C
Emerging
74/100
21 days ago
Before Users Do
Browser-backed QA MCP server that lets coding agents test web apps, collect browser evidence, and return fix-ready reports before shipping.
Emerging. No concerning findings. Grades remain capped until the project builds reputation through adoption. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Code Verified⚡ Live Monitored: not connected
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
bhuman-ai
Source: Glama
Is this your MCP?
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
// key findings
🚨
Secret credentials may flow to a network call
2 flows detected: SUPABASE_SERVICE_KEY. We can’t prove the destination matches the brand the credential belongs to.
⚠️
Known vulnerabilities in dependencies: 3 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 65 credentials: BROWSERBASE_API_KEY, BROWSERBASE_OPENAI_API_KEY, CAPTCHA_API_KEY, CRON_SECRET, CUSTOMERIO_PASSWORD, DASHSCOPE_API_KEY, FAL_KEY, GEMINI_API_KEY, GITHUB_APP_PRIVATE_KEY, GOOGLE_API_KEY, HUMAN_TEST_CREDENTIALS_SECRET, LOGIN_PASSWORD, MANUAL_QA_RECORDING_ANALYSIS_CRON_SECRET, MANUAL_QA_RECORDING_ANALYZER_API_KEY, MANUAL_QA_TOPIC_SEGMENTER_API_KEY, OPENAI_API_KEY, OPENROUTER_API_KEY, QA_AGENT_OTP_PROVIDER_AUTH_TOKEN, QA_AGENT_PASSWORD, QA_CALLBACK_SECRET, QA_COORDINATE_ANNOTATION_API_KEY, QA_COORDINATE_ANNOTATION_FAL_API_KEY, QA_COORDINATE_ANNOTATION_GEMINI_API_KEY, QA_COORDINATE_ANNOTATION_OPENROUTER_API_KEY, QA_COORDINATE_ANNOTATION_QWEN_API_KEY, QA_COORDINATE_ANNOTATION_REPLICATE_API_KEY, QA_COORDINATE_LLM_API_KEY, QA_COORDINATE_OCR_JUDGE_API_KEY, QA_COORDINATE_UI_TARS_API_KEY, QA_COORDINATE_VISION_API_KEY, QA_DEFAULT_ACCOUNT_PASSWORD, QA_GITHUB_APP_PRIVATE_KEY, QA_LIVE_STREAM_PASSWORD, QA_MCP_ACCESS_TOKEN, QA_MCP_REFRESH_TOKEN, QA_OPENAI_API_KEY, QA_OTP_PROVIDER_AUTH_TOKEN, QA_PUBLISH_BRAND_KEY, QA_PUBLISH_CALLBACK_SECRET, QA_SERVICE_TOKEN, QA_TOPIC_SEGMENTER_API_KEY, QA_UI_TARS_API_KEY, QA_VISION_API_KEY, QWEN_API_KEY, REPLICATE_API_TOKEN, STRIPE_PUBLISHABLE_KEY, STRIPE_SECRET_KEY, SUBMISSION_ASSET_GENERATOR_BEARER_TOKEN, SUBMISSION_ASSET_OPENAI_API_KEY, SUBMISSION_ASSET_REPLICATE_API_KEY, SUBMISSION_DO_2CAPTCHA_API_KEY, SUBMISSION_DO_PROXY_PASSWORD, SUBMISSION_DO_WEBSHARE_API_KEY, SUBMISSION_MAILBOX_SCRUB_SECRET, SUBMISSION_SELF_HOSTED_2CAPTCHA_API_KEY, SUBMISSION_SELF_HOSTED_PROXY_PASSWORD, SUBMISSION_SELF_HOSTED_WEBSHARE_API_KEY, SUPABASE_ACCESS_TOKEN, SUPABASE_SERVICE_KEY, SWARM_API_SERVICE_TOKEN, TWOCAPTCHA_API_KEY, TWO_CAPTCHA_API_KEY, UI_TARS_API_KEY, WEBHOOK_SECRET, WEBSHARE_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies3 high2 medium
