Back to MCP Trust Indexm8ven
15
/ 100
1 month ago
glama

unsubly

MCP server with 12 tools enabling AI agents (Claude, ChatGPT) to manage Algorand-based subscriptions, including locking funds in vaults and automated payments.

→ devndesigner6/unsubly· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
🚨
Secret credentials may flow to a network call
30 flows detected: SUPABASE_SERVICE_ROLE_KEY, TELEGRAM_BOT_TOKEN, GOOGLE_API_KEY. We can’t prove the destination matches the brand the credential belongs to.
⚠️
Known vulnerabilities in dependencies: 2 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 17 credentials: AGENT_RUN_SECRET, ALGOD_TOKEN, ANTHROPIC_API_KEY, CEREBRAS_API_KEY, DODO_WEBHOOK_SECRET, GOOGLE_API_KEY, GROQ_API_KEY, MCP_AUTH_TOKEN, OPENAI_API_KEY, OPENCLAW_GATEWAY_TOKEN, OPENROUTER_API_KEY, SUBSCRIPTION_CREDS_KEY, SUPABASE_SERVICE_ROLE_KEY, TELEGRAM_BOT_TOKEN, TELEGRAM_WEBHOOK_SECRET, VITE_SUPABASE_ANON_KEY, VITE_SUPABASE_PUBLISHABLE_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies2 high1 medium1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

highvite@7.3.1GHSA-p9ff-h696-f583

Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket

highvite@7.3.1GHSA-v2wj-q39q-566r

Vite: `server.fs.deny` bypassed with queries

mediumvite@7.3.1GHSA-4w7w-66w2-5vf9

Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling

lowpostcss@8.5.6GHSA-qx2v-qp2m-jg93

PostCSS has XSS via Unescaped </style> in its CSS Stringify Output

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
🔐 secretAGENT_RUN_SECRET
configAGENT_WALLET_MNEMONIC— and VITE_AGENT_WALLET_ADDRESS - generate with the one-liner in .env.example
configALGOD_MAINNET_URL
configALGOD_TESTNET_URL
🔐 secretALGOD_TOKEN
configALGOD_URL
configALGO_NETWORK
🔐 secretANTHROPIC_API_KEY
configAPP_URL
🔐 secretCEREBRAS_API_KEY— from [cloud.cerebras.ai](https://cloud.cerebras.ai) - powers AI Chat page and Telegram bot
configDEPLOY_ALL
🔐 secretDODO_WEBHOOK_SECRET
configFALLBACK_INTERVAL_MS
configFALLBACK_OFFSET_MS
🔐 secretGOOGLE_API_KEY
🔐 secretGROQ_API_KEY
🔐 secretMCP_AUTH_TOKEN
configMCP_DEFAULT_USER_ID
configMCP_TEST_USER_ID
configNANOBOT_INTERVAL_MS
🔐 secretOPENAI_API_KEY— your_model_provider_key
configOPENCLAW_AGENT_ID
configOPENCLAW_CONFIG_PATH
configOPENCLAW_CRON_NAME
configOPENCLAW_ENABLE_TELEGRAM_CHANNEL
configOPENCLAW_GATEWAY_PORT
🔐 secretOPENCLAW_GATEWAY_TOKEN
configOPENCLAW_HEARTBEAT_EVERY
configOPENCLAW_HOME
configOPENCLAW_MODEL— google/gemini-2.0-flash
configOPENCLAW_MONITOR_EVERY
configOPENCLAW_PORT
configOPENCLAW_PRIMARY_MODEL
configOPENCLAW_RAILWAY_URL
configOPENCLAW_STATE_DIR
configOPENCLAW_TELEGRAM_DM_POLICY
🔐 secretOPENROUTER_API_KEY
configPORT
configSEED_DRY_RUN
configSELLER_AGENT_URL
configSERVICE_REGISTRY_APP_ID
configSERVICE_REGISTRY_APP_ID_MAINNET
configSERVICE_REGISTRY_APP_ID_TESTNET
🔐 secretSUBSCRIPTION_CREDS_KEY
🔐 secretSUPABASE_SERVICE_ROLE_KEY— from Supabase, Settings, API (service_role key)
configSUPABASE_URL
🔐 secretTELEGRAM_BOT_TOKEN— your_telegram_bot_token
configTELEGRAM_CHAT_ID— your_telegram_chat_id
🔐 secretTELEGRAM_WEBHOOK_SECRET
configTESTNET_MNEMONIC— "..." node scripts/deploy.js
configTRUST_PROXY_HOPS
configVITE_AGENT_WALLET_ADDRESS— AGENT_WALLET_MNEMONIC and - generate with the one-liner in .env.example
configVITE_ALGOD_MAINNET_URL
configVITE_ALGOD_TESTNET_URL
🔐 secretVITE_SUPABASE_ANON_KEY
🔐 secretVITE_SUPABASE_PUBLISHABLE_KEY— VITE_SUPABASE_URL and from Supabase, Settings, API
configVITE_SUPABASE_URL— and VITE_SUPABASE_PUBLISHABLE_KEY from Supabase, Settings, API
configX402_FACILITATOR_URL
configX402_NETWORK
configX402_PAY_TO_ADDRESS— x402 payment rejected Ensure matches VITE_AGENT_WALLET_ADDRESS or leave both blank to disable x402 in dev
configX402_PRICE_MICROALGOS
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 2 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/devndesigner6-unsubly-mucs04)](https://m8ven.ai/mcp/devndesigner6-unsubly-mucs04)
commit: d6004523166c12aa7e7e6297d780c2ccce5ca842
code hash: af36f06a7ff1b267b3b4955d253039f8f005e33c1bb47c2ee4491486f8cdb763
verified: 6/15/2026, 2:12:55 PM
view raw JSON →