0
/ 100
1 month ago
glama
mcp-app
Framework for building and running MCP servers as HTTP services. Define tools as pure Python functions, wire up with two lines, run with one command.
Is this your MCP?
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
// key findings
🚨
Reads files from sensitive locations
Touches: ~/.config
🔐
You'll be asked for 2 credentials: SIGNING_KEY, MCP_APP_SIGNING_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// required environment variables
This server reads these from
process.env. You'll be asked to provide them before it can run.config
TOKEN_DURATION_SECONDS— No 315360000 (~10yr) Token lifetime in seconds🔐 secret
SIGNING_KEY— URL signed with , the agent fetches it with a plainconfig
JWT_AUD— No Audience not validated Expected JWT aud claimconfig
REQUIRED_FS_TYPE— assertion.config
XDG_CONFIG_HOMEconfig
MCP_APP_URL🔐 secret
MCP_APP_SIGNING_KEYconfig
APP_USERS_PATH— ~/.local/share/{name}/users/. Override withconfig
XDG_DATA_HOME— 2. ${}/{app-name}/users/, with XDG_DATA_HOME// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[](https://m8ven.ai/mcp/echomodel-mcp-app-bwxixa)commit: b354d870025be029633c4765c6c265e67d31fa63
code hash: 42eceed28be15a0d83201776760b5d38b216158717b58ef9db83f4057f6920ea
verified: 6/22/2026, 12:39:37 PM