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
vite: `server.fs.deny` bypass on Windows alternate paths
Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket
Vite: `server.fs.deny` bypassed with queries
Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling
launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows
Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
config
AUTH_MAGIC_LINK_REDIRECT_BASE_URLconfig
AUTH_MAGIC_LINK_REDIRECT_URLconfig
BRAND_PERSONA🔐 secret
BROWSERBASE_API_KEY🔐 secret
BROWSERBASE_OPENAI_API_KEYconfig
BROWSERBASE_PROJECT_IDconfig
BUD_OPERATOR_EMAILS🔐 secret
CAPTCHA_API_KEYconfig
CODEX_HOME🔐 secret
CRON_SECRETconfig
CUSTOMERIO_EMAIL🔐 secret
CUSTOMERIO_PASSWORDconfig
DASHBOARD_INVITE_CODE🔐 secret
DASHSCOPE_API_KEYconfig
DASHSCOPE_BASE_URLconfig
DASHSCOPE_WORKSPACEconfig
DEV_SERVER_MAX_BODY_BYTESconfig
FAL_BASE_URL🔐 secret
FAL_KEYconfig
FFMPEG_PATHconfig
FFPROBE_PATH🔐 secret
GEMINI_API_KEYconfig
GEMINI_BASE_URLconfig
GITHUB_API_BASE_URLconfig
GITHUB_API_VERSIONconfig
GITHUB_APP_ID🔐 secret
GITHUB_APP_PRIVATE_KEYconfig
GITHUB_APP_SLUG🔐 secret
GOOGLE_API_KEYconfig
HOST🔐 secret
HUMAN_TEST_CREDENTIALS_SECRET🔐 secret
LOGIN_PASSWORDconfig
LOGIN_URLconfig
LOGIN_USERNAMEconfig
MANUAL_QA_EVENT_JOURNAL_REQUIREDconfig
MANUAL_QA_RECORDING_AGGREGATOR_MODELconfig
MANUAL_QA_RECORDING_ANALYSIS_BATCH_SIZE🔐 secret
MANUAL_QA_RECORDING_ANALYSIS_CRON_SECRET🔐 secret
MANUAL_QA_RECORDING_ANALYZER_API_KEYconfig
MANUAL_QA_RECORDING_ANALYZER_BASE_URLconfig
MANUAL_QA_RECORDING_ANALYZER_CONCURRENCYconfig
MANUAL_QA_RECORDING_ANALYZER_MAX_CLIP_BYTESconfig
MANUAL_QA_RECORDING_ANALYZER_MAX_NEW_CLIPSconfig
MANUAL_QA_RECORDING_ANALYZER_MODELconfig
MANUAL_QA_RECORDING_ANALYZER_TIMEOUT_MSconfig
MANUAL_QA_RECORDING_VERIFIER_MODEL🔐 secret
MANUAL_QA_TOPIC_SEGMENTER_API_KEYconfig
MANUAL_QA_TOPIC_SEGMENTER_BASE_URLconfig
MANUAL_QA_TOPIC_SEGMENTER_ENABLEDconfig
MANUAL_QA_TOPIC_SEGMENTER_MODELconfig
MANUAL_QA_TOPIC_SEGMENTER_TIMEOUT_MSconfig
MCP_TOKEN_PEPPER🔐 secret
OPENAI_API_KEYconfig
OPENAI_BASE_URL🔐 secret
OPENROUTER_API_KEYconfig
OPENROUTER_BASE_URLconfig
OTP_MODEconfig
OWNER_EMAILconfig
OWNER_USER_IDconfig
PLAYWRIGHT_CHANNELconfig
QA_AGENT_AUTH_POLICYconfig
QA_AGENT_BRAND_PERSONAconfig
QA_AGENT_DEV_HANDOFFconfig
QA_AGENT_DEV_HANDOFF_OUTPUT_ROOTconfig
QA_AGENT_DEV_HANDOFF_ZIPconfig
QA_AGENT_GOALconfig
QA_AGENT_LOGIN_URLconfig
QA_AGENT_MANAGED_INBOXconfig
QA_AGENT_MODESconfig
QA_AGENT_OTP_MAILTM_BASE_URLconfig
QA_AGENT_OTP_MODEconfig
QA_AGENT_OTP_POLL_INTERVAL_MSconfig
QA_AGENT_OTP_PROVIDER🔐 secret
