clervo/clervo
A stdio MCP server backed by the TypeScript SDK that exposes frozen Clervo operations for web search and answer functionality, enabling agents to find and understand information through a clean-room outcome infrastructure.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
clervo
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
BLOCKSCOUT_API_KEYBRAVE_SEARCH_API_KEYCDP_API_KEY_IDCDP_API_KEY_SECRETCDP_X402_FACILITATOR_URLCLERVO_AI_API_KEYCLERVO_AI_BASE_URLCLERVO_BASE_URLCLERVO_CLOUD_ACCEPTANCECLERVO_CLOUD_BUILD_CONFIRMCLERVO_DATABASE_MIGRATION_CONFIRMCLERVO_DATABASE_URLCLERVO_ENVCLERVO_EXPECTED_RELEASE_SHACLERVO_GCP_IAM_CONFIRMCLERVO_HTTP_HOSTCLERVO_HTTP_PORTCLERVO_KUBECTL_BINCLERVO_MANAGED_MIGRATION_CONFIRMCLERVO_MIGRATION_IMAGECLERVO_N427R_BROWSER_KILL_SWITCHCLERVO_N427R_CERTIFICATE_SPKICLERVO_N427R_EXPECTED_MARKERCLERVO_N427R_GATEWAYCLERVO_N427R_IMPLEMENTATION_DIGESTCLERVO_N427R_TARGET_URLCLERVO_N427S_BROWSER_KILL_SWITCHCLERVO_N427S_EXPECTED_MARKERCLERVO_N427S_GATEWAYCLERVO_N427S_GATEWAY_ALLOWED_HOSTSCLERVO_N427S_GATEWAY_MAXIMUM_ACTIVECLERVO_N427S_IMAGE_DIGESTCLERVO_N427S_IMPLEMENTATION_DIGESTCLERVO_N427S_MARKER_MODECLERVO_N427S_TARGET_URLCLERVO_N427T_BROWSER_KILL_SWITCHCLERVO_N427T_EXPECTED_MARKERCLERVO_N427T_FINAL_EXECUTIONCLERVO_N427T_FIXTURE_BASE_URLCLERVO_N427T_FIXTURE_SPKI_SHA256CLERVO_N427T_GATEWAYCLERVO_N427T_IMPLEMENTATION_DIGESTCLERVO_N427T_MARKER_MODECLERVO_N427T_POLICY_DIGESTCLERVO_N427T_TARGET_URLCLERVO_RECOVERY_IDEMPOTENCY_KEYCLERVO_RECOVERY_PROXY_HOSTCLERVO_RECOVERY_PROXY_PORTCLERVO_RECOVERY_TARGETCLERVO_RELEASE_IDCLERVO_RETENTION_CONFIRMCLERVO_SANDBOX_CAPACITY_CONFIRMCLERVO_SANDBOX_COMPONENTCLERVO_SANDBOX_CONNECTIVITY_CONFIRMCLERVO_SANDBOX_IMAGECLERVO_SANDBOX_IMAGE_REFERENCECLERVO_SANDBOX_PRODUCTION_CONFIRMCLERVO_SANDBOX_QUALIFICATION_ACKCLERVO_SANDBOX_QUALIFICATION_CLUSTERCLERVO_SANDBOX_QUALIFICATION_REPORT_PATHCLERVO_SANDBOX_QUALIFICATION_SUITECLERVO_SANDBOX_SECRET_CONFIRMCLERVO_SENTRY_DELIVERY_CONFIRMCLERVO_SENTRY_DSN_SECRET_VERSIONCLERVO_SITE_ORIGINCLERVO_STAGE4_COMMERCE_ORIGINCLERVO_STAGE4_EXPECTED_MARKERCLERVO_STAGE4_FIXTURE_SPKI_SHA256CLERVO_STAGE4_GATEWAYCLERVO_STAGE4_HOSTILE_RUNSCLERVO_STAGE4_JAVASCRIPT_RUNSCLERVO_STAGE4_MARKER_MODECLERVO_STAGE4_TARGET_URLCLERVO_STAGING_EVIDENCE_PATHCLERVO_STAGING_IDENTITY_TOKENCLERVO_STAGING_ORIGINCLERVO_STATE_NAMESPACECLERVO_STUDIO_MODULE_ROOTCLERVO_STUDIO_TMUX_