Back to MCP Trust Indexm8ven
C
Emerging
74/100
1 day ago

enterprise-mcp

An MCP server exposing scoped, read-only enterprise operations tools with fail-closed credential handling. It returns opaque approval IDs for mutations and requires a separate operator approval command to release one-time capabilities.

→ dbett4/hermes-enterprise-deployment-lab· listed on glama

Emerging. No concerning findings. Grades remain capped until the project builds reputation through adoption. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

dbett4

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 2 credentials: ENTERPRISE_API_TOKEN, ENTERPRISE_API_WRITE_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configDEFAULT_INCIDENT_ID
configENTERPRISE_API_URL
🔐 secretENTERPRISE_API_TOKENRead scope. Required — there is no default; the server exits 2 without it
configWORKFLOW_TIMEOUT_SECONDS
configWORKFLOW_RECEIPT_PATH
configOTEL_EXPORTER_OTLP_TRACES_ENDPOINTOTEL_EXPORTER_OTLP_ENDPOINT / Loopback OTLP/HTTP collector. Non-loopback endpoints are ignored
configOTEL_EXPORTER_OTLP_ENDPOINT/ OTEL_EXPORTER_OTLP_TRACES_ENDPOINT Loopback OTLP/HTTP collector. Non-loopback endpoints are ignored
configOTEL_TRACES_EXPORTEROpt-in tracing. Must be otlp together with a loopback OTLP endpoint or tracing stays off
configENTERPRISE_MCP_ENABLED_TOOLSTool allowlist. Unset = read/plan only; all = also expose apply_incident_plan
🔐 secretENTERPRISE_API_WRITE_TOKENWrite scope. Absent means the server cannot mutate
configENTERPRISE_API_TIMEOUT_SECONDS
configENTERPRISE_INJECT_FAILUREerror_after_commit, enterprise-api/app/main.py writes the
configDEMO_ACTION_ID
configAUDIT_LOG_PATH/ APPROVAL_STORE_PATH Where the audit trail and approval store live
configAPPROVAL_STORE_PATHis an unauthenticated JSON file. It stores only a SHA-256
configDEMO_RECEIPT_PATH
configAPPROVAL_TTL_SECONDSLifetime of a pending/approved request; default 900 seconds
configAUDIT_RUN_ID
// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/dbett4-hermes-enterprise-deployment-lab-1s7z6w)](https://m8ven.ai/mcp/dbett4-hermes-enterprise-deployment-lab-1s7z6w)
Shows your grade and updates automatically. Prefer no grade? Append ?variant=verified to the badge URL.
commit: c7de7a08aaa79d401ca915c29eee36ffcdf00992
code hash: 8ec74d0a3bbb115a2d91cb74de4d2cf9e76748fcfc4ad3dcd8444c5dff496c88
verified: 8/19/2026, 3:28:17 AM
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client