mcp-agent-bridge (catesandrew/mcp-agent-bridge) is an MCP server listed on the M8ven Trust Index. It scores 62 out of 100, grade C. It declares 35 tools. No publisher has claimed this listing.

C
Caution
62/100

mcp-agent-bridge

Bridge AI coding agents (Claude Code, Codex, Copilot) as MCP servers for cross-agent code review and collaboration

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

catesandrew

Source: github_repo_search

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
🚨
Known vulnerabilities in dependencies: 1 critical, 3 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
// tools this server exposes35 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

review

Send a plan, diff, or implementation to a Claude instance for independent review. Returns structured JSON with verdict, issues, and suggestions.

ask

Ask a Claude instance a freeform question about the codebase. Returns text.

implement
code_review

Specialized code review that analyzes a git diff. Returns structured JSON with verdict, issues, and suggestions.

analyze_failure

Analyze a Playwright release-failure evidence bundle and return a structured diagnostic report. The caller supplies the full prompt (run summary, failed/flaky results, and repo context) as `content`; the model's output is constrained to the findings[] schema (runSummary + per-finding rootCause, conf

quick_analysis

Lightweight, non-agentic triage for a stale or low-priority item — e.g. deciding what to do with a PR review that's gone quiet. Returns a verdict from a small fixed set plus a one-sentence reason. Not a full code review.

agent_chat

One turn of an interactive chat with resource context and optional tool proposals. The caller assembles the full prompt (system instructions, resource context, available tool descriptions, and conversation history) — this tool has no memory of prior turns. Returns a text reply plus zero or more prop

cover_letter_generator

Generate a personalized, compelling cover letter from a resume and job description. Returns an analysis, the complete letter, alternative opening hooks, and interview talking points.

creative_portfolio_resume

Generate both an ATS-compatible and a designed resume for creative professionals (graphic designers, UX, marketing, writers, photographers, etc.). Returns both versions plus field-specific tips and portfolio link strategy.

executive_resume_writer

Craft a C-suite, VP, or Director-level resume that tells a transformation story. Returns executive profile, core competencies, career highlights, full experience section, and coaching notes.

interview_prep_generator

Generate STAR stories, predicted questions, self-introduction pitch, and interview strategy tailored to a specific role.

job_description_analyzer

Analyze a job posting to extract requirements, calculate match score, detect red flags, and generate tailored application strategy.

linkedin_profile_optimizer

Optimize a LinkedIn profile with keyword-rich headline options, rewritten About section, experience bullet rewrites, skills recommendations, and a 30-day action plan.

portfolio_case_study_writer

Transform a project into a compelling portfolio case study with problem, process, solution, results, and learnings. Returns full case study, executive summary, and interview prep notes.

reference_list_builder

Build a formatted professional reference list with briefing emails, permission scripts, talking points, and timing strategy for each reference.

resume_ats_optimizer

Optimize a resume to pass ATS screening. Returns keyword gap analysis, match score, formatting fixes, and optimized sections with projected score improvement.

resume_bullet_writer

Transform weak, duty-focused resume bullets into achievement-focused statements using the X-Y-Z formula. Returns diagnosed issues, metric-extraction questions, and 2-3 rewritten versions per bullet.

resume_formatter

Audit and fix resume formatting for ATS compatibility and human readability. Returns formatting audit, specific fixes, reformatted sections, and ATS compatibility score.

resume_quantifier

Add metrics and data-driven impact to resume bullets. Returns discovery questions, estimated metrics, and 2 quantified versions (conservative and optimistic) per bullet.

resume_section_builder

Build all resume sections optimized for career stage and target role. Returns section order, professional summary, skills section, experience guidance, and complete section checklist.

resume_tailor

Tailor a resume to a specific job posting with keyword extraction, match audit, rewritten summary, prioritized skills, and bullet rewrites. Maintains authenticity — all changes reflect genuine experience.

resume_version_manager

Create and organize a master resume, manage tailored versions with naming conventions, track applications, and establish an update workflow.

tech_resume_optimizer

Optimize resumes for software engineering, PM, data, and DevOps roles with skill section restructuring, technical bullet rewrites, projects section guidance, and GitHub recommendations.