CONFIGCLERVO_X402_BOOTSTRAP_CONFIRMCLERVO_X402_NEW_PAY_TOCLERVO_X402_PROOF_DEPLOY_CONFIRMCLERVO_X402_PROOF_DISABLE_CONFIRMCLERVO_X402_PROOF_IDEMPOTENCY_KEYCLERVO_X402_PROOF_IDENTITY_AUDIENCECLERVO_X402_PROOF_PAYERCLERVO_X402_PROOF_PAY_TOCLERVO_X402_PROOF_PORTCLERVO_X402_PROOF_TARGET_ORIGINCLERVO_X402_RECEIVER_ROTATION_CONFIRMCLERVO_X402_SOURCE_ENV_FILECLOUDFLARE_ACCOUNT_IDCLOUDFLARE_AI_TOKENCLOUDFLARE_API_TOKENCLOUDFLARE_BENCHMARK_MODELSCLOUDFLARE_QUALIFICATION_MODELSCODEX_HOMEDEEPGRAM_API_KEYDEVTO_API_KEYDRPC_API_KEYDRPC_QUALIFICATION_SAMPLESGH_TOKEN_1GITLAB_TOKENGROQ_API_KEYGROQ_BENCHMARK_MODELSHASHNODE_API_KEYHELIUS_API_KEYHELIUS_RPCKUBECONFIGMISTRAL_API_KEYOWNED_BENCHMARK_MODELSOWNED_BENCHMARK_SOURCER2_ACCESS_KEY_IDR2_BUCKET_NAMER2_S3_ENDPOINTR2_SECRET_ACCESS_KEYR2_USE_DERIVED_ACCOUNT_ENDPOINTSECRET_SCAN_BASE_SHASECRET_SCAN_HEAD_SHASECRET_SCAN_SKIP_HISTORYSECRET_SCAN_SOURCE_ARCHIVESERPER_API_KEYTELEGRAM_BOT_TOKENWORKOS_API_KEYZERION_API_KEYCLERVO_N426_BROWSER_KILL_SWITCHCLERVO_N426_TARGET_URLCLERVO_N426_GATEWAYCLERVO_N427_BROWSER_KILL_SWITCHCLERVO_N427_TARGET_URLCLERVO_N427_GATEWAYCLERVO_N427_EXPECTED_MARKERCLERVO_N427_IMAGE_DIGESTPORTTool inputs are validated
Only 0/2 tool handlers declare input schemas (0%)
Declare an inputSchema with zod/joi/yup on every tool definition.
Tool handlers catch errors
Only 0/2 tool handlers wrap calls in try/catch (0%)
Wrap each tool handler body in try/catch and return a structured error response.
License file
No license file
Add a LICENSE file (MIT, Apache-2.0, etc.).
Tests exist
No test files found
Add tests that exercise each declared tool.
Shell command execution
6 child_process calls — runs shell commands
Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.
Secrets stay with their owner
1 secret/sensitive value flow into network calls (R2_ACCESS_KEY_ID → dynamic) (4 other flows matched canonical API hosts)
Audit where credentials are sent. A NOTION_TOKEN should only reach api.notion.com — never a third-party host.
Secrets not logged
1 secret value sent to console.log
Redact or omit secret values from log output.
No arbitrary install scripts
Has postinstall/preinstall script — runs arbitrary code on npm install
Remove postinstall/preinstall hooks unless they’re essential.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/clervo-clervo-1urjxf)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check