Warning. Serious findings were identified. Review the full report before connecting. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
DrJLabs
Source: github_code
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
ANTHROPIC_API_KEYCOHERE_API_KEYGROQ_API_KEYMEM0_API_KEYNEO4J_PASSWORDNEO4J_URLNEO4J_USERNAMEOPENAI_API_KEYPOSTHOG_API_KEYGOOGLE_CLIENT_IDGOOGLE_CLIENT_SECRETOIDC_BASE_URLRSA_PRIVATE_KEY_PATHRSA_PRIVATE_KEY_PEMJWT_KEY_IDGOOGLE_REDIRECT_URIPOSTGRES_HOSTPOSTGRES_PORTPOSTGRES_DBPOSTGRES_USERPOSTGRES_PASSWORDPOSTGRES_COLLECTION_NAMENEO4J_URIMEMGRAPH_URIMEMGRAPH_USERNAMEMEMGRAPH_PASSWORDHISTORY_DB_PATHTESTINGCLIENT_NAMERUN_IDAGENT_IDGPT_API_KEYSSERVICE_VERSIONENVIRONMENTBUILD_TIMEDATABASE_HOSTDATABASE_PORTDATABASE_NAMEDATABASE_USERDATABASE_PASSWORDNEO4J_HOSTNEO4J_PORTNEO4J_AUTHMEM0_DIRAWS_ACCESS_KEY_IDAWS_SECRET_ACCESS_KEYAWS_SESSION_TOKENAWS_REGIONEMBEDDING_AZURE_OPENAI_API_KEYEMBEDDING_AZURE_DEPLOYMENTEMBEDDING_AZURE_ENDPOINTEMBEDDING_AZURE_API_VERSIONGOOGLE_API_KEYOPENAI_API_BASEOPENAI_BASE_URLTOGETHER_API_KEYGOOGLE_APPLICATION_CREDENTIALSLLM_AZURE_OPENAI_API_KEYLLM_AZURE_DEPLOYMENTLLM_AZURE_ENDPOINTLLM_AZURE_API_VERSIONDEEPSEEK_API_KEYDEEPSEEK_API_BASEOPENROUTER_API_KEYOPENROUTER_API_BASESARVAM_API_KEYSARVAM_API_BASEVLLM_API_KEYVLLM_BASE_URLXAI_API_KEYXAI_API_BASEPINECONE_API_KEYUPSTASH_VECTOR_REST_URLUPSTASH_VECTOR_REST_TOKENNEXT_PUBLIC_API_URLNEXT_PUBLIC_USER_IDDATABASE_URLTool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
14/14 tools missing one or more hints — add_memories (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); search_memory (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); list_memories (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +11 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tool test coverage
Only 4/14 tools referenced in tests (29%)
Write tests that reference each tool by name so every tool has at least one test.
Readable source code
1 file appear obfuscated
Ship unminified, readable source.
Secrets not logged
2 secret values sent to console.log
Redact or omit secret values from log output.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/drjlabs-forgetful-1xe3sy)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check