ai-agent-book (chemark/ai-agent-book) is an MCP server listed on the M8ven Trust Index. It scores 54 out of 100, grade D. It declares 200 tools. No publisher has claimed this listing.

Back to MCP Trust IndexM8ven
D
Caution
54/100

ai-agent-book

深入理解 AI Agent：设计原理与工程实践（学习副本，upstream: bojieli/ai-agent-book）

→ chemark/ai-agent-book· listed on github_code

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

chemark

Source: github_code

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

GitHub

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
🚨
Secret credentials may flow to a network call
10 flows detected: AUDIO_APP_KEY, DASHSCOPE_API_KEY, GOOGLE_API_KEY. We can’t prove the destination matches the brand the credential belongs to.
⚠️
Tool descriptions don’t match what handlers do
6 tools describe read intent but their handlers mutate — mcp_transcribe_audio (line 119: os.unlink(file_path)); mcp_transcribe_audio (line 114: os.unlink(file_path)); mcpreadpdf (line 468: with open(img_path, "wb") as img_file:)
🔐
You'll be asked for 26 credentials: ANTHROPIC_API_KEY, ARK_API_KEY, OPENAI_API_KEY, OPENROUTER_API_KEY, SILICONFLOW_API_KEY, AUDIO_LLM_API_KEY, LLM_API_KEY, E2B_API_KEY, IMAGE_LLM_API_KEY, TAVILY_API_KEY, MOONSHOT_API_KEY, DEEPSEEK_API_KEY, ZHIPU_API_KEY, KIMI_API_KEY, GOOGLE_API_KEY, JINA_API_KEY, BROWSERUSE_LLM_API_KEY, DATALAB_API_KEY, CODE_LLM_API_KEY, THINK_LLM_API_KEY, GUARD_LLM_API_KEY, VIDEO_LLM_API_KEY, AUDIO_APP_KEY, AUDIO_SECRET, DASHSCOPE_API_KEY, MCP_GATEWAY_TOKEN_SECRET
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes188 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

handle_call_tool

Handle tool execution.

browser_navigate

Navigate to a URL in the browser

browser_click

Click an element on the page by its index

browser_type

Type text into an input field

browser_get_state

Get the current state of the page including all interactive elements

browser_extract_content

Extract structured content from the current page based on a query

browser_scroll

Scroll the page

browser_go_back

Go back to the previous page

browser_list_tabs

List all open tabs

browser_switch_tab

Switch to a different tab

browser_close_tab

Close a tab

retry_with_browser_use_agent

Retry a task using the browser-use agent. Only use this as a last resort if you fail to interact with a page multiple times.

browser_list_sessions

List all active browser sessions with their details and last activity time

browser_close_session

Close a specific browser session by its ID

browser_close_all

Close all active browser sessions and clean up resources

mcp_transcribe_audio

Transcribe the given audio in a list of filepaths or urls.

get_browser_capabilities

Get information about browser automation capabilities and configuration.

browser_use

Perform browser automation tasks using the browser-use package. This tool provides comprehensive browser automation capabilities including: - Web scraping and content extraction - Form submission and automated interactions - File downloads and media handling …

complete_browser_task

Use browser to visit a web page, extract content, and optionally download files/images, ... Returns a dict with execution trace, answer (extracted content), and downloaded file/image paths.

e2b_upload_file

Upload local file to e2b sandbox.

e2b_run_code

Run code in a specified e2b sandbox.

hello_world

Say hello to the world.

mcp_image_recognition

Solve the question by careful reasoning given the image(s) in given local filepath or url, including reasoning, ocr, etc.

read_url

提取并将网页内容转换为清晰、可读的markdown格式。非常适合阅读文章、文档、博客文章或任何网页内容。当您需要分析网站的文本内容、绕过付费墙或获取结构化数据时，请使用此工具。

file_write

Write content to a file with automatic syntax verification

file_edit

Edit an existing file by searching and replacing content

code_interpreter

Execute code in multiple programming languages in a sandboxed environment with result analysis. Supports: Python, JavaScript, TypeScript, Go, Java, C++, Rust, PHP, Bash

virtual_terminal

Execute shell commands with error summarization

google_calendar_add

Add an event to Google Calendar

github_create_pr

Create a GitHub Pull Request

mcp
mcp_browser_navigate

Navigate to a URL in the virtual browser

mcp_browser_get_content

Get content from the current browser page

mcp_browser_execute_task

Execute a high-level browser task using AI agent

mcp_browser_screenshot

Take a screenshot of the current browser page

mcp_browser_list_tabs

List all open browser tabs

mcp_send_email

Send an email notification

mcp_send_telegram_message

Send a Telegram message

mcp_send_slack_message

Send a Slack message via webhook

mcp_send_discord_message

Send a Discord message via webhook

mcp_request_admin_approval

Request approval from a human administrator

mcp_request_admin_input

Request input from a human administrator

mcp_respond_to_request

Respond to an admin approval request (admin use)

mcp_list_pending_requests

List all pending admin approval requests

mcp_set_timer

Set a timer that will notify when completed

mcp_set_recurring_timer

Set a recurring timer that repeats at intervals

mcp_cancel_timer

Cancel an active timer

mcp_list_timers

List all timers, optionally filtered by status

mcp_get_timer_status

Get status of a specific timer

mcp_chess_new_game

Start a new chess game

mcp_chess_load_fen

Load a chess position from FEN notation

mcp_chess_make_move

Make a move on the chess board

mcp_chess_get_legal_moves

Get all legal moves in the current position

mcp_chess_get_board_state

Get the current chess board state

mcp_chess_get_game_status

Get the current game status (checkmate, stalemate, etc.)

