/ 100

1 month ago

glama

floomhq/floom

Item: floomhq/floom
Rating: 2
Author: M8ven

Floom MCP server — deploy Python apps instantly with auto-generated UI, REST API, and shareable URLs. 32 tools for AI agents.

→ floomhq/floom · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

🚨

Secret credentials may flow to a network call

1 flow detected: FLOOM_API_SECRET. We can’t prove the destination matches the brand the credential belongs to.

🚨

Reads files from sensitive locations

Touches: /etc/floom/api.env

🔐

You'll be asked for 35 credentials: FLOOM_API_SECRET, WORKEROS_API_SECRET, WORKEROS_API_TOKEN, WORKEROS_SMTP_PASS, FLOOM_SECRET, SLACK_CLIENT_SECRET, SLACK_BOT_TOKEN, SLACK_SIGNING_SECRET, WHATSAPP_TOKEN, WHATSAPP_APP_SECRET, WHATSAPP_WEBHOOK_VERIFY_TOKEN, COMPOSIO_API_KEY, WORKEROS_APPROVAL_SIGNING_SECRET, WORKEROS_SECRETS_KEY, WORKEROS_SECRET_ENCRYPTION_KEY, OPENAI_API_KEY, PLATFORM_OPENAI_API_KEY, WORKEROS_UPLOAD_URL_SIGNING_SECRET, COMPOSIO_WEBHOOK_SIGNING_KEY, WORKEROS_MAGIC_LINK_SECRET, WORKEROS_OAUTH_STATE_SECRET, WORKEROS_DROP_LINK_SECRET, WORKEROS_RUN_TOKEN_SECRET, WORKEROS_WORKER_CALL_SECRET, E2B_API_KEY, WORKEROS_E2B_WARM_POOL_SIZE_PER_KEY, WORKEROS_LLM_GATEWAY_KEY, WORKEROS_RUN_TOKEN, WORKEROS_GITHUB_PAT_ENCRYPTION_SECRET, RESEND_API_KEY, GRANOLA_API_KEY, HUBSPOT_ACCESS_TOKEN, WORKEROS_WORKER_PUBLIC_SIGNING_SECRET, SERPER_API_KEY, FLOOM_API_TOKEN

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configCLAUDE_SESSION_TRANSCRIPT

