ethora-mcp-server (dappros/ethora-mcp-server) is an MCP server listed on the M8ven Trust Index. It scores 52 out of 100, grade D. It declares 100 tools. No publisher has claimed this listing.
Model Context Protocol server for Ethora: login, app & chat management, and wallet tools (ERC-20) for MCP clients (Cursor, VS Code, Claude).
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
dappros
Source: github_repo_search
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
ethora-configureSet the Ethora API URL and credentials for this MCP session. Stores values in memory only; each call merges with omitted fields kept. Alternative to env vars (ETHORA_API_URL / ETHORA_APP_JWT / ETHORA_APP_TOKEN / ETHORA_B2B_TOKEN). On a hosted server `apiUrl` is fixed and cannot be changed; credentia…
ethora-statusReport the current Ethora MCP session state: configured API URL, active auth mode, which credentials are present (booleans like `hasAppJwt` — values never echoed), the selected appId/agentId, and `hosted`/`sessionId` on the hosted (Streamable HTTP) server. Auth: none required. Errors: effectively no…
ethora-helpTask-oriented orientation for this MCP server: explains the three Ethora auth modes (user / app-token / B2B) and recommends next tool calls + recipes based on current session state. Auth: none required — inspects state, no API calls. Errors: effectively none. Related: pass a recommended recipe id to…
ethora-run-recipeExecute a built-in recipe — an ordered sequence of this server's own tool calls — by id. Recipes capture common flows (B2B bootstrap, broadcast, sources ingest). Use `dryRun: true` to preview resolved steps. Omit `recipeId` to list runnable recipes for a `goal`. Requires: the inputs the chosen recip…
ethora-doctorDiagnose the session: validate the config is internally consistent for the active auth mode and ping the Ethora API (`GET /v1/ping`). Returns `{ state, checks, ping, suggestions }`. Auth: none required; report is tailored to whatever credentials are set. Errors: rarely throws — instead returns `sugg…
ethora-auth-use-appSwitch this session's active auth mode to app-token, so subsequent app-scoped calls authenticate with the configured `appToken`. Auth: requires an `appToken` to already be configured (via `ethora-configure`, ETHORA_APP_TOKEN env, or `ethora-app-select`). Errors: returns an error if no `appToken` is …
ethora-auth-use-userSwitch this session's active auth mode to user-session, so subsequent calls authenticate as a logged-in Ethora user. Auth: the switch needs nothing, but user-auth tools only work once `ethora-user-login` stores a user token (login also needs a configured `appJwt`). Errors: none on the switch; downst…
ethora-auth-use-b2bSwitch this session's active auth mode to B2B, so subsequent calls authenticate as a tenant actor via the `x-custom-token` header. Auth: requires a `b2bToken` (JWT with `type=server`) to already be configured (via `ethora-configure` or ETHORA_B2B_TOKEN env). Errors: returns an error if no `b2bToken`…
ethora-app-selectSet the current app context for this session so app-scoped tools can omit their `appId` argument. Stores `currentAppId` and, if given, `appToken` (which defaults the auth mode to app-token unless `authMode` overrides). Auth: none required to set the context. Errors: effectively none — a non-existent…
ethora-agent-selectSet the current saved-agent context for this session, so agent-scoped tools can omit their `agentId` argument. Stores `currentAgentId` in session state. Requires: an agent id or address from `ethora-agents-list-v2` or `ethora-agents-create-v2`. Auth: none required. Errors: effectively none — the `ag…
ethora-chats-broadcast-v2Enqueue an asynchronous broadcast job posting a message to one or more chat rooms of an app — returns a `jobId`; messages are not sent synchronously. Targeting is exclusive: `allRooms`, `chatIds`, or `chatNames`, not a mix. Requires: a selected app with at least one room (`ethora-app-create-chat`). …
