2
/ 100
1 month ago
glama

ThumbGate

An MCP server that provides memory management and gateway capabilities, enabling persistent storage and retrieval of contextual information across sessions.

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
🚨
Reads files from sensitive locations
Touches: /.dockerenv, /.dockerenv
🔐
You'll be asked for 19 credentials: CLOUDFLARE_SANDBOX_SHARED_SECRET, GEMINI_API_KEY, GH_TOKEN, GITHUB_MARKETPLACE_WEBHOOK_SECRET, GITHUB_TOKEN, GOOGLE_API_KEY, PERPLEXITY_API_KEY, PLAUSIBLE_API_KEY, POSTHOG_API_KEY, POSTHOG_PERSONAL_API_KEY, RESEND_API_KEY, STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET, THUMBGATE_API_KEY, THUMBGATE_CLOUDFLARE_SANDBOX_SECRET, THUMBGATE_GEMINI_API_KEY, THUMBGATE_OPERATOR_KEY, THUMBGATE_PERPLEXITY_API_KEY, THUMBGATE_RESEND_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

lowprotobufjs@8.5.0GHSA-f38q-mgvj-vph7

protobufjs : Schema-derived names can shadow runtime-significant properties

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configADK_FAKE_CONSOLIDATION
configADK_STATE_FILE
configALLOW_BARE_BOT_AUTHOR
configCLAUDE_PLUGIN_DATA
configCLAUDE_PLUGIN_ROOT
configCLAUDE_PROJECT_DIR
configCLAUDE_USER_PROMPT
🔐 secretCLOUDFLARE_SANDBOX_SHARED_SECRET
configCODEX_USER_PROMPT
configCONTAINER
configCONTINUOUS_INTEGRATION
configComSpec
configDO_NOT_TRACK
configGA4_PROPERTY_ID
🔐 secretGEMINI_API_KEY
🔐 secretGH_TOKEN
configGITHUB_ACTIONS
🔐 secretGITHUB_MARKETPLACE_WEBHOOK_SECRET
configGITHUB_REPOSITORY
🔐 secretGITHUB_TOKEN
🔐 secretGOOGLE_API_KEY
configGOOGLE_APPLICATION_CREDENTIALS
configGOOGLE_CLIENT_EMAIL
configGOOGLE_CLOUD_PROJECT
configINIT_CWD
configLARGE_ADD_THRESHOLD
configLESSON_DB_PATH
configMCP_TRANSPORT
🔐 secretPERPLEXITY_API_KEY
🔐 secretPLAUSIBLE_API_KEY
configPLAUSIBLE_DOMAIN
configPLAUSIBLE_SITE_ID
configPLAYWRIGHT_HOST
configPLAYWRIGHT_PORT
configPORT
🔐 secretPOSTHOG_API_KEY
🔐 secretPOSTHOG_PERSONAL_API_KEY
configPOSTHOG_PROJECT_ID
configPR_NUMBER
🔐 secretRESEND_API_KEY
configRESEND_FROM
configRESEND_FROM_EMAIL
configSHELL
configSTRIPE_PRICE_ID
configSTRIPE_PRICE_ID_PRO_ANNUAL
configSTRIPE_PRICE_ID_PRO_MONTHLY
configSTRIPE_PRICE_ID_TEAM_MONTHLY
configSTRIPE_PRODUCT_ID
🔐 secretSTRIPE_SECRET_KEY
🔐 secretSTRIPE_WEBHOOK_SECRET
configTHUMBGATE_ACTION_LOG
configTHUMBGATE_ALLOW_INSECURE
configTHUMBGATE_ALLOW_UNSIGNED_STRIPE_WEBHOOKS
🔐 secretTHUMBGATE_API_KEYH "Authorization: Bearer $" \
configTHUMBGATE_API_URL
configTHUMBGATE_ATTRIBUTED_FEEDBACK
configTHUMBGATE_ATTRIBUTION_WINDOW_MS
configTHUMBGATE_AUTO_PACKS_DIR
configTHUMBGATE_BILLING_API_BASE_URL