configFLOOM_API_BASE

🔐 secretFLOOM_API_SECRET

configFLOOM_USER

configNEXT_PUBLIC_API_PROXY_BASE

configNEXT_PUBLIC_BASE_PATH

configNEXT_PUBLIC_WA_BOT_NUMBER

configWORKEROS_API_BASE

🔐 secretWORKEROS_API_SECRET

🔐 secretWORKEROS_API_TOKEN

configWORKEROS_APP_BASE

configWORKEROS_CLOUD

configWORKEROS_SESSION_TRANSCRIPT

configWORKEROS_USER

configWORKEROS_WORKSPACE_ID

configWORKEROS_WORKSPACE_NAME

configXDG_CONFIG_HOME

configWORKEROS_ALERT_ENABLED

configWORKEROS_ALERT_EMAIL

configWORKEROS_SMTP_HOST

configWORKEROS_SMTP_PORT

configWORKEROS_SMTP_USER

🔐 secretWORKEROS_SMTP_PASS

configWORKEROS_SMTP_FROM

configWORKEROS_ALERT_CONSECUTIVE_FAILURES

configWORKEROS_ALERT_SUCCESS_RATE_THRESHOLD

configWORKEROS_ALERT_POLL_TICKS

configWORKERS_FRONTEND_URL

configWORKEROS_USER_ID

configWORKEROS_DEPLOY

🔐 secretFLOOM_SECRET

configWORKEROS_DB

configFLOOM_DB

configWORKEROS_ENABLE_USER_HEADER_SCOPE

configWORKEROS_SHARED_SECRET_ROLE

configWORKEROS_DEFAULT_WORKSPACE_NAME

configWORKEROS_PUBLIC_URL

configWORKEROS_PUBLIC_API_URL

configWORKEROS_API_URL

configWORKERS_API_URL

configSLACK_INSTALL_SCOPES

🔐 secretSLACK_CLIENT_SECRET

configSLACK_CLIENT_ID

🔐 secretSLACK_BOT_TOKEN

🔐 secretSLACK_SIGNING_SECRET

configSLACK_EVENTS_ENABLED

configSLACK_SIGNATURE_TOLERANCE_SECONDS

configSLACK_ALLOWED_TEAM_IDS

configSLACK_LEGACY_SINGLE_USER

configSLACK_WORKEROS_USER_ID

configSLACK_POST_ERRORS_TO_THREAD

configWHATSAPP_GRAPH_VERSION

configWHATSAPP_PHONE_ID

🔐 secretWHATSAPP_TOKEN

🔐 secretWHATSAPP_APP_SECRET

🔐 secretWHATSAPP_WEBHOOK_VERIFY_TOKEN

configWHATSAPP_ENABLED

configWHATSAPP_POST_ERRORS_TO_CHAT

configWORKEROS_CHAT_MODEL

configWORKEROS_WORKER_AGENT_MODEL

configWORKEROS_WORKSPACE_DIR

configFLOOM_WORKERS_DIR

configWORKEROS_CHAT_MAX_TOKENS

configWORKEROS_DEV

configWORKEROS_API_ENV_FILE

configFLOOM_API_ENV_FILE

🔐 secretCOMPOSIO_API_KEY

configFLOOM_CONTEXTS_DIR

configWORKEROS_MEMORY_ENABLED

configWORKEROS_MEMORY_WRITE_INTERVAL

🔐 secretWORKEROS_APPROVAL_SIGNING_SECRET

configtrusted_proxies

configTRUSTED_PROXIES

configWORKEROS_TRUSTED_PROXIES

configWORKEROS_SHORT_LINK_BASE_URL

configWORKEROS_FRONTEND_URL

configWORKEROS_USD_PER_MTOK

configFLOOM_MIN_CRON_INTERVAL_SECONDS

configWORKEROS_SQLITE_BUSY_TIMEOUT_MS

🔐 secretWORKEROS_SECRETS_KEY

🔐 secretWORKEROS_SECRET_ENCRYPTION_KEY

configFLOOM_BLOBS_DIR

configAWS_ACCESS_KEY_ID

configAWS_BEARER_TOKEN_BEDROCK

configAWS_PROFILE

🔐 secretOPENAI_API_KEY

🔐 secretPLATFORM_OPENAI_API_KEY

configWORKEROS_GIT_REMOTE

configWORKEROS_SHUTDOWN_RUN_DRAIN_SECONDS

configALLOWED_ORIGINS

configALLOWED_ORIGIN_REGEX

🔐 secretWORKEROS_UPLOAD_URL_SIGNING_SECRET

🔐 secretCOMPOSIO_WEBHOOK_SIGNING_KEY

configWORKEROS_RATE_LIMIT_DEV

configFLOOM_ARTIFACTS_DIR

configFLOOM_INBOX_MAX_FILES

configFLOOM_INBOX_RATE_LIMIT

configFLOOM_INBOX_RATE_WINDOW_SECONDS

configWORKEROS_MANAGED_LLM_MODEL

configWORKEROS_MANAGED_EMBEDDING_MODEL

configWORKEROS_EMBEDDING_MODEL

configOPENAI_EMBEDDING_MODEL

configCOMPOSIO_WEBHOOK_TOLERANCE_SECONDS

configWORKEROS_WEBHOOK_RECEIPT_TTL_SECONDS

configWORKSPACE_AGENT_MCP_ENABLED

configWORKSPACE_AGENT_MCP_USER_ID

configWORKEROS_MCP_MAX_BATCH_ITEMS

configFLOOM_WH_RATE_LIMIT

configFLOOM_WH_RATE_WINDOW

configWORKEROS_MCP_ENABLE_DESTRUCTIVE

configWORKEROS_MCP_ENABLED_TOOLS

configWORKEROS_API_HOST

configWORKEROS_API_PORT

configWORKEROS_ALLOW_PRIVATE_MCP_URLS

🔐 secretWORKEROS_MAGIC_LINK_SECRET

🔐 secretWORKEROS_OAUTH_STATE_SECRET

configWORKEROS_ENABLE_INTERNAL_AUTH_CONFIGS

configWORKEROS_SWEEP_COOLDOWN_SECONDS

🔐 secretWORKEROS_DROP_LINK_SECRET

configWORKEROS_CLOUD_RUNS_DEFAULT_LIMIT