ethora-chats-broadcast-job-v2Fetch the current status and per-room results of a broadcast job by `jobId` (one-shot, no polling). Returns the job object with its `state` (pending/running/completed/failed). Requires: a selected app with at least one room (`ethora-app-create-chat`). Auth: app-token mode OR B2B mode with an explici…
ethora-wait-broadcast-job-v2Block until a broadcast job reaches a terminal state (`completed` or `failed`) or until `timeoutMs` — read-only polling wrapper around `ethora-chats-broadcast-job-v2`. Returns `{ done, state, job }`, or `{ done: false, reason: "timeout" }` on timeout. Requires: a `jobId` returned by `ethora-chats-br…
ethora-files-upload-v2Upload 1–5 files to the authenticated user's Ethora file storage (`POST /v2/files`). Each upload is a new record (no overwrite-by-name); files passed as base64, 50MB max each. Auth: user-auth mode with an active user session (`ethora-user-login` first). Errors: 401 not logged in; 413 size limit exce…
ethora-files-get-v2List the authenticated user's files, or fetch one file's metadata by id (`GET /v2/files`). Returns an array when `id` is omitted, a single record when given. Requires: a file id from `ethora-files-upload-v2`. Auth: user-auth mode with an active user session. Errors: 401 not logged in; 404 unknown `i…
ethora-files-delete-v2Permanently delete one of the authenticated user's files by id (`DELETE /v2/files/:id`). Removes the record and its stored content; not reversible. Requires: a file id from `ethora-files-upload-v2`. Auth: user-auth mode with an active user session. Errors: 401 not logged in; 403 not owned by the use…
ethora-sources-docs-uploadUpload documents (1–5; PDF, text, etc.) into an app's RAG sources (legacy user-auth route). Async — content becomes queryable once indexing finishes; files passed as base64, 50MB max each. Requires: a selected app (`ethora-app-select`) or an explicit `appId`. Auth: user-auth mode, active session; th…
ethora-sources-docs-deleteRemove a previously ingested document from an app's RAG sources by `docId` (legacy user-auth route). Deletes the document record and its embeddings; not reversible. Requires: a document id from `ethora-sources-docs-list-v2`. Auth: user-auth mode, active session; the user must own the app. Errors: 40…
ethora-user-loginAuthenticate as an existing Ethora user with email + password. Stores the user session token in this MCP session and unlocks user-auth tools (`ethora-app-list`, `ethora-files-*`, `ethora-wallet-*`). Auth: user-auth mode (`ethora-auth-use-user` first) and a configured `appJwt`. Errors: 401/403 bad cr…
ethora-user-registerCreate a new Ethora user account by email + first/last name, then log in and bind the session. A password is generated when omitted and returned once. By default also mints a long-lived API key so an agent can reconnect later with `Authorization: Bearer <key>` (no human step needed). Auth: user-auth…
ethora-app-credentialsReveal the appToken of an app the caller owns, for a chat-component snippet or a widget config. Every other tool redacts appToken, appSecret and tenantSecret from its results because tool output enters the model's context and client logs; this tool returns exactly { appId, appToken, note } and nothi…
ethora-api-key-createMint a long-lived, revocable API key for the currently logged-in user. The key is a user token: send it as `Authorization: Bearer <key>` to the hosted MCP endpoint (or set it in the stdio client) to skip `ethora-user-login`. Shown once. Auth: user auth (logged in). Errors: 401 not logged in; 404 on …
ethora-api-key-listList the current user's API keys (id, name, createdAt, expiresAt). Token values are never returned. Auth: user auth.
ethora-api-key-revokeRevoke one of the current user's API keys by id. Clients using that key stop working immediately. Requires: a key id from `ethora-api-key-list` or `ethora-api-key-create`. Auth: user auth. Errors: 404 unknown id.