QA_AGENT_OTP_PROVIDER_AUTH_TOKENconfig
QA_AGENT_OTP_PROVIDER_CREATE_URLconfig
QA_AGENT_OTP_PROVIDER_HEADERSconfig
QA_AGENT_OTP_PROVIDER_METHODconfig
QA_AGENT_OTP_PROVIDER_URLconfig
QA_AGENT_OTP_SUBJECT_PATTERNconfig
QA_AGENT_OTP_TIMEOUT_MS🔐 secret
QA_AGENT_PASSWORDconfig
QA_AGENT_PERSONAconfig
QA_AGENT_RUN_IDconfig
QA_AGENT_SCENARIOSconfig
QA_AGENT_TARGET_URLconfig
QA_AGENT_USERNAMEconfig
QA_AUTH_MANUAL_OTP_TIMEOUT_MSconfig
QA_BROWSERBASE_ADVANCED_STEALTHconfig
QA_BROWSERBASE_BLOCK_ADSconfig
QA_BROWSERBASE_PROXY_CITYconfig
QA_BROWSERBASE_PROXY_COUNTRYconfig
QA_BROWSERBASE_PROXY_STATEconfig
QA_BROWSERBASE_REGIONconfig
QA_BROWSERBASE_SESSION_TIMEOUT_MSconfig
QA_BROWSERBASE_SOLVE_CAPTCHASconfig
QA_BROWSERBASE_USE_PROXIES🔐 secret
QA_CALLBACK_SECRETconfig
QA_CALLBACK_STRICTconfig
QA_CALLBACK_URL🔐 secret
QA_COORDINATE_ANNOTATION_API_KEYconfig
QA_COORDINATE_ANNOTATION_BASE_URL🔐 secret
QA_COORDINATE_ANNOTATION_FAL_API_KEYconfig
QA_COORDINATE_ANNOTATION_FAL_BASE_URL🔐 secret
QA_COORDINATE_ANNOTATION_GEMINI_API_KEYconfig
QA_COORDINATE_ANNOTATION_MODEL🔐 secret
QA_COORDINATE_ANNOTATION_OPENROUTER_API_KEYconfig
QA_COORDINATE_ANNOTATION_OPENROUTER_BASE_URLconfig
QA_COORDINATE_ANNOTATION_PROVIDER🔐 secret
QA_COORDINATE_ANNOTATION_QWEN_API_KEYconfig
QA_COORDINATE_ANNOTATION_QWEN_BASE_URLconfig
QA_COORDINATE_ANNOTATION_QWEN_MODELconfig
QA_COORDINATE_ANNOTATION_QWEN_TASKconfig
QA_COORDINATE_ANNOTATION_QWEN_WORKSPACE🔐 secret
QA_COORDINATE_ANNOTATION_REPLICATE_API_KEYconfig
QA_COORDINATE_ANNOTATION_REPLICATE_BASE_URLconfig
QA_COORDINATE_ANNOTATION_TIMEOUT_MSconfig
QA_COORDINATE_CLICK_FALLBACKconfig
QA_COORDINATE_CLICK_FALLBACK_MODE🔐 secret
QA_COORDINATE_LLM_API_KEYconfig
QA_COORDINATE_LLM_BASE_URLconfig
QA_COORDINATE_LLM_MAX_TOKENSconfig
QA_COORDINATE_LLM_MODELconfig
QA_COORDINATE_LOCALIZATION_ORDER🔐 secret
QA_COORDINATE_OCR_JUDGE_API_KEYconfig
QA_COORDINATE_OCR_JUDGE_BASE_URLconfig
QA_COORDINATE_OCR_JUDGE_ENABLEDconfig
QA_COORDINATE_OCR_JUDGE_MODEL🔐 secret
QA_COORDINATE_UI_TARS_API_KEYconfig
QA_COORDINATE_UI_TARS_BASE_URLconfig
QA_COORDINATE_UI_TARS_ENABLEDconfig
QA_COORDINATE_UI_TARS_MAX_TOKENSconfig
QA_COORDINATE_UI_TARS_MODELconfig
QA_COORDINATE_UI_TARS_MODEL_VERSION🔐 secret
QA_COORDINATE_VISION_API_KEYconfig
QA_COORDINATE_VISION_BASE_URLconfig
QA_COORDINATE_VISION_MAX_TOKENSconfig
QA_COORDINATE_VISION_MODELconfig
QA_CUA_MODELconfig
QA_DEFAULT_ACCOUNT_COMPANYconfig
QA_DEFAULT_ACCOUNT_EMAILconfig
QA_DEFAULT_ACCOUNT_HANDLEconfig
QA_DEFAULT_ACCOUNT_NAME🔐 secret
QA_DEFAULT_ACCOUNT_PASSWORDconfig
QA_DEFAULT_ACCOUNT_PHONEconfig
QA_DEFAULT_ACCOUNT_WEBSITEconfig
