grade C

4 days ago

npm

graphlit-mcp-server

Graphlit MCP Server

→ graphlit/graphlit-mcp-server· npm: graphlit-mcp-server· listed on npm

Install from

npm npm

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

⚠️

Known vulnerabilities in dependencies: 1 high

Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 32 credentials: BOX_CLIENT_SECRET, BOX_REFRESH_TOKEN, DISCORD_BOT_TOKEN, DROPBOX_APP_KEY, DROPBOX_APP_SECRET, DROPBOX_REFRESH_TOKEN, GITHUB_PERSONAL_ACCESS_TOKEN, GOOGLE_CLIENT_SECRET, GOOGLE_DRIVE_CLIENT_SECRET, GOOGLE_DRIVE_REFRESH_TOKEN, GOOGLE_EMAIL_CLIENT_SECRET, GOOGLE_EMAIL_REFRESH_TOKEN, GOOGLE_REFRESH_TOKEN, JIRA_TOKEN, LINEAR_API_KEY, MICROSOFT_CLIENT_SECRET, MICROSOFT_EMAIL_CLIENT_SECRET, MICROSOFT_EMAIL_REFRESH_TOKEN, MICROSOFT_REFRESH_TOKEN, MICROSOFT_TEAMS_CLIENT_SECRET, MICROSOFT_TEAMS_REFRESH_TOKEN, NOTION_API_KEY, ONEDRIVE_CLIENT_SECRET, ONEDRIVE_REFRESH_TOKEN, SHAREPOINT_CLIENT_SECRET, SHAREPOINT_REFRESH_TOKEN, SLACK_BOT_TOKEN, TWITTER_ACCESS_TOKEN_KEY, TWITTER_ACCESS_TOKEN_SECRET, TWITTER_CONSUMER_API_KEY, TWITTER_CONSUMER_API_SECRET, TWITTER_TOKEN

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configBOX_CLIENT_ID

🔐 secretBOX_CLIENT_SECRET

configBOX_REDIRECT_URI

🔐 secretBOX_REFRESH_TOKEN

🔐 secretDISCORD_BOT_TOKEN— "": "your-discord-bot-token",

🔐 secretDROPBOX_APP_KEY

🔐 secretDROPBOX_APP_SECRET

🔐 secretDROPBOX_REFRESH_TOKEN

configFROM_EMAIL_ADDRESS

🔐 secretGITHUB_PERSONAL_ACCESS_TOKEN— "": "your-github-pat",

configGOOGLE_CLIENT_ID

🔐 secretGOOGLE_CLIENT_SECRET

configGOOGLE_DRIVE_CLIENT_ID

🔐 secretGOOGLE_DRIVE_CLIENT_SECRET

🔐 secretGOOGLE_DRIVE_REFRESH_TOKEN

configGOOGLE_DRIVE_SERVICE_ACCOUNT_JSON

configGOOGLE_EMAIL_CLIENT_ID— "": "your-google-client-id",

🔐 secretGOOGLE_EMAIL_CLIENT_SECRET— "": "your-google-client-secret",

🔐 secretGOOGLE_EMAIL_REFRESH_TOKEN— "": "your-google-refresh-token",

🔐 secretGOOGLE_REFRESH_TOKEN

configJIRA_EMAIL— "": "your-jira-email",

🔐 secretJIRA_TOKEN— "": "your-jira-token",

🔐 secretLINEAR_API_KEY— "": "your-linear-api-key",

configMICROSOFT_CLIENT_ID

🔐 secretMICROSOFT_CLIENT_SECRET

configMICROSOFT_EMAIL_CLIENT_ID

🔐 secretMICROSOFT_EMAIL_CLIENT_SECRET

🔐 secretMICROSOFT_EMAIL_REFRESH_TOKEN

🔐 secretMICROSOFT_REFRESH_TOKEN

configMICROSOFT_TEAMS_CLIENT_ID

🔐 secretMICROSOFT_TEAMS_CLIENT_SECRET

🔐 secretMICROSOFT_TEAMS_REFRESH_TOKEN

🔐 secretNOTION_API_KEY— "": "your-notion-api-key"

configONEDRIVE_CLIENT_ID

🔐 secretONEDRIVE_CLIENT_SECRET

🔐 secretONEDRIVE_REFRESH_TOKEN

configSHAREPOINT_ACCOUNT_NAME

configSHAREPOINT_CLIENT_ID

🔐 secretSHAREPOINT_CLIENT_SECRET

🔐 secretSHAREPOINT_REFRESH_TOKEN

🔐 secretSLACK_BOT_TOKEN— "": "your-slack-bot-token",

🔐 secretTWITTER_ACCESS_TOKEN_KEY

🔐 secretTWITTER_ACCESS_TOKEN_SECRET

🔐 secretTWITTER_CONSUMER_API_KEY

🔐 secretTWITTER_CONSUMER_API_SECRET

🔐 secretTWITTER_TOKEN— "": "your-twitter-token",

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/graphlit-mcp-server-18j9c5)](https://m8ven.ai/mcp/graphlit-mcp-server-18j9c5)

commit: 1b94b887ba1692f7226ebc306b9ab7a02ce8b0f4

code hash: e7b662b522391e4f0a2e5dee10d78d9b51a403a40c9fef3d9658ae91c6898912

verified: 4/18/2026, 4:04:26 PM

view raw JSON →