ethora-app-listList all Ethora apps (tenants) owned by the currently logged-in user. Returns an array with `appId` (24-char hex), `displayName`, `domainName`, ownership and bot-status metadata. Credential fields (appSecret, tenantSecret, appToken, passwords) are redacted in the result; call `ethora-app-credentials…
ethora-app-createCreate a new Ethora app (tenant) owned by the currently logged-in user. Allocates a fresh 24-char hex `appId` and sets the caller as owner; counts against the owner's plan limit. Returns the new app object including `appId`. The returned app has its credential fields redacted; call `ethora-app-crede…
ethora-app-deletePermanently delete an Ethora app the caller owns — removes its chat rooms, files, indexed RAG sources, and bot config; end users are immediately signed out. Irreversible; gated behind ETHORA_MCP_ENABLE_DANGEROUS_TOOLS=true. Requires: an `appId` from `ethora-app-list` or `ethora-app-create`. Auth: us…
ethora-app-updateUpdate mutable fields on an app the caller owns (displayName, domainName, appTagline, primaryColor, botStatus). Partial update — omitted fields are left unchanged. Requires: an `appId` from `ethora-app-list` or `ethora-app-create`. Auth: user-auth mode, active session; the caller must own the app. E…
ethora-app-get-default-roomsList the default chat rooms (MUC rooms) of the currently selected Ethora app — every new user auto-joins these. Returns rooms with their JIDs and titles. Auth: user-auth mode, active session; operates against the app set via `ethora-app-select`. Errors: 400 no app currently selected; 401 not logged …
ethora-app-get-default-rooms-with-app-idList the default chat rooms of a specific Ethora app, passed via `appId` (or the currently selected app). Returns rooms with their JIDs and titles. Requires: an `appId` from `ethora-app-list` or `ethora-app-create`. Auth: user-auth mode, active session; the caller needs read access (ownership or roo…
ethora-app-create-chatCreate a new chat room (MUC room) inside an app the caller owns. Every room created this way is listed in the app's rooms (`defaultRooms`); `pinned: true` additionally makes new users auto-join it (existing users are not added), `pinned: false` (default) keeps it opt-in. Returns the new room object …
ethora-app-delete-chatPermanently delete a chat room from an app the caller owns — removes the MUC room, its message archive, and all member affiliations. Irreversible; gated behind ETHORA_MCP_ENABLE_DANGEROUS_TOOLS=true. Requires: a room from `ethora-app-get-default-rooms` or `ethora-app-create-chat`. Auth: user-auth mo…
ethora-wallet-get-balanceRead the authenticated user's on-chain ERC-20 wallet balance(s). Auth: user-auth (log in first). Errors: 401 not logged in; 503 wallet RPC unreachable — retry with backoff.
ethora-wallet-erc20-transferSTDIO ONLY: not available on the hosted server (directory rules forbid connectors that move money or crypto). Send ERC-20 tokens from the authenticated user's wallet to another address — submits a signed on-chain transaction; consumes gas and reduces the sender's balance. Irreversible and NOT idempo…
ethora-b2b-app-createCreate a new Ethora app (tenant) server-side using B2B auth — the partner/integrator equivalent of `ethora-app-create`. Allocates a fresh 24-char hex `appId`; does not create tokens, rooms, or a bot. Returns the new app object including `appId`. Auth: B2B mode (`ethora-auth-use-b2b` + a configured `…
ethora-b2b-bot-enableEnable the LEGACY per-app aiBot (B2B auth). NOTE: apps created via the API/B2B no longer auto-provision a legacy aiBot, so this returns 422 BOT_NOT_INITIALIZED on a clean app. The forward path for B2B AI is the Agents API — use `ethora-b2b-app-bootstrap-ai` or `ethora-agents-create-v2` + `ethora-age…
ethora-bot-get-v2Read the current AI bot configuration for an app: status, trigger, prompt, greeting, LLM provider/model, RAG settings, widget config. Requires: an app with a legacy per-app aiBot (dashboard-created). API-created apps have none: use `ethora-agents-create-v2` -> `ethora-agent-invite-to-chat` -> `ethor…
ethora-bot-update-v2Configure the AI bot for an app — prompt, LLM, trigger, greeting, RAG behavior, identity, and public widget settings. Partial update — omitted fields are left unchanged. `status: "on"` activates the bot (best-effort; needs a prompt + LLM and a backend AI service). Requires: an app with a legacy per-…
ethora-agents-list-v2List the reusable saved agents of an app (`GET /v2/apps/:appId/agents`, or `GET /v2/agents` for the token's own app) — a saved agent is a reusable bot definition. Returns an array of agents with ids, names, and config. Auth: app-token mode (after `ethora-app-select` + `ethora-auth-use-app`). Errors:…
ethora-agents-get-v2Fetch one reusable saved agent's full config by id (`GET /v2/agents/:agentId`) — prompt, LLM, RAG settings, visibility. Also sets this agent as the session's current agent context (no server-side change). Requires: an agent id or address from `ethora-agents-list-v2` or `ethora-agents-create-v2`. Aut…
ethora-agents-create-v2Create a reusable AI agent (POST /v2/apps/:appId/agents). Works in user auth mode (the normal hosted mode) or B2B mode; app-token mode is not accepted by the backend. Each agent is a persona — name, avatar, system prompt, LLM config, plus response-gate settings (responseMode, cooldownSec) that contr…
ethora-agents-update-v2Update a saved AI agent (PUT /v2/agents/:agentId). All fields are optional — only what you pass is updated. Common uses: tune the system `prompt` after a test run, switch `responseMode` to control turn-taking in multi-agent rooms, or adjust `cooldownSec`. See `ethora-agents-quickstart` prompt for th…
ethora-agents-clone-v2Duplicate an existing saved agent into a new agent, optionally overriding its name/slug/summary (`POST /v2/agents/:agentId/clone`). The source agent is unchanged; the new clone becomes the session's current agent context. Requires: an agent id or address from `ethora-agents-list-v2` or `ethora-agent…
ethora-agents-activate-v2Make an agent the app's ACTIVE widget bot: sets `App.defaultBotInstanceId` (and `botStatus: on`), which is what `POST /v2/widget/sessions` uses to decide who answers website visitors. Required before an embedded widget can answer on an API-created app. Preconditions: the agent was invited into a roo…
ethora-agent-set-visibilitySet an Agent's visibility (private | unlisted | public). Public agents can be invited cross-app by anyone who knows the address. Requires: an agent id or address from `ethora-agents-list-v2` or `ethora-agents-create-v2`.