QA_DELETE_LOCAL_ARTIFACTS_AFTER_UPLOADconfig
QA_EMBEDDED_EVIDENCE_MAX_BYTESconfig
QA_EMBEDDED_EVIDENCE_MAX_SCREENSHOTSconfig
QA_EMBEDDED_EVIDENCE_MAX_VIDEOSconfig
QA_EMBEDDED_EVIDENCE_MAX_VIDEO_BYTESconfig
QA_EVIDENCE_RESUMABLE_CHUNK_BYTESconfig
QA_EVIDENCE_RESUMABLE_THRESHOLD_BYTESconfig
QA_EVIDENCE_STORAGE_BUCKETconfig
QA_EVIDENCE_STORAGE_DISABLEDconfig
QA_EVIDENCE_STORAGE_MAX_SCREENSHOTSconfig
QA_EVIDENCE_STORAGE_MAX_SCREENSHOT_BYTESconfig
QA_EVIDENCE_STORAGE_MAX_VIDEOSconfig
QA_EVIDENCE_STORAGE_MAX_VIDEO_BYTESconfig
QA_EVIDENCE_STORAGE_MAX_VIDEO_SEGMENTSconfig
QA_EVIDENCE_STORAGE_VIDEO_SEGMENT_BYTESconfig
QA_FEATURE_LIMITconfig
QA_FIX_DIAGNOSIS_MODELconfig
QA_GITHUB_APP_ID🔐 secret
QA_GITHUB_APP_PRIVATE_KEYconfig
QA_GITHUB_APP_SLUGconfig
QA_LIVE_STREAM_ENABLED🔐 secret
QA_LIVE_STREAM_PASSWORDconfig
QA_LIVE_STREAM_PUBLIC_BASE_URLconfig
QA_LOCAL_BROWSER_CHANNELconfig
QA_LOCAL_BROWSER_LAUNCH_TIMEOUT_MSconfig
QA_LOCAL_EVIDENCE_ROOTconfig
QA_LOCAL_HEADLESSconfig
QA_LOCAL_OUTPUT_ROOTconfig
QA_LOGIN_MAX_STEPS🔐 secret
QA_MCP_ACCESS_TOKENconfig
QA_MCP_AUTH_PATHconfig
QA_MCP_BASE_URLconfig
QA_MCP_DEFAULT_BRANDconfig
QA_MCP_DEFAULT_EXECUTION_ENGINEconfig
QA_MCP_DEFAULT_PERSONAconfig
QA_MCP_HTTP_ALLOWED_HOSTSconfig
QA_MCP_HTTP_HOSTconfig
QA_MCP_HTTP_PATHconfig
QA_MCP_HTTP_PORTconfig
QA_MCP_OWNER_EMAILconfig
QA_MCP_OWNER_USER_ID🔐 secret
QA_MCP_REFRESH_TOKENconfig
QA_MCP_TOKEN_PEPPERconfig
QA_MISSION_JUDGE_MODELconfig
QA_MISSION_JUDGE_STALE_ROUND_LIMITconfig
QA_MISSION_JUDGE_STATE_CHANGE_TIMEOUT_MSconfig
QA_MISSION_JUDGE_TIMEOUT_MSconfig
QA_MODELconfig
QA_MODEL_FALLBACKS🔐 secret
QA_OPENAI_API_KEYconfig
QA_OPENAI_BASE_URLconfig
QA_OTP_MAILTM_BASE_URLconfig
QA_OTP_POLL_INTERVAL_MSconfig
QA_OTP_PROVIDER🔐 secret
QA_OTP_PROVIDER_AUTH_TOKENconfig
QA_OTP_PROVIDER_CREATE_URLconfig
QA_OTP_PROVIDER_HEADERSconfig
QA_OTP_PROVIDER_METHODconfig
QA_OTP_PROVIDER_POLL_URLconfig
QA_OTP_PROVIDER_URLconfig
QA_OTP_SUBJECT_PATTERNconfig
QA_OTP_TIMEOUT_MSconfig
QA_OWNER_EMAILconfig
QA_OWNER_USER_IDconfig
QA_PERSONA_AVATAR_MODELconfig
QA_PERSONA_AVATAR_PROVIDERconfig
QA_PLAYWRIGHT_BROWSER_CHANNELconfig
QA_PROGRESS_DB_MAX_LOG_ENTRIESconfig
QA_PROGRESS_FLUSH_INTERVAL_MSconfig
QA_PROGRESS_MAX_LOG_ENTRIES🔐 secret
QA_PUBLISH_BRAND_KEY🔐 secret
QA_PUBLISH_CALLBACK_SECRETconfig
QA_PUBLISH_CALLBACK_URLconfig
QA_PUBLISH_OWNER_EMAILconfig
QA_PUBLISH_OWNER_USER_IDconfig
QA_PUBLISH_REPORTSconfig
QA_PUBLISH_RUN_PREFIXconfig
QA_PUBLISH_SOURCEconfig
QA_REMOTE_EVIDENCE_BASE_URLconfig
QA_REMOTE_EVIDENCE_ROOTconfig
QA_REQUIRED_SCREENSHOT_COUNTconfig
QA_REQUIRED_VIDEO_COUNTconfig
QA_RUN_BRAND_PERSONAconfig
