/ 100

5 days ago

glama

fastmcp-server

Production-ready FastMCP server image that dynamically loads tools, resources, prompts, and knowledge bases from inline, S3, or Git sources.

→ helmforgedev/fastmcp-server · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 5 credentials: MCP_AUTH_TOKEN, SOURCE_GIT_TOKEN, SOURCE_S3_ACCESS_KEY, SOURCE_S3_SECRET_KEY, SOURCE_OCI_PASSWORD

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configMCP_AUTH_TYPE— None =none Development, internal networks

🔐 secretMCP_AUTH_TOKEN— ${MCP_AUTH_TOKEN}

configMCP_SERVER_VERSION

configMCP_SERVER_NAME— my-mcp-server

configEXTRA_PIP_PACKAGES— Comma-separated pip packages to install at startup

configMCP_ON_DUPLICATE_TOOLS— warn Duplicate handling: warn, error, replace, ignore

configMCP_STRICT_LOADING— false Fail on boot if any tool/resource has errors

configMCP_UI_ENABLED— Auto-refreshes every 15 seconds. Disable with =false.

configLOG_FORMAT— Set =json for JSON-structured logs compatible with Loki, ELK, CloudWatch, and Datadog:

configMCP_RATE_LIMIT_DEFAULT

configMCP_CACHE_ENABLED

configMCP_CACHE_MAX_SIZE

configSOURCE_INLINE_DIR

configSOURCE_S3_ENABLED— false Enable S3 sync

configSOURCE_GIT_ENABLED— false Enable Git sync

configSOURCE_S3_BUCKET— Bucket name

configSOURCE_GIT_REPOSITORY— e =https://github.com/myorg/mcp-tools.git \

configSOURCE_GIT_BRANCH— main Branch to clone

configMCP_WORKSPACE— /app/workspace Workspace directory

configMCP_PATH— /mcp HTTP endpoint path

configMCP_HOST— 0.0.0.0 Listen address

configMCP_PORT— 8000 Listen port

configMCP_MOUNT_SERVERS

configMCP_MODE

configMCP_HOT_RELOAD

configSOURCE_OCI_ENABLED

configSOURCE_GIT_PATH— Subdirectory within the repo

🔐 secretSOURCE_GIT_TOKEN— For private repos, set with a personal access token.

configSOURCE_GIT_INCLUDE

configSOURCE_GIT_EXCLUDE

configSOURCE_S3_ENDPOINT— S3-compatible endpoint URL

configSOURCE_S3_REGION— us-east-1 AWS region

configSOURCE_S3_PREFIX— Key prefix filter

🔐 secretSOURCE_S3_ACCESS_KEY— minioadmin

🔐 secretSOURCE_S3_SECRET_KEY— minioadmin

configSOURCE_S3_INCLUDE

configSOURCE_S3_EXCLUDE

configSOURCE_OCI_REGISTRY

configSOURCE_OCI_TAG

configSOURCE_OCI_USERNAME

🔐 secretSOURCE_OCI_PASSWORD

configSOURCE_OCI_INCLUDE

configSOURCE_OCI_EXCLUDE

configLOG_LEVEL— INFO Logging level

configMCP_METRICS_ENABLED— Enable with =true. Exposes at /metrics:

configSOURCE_S3_SYNC_INTERVAL

configSOURCE_GIT_SYNC_INTERVAL

configMCP_MAX_MEMORY_MB

configMCP_MAX_OUTPUT_SIZE_KB

configMCP_MASK_ERROR_DETAILS— false Hide internal error details from clients

configMCP_AUTH_JWT_ISSUER— JWT issuer

configMCP_AUTH_JWT_AUDIENCE— JWT audience

configMCP_AUTH_JWT_JWKS_URI— JWKS endpoint URL

configMCP_AUTH_PROVIDERS

configMCP_ENABLE_TAGS

configMCP_DISABLE_TAGS

configMCP_VISIBILITY_MODE

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 1 concrete improvement we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/helmforgedev-fastmcp-server-1tygb5)](https://m8ven.ai/mcp/helmforgedev-fastmcp-server-1tygb5)

commit: 703b142eb4750afd5c6e6f7895bedc809c6f5708

code hash: 602b96390f5f8a47b90cd45f27df366d3db0778f605d4f9e9f45cdba0ad912af

verified: 6/15/2026, 3:11:34 PM

view raw JSON →