ethora-agent-invite-to-chatInvite an Agent into a chat room. Multiple agents can coexist in the same room — call this tool once per agent and they will all appear as members able to converse. Lazily creates a per-App BotInstance (an Ethora user with isBot:true) if one does not already exist for (agent, app). Spawns the XMPP c…
ethora-agent-soul-appendAppend a fragment to an Agent's SOUL.MD (its evolving identity / private notes). Operator-driven; the Agent itself can also self-edit via the same endpoint when called by ai-service. Requires: an agent id or address from `ethora-agents-list-v2` or `ethora-agents-create-v2`.
ethora-agent-soul-setReplace an Agent's SOUL.MD with the provided markdown. Operator-driven; alternative to -append. Requires: an agent id or address from `ethora-agents-list-v2` or `ethora-agents-create-v2`.
ethora-bot-instances-listList BotInstances. Filter by appId (caller's App by default) and/or agentId. Requires: at least one invited agent in the app (`ethora-agent-invite-to-chat`); otherwise the list is empty.
ethora-bot-instance-statusTurn a specific BotInstance on or off. Off detaches it from XMPP; on re-spawns the XMPP client live. Requires: a bot instance id from `ethora-bot-instances-list` (instances are created by `ethora-agent-invite-to-chat`).
ethora-agents-delete-v2Delete an Agent (DELETE /v2/agents/:idOrAddress). Destructive — removes the saved Agent and its BotInstances. Gated behind ETHORA_MCP_ENABLE_DANGEROUS_TOOLS. Requires: an agent id or address from `ethora-agents-list-v2` or `ethora-agents-create-v2`.
ethora-agents-export-v2Export an Agent as a portable bundle (GET /v2/agents/:idOrAddress/export). format=json returns the bundle object directly; feed it back to `ethora-agents-import-v2` to recreate the Agent in another App/tenant. Requires: an agent id or address from `ethora-agents-list-v2` or `ethora-agents-create-v2`…
ethora-agents-import-v2Import an Agent from a bundle produced by `ethora-agents-export-v2` (POST /v2/agents/import, application/json body IS the bundle). Optionally scope the new Agent to an owning App via ownerAppId. Requires: a bundle produced by `ethora-agents-export-v2` with format json.
ethora-bot-instance-diagDiagnose a specific BotInstance for an Agent (GET /v2/agents/:idOrAddress/bot-instances/:botInstanceId/diag). Returns live XMPP/ai-service status and recent activity for troubleshooting. Requires: a bot instance id from `ethora-bot-instances-list` (instances are created by `ethora-agent-invite-to-ch…
ethora-bot-instance-test-messageSend a test message from a BotInstance (POST /v2/agents/:idOrAddress/bot-instances/:botInstanceId/test-message). Omit roomJid to fan out to every room the BotInstance is in. Requires the ai-service to be running. Requires: a bot instance id from `ethora-bot-instances-list` (instances are created by …
ethora-bot-instance-leave-chatRemove a BotInstance from a chat room (POST /v2/agents/:idOrAddress/bot-instances/:botInstanceId/leave-chat). The inverse of `ethora-agent-invite-to-chat`. Requires: a bot instance id from `ethora-bot-instances-list` (instances are created by `ethora-agent-invite-to-chat`).
