Back to MCP Trust Indexm8ven
41
/ 100
1 month ago
glama

decide

Deterministic MCP notary suite for subscription policies: refund, cancellation, return, and trial terms. Stateless, read-only rules engine with auditable verdicts and hosted remote endpoints.

→ decidefyi/decide· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
🚨
Secret credentials may flow to a network call
1 flow detected: AXIOM_TOKEN. We can’t prove the destination matches the brand the credential belongs to.
🔐
You'll be asked for 13 credentials: AXIOM_TOKEN, BROWSERLESS_TOKEN, DECIDE_API_KEY, DECIDE_CUSTOMER_API_KEY, DECIDE_PROXY_SHARED_TOKEN, DECIDE_RULEBOOK_RUNTIME_SMOKE_API_KEY, DECIDE_SMOKE_API_KEY, GEMINI_API_KEY, METRICS_ADMIN_TOKEN, POLICY_CHECK_BROWSER_HOOK_TOKEN, POLICY_FETCH_BROWSERLESS_TOKEN, POLICY_FETCH_HOOK_TOKEN, SECRET
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configAXIOM_DATASET
🔐 secretAXIOM_TOKEN
🔐 secretBROWSERLESS_TOKEN
🔐 secretDECIDE_API_KEY— /api/decide is public by default, and can be protected by setting in server env vars.
🔐 secretDECIDE_CUSTOMER_API_KEY
configDECIDE_GEMINI_MODEL_LADDER
🔐 secretDECIDE_PROXY_SHARED_TOKEN— shared secret required in x-decide-proxy-token header for trusted proxy calls.
configDECIDE_RULEBOOK_ATTESTATION_KEY_HISTORY_JSON— verification keys with so older
configDECIDE_RULEBOOK_ATTESTATION_KEY_ID
configDECIDE_RULEBOOK_ATTESTATION_PRIVATE_KEY_PEM
configDECIDE_RULEBOOK_ATTESTATION_SIGNATURE_REQUIRED— true in production to fail
🔐 secretDECIDE_RULEBOOK_RUNTIME_SMOKE_API_KEY
configDECIDE_RULEBOOK_RUNTIME_SMOKE_BASE_URL
🔐 secretDECIDE_SMOKE_API_KEY— '<customer-key>' npm run smoke:customer-key
configDECIDE_SMOKE_BASE_URL
🔐 secretGEMINI_API_KEY
configGITHUB_REPOSITORY
configGITHUB_RUN_ATTEMPT
configGITHUB_RUN_ID
configGITHUB_SHA
🔐 secretMETRICS_ADMIN_TOKEN
configPOLICY_ALERTS_ALLOW_FILE_FALLBACK
configPOLICY_ALERTS_BRIDGE_ALLOW_FILE_FALLBACK
configPOLICY_ALERTS_BRIDGE_DELAY_MS
configPOLICY_ALERTS_BRIDGE_EXPECT_DATE
configPOLICY_ALERTS_BRIDGE_EXPECT_RUN_URL
configPOLICY_ALERTS_BRIDGE_EXPECT_SCHEMA_VERSION
configPOLICY_ALERTS_BRIDGE_LIMIT
configPOLICY_ALERTS_BRIDGE_MIN_ALERTS
configPOLICY_ALERTS_BRIDGE_REQUIRE_LIVE_RUN
configPOLICY_ALERTS_BRIDGE_REQUIRE_SUPABASE
configPOLICY_ALERTS_BRIDGE_RETRIES
configPOLICY_ALERTS_BRIDGE_STATE
configPOLICY_ALERTS_BRIDGE_URL
configPOLICY_ALERT_CONTINUITY_LOOKBACK_DAYS
configPOLICY_ALERT_FEED_MAX_ENTRIES
configPOLICY_ALERT_INCLUDE_ZERO_CHANGE
configPOLICY_ALERT_LOW_SIGNAL_LOOKBACK
configPOLICY_ALERT_LOW_SIGNAL_THRESHOLD
configPOLICY_CHECK_ACTUAL_CONFIRM_RUNS
