Back to MCP Trust Indexm8ven
52
/ 100
10 days ago
glama

Tic-Tac-Toe MCP Server

Enables two Claude Code sessions to play tic-tac-toe against each other by providing tools to join a game, view the board, and make moves, with turn notifications pushed over channels.

→ devniel/Tic-Tac-Toe-Claude-Code· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
⚠️
Known vulnerabilities in dependencies: 3 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
// known CVEs in dependencies3 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.12.0GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.12.0GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.12.0GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configTTT_PORT— Everything binds to 127.0.0.1 only. Change the port with =9000 pnpm server
configTTT_SERVER— (the channel reads the same TTT_PORT, or set =http://host:port).
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/devniel-tic-tac-toe-claude-code-r549f1)](https://m8ven.ai/mcp/devniel-tic-tac-toe-claude-code-r549f1)
commit: c9f6edbaae965aa8750482a9480965df09223d81
code hash: 7c55119d68c37868ae41bac3c04eea0ba737f4d35fe866cc7e514e23fb15746d
verified: 7/21/2026, 8:35:49 AM
view raw JSON →