ethora-messages-search-v2Search an App's chat messages (GET /v2/apps/:appId/messages/search). B2B / tenant-actor auth. Filter by room (chatId), author (fromUserId), and time window. Requires: a selected app (`ethora-app-select`) or an explicit `appId`.
ethora-messages-context-v2Fetch the messages surrounding a target message (GET /v2/apps/:appId/chats/:chatId/messages/context). Provide either aroundStanzaId or aroundMessageId; radius controls how many messages before/after. Requires: a message id from `ethora-messages-search-v2` or `ethora-chats-history-v2`.
ethora-unread-counts-v2Batch per-room unread message counts for a set of users (POST /v2/apps/:appId/users/unread-counts). mode=count returns numbers (capped); mode=flag returns booleans. Requires Mongo message archiving enabled on the deployment. Requires: a selected app (`ethora-app-select`) or an explicit `appId`.
ethora-app-export-v2Export an App as a portable bundle (GET /v2/apps/:appId/export). format=json returns the bundle object directly. Use `include` to select sections (e.g. 'chats,users,sources,botInstances'). Feed the result to `ethora-app-import-v2`. Requires: a selected app (`ethora-app-select`) or an explicit `appId…
ethora-app-import-v2Import an App from a bundle produced by `ethora-app-export-v2` (POST /v2/apps/import, application/json body IS the bundle). B2B / tenant-actor auth. domainNameOverride renames the imported App's domain. Requires: a bundle produced by `ethora-app-export-v2`.
ethora-bot-enable-v2Enable the LEGACY per-app aiBot using app-token or B2B auth. NOTE: clean API/B2B-created apps have no legacy aiBot, so this returns 422 BOT_NOT_INITIALIZED there — use the Agents API (`ethora-agents-create-v2` + `ethora-agent-invite-to-chat`, or `ethora-b2b-app-bootstrap-ai`) for B2B AI. Valid for a…
ethora-bot-disable-v2Turn the AI bot off for an app (sets bot `status: "off"`) — it stops responding. The configured prompt/LLM/RAG and any activated agent are preserved, so re-enabling restores the same behavior. Requires: an app with a legacy per-app aiBot (dashboard-created). API-created apps have none: use `ethora-a…
ethora-bot-widget-v2LEGACY: read the per-app bot widget config (`GET /v2/bot/widget`); only apps that already have a legacy aiBot have one, API-created apps get 422. For the embeddable AI chat widget use `ethora-widget-embed-snippet` instead — the widget config and public widget URL metadata needed to embed the bot on …
ethora-chats-message-v2Post a message into a chat room of an app (POST /v2/apps/:appId/chats/broadcast targeting one room). The message is attributed to the app's broadcast sender (override the shown name with `senderName`). Use it to seed or test a conversation, e.g. right after `ethora-agent-invite-to-chat`, and set `wa…
ethora-chats-history-v2Read the archived messages of a chat room (GET /v2/apps/:appId/chats/:chatId/messages, newest last). Returns `results` with `from`, `nick`, `body`, `ts` (ms) plus a `nextBefore` cursor for older pages. Identify the room by `roomJid` (`${appId}_${chatId}`) or bare `chatId` plus the selected app. Requ…
ethora-bot-message-v2DEPRECATED alias of `ethora-chats-message-v2` (the old /v2/chats/messages automation route no longer exists). Posts a message into a room by `roomJid` or `chatId`; prefer `ethora-chats-message-v2`, which also supports `waitForReplySec`. Requires: an app with a legacy per-app aiBot (dashboard-created…
ethora-bot-history-v2DEPRECATED alias of `ethora-chats-history-v2` (the old /v2/chats/history automation route no longer exists). Reads a room's archived messages by `roomJid` or `chatId`. Requires: an app with a legacy per-app aiBot (dashboard-created). API-created apps have none: use `ethora-agents-create-v2` -> `etho…
ethora.b2b.auth.useDot-namespaced alias for `ethora-auth-use-b2b` — switches the session's active auth mode to B2B (`x-custom-token`). Behavior is identical. Auth: requires a `b2bToken` to already be configured. Errors: returns an error if no `b2bToken` is configured.