QA_RUN_GOAL🔐 secret
QA_SERVICE_TOKENconfig
QA_SHARE_PROMO_CODEconfig
QA_STAGEHAND_PAGE_PRIME_WAIT_UNTILconfig
QA_STAGEHAND_PAGE_READY_POLL_MSconfig
QA_STAGEHAND_PAGE_READY_TIMEOUT_MS🔐 secret
QA_TOPIC_SEGMENTER_API_KEYconfig
QA_TOPIC_SEGMENTER_BASE_URLconfig
QA_TOPIC_SEGMENTER_MODEL🔐 secret
QA_UI_TARS_API_KEYconfig
QA_UI_TARS_BASE_URLconfig
QA_UI_TARS_MAX_TOKENSconfig
QA_UI_TARS_MODELconfig
QA_UI_TARS_MODEL_VERSIONconfig
QA_VISION_ACTION_DELAY_MS🔐 secret
QA_VISION_API_KEYconfig
QA_VISION_BASE_URLconfig
QA_VISION_MAX_HISTORY_ITEMSconfig
QA_VISION_MAX_STEPSconfig
QA_VISION_MAX_WAIT_STREAKconfig
QA_VISION_MODELconfig
QA_VISION_STEP_TIMEOUT_MSconfig
QA_VISION_TIME_BUDGET_MSconfig
QA_WIDGET_MAX_RECORDING_BYTESconfig
QA_WIDGET_MAX_SESSION_RECORDING_BYTESconfig
QA_WIDGET_MAX_SESSION_STORAGE_BYTESconfig
QA_WIDGET_MAX_SESSION_UPLOAD_BYTESconfig
QA_WORKER_HEARTBEAT_INTERVAL_MSconfig
QA_WORKER_HEARTBEAT_OFFLINE_AFTER_MSconfig
QA_WORKER_HEARTBEAT_STALE_AFTER_MSconfig
QA_WORKER_HOSTNAMEconfig
QA_WORKER_ID🔐 secret
QWEN_API_KEY🔐 secret
REPLICATE_API_TOKENconfig
REPLICATE_BASE_URLconfig
RUN_IDconfig
SCENARIOSconfig
STRIPE_DEFAULT_PRICE_ID🔐 secret
STRIPE_PUBLISHABLE_KEY🔐 secret
STRIPE_SECRET_KEYconfig
STRIPE_SHARE_OFFER_CANCEL_URLconfig
STRIPE_SHARE_OFFER_MODEconfig
STRIPE_SHARE_OFFER_PRICE_IDconfig
STRIPE_SHARE_OFFER_SUCCESS_URLconfig
STRIPE_SHARE_PROMO_DURATIONconfig
STRIPE_SHARE_PROMO_DURATION_MONTHSconfig
STRIPE_SHARE_PROMO_MAX_REDEMPTIONSconfig
STRIPE_SHARE_PROMO_PERCENT_OFF🔐 secret
SUBMISSION_ASSET_GENERATOR_BEARER_TOKENconfig
SUBMISSION_ASSET_GENERATOR_BUILTINconfig
SUBMISSION_ASSET_GENERATOR_HEADERS_JSONconfig
SUBMISSION_ASSET_GENERATOR_PREFER_BUILTINconfig
SUBMISSION_ASSET_GENERATOR_REQUIREDconfig
SUBMISSION_ASSET_GENERATOR_TIMEOUT_MSconfig
SUBMISSION_ASSET_GENERATOR_URL🔐 secret
SUBMISSION_ASSET_OPENAI_API_KEYconfig
SUBMISSION_ASSET_OPENAI_BASE_URLconfig
SUBMISSION_ASSET_OPENAI_MAX_OUTPUT_TOKENSconfig
SUBMISSION_ASSET_OPENAI_MODELconfig
SUBMISSION_ASSET_OPENAI_REASONINGconfig
SUBMISSION_ASSET_OPENAI_TIMEOUT_MS🔐 secret
SUBMISSION_ASSET_REPLICATE_API_KEYconfig
SUBMISSION_ASSET_REPLICATE_BASE_URLconfig
SUBMISSION_ASSET_REPLICATE_MAX_ATTEMPTSconfig
SUBMISSION_ASSET_REPLICATE_MODELconfig
SUBMISSION_ASSET_REPLICATE_RESOLUTIONconfig
SUBMISSION_ASSET_REPLICATE_TIMEOUT_MSconfig
SUBMISSION_DO_2CAPTCHA_API_BASE_URL🔐 secret
SUBMISSION_DO_2CAPTCHA_API_KEYconfig
SUBMISSION_DO_2CAPTCHA_MAX_ATTEMPTSconfig
SUBMISSION_DO_2CAPTCHA_POLL_INTERVAL_MSconfig
SUBMISSION_DO_2CAPTCHA_POST_INJECT_WAIT_MSconfig
SUBMISSION_DO_2CAPTCHA_RECAPTCHA_V3_ACTIONconfig
