A production-ready remote MCP server with per-user tenant isolation, PAT authentication, and a notes domain, using Stateless Streamable HTTP transport.
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins
@hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware
@better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitive
Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp
Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default
process.env. You'll be asked to provide them before it can run.DATABASE_URL— Env vars: , BETTER_AUTH_SECRET (openssl rand -base64 32),PORT— Origin header of state-changing auth requests against it), and .[](https://m8ven.ai/mcp/cdotta-remote-mcp-starter-4z127h)