ethora.b2b.app.createDot-namespaced alias for `ethora-b2b-app-create` — create a new Ethora app server-side, allocating a fresh `appId`. Auth: B2B mode (`ethora.b2b.auth.use` / `ethora-auth-use-b2b` + a configured `b2bToken`). Errors: 401/403 not in B2B mode; 422 invalid `displayName`. Related: prefer `ethora-b2b-app-cr…
ethora.b2b.bot.enableDot-namespaced alias for `ethora-b2b-bot-enable` — turn on the AI bot for an app (sets `botStatus: "on"`). The bot only responds if a prompt + LLM are configured and the backend has an AI service. Auth: B2B mode (`ethora.b2b.auth.use` / `ethora-auth-use-b2b` + a configured `b2bToken`). Errors: 401/4…
ethora.b2b.broadcast.waitDot-namespaced sibling of `ethora-wait-broadcast-job-v2` — block until a broadcast job reaches a terminal state (`completed` / `failed`) or `timeoutMs`. Read-only polling. Returns `{ done, state, job }`, or `{ done: false, reason: "timeout" }` on timeout. Auth: app-token mode (despite `b2b` in the n…
ethora.b2b.app.bootstrap-aiDot-namespaced alias for `ethora-b2b-app-bootstrap-ai` — one-call B2B orchestrator: create an app, index RAG sources, then configure and enable its AI bot. Source ingest and bot activation are best-effort (the app is still created if a later step fails). Returns a per-step log including the new `app…
ethora-b2b-app-bootstrap-aiOne-call B2B orchestrator: create an app, set it as the current context, index RAG sources, then configure and enable its AI bot. Source ingest and bot activation are best-effort (the app is still created if a later step fails); crawl/embedding continues asynchronously after this returns. Returns a …
ethora-generate-chat-component-app-tsxGenerate a ready-to-paste React `App.tsx` snippet that mounts `@ethora/chat-component`. Returns `{ filename: "App.tsx", snippet }`; unpassed values are emitted as placeholders. Does not write any file. Get the appToken from `ethora-app-credentials { appId, confirm: true }` (other tools redact it). A…
ethora-generate-env-examplesGenerate `.env.example` templates for the three common Ethora integration targets: the frontend chat component, the backend SDK, and this MCP server. Returns `{ target, template }` when `target` is given, or `{ templates }` with all three. Placeholder values only; does not write any file. Auth: none…
ethora-generate-b2b-bootstrap-runbookGenerate a human-readable runbook listing this server's tool calls in the right order for a B2B bootstrap, with example payloads. Documentation only — does not write any file or execute any step. Auth: none required — pure text generator, no API calls. Errors: effectively none. Related: to actually …
ethora-sources-site-crawl-v2Crawl a website URL and ingest its content into an app's RAG sources (app-token / B2B variant of `ethora-sources-site-crawl`). Async — returns once the job is accepted; `followLink: true` follows in-domain links and can ingest many pages. Requires: a selected app (`ethora-app-select`) or an explicit…
ethora-sources-site-reindex-v2Re-crawl and re-embed a previously crawled URL by its `urlId`, refreshing its RAG content (app-token / B2B variant of `ethora-sources-site-reindex`). Async — the existing source record is updated in place once indexing finishes. Requires: an indexed site URL from `ethora-sources-site-list-v2` (crawl…
ethora-sources-site-crawl-v2-waitCrawl a website URL and wait for the crawl to finish: enqueues the job, then polls it until it reports `completed` or `failed`. Returns `{ done, status, jobId, polls, durationMs, result }`; `done: false` with a `note` means the budget ran out while the job was still running (it usually finishes serv…
ethora-sources-site-reindex-v2-waitRe-crawl and re-embed a previously crawled URL and wait for it to finish: enqueues the job, then polls it until it reports `completed` or `failed`. Returns `{ done, status, jobId, polls, durationMs, result }`; `done: false` with a `note` means the budget ran out while the job was still running. Requ…
ethora-sources-site-list-v2List an app's crawled website sources, including each source's id, URL, and current RAG tags. Their ids feed `ethora-sources-site-tags-update-v2`, `ethora-sources-site-delete-url-v2-batch`, and `ethora-sources-site-reindex-v2`. Requires: a selected app (`ethora-app-select`) or an explicit `appId`. A…