SUBMISSION_DO_2CAPTCHA_RECAPTCHA_V3_MIN_SCOREconfig
SUBMISSION_DO_2CAPTCHA_RETRY_BACKOFF_MSconfig
SUBMISSION_DO_2CAPTCHA_SOFT_IDconfig
SUBMISSION_DO_2CAPTCHA_TIMEOUT_MSconfig
SUBMISSION_DO_BLOCK_ADSconfig
SUBMISSION_DO_BROWSER_CHANNELconfig
SUBMISSION_DO_BROWSER_LAUNCH_TIMEOUT_MSconfig
SUBMISSION_DO_CAPTCHA_BUILTIN_WAIT_MSconfig
SUBMISSION_DO_CAPTCHA_HOOK_HEADERS_JSONconfig
SUBMISSION_DO_CAPTCHA_HOOK_REQUIREDconfig
SUBMISSION_DO_CAPTCHA_HOOK_TIMEOUT_MSconfig
SUBMISSION_DO_CAPTCHA_HOOK_URLconfig
SUBMISSION_DO_CAPTCHA_HOOK_WAIT_MSconfig
SUBMISSION_DO_CAPTCHA_STRATEGYconfig
SUBMISSION_DO_HEADLESSconfig
SUBMISSION_DO_IGNORE_HTTPS_ERRORSconfig
SUBMISSION_DO_LOCALEconfig
SUBMISSION_DO_PROFILE_NAMESPACEconfig
SUBMISSION_DO_PROFILE_ROOT_DIRconfig
SUBMISSION_DO_PROXY_AUTO_PURCHASE_ALLOW_PAYMENT_REQUIREDconfig
SUBMISSION_DO_PROXY_AUTO_PURCHASE_CREDITS_ONLYconfig
SUBMISSION_DO_PROXY_AUTO_PURCHASE_ENABLEDconfig
SUBMISSION_DO_PROXY_AUTO_PURCHASE_MAX_PAID_TODAY_USDconfig
SUBMISSION_DO_PROXY_AUTO_REPLACE_COUNTRY_MISMATCHconfig
SUBMISSION_DO_PROXY_AUTO_SELECTconfig
SUBMISSION_DO_PROXY_BYPASSconfig
SUBMISSION_DO_PROXY_MAX_ATTEMPTS🔐 secret
SUBMISSION_DO_PROXY_PASSWORDconfig
SUBMISSION_DO_PROXY_REQUIRE_GEO_MATCHconfig
SUBMISSION_DO_PROXY_ROTATE_ON_CAPTCHAconfig
SUBMISSION_DO_PROXY_ROTATE_ON_NETWORK_ERRORSconfig
SUBMISSION_DO_PROXY_ROTATION_ENABLEDconfig
SUBMISSION_DO_PROXY_SERVERconfig
SUBMISSION_DO_PROXY_USERNAMEconfig
SUBMISSION_DO_RECORD_VIDEOconfig
SUBMISSION_DO_STEALTH_MODEconfig
SUBMISSION_DO_TIMEZONE_IDconfig
SUBMISSION_DO_USER_AGENTconfig
SUBMISSION_DO_WEBSHARE_API_BASE_URL🔐 secret
SUBMISSION_DO_WEBSHARE_API_KEYconfig
SUBMISSION_DO_WEBSHARE_CACHE_TTL_MSconfig
SUBMISSION_DO_WEBSHARE_MAX_PAGESconfig
SUBMISSION_DO_WEBSHARE_MODEconfig
SUBMISSION_DO_WEBSHARE_PAGE_SIZEconfig
SUBMISSION_DO_WEBSHARE_PROXY_REPLACE_BASE_URLconfig
SUBMISSION_JOB_HEARTBEAT_INTERVAL_MSconfig
SUBMISSION_JOB_STALE_AFTER_MSconfig
SUBMISSION_LOCAL_BROWSER_CHANNELconfig
SUBMISSION_LOCAL_BROWSER_LAUNCH_TIMEOUT_MSconfig
SUBMISSION_LOCAL_HEADLESS🔐 secret
SUBMISSION_MAILBOX_SCRUB_SECRETconfig
SUBMISSION_MAILBOX_SECUREconfig
SUBMISSION_MAILBOX_SMTP_SECUREconfig
SUBMISSION_SELF_HOSTED_2CAPTCHA_API_BASE_URL🔐 secret
SUBMISSION_SELF_HOSTED_2CAPTCHA_API_KEYconfig
SUBMISSION_SELF_HOSTED_2CAPTCHA_MAX_ATTEMPTSconfig
SUBMISSION_SELF_HOSTED_2CAPTCHA_POLL_INTERVAL_MSconfig
SUBMISSION_SELF_HOSTED_2CAPTCHA_POST_INJECT_WAIT_MSconfig
SUBMISSION_SELF_HOSTED_2CAPTCHA_RECAPTCHA_V3_ACTIONconfig
SUBMISSION_SELF_HOSTED_2CAPTCHA_RECAPTCHA_V3_MIN_SCOREconfig
SUBMISSION_SELF_HOSTED_2CAPTCHA_RETRY_BACKOFF_MSconfig
