5
/ 100
1 month ago
github_topic
CoWork-OS
Local-first personal agentic OS and everything app for coding, knowledge work, web design, automations, and artifacts.
Is this your MCP?
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
// key findings
🚨
Known vulnerabilities in dependencies: 2 critical, 8 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 39 credentials: ADOPTION_STATS_GITHUB_TOKEN, ADOPTION_STATS_SKIP_GH_CLI_TOKEN, ANTHROPIC_API_KEY, APPLE_API_KEY, APPLE_APP_SPECIFIC_PASSWORD, ASANA_ACCESS_TOKEN, COWORK_CONTROL_PLANE_TOKEN, COWORK_HOOKS_TOKEN, COWORK_SECURITY_HARNESS_TARGET_KEY, DISCORD_BOT_TOKEN, FIGMA_ACCESS_TOKEN, GEMINI_API_KEY, GITHUB_TOKEN, GOOGLE_ACCESS_TOKEN, GOOGLE_CLIENT_SECRET, GOOGLE_REFRESH_TOKEN, HUBSPOT_ACCESS_TOKEN, HUBSPOT_CLIENT_SECRET, HUBSPOT_REFRESH_TOKEN, JIRA_ACCESS_TOKEN, JIRA_API_TOKEN, JIRA_CLIENT_SECRET, JIRA_REFRESH_TOKEN, LINEAR_API_KEY, MONDAY_API_TOKEN, NOTION_TOKEN, OKTA_API_TOKEN, OPENAI_API_KEY, OPENROUTER_API_KEY, RESEND_API_KEY, SALESFORCE_ACCESS_TOKEN, SALESFORCE_CLIENT_SECRET, SALESFORCE_REFRESH_TOKEN, SERVICENOW_ACCESS_TOKEN, SERVICENOW_PASSWORD, ZENDESK_ACCESS_TOKEN, ZENDESK_API_TOKEN, ZENDESK_CLIENT_SECRET, ZENDESK_REFRESH_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies2 critical8 high4 medium16 low
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
Baileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payload
When Vitest UI server is listening, arbitrary file can be read and executed
Pretext: Algorithmic Complexity (DoS) in the text analysis phase
Electron: Use-after-free in offscreen child window paint callback
Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks
Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from
process.env. You'll be asked to provide them before it can run.🔐 secret
ADOPTION_STATS_GITHUB_TOKENconfig
ADOPTION_STATS_NPM_PACKAGEconfig
ADOPTION_STATS_REPO_NAMEconfig
ADOPTION_STATS_REPO_OWNERconfig
ADOPTION_STATS_RESET_BASELINE🔐 secret
ADOPTION_STATS_SKIP_GH_CLI_TOKEN🔐 secret
ANTHROPIC_API_KEYconfig
APPLE_API_ISSUER🔐 secret
APPLE_API_KEYconfig
APPLE_API_KEY_BASE64config
APPLE_API_KEY_CONTENTconfig
APPLE_API_KEY_ID🔐 secret
APPLE_APP_SPECIFIC_PASSWORDconfig
APPLE_IDconfig
APPLE_KEYCHAIN_PROFILEconfig
APPLE_TEAM_ID🔐 secret
ASANA_ACCESS_TOKENconfig
