You'll be asked for 4 credentials: GH_TOKEN, GITEA_TOKEN, GITHUB_TOKEN, GITLAB_TOKEN

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// known CVEs in dependencies1 critical

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

criticalvitest@3.2.4GHSA-5xrq-8626-4rwp

When Vitest UI server is listening, arbitrary file can be read and executed

Depend on this server? Get alerted when its CVEs change.Watch this server free →

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

🔐 secretGH_TOKEN— 2. Export token: GITEA_TOKEN, GITHUB_TOKEN / , or GITLAB_TOKEN.

configGITEA_ACTIONS

🔐 secretGITEA_TOKEN— 2. Export token: , GITHUB_TOKEN / GH_TOKEN, or GITLAB_TOKEN.

🔐 secretGITHUB_TOKEN— 2. Export token: GITEA_TOKEN, / GH_TOKEN, or GITLAB_TOKEN.

🔐 secretGITLAB_TOKEN— 2. Export token: GITEA_TOKEN, GITHUB_TOKEN / GH_TOKEN, or .

configREMOGRAM_CWD— Stdio server remogram-mcp delegates to the CLI — same JSON as remogram … --json. Setup: [examples/mcp/README.md](examples/mcp/README.md). Set to the consumer repo root.

configXDG_CACHE_HOME

configXDG_CONFIG_HOME— Operator overlay discovery: --operator-config → REMOGRAM_OPERATOR_CONFIG → $/remogram/operator/<provider>-<owner>-<repo>.json. bind must match forge identity.

configXDG_DATA_HOME

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 3 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/attebury-remogram-1pxqlj)](https://m8ven.ai/mcp/attebury-remogram-1pxqlj)

commit: 9f99b931c3e58a702e9b32094bbf25023ca175fb

code hash: 852519b0b1add2ef17a2bd305bd099a2b41cf250c371def0ca0af8d947ebf08b

verified: 7/31/2026, 9:06:19 AM

view raw JSON →