Back to MCP Trust Indexm8ven
43
/ 100
1 month ago
glama

authensor-mcp-server

Policy enforcement gateway for MCP tool calls, evaluating every tool invocation against declarative YAML policies (allow/deny/escalate-to-human), generating cryptographic hash-chained audit receipts, and including built-in content safety scanning.

→ AUTHENSOR/AUTHENSOR· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
🚨
Secret credentials may flow to a network call
4 flows detected: AUTHENSOR_RATE_LIMIT_WEBHOOK_URL, AUTHENSOR_POLICY_ALERT_WEBHOOK_URL, AUTHENSOR_APPROVAL_WEBHOOK_URL. We can’t prove the destination matches the brand the credential belongs to.
🔐
You'll be asked for 11 credentials: AUTHENSOR_ADMIN_KEY, AUTHENSOR_API_KEY, AUTHENSOR_APPROVAL_WEBHOOK_SECRET, AUTHENSOR_BOOTSTRAP_ADMIN_TOKEN, AUTHENSOR_POLICY_ALERT_WEBHOOK_SECRET, AUTHENSOR_RATE_LIMIT_WEBHOOK_SECRET, AUTHENSOR_SENTINEL_ALERT_WEBHOOK_SECRET, GITHUB_TOKEN, STRIPE_LIVE_KEY, STRIPE_SECRET_KEY, STRIPE_TEST_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies1 medium1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

mediumturbo@2.3.0GHSA-hcf7-66rw-9f5r

Trubo: Login callback CSRF/session fixation

lowturbo@2.3.0GHSA-3qcw-2rhx-2726

Turbo: Unexpected local code execution during Yarn Berry detection

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
🔐 secretAUTHENSOR_ADMIN_KEY
configAUTHENSOR_AEGIS_ENABLED
configAUTHENSOR_AEGIS_MODE
configAUTHENSOR_ALLOW_FALLBACK_POLICY
configAUTHENSOR_ALLOW_HTTP
🔐 secretAUTHENSOR_API_KEY
configAUTHENSOR_APPROVAL_EXPIRY_INTERVAL_MS
🔐 secretAUTHENSOR_APPROVAL_WEBHOOK_SECRET
configAUTHENSOR_APPROVAL_WEBHOOK_URL
🔐 secretAUTHENSOR_BOOTSTRAP_ADMIN_TOKEN— set controlPlane.env.=your-token
configAUTHENSOR_CLAIM_TTL_SECONDS
configAUTHENSOR_ENV
configAUTHENSOR_GITHUB_ALLOWED_ORGS
configAUTHENSOR_GITHUB_ALLOWED_REPOS
configAUTHENSOR_MAX_REQUEST_BYTES
configAUTHENSOR_MAX_RESULT_BYTES
configAUTHENSOR_OTEL_ENABLED
🔐 secretAUTHENSOR_POLICY_ALERT_WEBHOOK_SECRET
configAUTHENSOR_POLICY_ALERT_WEBHOOK_URL
configAUTHENSOR_PRINCIPAL_ID
🔐 secretAUTHENSOR_RATE_LIMIT_WEBHOOK_SECRET
configAUTHENSOR_RATE_LIMIT_WEBHOOK_URL
configAUTHENSOR_RL_ADMIN_PER_MIN
configAUTHENSOR_RL_EXECUTOR_PER_MIN
configAUTHENSOR_RL_INGEST_PER_MIN
configAUTHENSOR_SANDBOX_MODE
🔐 secretAUTHENSOR_SENTINEL_ALERT_WEBHOOK_SECRET
configAUTHENSOR_SENTINEL_ALERT_WEBHOOK_URL
configAUTHENSOR_SENTINEL_ENABLED
configAUTHENSOR_SESSION_MAX_HISTORY
configAUTHENSOR_SESSION_TTL_MS
configAUTHENSOR_SHADOW_POLICY_ID— ?shadow=policy-id query parameter or env var
configAUTHENSOR_SKIP_DEFAULT_POLICY
configAUTHENSOR_STRICT_PRINCIPAL_BINDING
configAUTHENSOR_STRIPE_ALLOWED_CURRENCIES
configAUTHENSOR_STRIPE_ALLOW_LIVE
configAUTHENSOR_STRIPE_MAX_AMOUNT
configAUTHENSOR_STRIPE_MIN_AMOUNT
configAUTHENSOR_TOCTOU_REEVALUATE
configAUTHENSOR_TRANSPARENCY_ENABLED
configAUTHENSOR_URL
configCONTROL_PLANE_URL
configDATABASE_URL
🔐 secretGITHUB_TOKEN
configPORT
configSTRIPE_API_VERSION
🔐 secretSTRIPE_LIVE_KEY
🔐 secretSTRIPE_SECRET_KEY
🔐 secretSTRIPE_TEST_KEY
configTRUST_PROXY
configUPSTREAM_COMMAND
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 2 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/authensor-authensor-k71vlr)](https://m8ven.ai/mcp/authensor-authensor-k71vlr)
commit: 5b6778dd3ff884f9be36f7b380412851517180f9
code hash: 766090c6411d1daf271506774d83b8f7ac9f6fa20bbebf2232b010dd97fd1a51
verified: 6/15/2026, 2:22:06 PM
view raw JSON →