/ 100

1 month ago

glama

CRMy

Item: CRMy
Rating: 2
Author: M8ven

Provides AI agents with operational customer context, including typed revenue objects, persistent state, scoped tools, and human-in-the-loop handoffs through MCP, REST, and CLI.

→ crmy-ai/crmy · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

🚨

Secret credentials may flow to a network call

1 flow detected: SEED_PASSWORD. We can’t prove the destination matches the brand the credential belongs to.

🚨

Code appears obfuscated

29 files are unreadable to a human reviewer. Cannot audit what they do.

🔐

You'll be asked for 9 credentials: AGENT_ENCRYPTION_KEY, ANTHROPIC_API_KEY, CRMY_ADMIN_PASSWORD, CRMY_AGENT_API_KEY, CRMY_API_KEY, CRMY_ENCRYPTION_KEY, EMBEDDING_API_KEY, JWT_SECRET, SEED_PASSWORD

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

🔐 secretAGENT_ENCRYPTION_KEY

configAGENT_READINESS_TIMEOUT_MS

configAGENT_READINESS_TTL_MS

configAGENT_STREAM_TIMEOUT_MS— Optional Streaming Workspace Agent provider timeout. Default: 60000.

configAGENT_TURN_HEARTBEAT_MS

configAGENT_TURN_LEASE_MS

configAGENT_TURN_STALE_MINUTES

🔐 secretANTHROPIC_API_KEY

configAPI_BASE

configCONTEXT_EXTRACTION_LLM_TIMEOUT_MS— Optional Raw Context extraction timeout. Default: 90000.

configCONTEXT_EXTRACTION_RECOVERY_TIMEOUT_MS

configCONTEXT_EXTRACTION_REPAIR_TIMEOUT_MS

configCRMY_ADMIN_EMAIL— export =admin@example.com

configCRMY_ADMIN_NAME

🔐 secretCRMY_ADMIN_PASSWORD— export ="$(openssl rand -base64 24)"

🔐 secretCRMY_AGENT_API_KEY— export =sk-... # not required for Ollama

configCRMY_AGENT_BASE_URL— export =https://api.openai.com/v1

configCRMY_AGENT_ENABLED

configCRMY_AGENT_MODEL— export =gpt-5.2

configCRMY_AGENT_PROVIDER— export =openai # also supports azure_openai, google_gemini, aws_bedrock, mistral, litellm, databricks, nvidia_nim

configCRMY_AGENT_WORKER_ID

🔐 secretCRMY_API_KEY

configCRMY_CLI_HTTP_TIMEOUT_MS

🔐 secretCRMY_ENCRYPTION_KEY

configCRMY_IMPORTED

configCRMY_INTEGRATION_DATABASE_SOURCE

configCRMY_INTEGRATION_DATABASE_URL

configCRMY_SERVER_URL

configDATABASE_URL— export =postgresql://postgres:postgres@localhost:5432/crmy

🔐 secretEMBEDDING_API_KEY— Optional Embedding provider API key.

configEMBEDDING_BASE_URL

configEMBEDDING_DIMENSIONS

configEMBEDDING_FETCH_TIMEOUT_MS

configEMBEDDING_MODEL— text-embedding-3-small

configEMBEDDING_PROVIDER— Optional Embedding provider for semantic retrieval.

configENABLE_PGVECTOR— true crmy migrate run

🔐 secretJWT_SECRET— Server process JWT signing secret. crmy init generates this for local CLI-managed installs; set it explicitly for production, containers, or direct npm run dev/server processes.

configLLM_MAX_TRANSIENT_RETRIES

configLLM_TIMEOUT_MS— Optional General Workspace Agent and background LLM timeout. Default: 60000.

configLLM_TRANSIENT_RETRY_DELAY_MS

configPORT

configSEED_EMAIL

🔐 secretSEED_PASSWORD

configTEST_DATABASE_URL

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/crmy-ai-crmy-5sfvqy)](https://m8ven.ai/mcp/crmy-ai-crmy-5sfvqy)

commit: 3425203becd6b36048914958ab218a75d6560a12

code hash: 5765855a8e9b945c7e996ae49c9d7029b9820426f07ad199094c7d599aeccad3

verified: 6/10/2026, 11:02:57 AM

view raw JSON →