Back to MCP Trust Indexm8ven
58
/ 100
1 month ago
glama

zpl-engine-mcp

ZPL stability engine — AIN bias & stability scoring across finance, gaming, AI/ML, security, and crypto. 68 tools across 11 categories. Math-based neutrality (Zenodo DOI). Free 5K tokens/mo, no card. Install: npx zpl-engine-mcp setup.

→ cicicalex/zpl-engine-mcp· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
⚠️
Known vulnerabilities in dependencies: 3 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 3 credentials: ANTHROPIC_API_KEY, ZPL_API_KEY, ZPL_ENGINE_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies3 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.12.1GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.12.1GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.12.1GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configALL_PROXY
🔐 secretANTHROPIC_API_KEY— Only for AI Eval tools — Required for the 8 AI Eval tools (zpl_consistency_test, etc.). Session capped at 100 Claude calls per process.
configHTTPS_PROXY
🔐 secretZPL_API_KEY— "": "zpl_u_YOUR_KEY_HERE",
configZPL_BACKEND_URL
configZPL_BUDGET_WARN— No 500 Token budget warning threshold
configZPL_DEFAULT_D
configZPL_DEFAULT_SAMPLES
configZPL_ENGINE_ALLOW_INSECURE_LOCAL— Local dev fix — with =1, localhost / 127.0.0.1 / ::1 are accepted as engine hostnames (not only production). Use with http://127.0.0.1:PORT for a local engine.
configZPL_ENGINE_DISABLE_URL_GUARD— No unset Set to 1 to skip hostname allowlist (dangerous; mistyped URLs could exfiltrate your API key)
configZPL_ENGINE_HOST_ALLOWLIST— No — Extra allowed hostnames (comma-separated), e.g. staging.engine.example.com for self-hosted engines
🔐 secretZPL_ENGINE_KEY
configZPL_ENGINE_URL— No https://engine.zeropointlogic.io Engine base URL (must match host allowlist; see Security)
configZPL_MAX_RETRIES— Safety bounds on numeric env vars — ZPL_RATE_LIMIT clamped to [1, 600], to [0, 5].
configZPL_MODE— "": "pure"
configZPL_NO_PROXY
configZPL_OUTPUT
configZPL_PLAN
configZPL_RATE_LIMIT— Safety bounds on numeric env vars — clamped to [1, 600], ZPL_MAX_RETRIES to [0, 5].
configZPL_SAVE_HISTORY
configZPL_SKIP_AUTOUPGRADE
configZPL_SKIP_UPDATE_CHECK
configZPL_STORE_DIR— ZPL_STORE_PATH No ~/.zpl-engine/ Local history storage path (legacy alias: ). Must resolve inside $HOME or the OS tmp dir; otherwise falls back to default.
configZPL_STORE_PATH— No ~/.zpl-engine/ Local history storage path (legacy alias: ZPL_STORE_DIR). Must resolve inside $HOME or the OS tmp dir; otherwise falls back to default.
configall_proxy
confighttps_proxy
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/cicicalex-zpl-engine-mcp-0zpaul)](https://m8ven.ai/mcp/cicicalex-zpl-engine-mcp-0zpaul)
commit: 31be14b68450ee31119b7b01614e96f9a15f156e
code hash: d3c91a5e9f633907f067303729fb59e9d0caf5cde416db3dfe743e76da2aebaf
verified: 6/10/2026, 11:37:11 AM
view raw JSON →