SUBMISSION_SELF_HOSTED_2CAPTCHA_SOFT_IDconfig
SUBMISSION_SELF_HOSTED_2CAPTCHA_TIMEOUT_MSconfig
SUBMISSION_SELF_HOSTED_BLOCK_ADSconfig
SUBMISSION_SELF_HOSTED_BROWSER_CHANNELconfig
SUBMISSION_SELF_HOSTED_BROWSER_LAUNCH_TIMEOUT_MSconfig
SUBMISSION_SELF_HOSTED_CAPTCHA_BUILTIN_WAIT_MSconfig
SUBMISSION_SELF_HOSTED_CAPTCHA_HOOK_HEADERS_JSONconfig
SUBMISSION_SELF_HOSTED_CAPTCHA_HOOK_REQUIREDconfig
SUBMISSION_SELF_HOSTED_CAPTCHA_HOOK_TIMEOUT_MSconfig
SUBMISSION_SELF_HOSTED_CAPTCHA_HOOK_URLconfig
SUBMISSION_SELF_HOSTED_CAPTCHA_HOOK_WAIT_MSconfig
SUBMISSION_SELF_HOSTED_CAPTCHA_STRATEGYconfig
SUBMISSION_SELF_HOSTED_HEADLESSconfig
SUBMISSION_SELF_HOSTED_IGNORE_HTTPS_ERRORSconfig
SUBMISSION_SELF_HOSTED_LOCALEconfig
SUBMISSION_SELF_HOSTED_PROFILE_NAMESPACEconfig
SUBMISSION_SELF_HOSTED_PROFILE_ROOT_DIRconfig
SUBMISSION_SELF_HOSTED_PROXY_AUTO_PURCHASE_ALLOW_PAYMENT_REQUIREDconfig
SUBMISSION_SELF_HOSTED_PROXY_AUTO_PURCHASE_CREDITS_ONLYconfig
SUBMISSION_SELF_HOSTED_PROXY_AUTO_PURCHASE_ENABLEDconfig
SUBMISSION_SELF_HOSTED_PROXY_AUTO_PURCHASE_MAX_PAID_TODAY_USDconfig
SUBMISSION_SELF_HOSTED_PROXY_AUTO_REPLACE_COUNTRY_MISMATCHconfig
SUBMISSION_SELF_HOSTED_PROXY_AUTO_SELECTconfig
SUBMISSION_SELF_HOSTED_PROXY_BYPASSconfig
SUBMISSION_SELF_HOSTED_PROXY_MAX_ATTEMPTS🔐 secret
SUBMISSION_SELF_HOSTED_PROXY_PASSWORDconfig
SUBMISSION_SELF_HOSTED_PROXY_REQUIRE_GEO_MATCHconfig
SUBMISSION_SELF_HOSTED_PROXY_ROTATE_ON_CAPTCHAconfig
SUBMISSION_SELF_HOSTED_PROXY_ROTATE_ON_NETWORK_ERRORSconfig
SUBMISSION_SELF_HOSTED_PROXY_ROTATION_ENABLEDconfig
SUBMISSION_SELF_HOSTED_PROXY_SERVERconfig
SUBMISSION_SELF_HOSTED_PROXY_USERNAMEconfig
SUBMISSION_SELF_HOSTED_RECORD_VIDEOconfig
SUBMISSION_SELF_HOSTED_STEALTH_MODEconfig
SUBMISSION_SELF_HOSTED_TIMEZONE_IDconfig
SUBMISSION_SELF_HOSTED_USER_AGENTconfig
SUBMISSION_SELF_HOSTED_WEBSHARE_API_BASE_URL🔐 secret
SUBMISSION_SELF_HOSTED_WEBSHARE_API_KEYconfig
SUBMISSION_SELF_HOSTED_WEBSHARE_CACHE_TTL_MSconfig
SUBMISSION_SELF_HOSTED_WEBSHARE_MAX_PAGESconfig
SUBMISSION_SELF_HOSTED_WEBSHARE_MODEconfig
SUBMISSION_SELF_HOSTED_WEBSHARE_PAGE_SIZEconfig
SUBMISSION_SELF_HOSTED_WEBSHARE_PROXY_REPLACE_BASE_URLconfig
SUBMISSION_WORKER_HEARTBEAT_INTERVAL_MSconfig
SUBMISSION_WORKER_IDconfig
SUBMISSION_WORKER_STALE_AFTER_MS🔐 secret
SUPABASE_ACCESS_TOKENconfig
SUPABASE_PROJECT_REF🔐 secret
SUPABASE_SERVICE_KEYconfig
SWARMTESTER_BASE_URL🔐 secret
SWARM_API_SERVICE_TOKENconfig
SWARM_BASE_URLconfig
SWARM_OWNER_EMAILconfig
SWARM_OWNER_USER_IDconfig
SWARM_SHARE_PROMO_CODEconfig
SWARM_SHARE_PROMO_DESCRIPTIONconfig
SWARM_SHARE_PROMO_LABELconfig
TARGET_URLconfig
TESTER_OPERATOR_EMAILSconfig