configTHUMBGATE_BUDGET_CONFIG_PATH
configTHUMBGATE_BUDGET_PROFILE
configTHUMBGATE_BUDGET_STATE_PATH
configTHUMBGATE_CLAUDE_HISTORY_PATH
🔐 secretTHUMBGATE_CLOUDFLARE_SANDBOX_SECRET
configTHUMBGATE_CODEGRAPH_AUTO_INDEX
configTHUMBGATE_CODEGRAPH_BIN
configTHUMBGATE_CODEGRAPH_DISABLED
configTHUMBGATE_CODEGRAPH_STUB_RESPONSE
configTHUMBGATE_CODEGRAPH_TIMEOUT_MS
configTHUMBGATE_CODEX_BIN
configTHUMBGATE_CONTEXTFS_DIR
configTHUMBGATE_DASHBOARD_NO_OPEN
configTHUMBGATE_DEBUG_CHAT
configTHUMBGATE_DFCX_BLOCK_MESSAGE
configTHUMBGATE_DFCX_FULFILLMENT_URL
configTHUMBGATE_DISABLE_CLAUDE_HISTORY_SYNC
configTHUMBGATE_DISABLE_MCP_FIREWALL
configTHUMBGATE_FEEDBACK_ATTRIBUTIONS
configTHUMBGATE_FEEDBACK_DIR
configTHUMBGATE_FUNNEL_LEDGER_PATH
🔐 secretTHUMBGATE_GEMINI_API_KEY
configTHUMBGATE_GEMINI_MODEL
configTHUMBGATE_GITHUB_MARKETPLACE_PLAN_PRICES_JSON
configTHUMBGATE_HERMES_WARN_ONLY
configTHUMBGATE_HOTFIX_BYPASS
configTHUMBGATE_INCLUDE_LEGACY_BILLING_DATA
configTHUMBGATE_INSTALL_EMAIL_ENDPOINT
configTHUMBGATE_LOCAL_LLM_ENDPOINT
configTHUMBGATE_LOCAL_LLM_MODEL
configTHUMBGATE_LOCK_STALE_MS
configTHUMBGATE_MAX_ACTIONS
configTHUMBGATE_MAX_TIME_MINUTES
configTHUMBGATE_MONTHLY_BUDGET_USD
configTHUMBGATE_NO_NUDGE
configTHUMBGATE_NO_TELEMETRY
configTHUMBGATE_OBSIDIAN_VAULT_PATH
🔐 secretTHUMBGATE_OPERATOR_KEY
🔐 secretTHUMBGATE_PERPLEXITY_API_KEY
configTHUMBGATE_PROJECT_DIR
configTHUMBGATE_PROOF_DIR
configTHUMBGATE_PUBLIC_APP_ORIGIN
🔐 secretTHUMBGATE_RESEND_API_KEY
configTHUMBGATE_REVENUE_LEDGER_PATH
configTHUMBGATE_RULE_TTL_DAYS
configTHUMBGATE_SEMANTIC_CACHE_ENABLED
configTHUMBGATE_SEMANTIC_CACHE_THRESHOLD
configTHUMBGATE_SEMANTIC_CACHE_TTL_SECONDS
configTHUMBGATE_STRICT_ENFORCEMENT
configTHUMBGATE_SUPPORT_EMAIL
configTHUMBGATE_TRIAL_EMAIL_FROM
configTHUMBGATE_TRIAL_EMAIL_LEDGER_PATH
configTHUMBGATE_TRIAL_EMAIL_REPLY_TO
configTHUMBGATE_USER_PROMPT
configVERTEX_PROJECT_ID
config_TEST_API_KEYS_PATH
config_TEST_FUNNEL_LEDGER_PATH
config_TEST_INCLUDE_LEGACY_BILLING_DATA
config_TEST_LOCAL_CHECKOUT_SESSIONS_PATH
config_TEST_NEWSLETTER_SUBSCRIBERS_PATH
config_TEST_REVENUE_LEDGER_PATH
config_TEST_STRIPE_RECONCILED_REVENUE_EVENTS_JSON
config_TEST_TRIAL_EMAIL_LEDGER_PATH
configcontainer
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 3 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/igorganapolsky-thumbgate-13sqwp)](https://m8ven.ai/mcp/igorganapolsky-thumbgate-13sqwp)
commit: 8aa6e3b936fa1ceb424a88bed09b589f0085c963
code hash: 4d3fa9de1c2cfd80cb69df3b90bbe1e4362b95d26df9d1b048438251ca00aff5
verified: 6/16/2026, 11:35:30 AM
view raw JSON →