ethora-sources-site-tags-update-v2Set the RAG retrieval tags on a crawled website source — replaces the source's tag set with the provided `tags` array (not additive; pass `[]` to clear all). Tags let the bot's `ragTags` narrow retrieval. Requires: an indexed site URL from `ethora-sources-site-list-v2` (crawled with `ethora-sources-…
ethora-users-batch-create-v2Provision many Ethora users (1–100) in one asynchronous batch job — the bulk equivalent of `ethora-user-register`. Enqueues a background job (HTTP 202); the job reports per-user conflicts rather than failing the whole batch. Returns `{ jobId, statusUrl }`. Auth: B2B mode (`ethora-auth-use-b2b` + a c…
ethora-users-batch-job-v2Fetch the current status and per-user results of a users batch job by `jobId` (one-shot, no polling). Returns the job object with its `state` (pending/running/completed/failed) and per-user outcomes. Requires: a `jobId` returned by `ethora-users-batch-create-v2`. Auth: B2B mode (`ethora-auth-use-b2b…
ethora-wait-users-batch-job-v2Block until a users batch job reaches a terminal state (`completed` or `failed`) or `timeoutMs` — read-only polling wrapper around `ethora-users-batch-job-v2`. Returns `{ done, state, job }`, or `{ done: false, reason: "timeout" }` on timeout. Requires: a `jobId` returned by `ethora-users-batch-crea…
ethora-app-tokens-list-v2List the app tokens issued for an app — metadata only (`tokenId`, label, created/rotated timestamps, status); the secret token values are never returned (only shown once at create/rotate time). Auth: B2B mode (`ethora-auth-use-b2b` + a configured `b2bToken`). Errors: 401/403 not in B2B mode; 400 no …
ethora-app-tokens-create-v2Mint a new app token for an app. The secret token value is returned exactly once and cannot be retrieved again — capture it immediately. Returns the new token including its one-time secret value and `tokenId`. Auth: B2B mode (`ethora-auth-use-b2b` + a configured `b2bToken`). Errors: 401/403 not in B…
ethora-app-tokens-rotate-v2Rotate an app token: revoke an existing token and issue a replacement in one step. The old `tokenId` is revoked immediately — anything using it stops working at once. The new secret value is returned exactly once — capture it immediately. Requires: a token id from `ethora-app-tokens-list-v2`. Auth: …
ethora-app-tokens-revoke-v2Permanently revoke an app token by `tokenId` — it stops working immediately; any client, SDK, or MCP session still using it gets auth failures. No replacement is issued. Requires: a token id from `ethora-app-tokens-list-v2`. Auth: B2B mode (`ethora-auth-use-b2b` + a configured `b2bToken`). Errors: 4…
ethora-b2b-app-provisionOne-call B2B orchestrator: create an app, mint one or more app tokens, provision default chat rooms, then configure and enable its AI bot. Later-step failures don't undo earlier steps. Returns a per-step log including `appId` and the created tokens (returned once — capture them). Auth: B2B mode (`et…
ethora-sources-site-delete-url-v2Remove a single crawled URL from an app's RAG sources, matched by its exact url string (app-token / B2B variant of `ethora-sources-site-delete-url`). Deletes the source record and its embeddings; not reversible. Matches on the exact stored URL string. Requires: an indexed site URL from `ethora-sourc…
ethora-sources-site-delete-url-v2-batchBulk-remove crawled website sources (1–100) from an app in one call, matched by their source record ids. Deletes each matching record and its embeddings; not reversible. Ids not present are skipped. Requires: an indexed site URL from `ethora-sources-site-list-v2` (crawled with `ethora-sources-site-c…
ethora-sources-docs-upload-v2Upload documents (1–5; PDF, text, etc.) into an app's RAG sources (app-token / B2B variant of `ethora-sources-docs-upload`). Async — content becomes queryable once indexing finishes; files passed as base64, 50MB max each. Requires: a selected app (`ethora-app-select`) or an explicit `appId`. Auth: a…
ethora-sources-docs-delete-v2Remove a previously ingested document from an app's RAG sources by `docId` (app-token / B2B variant of `ethora-sources-docs-delete`). Deletes the document record and its embeddings; not reversible. Requires: a document id from `ethora-sources-docs-list-v2`. Auth: app-token mode OR B2B mode with an e…
