open-manus (GarrettRoi/open-manus) is an MCP server listed on the M8ven Trust Index. It scores 74 out of 100, grade C. It declares 18 tools. No publisher has claimed this listing.

Emerging

74/100

7 days ago

open-manus

Item: open-manus
Rating: 74
Author: M8ven

Open Manus: An open-source autonomous AI agent built on Hermes-Agent

→ GarrettRoi/open-manus · listed on github_code

Emerging. No concerning findings. Grades remain capped until the project builds reputation through adoption. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every push why connect →

Who stands behind it

GarrettRoi

Source: github_code

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

GitHub

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

🚨

Secret credentials may flow to a network call

3 flows detected: QQ_CLIENT_SECRET. We can’t prove the destination matches the brand the credential belongs to.

🔐

You'll be asked for 29 credentials: HERMES_API_KEY, VAULT_ADMIN_PASSWORD, VAULT_ADMIN_TOKEN, VAULT_MASTER_KEY, API_TOKEN, XAI_API_KEY, HASS_TOKEN, OPENROUTER_API_KEY, CAMOFOX_API_KEY, CAMOFOX_SESSION_KEY, HERMES_RPC_TOKEN, DISCORD_BOT_TOKEN, VAULT_TOKEN, HERMES_SESSION_KEY, TOOL_GATEWAY_USER_TOKEN, TINKER_API_KEY, WANDB_API_KEY, WEIXIN_TOKEN, QQ_CLIENT_SECRET, GITHUB_TOKEN, GH_TOKEN, SUDO_PASSWORD, TERMINAL_SSH_KEY, DAYTONA_API_KEY, MODAL_TOKEN_SECRET, VOICE_TOOLS_OPENAI_KEY, OPENAI_API_KEY, FAL_KEY, ELEVENLABS_API_KEY

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// environment variables

To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.

configHERMES_SESSION_ID

configHERMES_HOME

configSSH_CLIENT

configSSH_TTY

configDISPLAY

configWAYLAND_DISPLAY

configHERMES_TUI_SLASH_TIMEOUT_S

configHERMES_TUI_WS_ORPHAN_REAP_GRACE_S

configHERMES_TUI_RPC_POOL_WORKERS

configHERMES_TUI_SESSION_TTL_S

configTERMINAL_CWD

configTERMINAL_ENV

configHERMES_GATEWAY_SESSION

configHERMES_EXEC_ASK

configHERMES_INTERACTIVE

configHERMES_MODEL

configHERMES_INFERENCE_MODEL

configHERMES_TUI_PROVIDER

configHERMES_INFERENCE_PROVIDER

configHERMES_TUI_TOOL_PROGRESS

configHERMES_TUI_TOOLSETS

configHERMES_DEV_CREDITS

configHERMES_TUI_MAX_TURNS

configHERMES_TUI_SKILLS

configHERMES_TUI_CHECKPOINTS

configHERMES_TUI_PASS_SESSION_ID

configHERMES_IGNORE_RULES

configHERMES_PET_REFERENCE_MAX_BYTES

configHERMES_YOLO_MODE

configHERMES_VOICE

configHERMES_VOICE_TTS

configBROWSER_CDP_URL

🔐 secretHERMES_API_KEY

configHERMES_BASE_URL

configHERMES_TUI

configHERMES_TUI_NO_EARLY_DISABLE

configPREFIX

configTERMUX_VERSION

configHERMES_TERMUX_DISABLE_FAST_CLI

configSUDO_USER

configHERMES_S6_SUPERVISED_CHILD

configHERMES_REDACT_SECRETS

configHERMES_TERMUX_FORCE_SKILLS_SYNC

configHERMES_TERMUX_PREFETCH_UPDATES

configHERMES_TUI_FORCE_BUILD

configHERMES_SKIP_NODE_BOOTSTRAP

configHERMES_QUIET

configHERMES_NODE

configHERMES_TUI_DIR

configHERMES_KANBAN_BOARD

configHERMES_SAFE_MODE

configHERMES_IGNORE_USER_CONFIG

configHERMES_SESSION_SOURCE

configelectron_config_cache

configELECTRON_CACHE

configXDG_CACHE_HOME

configCSC_LINK

configAPPLE_SIGNING_IDENTITY

configHERMES_DESKTOP_CHILD_PID

configTERM

configHERMES_DESKTOP

configHERMES_SERVE_HEADLESS

configHERMES_WEB_DIST

configHERMES_DEFER_AGENT_STARTUP

configHERMES_FAST_STARTUP_BANNER

configHERMES_ACCEPT_HOOKS

🔐 secretVAULT_ADMIN_PASSWORD

🔐 secretVAULT_ADMIN_TOKEN

configVAULT_PUBLIC_URL

🔐 secretVAULT_MASTER_KEY

configSQLITE_PATH

configSQLITE_MAX_ROWS

configAPI_BASE_URL

🔐 secretAPI_TOKEN

configAPI_TIMEOUT_SECONDS

configHERMES_KANBAN_TASK

configHERMES_CONCURRENT_TOOL_TIMEOUT_S

🔐 secretXAI_API_KEY

configHERMES_CUA_DRIVER_CMD

configCUA_DRIVER_RS_HOME

🔐 secretHASS_TOKEN

🔐 secretOPENROUTER_API_KEY

configAGENT_NAMEEach agent runs in its own Railway service container. The environment variable determines which agent configuration is loaded at startup.