configPOLICY_CHECK_ACTUAL_MIN_GAP_HOURS
configPOLICY_CHECK_ADAPTIVE_WINDOW_ENABLED
configPOLICY_CHECK_BATCH_SIZE
configPOLICY_CHECK_BROWSER_HOOK_ATTEMPTS
🔐 secretPOLICY_CHECK_BROWSER_HOOK_TOKEN— Authorization: Bearer <> or x-hook-token: <token>
configPOLICY_CHECK_BROWSER_HOOK_URL— Secret = deployed endpoint URL (example: https://decide-1.vercel.app/api/policy-fetch-hook)
configPOLICY_CHECK_CANDIDATE_TTL_DAYS
configPOLICY_CHECK_CROSS_RUN_WINDOW_REQUIRED
configPOLICY_CHECK_CROSS_RUN_WINDOW_SIZE
configPOLICY_CHECK_DIRECT_ATTEMPTS
configPOLICY_CHECK_ERROR_DETAIL_LIMIT
configPOLICY_CHECK_ESCALATION_FLIP_THRESHOLD
configPOLICY_CHECK_ESCALATION_PENDING_DAYS
configPOLICY_CHECK_ESCALATION_REQUIRE_RECENT_FLIP
configPOLICY_CHECK_FALLBACK_ATTEMPTS
configPOLICY_CHECK_FALLBACK_SIGNAL_CONSECUTIVE_RUNS
configPOLICY_CHECK_FETCH_FAILURE_QUARANTINE_STREAK
configPOLICY_CHECK_FETCH_LANES_DEFAULT— Variable = browser_hook,direct,zendesk_api,mirror
configPOLICY_CHECK_FETCH_QUALITY_MIN_CHARS
configPOLICY_CHECK_FETCH_QUALITY_MIN_LINES
configPOLICY_CHECK_FETCH_QUALITY_MIN_POLICY_HITS
configPOLICY_CHECK_HASH_PROFILE
configPOLICY_CHECK_HIGH_SIGNAL_MIN_LINES
configPOLICY_CHECK_HIGH_SIGNAL_MIN_POLICY_HITS
configPOLICY_CHECK_HIGH_SIGNAL_WINDOW_REQUIRED
configPOLICY_CHECK_MATERIAL_COOLDOWN_DAYS
configPOLICY_CHECK_MATERIAL_OSCILLATION_WINDOW_DAYS
configPOLICY_CHECK_NO_CONFIRM_ESCALATION_DAYS
configPOLICY_CHECK_PENDING_DETAIL_LIMIT
configPOLICY_CHECK_PENDING_MODEL
configPOLICY_CHECK_QUALITY_GATE_REJECT_FAILURES
configPOLICY_CHECK_SAME_RUN_MAJORITY_MIN_VOTES
configPOLICY_CHECK_SAME_RUN_RECHECK_BATCH_SIZE
configPOLICY_CHECK_SAME_RUN_RECHECK_DELAY_MS
configPOLICY_CHECK_SAME_RUN_RECHECK_PASSES
configPOLICY_CHECK_STALE_PENDING_DAYS
configPOLICY_CHECK_TIMEOUT_MS
configPOLICY_CHECK_VOLATILE_FLIP_THRESHOLD
configPOLICY_CHECK_VOLATILE_REQUIRE_RECENT_FLIP
configPOLICY_FETCH_ALLOWED_HOSTS— (optional comma-separated host allowlist)
configPOLICY_FETCH_BROWSERLESS_CONTENT_URL— (optional override; default https://chrome.browserless.io/content)
🔐 secretPOLICY_FETCH_BROWSERLESS_TOKEN— (optional; enables browserless render first)
🔐 secretPOLICY_FETCH_HOOK_TOKEN
configPOLICY_SUPABASE_SYNC_ENABLED
configREFUND_BASE
🔐 secretSECRET
configTRACK_ALLOWED_ORIGINS
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 3 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/decidefyi-decide-1mlcep)](https://m8ven.ai/mcp/decidefyi-decide-1mlcep)
commit: b65fb85f86e8f8a9b59f5f630eecf2e92cacc1d1
code hash: 9958b7eb5e3e9a09573762c6f79c8badfdefbb12631f38f2d7de0492f46d30d0
verified: 6/16/2026, 11:35:30 AM
view raw JSON →