career_fact_extractor

Extract a structured, fact-ID-tagged database of career facts from a resume, LinkedIn profile, brag document, or any source material. Preserves truthfulness for downstream resume tailoring.

recruiter_first_screen_simulation

Simulate a skeptical hiring manager's 45-second resume screen. Returns a Yes/Maybe/No decision, top reasons and concerns, scores across 6 dimensions, and exact rewrites to make before applying.

open_pr_gh

Push the active branch and open a GitHub pull request with a structured description, linked ticket, reviewers, and labels. Returns step-by-step workflow instructions.

review_pr_gh

Systematic file-by-file GitHub PR code review. Posts inline comments and a verdict. Returns step-by-step workflow instructions.

open_pr_ado

Push the active branch and open an Azure DevOps pull request with a structured description, linked work items, and optional auto-complete. Returns step-by-step workflow instructions.

review_pr_ado

Systematic file-by-file ADO PR code review. Posts inline thread comments and a vote. Returns step-by-step workflow instructions.

codex

Send a prompt to OpenAI Codex CLI for code generation or analysis.

codex_reply

Continue a conversation with Codex by sending a follow-up reply. Note: Does not maintain actual session state; context is passed inline.

narrate_video

Extract frames from a video (fixed-fps or scene-change sampling) and narrate the sequence with Claude. Returns both the per-frame descriptions and a single synthesized narration string.

extract_frames

Extract frames from a video (fixed-fps or scene-change sampling) without narrating them. Returns a sessionId plus a thumbnail per frame; pass the sessionId to narrate_frames to describe them, or to close_session to free the extracted files early. Sessions auto-expire after 30 minutes.

narrate_frames

Narrate frames previously extracted via extract_frames, identified by sessionId. Can be called more than once against the same sessionId (e.g. with a different prompt or batchSize) without re-extracting. Pass close: true to free the session's frame files immediately after this call instead of waitin

close_session

Free the frame files held by a session started with extract_frames. Safe to call on an already-closed or expired sessionId (no-op).

// known CVEs in dependencies1 critical3 high1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

criticalvitest@3.2.1GHSA-5xrq-8626-4rwp

When Vitest UI server is listening, arbitrary file can be read and executed

high@modelcontextprotocol/sdk@1.12.1GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.12.1GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.12.1GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

lowvitest@3.2.1GHSA-82fw-gwwq-j7x9

Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configCLAUDE_ALLOWED_CWD_ROOTS
configCLAUDE_ANALYSIS_MODEL
configCLAUDE_MCP_HTTP
configCLAUDE_MCP_HTTP_PORTClaude HTTP port
configCLAUDE_REVIEW_ALLOWED_TOOLS
configCLAUDE_REVIEW_CWD
configCLAUDE_REVIEW_MAX_TURNS
configCLAUDE_REVIEW_MODELModel for Claude reviews
configCLAUDE_REVIEW_PERMISSION_MODE
configCLAUDE_REVIEW_TIMEOUT_MS
configCODEX_REVIEW_AGENT_PATH
configCODEX_REVIEW_MODEL
configCOPILOT_REVIEW_MODEL
configVIDEO_CLAUDE_PERMISSION_MODE
configVIDEO_FFMPEG_TIMEOUT_MS
configVIDEO_MCP_HTTP
configVIDEO_MCP_HTTP_PORT
configVIDEO_NARRATION_MODEL
configVIDEO_NARRATION_TIMEOUT_MS
configVIDEO_SESSION_TTL_MS
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

35/35 tools missing one or more hints — review (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); ask (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); implement (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +32 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Production dependencies are patched

0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.12.1 (high), @modelcontextprotocol/sdk@1.12.1 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Dev dependencies

1 critical/high in dev-only deps (does not ship to users)

Upgrade dev dependencies when convenient.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/catesandrew/mcp-agent-bridge?variant=verified)](https://m8ven.ai/mcp/catesandrew/mcp-agent-bridge)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 95a4f31b1887747db2e567e0135ff168ddaf44cb
code hash: 73ad7eec9dcb5d30901443b182e99838633b731f6b710446088825a46425569c
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client