/ 100

1 day ago

glama

attestor

Item: attestor
Rating: 74
Author: M8ven

Audit-grade memory backbone for agent teams. Bi-temporal facts (event time + transaction time, with recall(as_of=...) replay), 6-step deterministic retrieval (no LLM in the critical path), conversation ingest with speaker-locked dual-pass extraction, per-tenant Postgres row-level security, and Ed25519-signed provenance. Postgres + pgvector + Neo4j defaults.

→ bolnet/attestor · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama PulseMCP

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 8 credentials: PINECONE_API_KEY, POSTGRES_PASSWORD, NEO4J_PASSWORD, ATTESTOR_JWT_PUBLIC_KEY, HF_HUB_DISABLE_IMPLICIT_TOKEN, VOYAGE_API_KEY, COHERE_API_KEY, OPENAI_API_KEY

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

🔐 secretPINECONE_API_KEY— set -a && source .env && set +a # OPENROUTER_API_KEY, , NEO4J_PASSWORD

configPINECONE_HOST

configPINECONE_INDEX

configPOSTGRES_URL

configNEO4J_URI

configPOSTGRES_DATABASE

configPOSTGRES_USERNAME

🔐 secretPOSTGRES_PASSWORD

configPOSTGRES_SSLMODE

configNEO4J_DATABASE

configNEO4J_USERNAME

🔐 secretNEO4J_PASSWORD— set -a && source .env && set +a # OPENROUTER_API_KEY, PINECONE_API_KEY,

🔐 secretATTESTOR_JWT_PUBLIC_KEY

configATTESTOR_JWT_ALGORITHMS

configATTESTOR_JWT_LEEWAY_SECONDS

configATTESTOR_JWT_AUDIENCE

configATTESTOR_JWT_ISSUER

configATTESTOR_TRACE_FILE

configATTESTOR_AUDIT_ENABLED

configATTESTOR_BENCH_CONFIG

configATTESTOR_CONFIG

configHF_HUB_DISABLE_PROGRESS_BARS

configTOKENIZERS_PARALLELISM

configTRANSFORMERS_VERBOSITY

configSAFETENSORS_LOG_LEVEL

configHF_HUB_VERBOSITY

configHF_HUB_DISABLE_TELEMETRY

🔐 secretHF_HUB_DISABLE_IMPLICIT_TOKEN

configTQDM_DISABLE

configATTESTOR_MCP_TOLERATE_INIT_FAILURE

configPG_TEST_URL

🔐 secretVOYAGE_API_KEY

configVOYAGE_EMBEDDING_MODEL

configVOYAGE_EMBEDDING_DIMENSIONS

configOPENAI_EMBEDDING_DIMENSIONS— 3. OpenAI text-embedding-3-large (3072-D native; pin =1024 for schema compat)

configOPENAI_EMBEDDING_MODEL

configPINECONE_EMBEDDING_MODEL

configPINECONE_EMBEDDING_DIMENSIONS

configATTESTOR_HOOK_TIMEOUT_S

configOTEL_EXPORTER

configOTEL_SERVICE_NAME

configHYDE_GENERATOR_MODEL

configMULTI_QUERY_REWRITER_MODEL

configPLANNER_MODEL

🔐 secretCOHERE_API_KEY

configATTESTOR_TRACE— Every call writes a JSONL trace to logs/attestor_trace.jsonl (disable via =0).

configATTESTOR_TRACE_PATH

configMY_VAR

configVOYAGE_INPUT_TYPE

configPINECONE_EMBEDDING_INPUT_TYPE

🔐 secretOPENAI_API_KEY

configOPENAI_BASE_URL

configATTESTOR_V4

configATTESTOR_SKIP_SCHEMA_INIT

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/bolnet-attestor-1jswsf)](https://m8ven.ai/mcp/bolnet-attestor-1jswsf)

commit: e7fb46ebbd01a8a9d7091936076005b6c5d3f4a7

code hash: 1d75bb2c15893ab3a16fed0c05ba30baa82375f70d8007470784e20bd8ea5828

verified: 7/30/2026, 8:17:30 PM

view raw JSON →