Emerging. No concerning findings. Grades remain capped until the project builds reputation through adoption. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
clockparadox
Source: github_code
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
HA_URL/ HA_TOKEN Home Assistant URL and long-lived tokenHA_TOKENeyJhbGciOi... # Long-lived access tokenOPENCODE_MODEL_NAMEq36 # model name for opencode to useMEM_RETENTION_TIMEDays to retain short-term memory files (default: 3)SKILLS_DIR3. Custom skills directory can be set via environment variableamap_apiAmap (高德) weather API keymail_account/ mail_api QQ email account and SMTP auth codemail_apimail_account / QQ email account and SMTP auth codeMAIN_PORTFastAPI server port (default: 8000)TERMINAL_ALLOWED_DIRFilesystem path sandbox for terminal MCP serverDECIDER_MODEL_NAMEqwen3-235b-a22bASSISTANT_NAMEBot's display name (default: lyric)DECIDER_BASE_URLBase URL for the decision-making model APIDECIDER_API_KEYAPI key for the decider modelSAVE_URLSTATUS_NOTIFYMCP_PORTEMBEDDERQwen3-Embedding:0.6BNEO4J_URIneo4j://your-neo4j-host:7687NEO4J_USERNAME/ NEO4J_PASSWORD Neo4j credentialsNEO4J_PASSWORDyour-passwordMEM_MODEL_NAMEqwen3-235b-a22bMEM_BASE_URL/ MEM_MODEL_NAME Model for memory extractionMEM_API_KEYAPI key for memory modelONEBOT_WS_URLws://127.0.0.1:3001ONEBOT_ACCESS_TOKENyour-tokenCHAT_API_URLThe Telegram bot (telebot.py) long-polls the Telegram API for new messages. Each incoming text or file is forwarded via HTTP POST to the FastAPI server at (default http://127.0.0.1:8000/chat).CHAT_API_TIMEOUTONEBOT_BOT_QQauto-detectedONEBOT_GROUP_ONLY_ATtrue # safety: only reply to @mentions in groupsONEBOT_RATE_LIMIT0.5 # seconds between repliesSTICKER_ENABLEBATCH_TIMEOUTPROACTIVE_TZPROACTIVE_ENABLEPROACTIVE_STARTPROACTIVE_ENDPROACTIVE_MIN_INTERVALPROACTIVE_MAX_INTERVALQQ_BOT_APP_IDQQ_BOT_SECRETyour-app-secretQQ_SANDBOX3. In sandbox mode (=true), add yourself as a tester. Only testers can interact.SEARCH_MODEL_NAMEqwen3-235b-a22bSEARCH_BASE_URL/ SEARCH_MODEL_NAME Model for memory search queriesSEARCH_API_KEYAPI key for search modelADMIN_USERSTELEGRAM_BOT_TOKENTelegram Bot API tokenTELEGRAM_BASE_URLTelegram API URL (default: https://api.telegram.org; use proxy domain for GFW)TELEGRAM_SSL_VERIFY3. SSL verification — can be disabled for proxy servers with self-signed certs (not recommended for production)VOICEPOLLING_TIMEOUT2. Long-polling timeout — (default 30s) prevents long TCP connections from being detectedMODEL_VISIONempty = local Qwen2-VL, true = use API vision modeVISION_MODEL_NAMEVISION_MAX_TOKENSVISION_LOAD_IN_4BITBLOCKER_THRESHOLDTool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
15/15 tools missing one or more hints — call_tool (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); ha_get_device_states (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); ha_control_device (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +12 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tool inputs are validated
8/9 tool handlers declare input schemas (89%)
Declare an inputSchema with zod/joi/yup on every tool definition.
License file
No license file
Add a LICENSE file (MIT, Apache-2.0, etc.).
Tool test coverage
Only 2/15 tools referenced in tests (13%)
Write tests that reference each tool by name so every tool has at least one test.
Shell command execution
1 child_process/subprocess call in production code — runs shell commands (src/back/models/blocker/__init__.py:88)
Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.
Secrets not logged
2 secret values sent to console.log
Redact or omit secret values from log output.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/clockparadox-lyric-1l7xp0)?variant=verified to the badge URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check