bamboo-mcp (BNLNPPS/bamboo-mcp) is an MCP server listed on the M8ven Trust Index. M8ven has not graded it yet. No publisher has claimed this listing.

Back to MCP Trust IndexM8ven
C
Emerging
74/100

bamboo-mcp

Bamboo is a lightweight MCP-based runtime with a plugin architecture for AI-assisted scientific tools

→ BNLNPPS/bamboo-mcp· listed on github_code

Emerging. No concerning findings. Grades remain capped until the project builds reputation through adoption. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

BNLNPPS

Source: github_code

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

GitHub

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 5 credentials: PANDA_MCP_TOKEN, BAMBOO_MCP_TOKEN, BAMBOO_SUPERUSER_PASSWORD, MCP_BEARER_TOKEN, ANTHROPIC_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configBAMBOO_QUIET
configBAMBOO_MCP_HTTP_TIMEOUT
configBAMBOO_MCP_CLIENT_TIMEOUT
configPANDA_MCP_BASE_URL
🔐 secretPANDA_MCP_TOKEN
configPANDA_MCP_TOKEN_FILE
configPANDA_MCP_ORIGIN
configPANDA_MCP_USE_SSE
configPANDA_MCP_TLS_VERIFY
configSSL_CERT_FILE
configPANDA_MCP_CA_BUNDLE
configPANDA_BASE_URL
configASKPANDA_PLUGINSet =cgsim and CGSIM_DB_PATH=/path/to/cgsim.db when
configBAMBOO_CRIC_TABLE_FILE
configBAMBOO_CODE_QUERY_REPOanalyses source files from any GitHub repository ();
configBAMBOO_CODE_QUERY_BRANCHSuperuser. Fetches any source file from a configurable GitHub repository for code review, algorithm explanation, and Mermaid diagram generation. Default repo: PanDAWMS/pilot3. Configured via BAMBOO_CODE_QUERY_REPO and BAMBOO_CODE_QUERY_BRANCH.
configASKPANDA_OPENSEARCH
configBAMBOO_HTTP_HOST
configBAMBOO_HTTP_PORT
configBAMBOO_HTTP_LOG_LEVEL
configBAMBOO_MCP_TOKENS_FILE
configBAMBOO_MCP_TOKENS
configBAMBOO_MCP_HTTP_URL
🔐 secretBAMBOO_MCP_TOKEN
configBAMBOO_AGENT_MAX_STEPS
configBAMBOO_AGENT_CONFIDENCE
configBAMBOO_AGENT_MAX_TOKENS
configBAMBOO_CHROMA_PATH
configBAMBOO_CHROMA_COLLECTIONSet =atlas_docs when running the ATLAS deployment to
configCRIC_DUCKDB_PATH
configASKPANDA_SERVER_NAME
configASKPANDA_SERVER_VERSION
configASKPANDA_ENABLE_REAL_PANDA
configASKPANDA_ENABLE_REAL_LLM
configASKPANDA_KB_PATH
configASKPANDA_QUEUE_DATA_PATH
configASKPANDA_LLM_DEFAULT_PROFILE
configASKPANDA_LLM_FAST_PROFILE
configASKPANDA_LLM_REASONING_PROFILE
configLLM_DEFAULT_PROVIDER
configLLM_DEFAULT_MODEL
configLLM_FAST_PROVIDER
configLLM_FAST_MODEL
configLLM_REASONING_PROVIDER
configLLM_REASONING_MODEL
configASKPANDA_OPENAI_COMPAT_BASE_URL
configBAMBOO_TRACE
configBAMBOO_TRACE_FILE
configBAMBOO_OTEL_ENDPOINT
configBAMBOO_OTEL_SERVICE_NAME
configBAMBOO_OTEL_INSECURE
configBAMBOO_SUPERUSER_PATTERNS
configBAMBOO_SUPERUSER_TOOLS
configBAMBOO_HISTORY_TURNS
configBAMBOO_DIAGRAM_MODE
🔐 secretBAMBOO_SUPERUSER_PASSWORDUnlock developer mode (requires BAMBOO_SUPERUSER_PASSWORD)
configBAMBOO_FAST_PATHConfigurable routing — bamboo_answer uses deterministic fast-path routing by default; set =0 to route all questions through the LLM planner (recommended for CGSim)
configMCP_URL
🔐 secretMCP_BEARER_TOKEN
configBAMBOO_STARTUP_TIMEOUT
configSSH_CLIENT
configSSH_TTY
configSSH_CONNECTION
configBAMBOO_FORCE_NO_INLINE
configLLM_PROFILES_JSON
configASKPANDA_OPENSEARCH_HOST
configASKPANDA_OPENSEARCH_USER
configASKPANDA_OPENSEARCH_CA
configASKPANDA_OPENSEARCH_VERIFY_CERTS
configBAMBOO_OPENSEARCH_PROMPTLOG
configBAMBOO_OPENSEARCH_PROMPTLOG_INDEX
configCGSIM_DB_PATHSet ASKPANDA_PLUGIN=cgsim and =/path/to/cgsim.db when
🔐 secretANTHROPIC_API_KEY
configCORE_ANALYSIS_MODEL
configBAMBOO_CORE_ANALYSIS_ROOT
configBAMBOO_CORE_DUMP_DEBUG_DIR
configBAMBOO_CORE_DUMP_PYTHON_GDB
configPANDA_DUCKDB_PATH
configBAMBOO_PILOT3_REPO
configBAMBOO_PILOT3_BRANCH
configBAMBOO_PILOT3_DEV_REPO
configBAMBOO_PILOT3_DEV_BRANCH
configASKPANDA_ANTHROPIC_CONCURRENCY
configASKPANDA_ANTHROPIC_RETRIES
configASKPANDA_ANTHROPIC_BACKOFF_SECONDS
configASKPANDA_GEMINI_CONCURRENCY
configASKPANDA_GEMINI_RETRIES
configASKPANDA_GEMINI_BACKOFF_SECONDS
configASKPANDA_MISTRAL_CONCURRENCY
configASKPANDA_MISTRAL_RETRIES
configASKPANDA_MISTRAL_BACKOFF_SECONDS
configASKPANDA_OPENAI_CONCURRENCY
configASKPANDA_OPENAI_RETRIES
configASKPANDA_OPENAI_BACKOFF_SECONDS
configASKPANDA_OPENAI_COMPAT_CONCURRENCY
configOPENAI_COMPAT_BASE_URL
configASKPANDA_OPENAI_COMPAT_RETRIES
configASKPANDA_OPENAI_COMPAT_BACKOFF_SECONDS
// quality suggestions

Secrets not logged

1 secret value sent to print

Redact or omit secret values from log output.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 1 concrete improvement we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/bnlnpps/bamboo-mcp)](https://m8ven.ai/mcp/bnlnpps/bamboo-mcp)
Shows your grade and updates automatically. Prefer no grade? Append ?variant=verified to the badge URL.
commit: 157e111cb3761df968cb082fc9a88a363910ddd2
code hash: 378c5ac3a7c862e82fcf2f6e9b4ff518ea16c781e066c3ab6dbec78d8c1442b2
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client