configDISPATCH_MAX_DEPTH

configDISPATCH_MAX_FANOUT

configDISPATCH_CHANNEL_ID

configHERMES_SESSION_PLATFORM

configHERMES_SPINNER_PAUSE

🔐 secretCAMOFOX_API_KEY

configCAMOFOX_URL

configCAMOFOX_USER_ID

🔐 secretCAMOFOX_SESSION_KEY

configCAMOFOX_LOOPBACK_HOST_ALIAS

configAUXILIARY_VISION_MODEL

configAUXILIARY_WEB_EXTRACT_MODEL

configAGENT_BROWSER_ENGINE

configPLAYWRIGHT_BROWSERS_PATH

configAGENT_BROWSER_EXECUTABLE_PATH

configHERMES_RPC_SOCKET

🔐 secretHERMES_RPC_TOKEN

configHERMES_RPC_DIR

configHERMES_TIMEZONE

configDELEGATION_MAX_CONCURRENT_CHILDREN

configDELEGATION_CHILD_TIMEOUT_SECONDS

🔐 secretDISCORD_BOT_TOKEN

configHERMES_DISABLE_FILE_STATE_GUARD

configHASS_URL

configVAULT_FAL_CONNECTION

🔐 secretVAULT_TOKEN

configFAL_IMAGE_MODEL

configIMAGE_OUTPUT_DIR

configHERMES_DEBUG_INTERRUPT

configHERMES_KANBAN_RUN_ID

configHERMES_KANBAN_CLAIM_LOCK

configHERMES_PROFILE

configHERMES_TENANT

🔐 secretHERMES_SESSION_KEY

configHERMES_DISABLE_LAZY_INSTALLS

🔐 secretTOOL_GATEWAY_USER_TOKEN

configTOOL_GATEWAY_SCHEME

configTOOL_GATEWAY_DOMAIN

configHERMES_WORKSPACE_DIR

configMAP_REDUCE_MAX_WORKERS

configMAP_REDUCE_MODEL

configLLM_MODEL

configOSV_ENDPOINT

configTERMINAL_TIMEOUT

🔐 secretTINKER_API_KEY

configWANDB_ENTITY

🔐 secretWANDB_API_KEY

🔐 secretWEIXIN_TOKEN

configWEIXIN_ACCOUNT_ID

configWEIXIN_BASE_URL

configWEIXIN_CDN_BASE_URL

configWEIXIN_HOME_CHANNEL

configQQ_APP_ID

🔐 secretQQ_CLIENT_SECRET

🔐 secretGITHUB_TOKEN

🔐 secretGH_TOKEN

configGITHUB_APP_ID

configGITHUB_APP_PRIVATE_KEY_PATH

configGITHUB_APP_INSTALLATION_ID

configHERMES_PLATFORM

🔐 secretSUDO_PASSWORD

configTERMINAL_LIFETIME_SECONDS

configTERMINAL_DOCKER_MOUNT_CWD_TO_WORKSPACE

configTERMINAL_MODAL_MODE

configTERMINAL_DOCKER_IMAGE

configTERMINAL_SINGULARITY_IMAGE

configTERMINAL_MODAL_IMAGE

configTERMINAL_DAYTONA_IMAGE

configTERMINAL_SSH_HOST

configTERMINAL_SSH_USER

🔐 secretTERMINAL_SSH_KEY

configTERMINAL_PERSISTENT_SHELL

configTERMINAL_LOCAL_PERSISTENT

configTERMINAL_CONTAINER_PERSISTENT

configTERMINAL_DOCKER_RUN_AS_HOST_USER

configTERMINAL_DOCKER_NETWORK

config_HERMES_GATEWAY

🔐 secretDAYTONA_API_KEY

configTERMINAL_SANDBOX_DIR

configTIRITH_BIN

configMODAL_TOKEN_ID

🔐 secretMODAL_TOKEN_SECRET

🔐 secretVOICE_TOOLS_OPENAI_KEY

🔐 secretOPENAI_API_KEY

🔐 secretFAL_KEY

configDISCORD_HOME_CHANNEL

configSTT_OPENAI_MODEL

configSTT_GROQ_MODEL

configSTT_MISTRAL_MODEL

configSTT_ELEVENLABS_MODEL

configGROQ_BASE_URL

configSTT_OPENAI_BASE_URL

configXAI_STT_BASE_URL

configELEVENLABS_STT_BASE_URL

configHERMES_LOCAL_STT_LANGUAGE

configHERMES_ALLOW_PRIVATE_URLS

configVAULT_URL

configVAULT_TOOLS_REFRESH_SECONDS

configHERMES_VISION_DOWNLOAD_TIMEOUT

configHERMES_VISION_MAX_CONCURRENCY

configAUXILIARY_VIDEO_MODEL

configPULSE_SERVER

configPULSE_RUNTIME_PATH

configXDG_RUNTIME_DIR

configPIPEWIRE_REMOTE

🔐 secretELEVENLABS_API_KEY

configELEVENLABS_VOICE_ID

configHERMES_COMPUTER_USE_BACKEND

Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.

deployREDIS_URL

deployPORT

// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

18/18 tools missing one or more hints — conversations_list (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); conversation_get (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); messages_read (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +15 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool test coverage

13/18 tools referenced in tests (72%)

Write tests that reference each tool by name so every tool has at least one test.

No arbitrary install scripts

Has postinstall/preinstall script — runs arbitrary code on npm install

Remove postinstall/preinstall hooks unless they’re essential.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail

The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.

// improvement guidance — verified publishers only

We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/garrettroi/open-manus)](https://m8ven.ai/mcp/garrettroi/open-manus)

Shows your grade and updates automatically. Prefer no grade? Append ?variant=verified to the badge URL.

commit: 6b6133358fe7b18fc992dec11bf2ca493115d1d7

code hash: 0f757865febf4a64407dcda83dc007e1637672933f44f9973c2acdcbf72bacde

verified: 9/3/2026, 7:25:44 PM

view raw JSON →

Check MCPs from inside your assistant

Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check

check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern

How to add it →Free · no account needed · works in any MCP client