Back to MCP Trust Indexm8ven
43
/ 100
1 month ago
npm

duckpond-mcp-server

MCP server for multi-tenant DuckDB management with R2/S3 storage

→ jordanburke/duckpond-mcp-server· npm: duckpond-mcp-server· listed on npm
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

npmGlama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 6 credentials: DUCKPOND_BASIC_AUTH_PASSWORD, DUCKPOND_BEARER_TOKEN, DUCKPOND_JWT_SECRET, DUCKPOND_OAUTH_PASSWORD, DUCKPOND_R2_SECRET_ACCESS_KEY, DUCKPOND_S3_SECRET_ACCESS_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configDUCKPOND_BASIC_AUTH_EMAIL— export =admin@example.com
🔐 secretDUCKPOND_BASIC_AUTH_PASSWORD— export =secret123
configDUCKPOND_BASIC_AUTH_USERNAME— export =admin
configDUCKPOND_BASIC_AUTH_USER_ID— export =admin-user
🔐 secretDUCKPOND_BEARER_TOKEN
configDUCKPOND_BEARER_TOKEN_USER_ID
configDUCKPOND_CACHE_DIR
configDUCKPOND_CACHE_TYPE— Cache type: disk, memory, noop (default: disk)
configDUCKPOND_DATA_DIR— export =/path/to/data
configDUCKPOND_DEFAULT_USER— With set, the UI auto-starts when the server starts. Just open http://localhost:4213 in your browser.
configDUCKPOND_EVICTION_TIMEOUT— Idle timeout in ms (default: 300000)
configDUCKPOND_JWT_EXPIRES_IN— Token expiration in seconds (default: 31536000 = 1 year)
🔐 secretDUCKPOND_JWT_SECRET— Secret for signing JWTs (auto-generated if not set)
configDUCKPOND_MAX_ACTIVE_USERS— LRU cache size (default: 10)
configDUCKPOND_MEMORY_LIMIT— Memory limit (default: 4GB)
configDUCKPOND_OAUTH_EMAIL— export =admin@example.com
configDUCKPOND_OAUTH_ENABLED— export =true
configDUCKPOND_OAUTH_ISSUER
🔐 secretDUCKPOND_OAUTH_PASSWORD— export =secret123
configDUCKPOND_OAUTH_RESOURCE
configDUCKPOND_OAUTH_USERNAME— export =admin
configDUCKPOND_OAUTH_USER_ID— export =admin-user
configDUCKPOND_R2_ACCESS_KEY_ID— "": "your-access-key",
configDUCKPOND_R2_ACCOUNT_ID— "": "your-account-id",
configDUCKPOND_R2_BUCKET— "": "your-bucket"
🔐 secretDUCKPOND_R2_SECRET_ACCESS_KEY— "": "your-secret-key",
configDUCKPOND_S3_ACCESS_KEY_ID— export =your-access-key
configDUCKPOND_S3_BUCKET— export =your-bucket
configDUCKPOND_S3_ENDPOINT— export =http://localhost:9000
configDUCKPOND_S3_REGION— export =us-east-1
🔐 secretDUCKPOND_S3_SECRET_ACCESS_KEY— export =your-secret-key
configDUCKPOND_STRATEGY— Storage strategy: parquet, duckdb, hybrid (default: duckdb)
configDUCKPOND_TEMP_DIR
configDUCKPOND_THREADS— Number of threads (default: 4)
configDUCKPOND_UI_ENABLED— Enable UI (default: false, or use --ui flag)
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 1 concrete improvement we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/duckpond-mcp-server-dk591y)](https://m8ven.ai/mcp/duckpond-mcp-server-dk591y)
commit: 7b010f7c83d7716012e941f9ae8b1cf4eb1ef830
code hash: 84beabab08ae3ef490b80ea964e6f3f06bd76fae17dc5bc1a3945ed73588d3c2
verified: 6/13/2026, 10:11:22 AM
view raw JSON →