Back to MCP Trust Indexm8ven
52
/ 100
8 days ago
glama

mcp-asdeporte

Read-only MCP server for querying events and inscriptions from asdeporte microservices, with a chatbot interface and tools for searching, retrieving details, and checking user inscriptions.

→ FrankoCamposT800/mcp-asdeporte· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
⚠️
Known vulnerabilities in dependencies: 4 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
🔐
You'll be asked for 3 credentials: CURSOR_API_KEY, MCP_APIKEY, MCP_INBOUND_APIKEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies4 high3 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.10.0GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.10.0GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.10.0GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

high@nestjs/microservices@10.3.8GHSA-hpwf-8g29-85qm

Nest Affected by DoS via Recursive handleData in JsonSocket (TCP Transport)

low@nestjs/common@10.3.8GHSA-cj7v-w2c7-cp7c

nest allows a remote attacker to execute arbitrary code via the Content-Type header

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configCHAT_TIMEOUT_MS— Env: CURSOR_API_KEY (obligatorio), CURSOR_MODEL, MCP_PUBLIC_URL, (default 120s)
🔐 secretCURSOR_API_KEY— Completar EVENT_BASE_URL, INSCRIPTION_BASE_URL, MCP_APIKEY, MCP_INBOUND_APIKEY,
configCURSOR_MODEL— Env: CURSOR_API_KEY (obligatorio), , MCP_PUBLIC_URL, CHAT_TIMEOUT_MS (default 120s)
configEVENT_BASE_URL— Completar , INSCRIPTION_BASE_URL, MCP_APIKEY, MCP_INBOUND_APIKEY, CURSOR_API_KEY
configINSCRIPTION_BASE_URL— Completar EVENT_BASE_URL, , MCP_APIKEY, MCP_INBOUND_APIKEY, CURSOR_API_KEY
🔐 secretMCP_APIKEY— Auth MCP → micros: header x-api-key =
🔐 secretMCP_INBOUND_APIKEY— Auth chatbot → MCP: header x-api-key =
configMCP_INSPECTOR_URL
configMCP_PUBLIC_URL— Env: CURSOR_API_KEY (obligatorio), CURSOR_MODEL, , CHAT_TIMEOUT_MS (default 120s)
configPORT
configRATE_LIMIT_LIMIT
configRATE_LIMIT_TTL_MS
configUPSTREAM_TIMEOUT_MS— Upstream timeout () → 504
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 3 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/frankocampost800-mcp-asdeporte-qpcl2k)](https://m8ven.ai/mcp/frankocampost800-mcp-asdeporte-qpcl2k)
commit: 53642dd80ad3ec39893af8b9f578491485eacbb4
code hash: 8fb8a71c2dea53c6c0eff891a65a4df4f28ff34b9fbee53e96c61141716767d2
verified: 7/23/2026, 9:02:23 AM
view raw JSON →