/ 100

28 days ago

glama

fr0ster/mcp-calm-server

MCP server for SAP Cloud ALM, providing 54 tools across 9 services to manage features, tasks, test cases, documents, projects, and more via natural language.

→ fr0ster/mcp-calm-server · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

⚠️

Known vulnerabilities in dependencies: 2 high

Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 2 credentials: CALM_API_KEY, CALM_UAA_CLIENT_SECRET

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// known CVEs in dependencies2 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.0.0GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.0.0GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

Depend on this server? Get alerted when its CVEs change.Watch this server free →

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configAUTH_REDIRECT_PORT

configAUTH_TIMEOUT_MS

configCALM_ALLOW_MUTATIONS— describeMutating live + CALM_PROJECT_ID + =1 Write tests (every mutation finalises via try/finally { delete })

🔐 secretCALM_API_KEY— your-key-from-api.sap.com>

configCALM_AUTH_FLOW— authorization_code # or client_credentials

configCALM_BASE_URL— defaults to https://sandbox.api.sap.com/SAPCALM

configCALM_DESTINATION

configCALM_LOG_LEVEL— debug # error warn info debug

configCALM_MODE— "": "sandbox",

configCALM_PROJECT_ID— describeWithProject live backend + Project-scoped chains (features list→get, tasks list→get→comments, …)

configCALM_TIMEOUT

configCALM_UAA_CLIENT_ID— sb-…!b…calm!b…

🔐 secretCALM_UAA_CLIENT_SECRET— works as before — no extra steps. The broker uses

configCALM_UAA_URL— Plain .env with inline / CALM_UAA_CLIENT_ID /

configJEST_WORKER_ID

configLOGS_CATEGORY

configLOGS_PERIOD

configLOGS_PROVIDER

configLOGS_SERVICE_ID

configLOGS_VERSION

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 2 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/fr0ster-mcp-calm-server-p1shiv)](https://m8ven.ai/mcp/fr0ster-mcp-calm-server-p1shiv)

commit: c8be4482abea499cdf25a32ce759fc1e02660765

code hash: 2dc4afc570f6f40b18130bdca2e01c1c9fc77737a6e83401e18383a7db87af72

verified: 6/12/2026, 10:30:23 AM

view raw JSON →