mcp_chess_undo_move

Undo the last move

mcp_chess_get_move_history

Get the history of moves played

mcp_chess_reset_board

Reset the chess board to starting position

mcp_excel_read

Read data from Excel file

mcp_excel_write

Write data to Excel file

mcp_excel_create_workbook

Create a new Excel workbook

mcp_excel_create_worksheet

Create a new worksheet in Excel

mcp_excel_apply_formula

Apply formula to Excel cell

mcp_excel_get_metadata

Get Excel file metadata

mcp_excel_screenshot

Create screenshot of Excel file

mcp_intelligence_generate_code

Generate Python code based on task description

mcp_intelligence_think

Perform complex problem reasoning with step-by-step thinking

mcp_intelligence_guard

Guard and validate a proposed action for safety

mcp_spawn_subagent

Spawn a sub-agent to handle a delegated task. Supports sync (waits and returns result) and async (returns a task_id immediately) modes, and two context-passing strategies: 'minimal' or 'llm_generated'.

mcp_send_message_to_subagent

Send a follow-up message to an existing sub-agent and get its reply

mcp_cancel_subagent

Cancel a sub-agent (cancels the background task for async sub-agents)

mcp_get_subagent_status

Get the status and result of a sub-agent (useful for async sub-agents)

web_search

Search the web using DuckDuckGo (free, no API key required)

download

Download a file from a URL to local storage

knowledge_base_search

Search a local knowledge base directory

webpage_reader

Read and extract content from a webpage

document_reader

Read and extract content from documents (PDF, DOCX, PPTX)

image_parser

Parse and analyze image files

video_parser

Parse and extract metadata from video files

file_reader

Read a file and return its contents

grep

Search for patterns in files (grep-like functionality)

text_summarizer

Summarize long text content

weather

Get current weather information for a location (Open-Meteo, free, no API key)

stock_price

Get stock price and market information

currency_converter

Convert between currencies

crypto_price

Get cryptocurrency price information (CoinGecko, free, no API key)

location_search

Search for locations using Nominatim/OpenStreetMap (free, no API key)

poi_search

Search for Points of Interest near a location using Overpass/OpenStreetMap (free, no API key)

wikipedia_search

Search Wikipedia and get article summary

arxiv_search

Search ArXiv for academic papers

wayback_search

Search Wayback Machine for archived web pages

youtube_transcript

Extract transcript from a YouTube video

pubchem_search

Search PubChem for chemical compounds

pubchem_properties

Get detailed properties for a PubChem compound

pubchem_synonyms

Get synonyms for a PubChem compound

pubchem_similar

Search for structurally similar compounds in PubChem

yfinance_quote

Get current stock quote and market data

yfinance_historical

Get historical stock price data

yfinance_company_info

Get comprehensive company information

yfinance_financials

Get financial statements (income statement, balance sheet, cash flow)

88 further tools are not listed here. The complete surface is in the source.

// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
🔐 secretANTHROPIC_API_KEY
🔐 secretARK_API_KEY
🔐 secretOPENAI_API_KEY
🔐 secretOPENROUTER_API_KEY
configPLAYWRIGHT_PORT
🔐 secretSILICONFLOW_API_KEY
configWEBSOCKET_PORT
configWS_PATH
configBROWSER_USE_LOGGING_LEVEL
configBROWSER_USE_SETUP_LOGGING
🔐 secretAUDIO_LLM_API_KEY
configAUDIO_LLM_BASE_URL
configAUDIO_LLM_MODEL_NAME
configLLM_MODEL_NAME
🔐 secretLLM_API_KEY
configLLM_BASE_URL
configCOOKIES_FILE_PATH
🔐 secretE2B_API_KEY
🔐 secretIMAGE_LLM_API_KEY
configIMAGE_LLM_BASE_URL
configIMAGE_LLM_MODEL_NAME
🔐 secretTAVILY_API_KEY
configPIC_SEARCH_URL
configPIC_SEARCH_SEARCHMODE
configPIC_SEARCH_SOURCE
configPIC_SEARCH_DOMAIN
configPIC_SEARCH_UID
configLLM_PROVIDER
configLLM_MODEL
configENABLE_MCP_TOOLS
configAGENT_HOST
🔐 secretMOONSHOT_API_KEY
🔐 secretDEEPSEEK_API_KEY
🔐 secretZHIPU_API_KEY
🔐 secretKIMI_API_KEY
configNO_COLOR
configCHAT_MODEL
configOPENAI_BASE_URL
configGLOBAL_LOG_LEVEL
🔐 secretGOOGLE_API_KEY
configGOOGLE_CSE_ID
configCHROME_DRIVER_PATH
configPIC_SEARCH_TOTAL_NUM
configPIC_SEARCH_SLICE_NUM
🔐 secretJINA_API_KEY
configBROWSERUSE_LLM_BASE_URL
configBROWSERUSE_LLM_MODEL_NAME
🔐 secretBROWSERUSE_LLM_API_KEY
🔐 secretDATALAB_API_KEY
configCODE_LLM_BASE_URL
configCODE_LLM_MODEL_NAME
🔐 secretCODE_LLM_API_KEY
configTHINK_LLM_BASE_URL
configTHINK_LLM_MODEL_NAME
🔐 secretTHINK_LLM_API_KEY
configGUARD_LLM_BASE_URL
configGUARD_LLM_MODEL_NAME
🔐 secretGUARD_LLM_API_KEY
configVIDEO_LLM_BASE_URL
configVIDEO_LLM_MODEL_NAME
🔐 secretVIDEO_LLM_API_KEY
configAWORLD_SEARCH_URL
configAWORLD_SEARCH_SEARCHMODE
configAWORLD_SEARCH_SOURCE
configAWORLD_SEARCH_DOMAIN
configAWORLD_SEARCH_UID
configAWORLD_SEARCH_TOTAL_NUM
configAWORLD_SEARCH_SLICE_NUM
configLOG_FILE_PATH
configAUDIO_TASK_URL
configAUDIO_QUERY_URL
🔐 secretAUDIO_APP_KEY
🔐 secretAUDIO_SECRET
configAUDIO_SAMPLE_RATE
configAUDIO_AUDIO_FORMAT
configAUDIO_TTS_VOICE
configAUDIO_TTS_SPEECH_RATE
configAUDIO_TTS_VOLUME
configAUDIO_TTS_PITCH
configAUDIO_VOICE_TYPE
configAUDIO_RETRY_TIMES
configAUDIO_SLEEP_TIME
🔐 secretDASHSCOPE_API_KEY
configDASHSCOPE_SUBMIT_URL
configDASHSCOPE_QUERY_BASE_URL
configDASHSCOPE_MODEL
configDASHSCOPE_SIZE
configDASHSCOPE_N
configDASHSCOPE_RETRY_TIMES
configDASHSCOPE_SLEEP_TIME
configDASHSCOPE_VIDEO_SUBMIT_URL
configDASHSCOPE_VIDEO_MODEL
configDASHSCOPE_VIDEO_SIZE
configDASHSCOPE_VIDEO_RETRY_TIMES
configDASHSCOPE_VIDEO_SLEEP_TIME
configLLM_TEMPERATURE
configFILESYSTEM_SERVER_WORKDIR
configGITHUB_MCP_COMMAND
configTCODE_LLM_MODEL_NAME
configTCODE_LLM_BASE_URL
configVIDEO_LLM_TEMPERATURE
configCLUSTER_NAME
configVNC_AUTH
configMCP_GATEWAY_REDIS_URL
🔐 secretMCP_GATEWAY_TOKEN_SECRET
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

202/202 tools missing one or more hints — handle_call_tool (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); browser_navigate (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); browser_click (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +199 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Destructive tools are labelled

7 tools perform destructive updates without destructiveHint — mcp_transcribe_audio deletes at line 119 (os.unlink(file_path)); mcp_transcribe_audio deletes at line 114 (os.unlink(file_path)); mcpreaddocx deletes at line 545 (os.remove(md_file_path))

Add destructiveHint:true to any tool whose handler calls .delete(), .upsert(), .update(), unlink, rm, DELETE, DROP, REPLACE INTO, or any operation that overwrites existing data.

Descriptions match behaviour

6 tools describe read intent but their handlers mutate — mcp_transcribe_audio (line 119: os.unlink(file_path)); mcp_transcribe_audio (line 114: os.unlink(file_path)); mcpreadpdf (line 468: with open(img_path, "wb") as img_file:)

Rename the tool, rewrite the description, or move the side-effect into a separate clearly-named tool.

Tool test coverage

125/202 tools referenced in tests (62%)

Write tests that reference each tool by name so every tool has at least one test.

Secrets not logged

39 secret values sent to logging.info/logger.info/print/logger.warning

Redact or omit secret values from log output.

Tool description accuracy

6 tools have description/behavior mismatches: mcp_transcribe_audio: description implies read-only but handler writes/deletes/executes; mcp_transcribe_audio: description implies read-only but handler writes/deletes/executes; mcpreadpdf: description implies read-only but handler writes/deletes/executes

Update tool descriptions to accurately reflect all capabilities — especially write, delete, or execute operations.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/chemark/ai-agent-book?variant=verified)](https://m8ven.ai/mcp/chemark/ai-agent-book)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 5687624e1b5c85969472c07d915f8da69189a9ab
code hash: 0a51fcf02aa4a4a603ef2bd1c4de62b6639da49d13c1b4f77761087d5694f83b
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client