2
/ 100
1 month ago
glama
delimit
One workspace for every AI coding assistant. Governance tools for API lint, diff, persistent ledger, multi-model deliberation, security audit, and test verification. Works with Claude Code, Codex, Cursor, and Gemini CLI.
Is this your MCP?
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
// key findings
🚨
Reads files from sensitive locations
Touches: GOOGLE_APPLICATION_CREDENTIALS
⚠️
Tool descriptions don’t match what handlers do
3 tools describe read intent but their handlers mutate — delimit_diagnose (line 7297: target.unlink()); delimit_models (line 8948: MODELS_CONFIG.write_text(_json.dumps(config, indent=2))); delimit_vendor_news_health (line 11397: proc = subprocess.run()
⚠️
Known vulnerabilities in dependencies: 3 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 12 credentials: ANTHROPIC_API_KEY, DELIMIT_AUTH_TOKEN, OPENAI_API_KEY, RAPIDAPI_KEY, XAI_API_KEY, DELIMIT_INTERNAL_BRIDGE_TOKEN, SNYK_TOKEN, DELIMIT_SMTP_PASS, DELIMIT_TELEGRAM_BOT_TOKEN, DELIMIT_REDDIT_PROXY_TOKEN, CHATOPS_AUTH_TOKEN, SUPABASE_SERVICE_ROLE_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies3 high4 low
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments
express vulnerable to XSS via response.redirect()
Express.js Open Redirect in malformed URLs
Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from
process.env. You'll be asked to provide them before it can run.🔐 secret
ANTHROPIC_API_KEYconfig
CLAUDE_TOOL_EXIT_CODEconfig
CLAUDE_TOOL_NAMEconfig
CLAUDE_TOOL_PARAMSconfig
CLAUDE_TOOL_RESULTconfig
DELIMIT_AGENT_PORTconfig
DELIMIT_API_FALLBACK🔐 secret
DELIMIT_AUTH_TOKENconfig
DELIMIT_CONTINUITY_ROOTconfig
DELIMIT_DEBUGconfig
DELIMIT_DEBUG_CONTINUITYconfig
DELIMIT_GATEWAY_ROOTconfig
DELIMIT_HANDOFF_IDconfig
DELIMIT_HOMEconfig
DELIMIT_MODELconfig
DELIMIT_NAMESPACE_ROOTconfig
DELIMIT_NO_TELEMETRYconfig
DELIMIT_ORG_POLICY_URLconfig
DELIMIT_REPO_BASEconfig
DELIMIT_REPO_GOVERNANCE_ROOTconfig
DELIMIT_RESOLVED_ACTORconfig
DELIMIT_RESOLVED_VENTUREconfig
DELIMIT_SCOPEconfig
DELIMIT_SESSION_TYPEconfig
DELIMIT_SETUP_UPDATEDconfig
DELIMIT_VENTUREconfig
DELIMIT_WORKER_RUN_IDconfig
DELIMIT_WORKER_STARTED_ATconfig
GCLOUD_PROJECTconfig
GITHUB_ACTIONSconfig
GITHUB_ACTORconfig
GITHUB_USERconfig
GITLAB_CIconfig
GOOGLE_APPLICATION_CREDENTIALSconfig
GOOGLE_CLOUD_PROJECTconfig
JENKINS_URLconfig
NO_COLOR🔐 secret
OPENAI_API_KEY🔐 secret
RAPIDAPI_KEYconfig
TRAVIS🔐 secret
XAI_API_KEYconfig
CLAUDE_CODEconfig
CODEX_CLIconfig
DELIMIT_CHANGELOG_REDACT_PATTERNS🔐 secret
DELIMIT_INTERNAL_BRIDGE_TOKENconfig
DELIMIT_DEPLOYS_DIR🔐 secret
SNYK_TOKENconfig
TRIVY_PATHconfig
PROMETHEUS_URLconfig
ELASTICSEARCH_URLconfig
DELIMIT_LEDGER_DIRconfig
DELIMIT_ATTESTATIONS_DIRconfig
DELIMIT_GROUNDING_OUTconfig