configWORKEROS_PRECLEAR_BACKUP_DIR

configWORKEROS_INSTANCE

configWORKEROS_SUGGEST_MODEL

configWORKEROS_MAX_CONCURRENT_RUNS

configWORKEROS_MAX_CONCURRENT_LLM_RUNS

configWORKEROS_RUN_PERF_LOGS

configWORKEROS_ROLE

configWORKEROS_PROCESS_ROLE

configWORKEROS_ASYNC_LOG_FLUSH

configWORKEROS_DEPLOYMENT

configWORKEROS_ENV

configWORKEROS_LOG_FLUSH_BATCH_SIZE

configWORKEROS_LOG_FLUSH_INTERVAL_SECONDS

configWORKEROS_SCHEDULE_MISSING_SECRET_PAUSE_AFTER

configWORKEROS_RUN_REAPER_GRACE_SECONDS

configWORKEROS_RUN_REAPER_INTERVAL_SECONDS

configWORKEROS_AUTO_REQUEUE_ABANDONED_RUNS

configWORKEROS_MAX_RESTART_RETRIES

configWORKEROS_DISPATCH_ORPHAN_TIMEOUT_SECONDS

configWORKEROS_INFRA_RETRY_MAX_ATTEMPTS

configAPPROVAL_TTL_HOURS

🔐 secretWORKEROS_RUN_TOKEN_SECRET

🔐 secretWORKEROS_WORKER_CALL_SECRET

configFLOOM_USER_ID

configPORT

configPYTHONPATH

configWORKEROS_ALLOW_LOCAL_RUNNER

🔐 secretE2B_API_KEY— edit apps/api/.env: add a model provider key and

configWORKEROS_AI_CAPTURE_MODE

configWORKEROS_E2B_TEMPLATE_CACHE_FILE

🔐 secretWORKEROS_E2B_WARM_POOL_SIZE_PER_KEY

configWORKEROS_E2B_WARM_POOL_MAX_AGE_SECONDS

configWORKEROS_CODEGEN_MODEL

configWORKEROS_LLM_GATEWAY_URL

🔐 secretWORKEROS_LLM_GATEWAY_KEY

configWORKEROS_E2B_API_URL

configCOMPOSIO_API_BASE

configWORKEROS_E2B_RESTRICT_EGRESS

configWORKEROS_E2B_PYTHON_BAKED_PACKAGES

configWORKEROS_E2B_TEMPLATE_MEMORY_MB

configWORKEROS_E2B_TEMPLATE_CPU_COUNT

configWORKEROS_E2B_TEMPLATE_PROFILE_FALLBACK

configWORKEROS_E2B_NODE_TEMPLATE_ID

configWORKEROS_E2B_PYTHON_TEMPLATE_ID

configWORKEROS_E2B_DEFAULT_TEMPLATE_ID

configWORKEROS_E2B_TEMPLATE_CACHE_JSON

configE2B_API_KEYS

configE2B_API_KEY_FALLBACK

configOPENAI_BASE_URL

🔐 secretWORKEROS_RUN_TOKEN

configWORKEROS_CALL_DEPTH

configFLOOM_RUN_ID

configFLOOM_EXTRA_WORKERS_DIRS

configFLOOM_RUN_TIMEOUT

configWORKEROS_SCHEDULE_MISSED_GRACE_SECONDS

configWORKEROS_INSECURE_COOKIES

configWORKEROS_PAT_MAX_TTL_DAYS

configWORKEROS_DRAFT_RATE_HOUR

configWORKEROS_RUN_CREATE_RATE_LIMIT

configWORKEROS_RUN_CREATE_RATE_WINDOW_SECONDS

configCOMPOSIO_WEBHOOK_URL

configWORKEROS_CONTEXT_LIST_COUNT_TIMEOUT_SECONDS

configWORKEROS_BLOCK_SECRETS_IN_CONTEXTS

configWORKEROS_CONTEXT_UPLOAD_MAX_BYTES

configWORKEROS_CONTEXT_MAX_BYTES

🔐 secretWORKEROS_GITHUB_PAT_ENCRYPTION_SECRET

configHEALTH_MIN_FREE_DISK_GB

configWORKEROS_RUN_CREATE_PER_WORKER_RATE_LIMIT

configWORKEROS_RUN_REPLAY_PER_RUN_RATE_LIMIT

configWORKEROS_CHAT_RATE_LIMIT

configWORKEROS_CHAT_RATE_WINDOW_SECONDS

configWORKEROS_CHAT_COST_UNITS_LIMIT

configWORKEROS_CHAT_COST_WINDOW_SECONDS

configWORKEROS_MIN_FREE_DISK_BYTES

configWORKEROS_RESEND_TIMEOUT_SECONDS

configWORKEROS_BRAND_NAME

configWORKEROS_EMAIL_LOGO_URL

configWORKEROS_SUPPORT_EMAIL

🔐 secretRESEND_API_KEY

configNOTIFY_FROM_EMAIL

configNOTIFY_EMAIL

configWORKEROS_MAX_CONCURRENT_STREAMS

configWORKEROS_UPLOAD_URL_TTL_SECONDS

🔐 secretGRANOLA_API_KEY

🔐 secretHUBSPOT_ACCESS_TOKEN

configWORKEROS_CODEGEN_MAX_TOKENS

configWORKEROS_REQUIRE_WORKSPACE_HEADER_FOR_WRITES

🔐 secretWORKEROS_WORKER_PUBLIC_SIGNING_SECRET

🔐 secretSERPER_API_KEY

configWORKEROS_WEBHOOK_LEGACY_TOKEN_GRACE

🔐 secretFLOOM_API_TOKEN

configWORKEROS_E2B_NODE_TEMPLATE_ALIAS

configSKIP_CACHE

configWORKEROS_E2B_PYTHON_TEMPLATE_ALIAS

configWORKEROS_ROOT

configWORKEROS_ARTIFACT_RETENTION_DAYS

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/floomhq-floom-r43rht)](https://m8ven.ai/mcp/floomhq-floom-r43rht)

commit: 8a46b329c293377844ca5d04986cd9e92b1d147b

code hash: 3fefd827526ede7ed87390205573bdf8e25d1059fb34e5e63d024ba6f7661c52

verified: 6/28/2026, 9:13:39 AM

view raw JSON →