45
/ 100
21 days ago
glama

mcp-nexus

Unified MCP server that bridges Tavily and Brave Search APIs with key management, rate limiting, and an admin UI for monitoring and configuration.

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 5 credentials: ADMIN_API_TOKEN, BRAVE_API_KEY, BRAVE_USAGE_HASH_SECRET, TAVILY_BRIDGE_MCP_TOKEN, TAVILY_USAGE_HASH_SECRET
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

lowuuid@13.0.0GHSA-w5hq-g745-h8pq

uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
🔐 secretADMIN_API_TOKENEdit .env to set your and other configurations
configADMIN_KEYS_EXPORT_RATE_LIMIT_PER_MINUTE
configADMIN_KEYS_IMPORT_RATE_LIMIT_PER_MINUTE
configADMIN_KEY_REVEAL_RATE_LIMIT_PER_MINUTEMax key reveal attempts per minute in the Admin UI. 20
🔐 secretBRAVE_API_KEYA Brave Search API key. If set, this single key will be used. For multi-key support, add keys via the Admin UI. ""
configBRAVE_HTTP_TIMEOUT_MSPer-request HTTP timeout for the Brave API. 20000
configBRAVE_MAX_QPSMax requests per second to the Brave API to stay within rate limits. 1
configBRAVE_MAX_QUEUE_MSMax time a request can wait in the queue before failing or falling back to Tavily. 30000
configBRAVE_MIN_INTERVAL_MSOverrides BRAVE_MAX_QPS with a fixed minimum interval between requests. ""
configBRAVE_OVERFLOWBehavior when the request queue is full: fallback_to_tavily (default), queue (wait), or error. fallback_to_tavily
configBRAVE_USAGE_CLEANUP_PROBABILITY
🔐 secretBRAVE_USAGE_HASH_SECRET
configBRAVE_USAGE_LOG_MODE
configBRAVE_USAGE_RETENTION_DAYS
configBRAVE_USAGE_SAMPLE_RATE
configDATABASE_URLConnection string for the database. For local setups, a file-based SQLite DB is recommended. file:./tavily_bridge.db
configDEFAULT_PARAMETERS
configENABLE_QUERY_AUTHIf true, also allow passing the MCP client token via query string (?tavilyApiKey=... / ?token=...) instead of Authorization: Bearer .... (Not recommended for production.) false
configENABLE_TAVILY_CREDITS_CHECK
configHOSTThe host address for the server to listen on. 0.0.0.0
configMCP_COOLDOWN_MSCooldown period in milliseconds for an upstream API key after a failure. 60000
configMCP_GLOBAL_RATE_LIMIT_PER_MINUTEMax requests per minute across all clients. 600
configMCP_MAX_RETRIESMaximum number of retries for failed upstream requests. 2
configMCP_RATE_LIMIT_PER_MINUTEMax requests per minute per client token. 60
configPORTThe port for the server to listen on. 8787
configSEARCH_SOURCE_MODEWhen =combined:
configSERVER_SETTINGS_REFRESH_MS
configTAVILY_BRIDGE_BASE_URLSet to your deployment URL (for local Docker Compose: http://localhost:8787).
🔐 secretTAVILY_BRIDGE_MCP_TOKEN"": "<client_token>"
configTAVILY_BRIDGE_MCP_URL
configTAVILY_CREDITS_CACHE_TTL_MSDuration to cache Tavily credit information before it's considered stale. 60000
configTAVILY_CREDITS_COOLDOWN_MSCooldown duration for a key that has fallen below the minimum credit threshold. 300000 (5m)
configTAVILY_CREDITS_MIN_REMAININGCredit threshold at which a Tavily key will be automatically put into cooldown status. 1
configTAVILY_CREDITS_REFRESH_LOCK_MSLock duration to prevent concurrent credit refreshes for the same key. 15000
configTAVILY_CREDITS_REFRESH_MAX_RETRIES
configTAVILY_CREDITS_REFRESH_RETRY_DELAY_MS
configTAVILY_CREDITS_REFRESH_TIMEOUT_MSTimeout for the upstream Tavily credits API request. 5000
configTAVILY_CREDITS_STALE_GRACE_MS
configTAVILY_KEY_SELECTION_STRATEGY
configTAVILY_RESEARCH_ENABLED
configTAVILY_USAGE_CLEANUP_PROBABILITYThe probability (0.0 to 1.0) that a cleanup of old usage logs is triggered on a new usage event. 0.001
🔐 secretTAVILY_USAGE_HASH_SECRETOptional secret for creating a keyed HMAC-SHA256 hash of queries instead of a plain SHA256. Recommended for privacy. ""
configTAVILY_USAGE_LOG_MODELog level for Tavily tool usage: none, hash (query hash only), preview (redacted query), or full query. preview
configTAVILY_USAGE_RETENTION_DAYSOptional retention period for usage logs. If set, old logs will be periodically cleaned up. ""
configTAVILY_USAGE_SAMPLE_RATEOptional sampling rate (0.0 to 1.0) for logging usage events. Empty string means log all events. ""
configVITE_ADMIN_UI_PROXY_TARGET
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 1 concrete improvement we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/greenchannel-mcp-nexus-05rjos)](https://m8ven.ai/mcp/greenchannel-mcp-nexus-05rjos)
commit: e17836c3e14c7b169510c4aae5b21c2789f31075
code hash: b1b0423b113db333be11372eae865f416c376cf9d099f1d3c85f478d3dd341e7
verified: 7/10/2026, 10:10:10 AM
view raw JSON →