DELIMIT_CLI_BINconfig
DELIMIT_MULTI_USERconfig
GOOGLE_CLOUD_LOCATIONconfig
DELIMIT_QUIETconfig
DELIMIT_DIGEST_EMAILconfig
DELIMIT_SMTP_TOconfig
DELIMIT_INTERNAL_USERSconfig
INTERNAL_PYTEST_GUARDconfig
DELIMIT_ALLOWED_REPOSconfig
DELIMIT_GIT_IDENTITIESconfig
DELIMIT_HEARTBEAT_DIR🔐 secret
DELIMIT_SMTP_PASSconfig
DELIMIT_ENABLE_GH_AUTOPOSTconfig
DELIMIT_GH_AUTOPOST_DAILY_CAPconfig
DELIMIT_LED193_PER_ITEM_USDconfig
DELIMIT_LED193_DAILY_USDconfig
DELIMIT_LED193_DAEMON_DISABLEDconfig
DELIMIT_P0_SOFT_QUOTAconfig
CODEX_MODELconfig
GEMINI_MODELconfig
MCP_CLIENT_NAMEconfig
_DELIMIT_SIGNAL_PROMOTED_BYconfig
DELIMIT_SIGNAL_GUARDconfig
DELIMIT_LEDGER_STRICT_DONEconfig
DELIMIT_STALE_TTL_DAYSconfig
DELIMIT_LOCAL_PORTconfig
DELIMIT_SOCIAL_JITTER_MAX_SECONDSconfig
DELIMIT_SOCIAL_ITERATION_TIMEOUTconfig
DELIMIT_SOCIAL_STRATEGY_TIMEOUTconfig
DELIMIT_SOCIAL_SCAN_TIMEOUTconfig
DELIMIT_SOCIAL_SCAN_STAGE_TIMEOUTconfig
DELIMIT_SOCIAL_DRAFT_STAGE_TIMEOUTconfig
AUTONOMOUS_BUILDER_MODELconfig
DELIMIT_CYCLE_THINK_TIMEOUTconfig
DELIMIT_CYCLE_STRATEGY_TIMEOUTconfig
DELIMIT_CYCLE_BUILD_TIMEOUTconfig
DELIMIT_CYCLE_EXECUTE_TIMEOUTconfig
DELIMIT_CYCLE_DEPLOY_TIMEOUTconfig
DELIMIT_DEPLOY_MAX_AGE_HOURSconfig
DELIMIT_FORWARD_TOconfig
DELIMIT_IMAP_HOSTconfig
DELIMIT_IMAP_PORTconfig
DELIMIT_IMAP_USERconfig
DELIMIT_OWNER_EMAIL🔐 secret
DELIMIT_TELEGRAM_BOT_TOKENconfig
DELIMIT_TELEGRAM_CHAT_IDconfig
DELIMIT_SMTP_HOSTconfig
DELIMIT_SMTP_PORTconfig
DELIMIT_SMTP_USERconfig
DELIMIT_SMTP_FROMconfig
DELIMIT_ALLOW_TEST_RECIPIENTSconfig
DELIMIT_REDDIT_MAX_AGE_DAYSconfig
DELIMIT_REDDIT_PROXY🔐 secret
DELIMIT_REDDIT_PROXY_TOKENconfig
DELIMIT_SITE_LAYOUTconfig
DELIMIT_SCAN_PROMO_CONFIDENCEconfig
DELIMIT_SELF_REPAIR_OVERRIDE_RATEconfig
DELIMIT_SELF_REPAIR_PAUSEconfig
DELIMIT_SELF_REPAIR_MODEconfig
DELIMIT_SELF_REPAIR_MAX_FAILURESconfig
DELIMIT_SESSION_IDconfig
DELIMIT_TRACE_IDconfig
DELIMIT_USERconfig
DELIMIT_RATE_LIMITS_DISABLEDconfig
DELIMIT_SHOW_EXPERIMENTALconfig
DELIMIT_SHOW_OPSconfig
DELIMIT_SHOW_INTERNAL🔐 secret
CHATOPS_AUTH_TOKENconfig
DELIMIT_HOT_RELOADconfig
DELIMIT_SOCIAL_SCAN_INTERVALconfig
SUPABASE_URL🔐 secret
SUPABASE_SERVICE_ROLE_KEYconfig
DELIMIT_DISABLE_CLOUD_SYNC— Set =1 in your environment to force all sync operations to no-op even if credentials are present. Local files continue to work normally.config
DELIMIT_NTFY_BASE_URLconfig
_NTFY_TS_OVERRIDEconfig
DELIMIT_MCP_PIDconfig
DELIMIT_VENDOR_NEWS_BUDGET// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 12 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[](https://m8ven.ai/mcp/delimit-ai-delimit-mcp-server-evd37t)commit: 4c2c2f63a17ea395c32d785174b32cc78c7b09dd
code hash: 656edd05536133d5dcd27f0efc2310733d9cfab4c1f315eb8442691e1db161ec
verified: 6/16/2026, 12:03:37 PM