mc-rp-assistant-mcp (dcd887/mc-rp-assistant-mcp) is an MCP server listed on the M8ven Trust Index. It scores 89 out of 100, grade B. It declares 9 tools. The publisher has proved control of what we score (Verified Publisher). It is connected through the M8ven GitHub App, so the listing is re-checked on every push.

Back to MCP Trust IndexM8ven
B
Caution
89/100
3 days ago

mc-rp-assistant-mcp

Enables reading, validating, and managing Minecraft resource packs, including structure checks, asset listing, pack comparison, and Modrinth queries.

→ dcd887/mc-rp-assistant-mcp· listed on glama

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored

Monitored 4 days · every push re-verified

Who stands behind it

qq.com (@dcd887) · Verified Publisher

Source: Glama

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
⚠️
Known vulnerabilities in dependencies: 1 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
Are you the publisher? Confirm or correct these findings.
// known CVEs in dependencies1 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

highadm-zip@0.5.18GHSA-xcpc-8h2w-3j85

adm-zip: Crafted ZIP file triggers 4GB memory allocation

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configRP_ASSISTANT_DEFAULT_SEARCH_LIMITModrinth 资源包搜索默认返回条数
configRP_ASSISTANT_MAX_SEARCH_RESULTSModrinth 搜索返回条数硬上限
configRP_ASSISTANT_MODRINTH_API_BASEModrinth API 根地址，支持自建网关/代理
configRP_ASSISTANT_PACK_ICON_MAX_KB资源包图标 pack.png 大小上限（KB）
configRP_ASSISTANT_TEXTURE_MAX_MB单张纹理大小上限（MB），超过则标记为大纹理
configRP_ASSISTANT_USER_AGENT请求 User-Agent（Modrinth 要求标明来源）
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

9/9 tools missing one or more hints — read_packmeta (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); validate_rp_structure (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); list_rp_assets (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +6 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool test coverage

Only 0/9 tools referenced in tests (0%)

Write tests that reference each tool by name so every tool has at least one test.

Production dependencies are patched

0 critical, 1 high severity in production deps — adm-zip@0.5.18 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/dcd887/mc-rp-assistant-mcp?variant=verified)](https://m8ven.ai/mcp/dcd887/mc-rp-assistant-mcp)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 4bb84e12dfef3e371b79868de44a5276582a7785
code hash: 54e3aa406b68d616ec914622c5bcd773a18b6de8fca25a194f4b395428b826da
verified: 9/7/2026, 4:57:53 AM
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client