ASANA_BASE_URLconfig
BLENDER_MCP_BRIDGE_TIMEOUT_MSconfig
BLENDER_MCP_BRIDGE_URLconfig
BRAVE_PATHconfig
CHROME_PATHconfig
CLANG_MODULE_CACHE_PATHconfig
COMFYUI_BASE_URLconfig
COMFYUI_MCP_TIMEOUT_MSconfig
COMFYUI_WORKFLOW_DIRconfig
CONNECTOR_PREFIXconfig
COWORK_ARCH_PROJECT_ROOTconfig
COWORK_BOOTSTRAP_WORKSPACE_NAMEconfig
COWORK_BOOTSTRAP_WORKSPACE_PATHconfig
COWORK_CLI_CONFIG_DIRconfig
COWORK_CLI_DEBUGconfig
COWORK_CONTROL_PLANE_HOSTconfig
COWORK_CONTROL_PLANE_PORT🔐 secret
COWORK_CONTROL_PLANE_TOKENconfig
COWORK_CONTROL_PLANE_TRUST_PROXYconfig
COWORK_CONTROL_PLANE_URLconfig
COWORK_CRON_STORE_PATHconfig
COWORK_DB_PATHconfig
COWORK_DEV_LOG_CAPTUREconfig
COWORK_DEV_SERVER_PORTconfig
COWORK_EVAL_ALLOW_EMPTYconfig
COWORK_FINANCE_PROVIDERconfig
COWORK_HEADLESSconfig
COWORK_HEALTHKIT_APP_NAMEconfig
COWORK_HEALTHKIT_BUNDLE_IDENTIFIERconfig
COWORK_HEALTHKIT_DEVELOPMENT_TEAMconfig
COWORK_HEALTHKIT_PROVISIONING_PROFILEconfig
COWORK_HEALTHKIT_SIGNING_IDENTITYconfig
COWORK_HEALTHKIT_SWIFTPM_CACHE_DIRconfig
COWORK_HEALTHKIT_SWIFTPM_HOMEconfig
COWORK_HEALTHKIT_USE_XCODE_BUILDconfig
COWORK_HOOKS_ORIGIN🔐 secret
COWORK_HOOKS_TOKENconfig
COWORK_IMPORT_ENV_SETTINGSconfig
COWORK_LOCATION_HELPER_BUNDLE_IDENTIFIERconfig
COWORK_LOCATION_SWIFTPM_CACHE_DIRconfig
COWORK_LOCATION_SWIFTPM_HOMEconfig
COWORK_MAC_UNSIGNEDconfig
COWORK_PERF_ALLOW_EMPTYconfig
COWORK_PROFILEconfig
COWORK_PROFILE_ALLOW_HEADLESSconfig
COWORK_PROFILE_IDconfig
COWORK_QA_WORKSPACE_IDconfig
COWORK_REPO_WORKSPACE_IDconfig
COWORK_SECURITY_CONFIRMED_FIXconfig
COWORK_SECURITY_FIX_IDconfig
COWORK_SECURITY_FIX_SUMMARYconfig
COWORK_SECURITY_HARNESS_BASEconfig
COWORK_SECURITY_HARNESS_FAIL_ON_FINDINGSconfig
COWORK_SECURITY_HARNESS_HEADconfig
COWORK_SECURITY_HARNESS_PROFILE_ID🔐 secret
COWORK_SECURITY_HARNESS_TARGET_KEYconfig
COWORK_SECURITY_HARNESS_WORKSPACE_IDconfig
COWORK_SETUP_JOBSconfig
COWORK_SETUP_NATIVE_ATTEMPTSconfig
COWORK_SETUP_NATIVE_OUTER_ATTEMPTSconfig
COWORK_SETUP_SKIP_X64_FALLBACKconfig
COWORK_SQLITE_BUSY_TIMEOUT_MSconfig
COWORK_TZconfig
COWORK_USER_DATA_DIRconfig
COWORK_WORKSPACE_ROOTconfig
CSC_IDENTITY_AUTO_DISCOVERYconfig
CSC_LINKconfig
CSC_NAMEconfig
DEVELOPMENT_TEAMconfig
DISCORD_APPLICATION_ID🔐 secret
DISCORD_BOT_TOKENconfig
DISCORD_GUILD_IDconfig
DISPLAY🔐 secret
FIGMA_ACCESS_TOKENconfig
