Back to MCP Trust Indexm8ven
74
/ 100
3 days ago
glama

EVIDIQ Rubric MCP

Determines whether a deliverable meets its contract using deterministic rules, criteria, and signed attestations.

→ evidiq/evidiq-rubric-mcp· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 5 credentials: OG_PRIVATE_KEY, OKX_API_KEY, OKX_SECRET_KEY, RUBRIC_SIGNER_PRIVATE_KEY, X402_SETTLE_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies1 medium

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

mediumajv@8.17.1GHSA-2g4f-4pwh-qvx6

ajv has ReDoS when using `$data` option

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configHOSTNAME
configOG_CHAIN_ID
🔐 secretOG_PRIVATE_KEY— The 0G anchor key is , used to anchor digests only, never
🔐 secretOKX_API_KEY— The OKX SDK credentials (/SECRET_KEY/PASSPHRASE) are the
configOKX_BASE_URL
configOKX_PASSPHRASE— PORT=3100 OKX_API_KEY=… OKX_SECRET_KEY=… =… \
🔐 secretOKX_SECRET_KEY— PORT=3100 OKX_API_KEY=… =… OKX_PASSPHRASE=… \
configOKX_SYNC_SETTLE
configPORT— 3100 npm start
configPUBLIC_BASE_URL— the prefix, so the x402 challenge advertises /mcp, never
configRUBRIC_ARTIFACT_TTL_MS— Artifact TTL (ms) 600000
configRUBRIC_MAX_CRITERIA— Maximum criteria 100
configRUBRIC_MAX_INPUT_BYTES— Maximum input bytes 524288
configRUBRIC_MAX_SOURCES— Maximum sources 20
🔐 secretRUBRIC_SIGNER_PRIVATE_KEY— The signer key is read from and is the ONLY
configX402_ASSET
configX402_CHAIN
configX402_DOMAIN_NAME
configX402_DOMAIN_VERSION
configX402_FACILITATOR_URL
configX402_NETWORK
configX402_PAY_TO— 0x2a8efe3093278bb4bd3b2d9c7b5ba992ca4fc9b0 \
configX402_RPC
configX402_RPC_URL
🔐 secretX402_SETTLE_KEY— The settle key () is the legacy self-hosted settlement
configX402_USE_FACILITATOR
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/evidiq-evidiq-rubric-mcp-b2pitx)](https://m8ven.ai/mcp/evidiq-evidiq-rubric-mcp-b2pitx)
commit: c57b4f1bad8b7b721fffe18661ad365ccf2e8af5
code hash: 69ef93fe758a284ec63f87ca939fff68249ea8c8d0761a44fafed566240fed44
verified: 7/28/2026, 9:05:22 AM
view raw JSON →