Back to MCP Trust Indexm8ven
3
/ 100
27 days ago
glama

AppCrane

AppCrane is the self-hosted home for the apps your AI builds and your AI deploys. It exposes 35 appcrane_* MCP tools so any MCP client (Claude Code, Cursor, Codex) can run the full deploy lifecycle — create app, deploy to sandbox/production, manage secrets, stream logs, list releases, roll back — every action bound to a user and audit-logged. Enterprise SSO (SAML/OIDC/SCIM), Docker isolation per a

→ gitayg/appCrane· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
⚠️
Known vulnerabilities in dependencies: 7 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 7 credentials: ANTHROPIC_API_KEY, APPCRANE_API_KEY, APPCRANE_GITHUB_TOKEN, CC_API_KEY, ENCRYPTION_KEY, GRAPH_CLIENT_SECRET, SMTP_PASS
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies7 high4 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

highmulter@2.0.0GHSA-5528-5vmv-3xc2

Multer Vulnerable to Denial of Service via Uncontrolled Recursion

highmulter@2.0.0GHSA-72gw-mp4g-v24j

Multer vulnerable to Denial of Service via deeply nested field names

highmulter@2.0.0GHSA-fjgf-rc76-4x9p

Multer vulnerable to Denial of Service via unhandled exception from malformed request

highmulter@2.0.0GHSA-g5hg-p3ph-g8qg

Multer vulnerable to Denial of Service via unhandled exception

highmulter@2.0.0GHSA-v52c-386h-88mc

Multer vulnerable to Denial of Service via resource exhaustion

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
🔐 secretANTHROPIC_API_KEY— Add under [Service]: Environment="=sk-ant-..."
🔐 secretAPPCRANE_API_KEY
configAPPCRANE_AUDIT_REQUIRED
configAPPCRANE_DEBUG_CREDS
configAPPCRANE_GH_MCP_CALL_TIMEOUT_MS
configAPPCRANE_GH_MCP_DISABLED
🔐 secretAPPCRANE_GITHUB_TOKEN
configAPPCRANE_MCP_URL
configAPPCRANE_PR_POLL_DISABLED
configAPPCRANE_PR_POLL_MS
configAPPCRANE_SPA_AUTOBUILD
configAPPCRANE_URL
configAPPSTUDIO_CODER_MODEL
configAPPSTUDIO_CONTEXT_TIMEOUT_MS
configAPPSTUDIO_IMAGE
configAPPSTUDIO_MAX_PLAN_PARALLEL
configAPPSTUDIO_PLANNER_MODEL
configAPPSTUDIO_PLAN_TIMEOUT_MS
configAPPSTUDIO_POLL_MS
configAPPSTUDIO_TIMEOUT_MS
configASK_TIMEOUT_MS
configBASE_URL
configCADDY_ADMIN_URL
configCADDY_HTTP_PORT
🔐 secretCC_API_KEY
configCC_API_URL
configCODER_IDLE_MS
configCODER_TIMEOUT_MS
configCRANE_DOMAIN
configDATA_DIR
🔐 secretENCRYPTION_KEY
configGRAPH_CLIENT_ID
🔐 secretGRAPH_CLIENT_SECRET
configGRAPH_TENANT_ID
configHOST
configLOG_LEVEL
configPORT
configSESSION_DURATION_HOURS
configSMTP_FROM
configSMTP_HOST
🔐 secretSMTP_PASS
configSMTP_PORT
configSMTP_USER
configSTAGED_MAX_BYTES
configSTAGED_TTL_MIN
configTLS_CERT_FILE
configTLS_KEY_FILE
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 3 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/gitayg-appcrane-4mhsl4)](https://m8ven.ai/mcp/gitayg-appcrane-4mhsl4)
commit: fe4a939996a100f876f1035a7a68dc390e9cb433
code hash: e3cc6a4e29acf1c32af75c626fb7fae0b94254d5c160c22f0e4aa860e6e4da85
verified: 7/4/2026, 9:12:01 AM
view raw JSON →