Back to MCP Trust Indexm8ven
62
/ 100
1 month ago
glama

satellite-mcp

Full-spectrum GEOINT server with 171 tools covering satellite imagery, aircraft tracking, maritime surveillance, military intelligence, conflict monitoring, environmental analysis, critical infrastructure, sanctions compliance, and cyber-geo intelligence from open-source data.

→ badchars/satellite-mcp· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
⚠️
Known vulnerabilities in dependencies: 3 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 12 credentials: ACLED_API_KEY, COMTRADE_API_KEY, COPERNICUS_CLIENT_SECRET, GFW_API_KEY, N2YO_API_KEY, NASA_API_KEY, NASA_EARTHDATA_TOKEN, NASA_FIRMS_KEY, OPENSKY_PASSWORD, PLANET_API_KEY, TIMEZONEDB_KEY, USGS_PASSWORD
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies3 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.12.1GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.12.1GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.12.1GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
🔐 secretACLED_API_KEY— ACLED Optional Armed conflict event data
configACLED_EMAIL— ACLED Optional ACLED registered email (pair with API_KEY)
🔐 secretCOMTRADE_API_KEY— UN Comtrade Optional International trade flow data
configCOPERNICUS_CLIENT_ID— Copernicus Data Space Optional Sentinel-2 imagery download and quicklook access
🔐 secretCOPERNICUS_CLIENT_SECRET— Copernicus Data Space Optional Sentinel-2 OAuth2 authentication (pair with CLIENT_ID)
🔐 secretGFW_API_KEY— Global Fishing Watch Optional Maritime vessel tracking, fishing activity, AIS gaps
🔐 secretN2YO_API_KEY— N2YO Optional Satellite pass predictions and overhead tracking
🔐 secretNASA_API_KEY— "": "your-key-or-use-DEMO_KEY",
🔐 secretNASA_EARTHDATA_TOKEN— NASA Earthdata Optional Premium NASA data access
🔐 secretNASA_FIRMS_KEY— NASA FIRMS Optional Active fire detections (fallback: DEMO_KEY)
🔐 secretOPENSKY_PASSWORD— OpenSky Network Optional OpenSky authentication (pair with USERNAME)
configOPENSKY_USERNAME— "": "optional"
🔐 secretPLANET_API_KEY— Planet Labs Required Daily 3m satellite imagery (search, metadata, thumbnails)
🔐 secretTIMEZONEDB_KEY— TimezoneDB Optional Enhanced timezone lookups
🔐 secretUSGS_PASSWORD— USGS EarthExplorer Optional Landsat authentication (pair with USERNAME)
configUSGS_USERNAME— USGS EarthExplorer Optional Landsat scene search, metadata, and download
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 2 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/badchars-satellite-mcp-1l9imh)](https://m8ven.ai/mcp/badchars-satellite-mcp-1l9imh)
commit: 3764b8f0737ee7eb7b2e8c8fb6cb537818a9dff6
code hash: cefb8c17c2930ebf06a47c8a553ab93b7336ace5347a24b266769309a7b66c17
verified: 7/1/2026, 9:59:45 AM
view raw JSON →