FORCE_COLOR🔐 secret
GEMINI_API_KEYconfig
GITHUB_ENVconfig
GITHUB_EVENT_NAMEconfig
GITHUB_EVENT_PATH🔐 secret
GITHUB_TOKEN🔐 secret
GOOGLE_ACCESS_TOKENconfig
GOOGLE_CLIENT_ID🔐 secret
GOOGLE_CLIENT_SECRET🔐 secret
GOOGLE_REFRESH_TOKENconfig
GOOGLE_SCOPESconfig
GOOGLE_WORKSPACE_SCOPESconfig
HEALTHKIT_BRIDGE_BUNDLE_IDENTIFIERconfig
HEALTHKIT_BRIDGE_PROVISIONING_PROFILE🔐 secret
HUBSPOT_ACCESS_TOKENconfig
HUBSPOT_BASE_URLconfig
HUBSPOT_CLIENT_ID🔐 secret
HUBSPOT_CLIENT_SECRET🔐 secret
HUBSPOT_REFRESH_TOKEN🔐 secret
JIRA_ACCESS_TOKEN🔐 secret
JIRA_API_TOKENconfig
JIRA_API_VERSIONconfig
JIRA_BASE_URLconfig
JIRA_CLIENT_ID🔐 secret
JIRA_CLIENT_SECRETconfig
JIRA_EMAIL🔐 secret
JIRA_REFRESH_TOKEN🔐 secret
LINEAR_API_KEYconfig
LINEAR_BASE_URL🔐 secret
MONDAY_API_TOKEN🔐 secret
NOTION_TOKENconfig
NO_COLOR🔐 secret
OKTA_API_TOKENconfig
OKTA_BASE_URL🔐 secret
OPENAI_API_KEY🔐 secret
OPENROUTER_API_KEYconfig
PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATHconfig
PRODUCT_BUNDLE_IDENTIFIERconfig
PUPPETEER_EXECUTABLE_PATH🔐 secret
RESEND_API_KEYconfig
RESEND_BASE_URLconfig
RHINO_MCP_BRIDGE_TIMEOUT_MSconfig
RHINO_MCP_BRIDGE_URLconfig
RUNNER_TEMP🔐 secret
SALESFORCE_ACCESS_TOKENconfig
SALESFORCE_API_VERSIONconfig
SALESFORCE_CLIENT_ID🔐 secret
SALESFORCE_CLIENT_SECRETconfig
SALESFORCE_INSTANCE_URLconfig
SALESFORCE_LOGIN_URL🔐 secret
SALESFORCE_REFRESH_TOKEN🔐 secret
SERVICENOW_ACCESS_TOKENconfig
SERVICENOW_INSTANCEconfig
SERVICENOW_INSTANCE_URL🔐 secret
SERVICENOW_PASSWORDconfig
SERVICENOW_USERNAMEconfig
SKILLS_CHECK_BYPASSconfig
SKILLS_CHECK_PHASEconfig
SKILLS_VALIDATE_ENFORCE_PATHSconfig
SKILLS_VALIDATE_STRICT_WARNINGSconfig
SWIFT_MODULE_CACHE_PATHconfig
TIMELINE_DROP_RATE_MAXconfig
TIMELINE_ORDER_VIOLATION_RATE_MAXconfig
TIMELINE_STEP_STATE_MISMATCH_RATE_MAXconfig
WAYLAND_DISPLAYconfig
XDG_CACHE_HOMEconfig
XDG_CONFIG_HOME🔐 secret
ZENDESK_ACCESS_TOKEN🔐 secret
ZENDESK_API_TOKENconfig
ZENDESK_BASE_URLconfig
ZENDESK_CLIENT_ID🔐 secret
ZENDESK_CLIENT_SECRETconfig
ZENDESK_EMAIL🔐 secret
ZENDESK_REFRESH_TOKENconfig
ZENDESK_SUBDOMAIN// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[](https://m8ven.ai/mcp/cowork-os-cowork-os-1gec73)commit: 6c6d013a9e591c357f34517c55f5bf9885b3cd4e
code hash: 572e1aeee3bac1b1784838f4b2ca2aed2425ba031a6b01b0430536a236f16c8a
verified: 6/14/2026, 11:25:52 AM