Back to MCP Trust Indexm8ven
54
/ 100
22 days ago
glama

MCP SFTP Orchestrator

Enables remote server management through SSH/SFTP with persistent task queuing, system monitoring, file transfers, service status checks, and API health monitoring through a unified interface.

→ fkom13/mcp-sftp-orchestrator· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
⚠️
Known vulnerabilities in dependencies: 4 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
// known CVEs in dependencies4 high2 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.17.0GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.17.0GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.17.0GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

highglob@11.0.3GHSA-5j98-mcp5-4vw2

glob CLI: Command injection via -c/--cmd executes matches with shell:true

lowmicromatch@4.0.5GHSA-952p-6rrq-rcjv

Regular Expression Denial of Service (ReDoS) in micromatch

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configHISTORY_RETENTION
configIDLE_TIMEOUT— 300000 Délai en ms avant fermeture d'une connexion SSH inactive (5 min)
configKEEP_ALIVE_INTERVAL— 30000 Intervalle keepalive SSH en ms (30s)
configMAX_CONNECTIONS_PER_SERVER— 5 Nombre max de connexions SSH simultanées par serveur
configMAX_QUEUE_SIZE— 1000 Nombre maximum de jobs dans la file d'attente
configMCP_DATA_DIR— ~/.config/mcp-orchestrator Dossier où sont stockés servers.json, apis.json, queue.json, history.json
configMCP_DEBUG— false true pour activer les logs détaillés dans stderr
configMCP_DEFAULT_CMD_TIMEOUT_S— 600 Timeout SSH par défaut en secondes. 0 = aucune limite
configMCP_INTERACTIVE_CMD_TIMEOUT_S— 300 Timeout pour les commandes interactives. 0 = aucune limite
configMCP_MAX_WAIT_TIMEOUT_S— 600 Timeout maximum pour l'outil task_wait
configMCP_SYNC_TIMEOUT_S— 120 Délai en secondes avant qu'une tâche passe en arrière-plan (retour immédiat au client, tâche continue)
configMIN_CONNECTIONS_PER_SERVER— 1 Nombre min de connexions SSH maintenues par serveur
configSAVE_INTERVAL— 5000 Intervalle de sauvegarde de la queue sur disque en ms (5s)
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/fkom13-mcp-sftp-orchestrator-seq7r8)](https://m8ven.ai/mcp/fkom13-mcp-sftp-orchestrator-seq7r8)
commit: 03d67dafcf45d2ecaae40eb7f06302fd9c89af32
code hash: ab8767be0c8ce2840e7e745d7013447f359009629f03ab8aa043d2714f2e417a
verified: 7/9/2026, 10:11:12 AM
view raw JSON →