TokenHub MCP

A production-packaged Model Context Protocol server for coding agents that routes large file, git, web, database, and other tasks through token-budgeted tools and workflows.

→ Gravitied/tokenhub · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

⚠️

Tests do not pass

Either the test suite is broken or the code regressed. Either way the published behaviour can’t be verified by the publisher’s own tests.

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 4 credentials: BRAVE_SEARCH_API_KEY, EXA_API_KEY, SERPAPI_API_KEY, TAVILY_API_KEY

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

🔐 secretBRAVE_SEARCH_API_KEY— Selects Brave as the default web_search provider and authenticates Brave Search.

🔐 secretEXA_API_KEY— Selects Exa as the default search provider when Brave is not set.

🔐 secretSERPAPI_API_KEY— Selects SerpAPI as the default search provider when the other keyed providers are not set.

🔐 secretTAVILY_API_KEY— Selects Tavily as the default search provider when Brave and Exa are not set.

configTOKENHUB_ALLOW_PRIVATE_NETWORK— When set to true, allows trusted-local web and browser retrieval of localhost, private LAN, and other non-public network targets. Leave unset for public-network-only retrieval.

configTOKENHUB_ENABLE_FS_MUTATIONS— filesystem_action run_workflow Lists a workspace tree by default. Write, move, and delete require the service process to be started with =true.

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/gravitied-tokenhub-7ys7pm)](https://m8ven.ai/mcp/gravitied-tokenhub-7ys7pm)

commit: 297b07c83bbeab0492908cdb436acb1ec30a557d

code hash: 08de93a26e917dca635805ecc32861b5dd72d129c969658f305a3ae297d44c7f

verified: 6/15/2026, 2:00:41 PM

view raw JSON →