ethora-sources-docs-list-v2List an app's ingested documents, including each document's id, name, and current RAG tags. Their ids feed `ethora-sources-docs-tags-update-v2` and `ethora-sources-docs-delete-v2`. Requires: a selected app (`ethora-app-select`) or an explicit `appId`. Auth: app-token mode OR B2B mode with an explici…
ethora-sources-docs-tags-update-v2Set the RAG retrieval tags on an ingested document — replaces the document's tag set with the provided `tags` array (not additive; pass `[]` to clear all). Tags let the bot's `ragTags` narrow retrieval. Requires: a document id from `ethora-sources-docs-list-v2`. Auth: app-token mode OR B2B mode with…
ethora-widget-embed-snippetGenerate the <script> tag that embeds the Ethora AI chat widget (the floating launcher + chat panel that website visitors use) for an app, plus the prerequisites that must hold before it answers. No API call; pure generator using this deployment's hosted widget URL and public API base. The widget an…
searchSearch the Ethora documentation and tool reference: auth model (app JWT vs app token vs B2B token vs API keys), hosted-server getting started, chat-component and backend SDK quickstarts, recipes, and a reference entry for every tool with its inputs. Use it for any "how do I ..." question about Ethor…
fetchFetch the full text of a documentation section or tool reference entry by the id returned from `search` (e.g. `tool:ethora-app-create`, `doc:auth-map#app-jwt`, `doc:hosted-guide`). Auth: none required. Errors: unknown id.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
ETHORA_API_URLFull API URL, e.g. https://api.chat.ethora.com/v1 (default). On a hosted server it is fixed for all sessionsETHORA_APP_DOMAIN_NAMEBase app domainName; when ETHORA_APP_JWT is empty the server fetches the app JWT from GET /v1/apps/get-config?domainName=... at startupETHORA_APP_JWTLocal CLIETHORA_APP_TOKENApp JWT used only by login and register (ETHORA_APP_TOKEN is a legacy alias)ETHORA_B2B_TOKENLocal CLIETHORA_BASE_URLHost-only alternative to ETHORA_API_URL; /v1 is appendedETHORA_MCP_AUTH_ISSUERSet to the public URL of the Ethora API that hosts the authorization server (the monoserver deploy sets it). The MCP server then:ETHORA_MCP_ENABLE_ALIASESAlias tools (ethora.b2b., ethora-bot-message-v2, ethora-bot-history-v2) are off by default (=true to expose them); the canonical tools cover the same ground.ETHORA_MCP_ENABLE_DANGEROUS_TOOLStrue registers app deletion, wallet transfer and bulk-delete tools (default off)ETHORA_MCP_HTTP_HOSTBind address, default 127.0.0.1:3030; put nginx in frontETHORA_MCP_OPENAI_APPS_CHALLENGEHosted only. Token issued by the OpenAI apps portal for domain verification; served verbatim at /.well-known/openai-apps-challenge (404 when unset)ETHORA_MCP_PUBLIC_API_URLPublic API base browsers can reach, emitted as data-api-base; falls back to ETHORA_MCP_AUTH_ISSUER, then a non-loopback ETHORA_API_URLETHORA_MCP_PUBLIC_URLPublic base URL advertised in discovery and used for connectorUrl, e.g. https://mcp.chat.ethora.com/mcpETHORA_MCP_TEST_FORCE_SCOPEETHORA_MCP_TRANSPORTThe hosted and self-hosted modes are the same server started with =http. Every MCP session has private in-memory state: one client's login, selected app or tokens are never visible to another session.ETHORA_MCP_WIDGET_URLBase URL of the hosted AI chat widget (<url>/assistant.js) for ethora-widget-embed-snippetAll four hints declared on every tool
26/100 tools missing one or more hints — ethora-status (missing: destructiveHint, idempotentHint); ethora-help (missing: destructiveHint, idempotentHint); ethora-doctor (missing: destructiveHint, idempotentHint), +23 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tool inputs are validated
90/100 tool handlers declare input schemas (90%)
Declare an inputSchema with zod/joi/yup on every tool definition.
Tool test coverage
Only 6/100 tools referenced in tests (6%)
Write tests that reference each tool by name so every tool has at least one test.
Production dependencies are patched
0 critical, 15 high severity in production deps — @modelcontextprotocol/sdk@1.17.1 (high), @modelcontextprotocol/sdk@1.17.1 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Domain consistency
npm scope @ethora doesn't match GitHub owner dappros
Use the same org name across GitHub, npm, and your homepage so users can verify the publisher.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/dappros/ethora-mcp-server)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check