TWOCAPTCHA_API_BASE_URL🔐 secret
TWOCAPTCHA_API_KEYconfig
TWOCAPTCHA_MAX_ATTEMPTSconfig
TWOCAPTCHA_POLL_INTERVAL_MSconfig
TWOCAPTCHA_POST_INJECT_WAIT_MSconfig
TWOCAPTCHA_RECAPTCHA_V3_ACTIONconfig
TWOCAPTCHA_RECAPTCHA_V3_MIN_SCOREconfig
TWOCAPTCHA_RETRY_BACKOFF_MSconfig
TWOCAPTCHA_SOFT_IDconfig
TWOCAPTCHA_TIMEOUT_MS🔐 secret
TWO_CAPTCHA_API_KEY🔐 secret
UI_TARS_API_KEYconfig
UI_TARS_BASE_URLconfig
UI_TARS_MAX_TOKENSconfig
UI_TARS_MODELconfig
UI_TARS_MODEL_VERSIONconfig
WEBHOOK_EVENTS🔐 secret
WEBHOOK_SECRETconfig
WEBHOOK_URLconfig
WEBSHARE_API_BASE_URL🔐 secret
WEBSHARE_API_KEYDeployment configuration, supplied by whoever hosts the server. Users are not asked for these.
deploy
PORTdeploy
QA_PUBLIC_APP_URLdeploy
SUPABASE_ANON_KEYdeploy
SUPABASE_SERVICE_ROLE_KEYdeploy
SUPABASE_URL// quality suggestions
Dependencies
20 dependencies, 1 flagged: playwright
Tool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
23/23 tools missing one or more hints — qa_ai_test (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); qa_self_review (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); qa_hire_tester (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +20 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tool inputs are validated
14/23 tool handlers declare input schemas (61%)
Declare an inputSchema with zod/joi/yup on every tool definition.
Tool handlers catch errors
22/23 tool handlers wrap calls in try/catch (96%)
Wrap each tool handler body in try/catch and return a structured error response.
License file
No license file
Add a LICENSE file (MIT, Apache-2.0, etc.).
Tool test coverage
Only 0/23 tools referenced in tests (0%)
Write tests that reference each tool by name so every tool has at least one test.
Shell command execution
8 child_process calls — runs shell commands
Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.
Dev dependencies
3 critical/high in dev-only deps (does not ship to users)
Upgrade dev dependencies when convenient.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 8 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[](https://m8ven.ai/mcp/bhuman-ai-qabro-eu07g6)Shows your grade and updates automatically. Prefer no grade? Append
?variant=verified to the badge URL.commit: 502886b341d4d214872d61636d4bd261eb47989e
code hash: 9ff2cce54c13d2c66f007edd76cf85e458c0e506e8093a415a0b928ddba58434
verified: 8/1/2026, 8:42:36 AM
Check MCPs from inside your assistant
Tool Check · MCPVetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-checkcheck_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client