Warning. Serious findings were identified. Review the full report before connecting. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
ipJoseph
Source: github_code
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
AUTH_SECRETDREAMS_ENVdev # dev or prdGOOGLE_CLIENT_IDGOOGLE_CLIENT_SECRETDREAMS_DB_PATHFUB_API_KEYFUB_BASE_URLFLASK_SECRET_KEYFLASK_DEBUGCORS_ALLOWED_ORIGINSDREAMS_API_KEYxxx # X-API-Key headerNOTION_API_KEYNOTION_PROPERTIES_DB_IDDISABLE_NOTION_SYNCDASHBOARD_USERNAMEDASHBOARD_PASSWORDCLIENT_PORTFOLIO_KEYFUB_MY_USER_IDFUB_MY_USER_NAMEGOOGLE_MAPS_API_KEYAGENT_HOME_ADDRESSGOOGLE_SHEET_IDDREAMS_PHOTOS_DIRIPQS_API_KEYDASHBOARD_URLAGENT_EMAILAGENT_NAMEAGENT_LICENSEAGENT_PHONEAGENT_WEBSITEAGENT_OFFICEEMAIL_FROM_NAMEBROKERAGE_NAMEAGENT_HEADSHOT_URLBROKERAGE_LOGO_URLWEEKLY_SUMMARY_RECIPIENTMONTHLY_REPORT_RECIPIENTNEW_LISTING_MATCH_THRESHOLDALERT_LOOKBACK_HOURSTRACKED_COUNTIESAUTOMATION_LOG_LEVELPUBLIC_SITE_URLGOOGLE_BACKUP_SHEET_IDEMAIL_TOEMAIL_SUBJECT_PREFIXSQLITE_SYNC_ENABLEDREQUEST_SLEEP_SECONDSDEFAULT_FETCH_LIMITMAX_PARALLEL_WORKERSENABLE_STAGE_SYNCENABLE_CACHECACHE_MAX_AGE_MINUTESCALL_LIST_MIN_PRIORITYCALL_LIST_MAX_ROWSEXCLUDE_LEAD_IDSEXCLUDE_EMAILSFUB_USER_IDFETCH_POND_IDS_ALLFETCH_POND_ID_CAPPEDFETCH_POND_CAPENABLE_SHEETS_BACKUPHIVE_TOKENMLSGRID_TOKENMLSGRID_USE_DEMONAVICA_API_URLNAVICA_DATASET_CODENAVICA_BBO_TOKENNAVICA_IDX_TOKENIDX_EMAILIDX_PHONEBROWSERLESS_TOKENPROXY_HOSTPROXY_PORTPROXY_USERPROXY_PASSFORCE_LOCAL_BROWSERSKIP_PROXYDISPLAYHEAT_WEIGHT_WEBSITE_VISITHEAT_WEIGHT_PROPERTY_VIEWEDHEAT_WEIGHT_PROPERTY_FAVORITEDHEAT_WEIGHT_PROPERTY_SHAREDHEAT_WEIGHT_CALL_INBOUNDHEAT_WEIGHT_TEXT_INBOUNDRECENCY_BONUS_0_3_DAYSRECENCY_BONUS_4_7_DAYSRECENCY_BONUS_8_14_DAYSRECENCY_BONUS_15_30_DAYSPRIORITY_WEIGHT_HEATPRIORITY_WEIGHT_VALUEPRIORITY_WEIGHT_RELATIONSHIPSTAGE_MULTIPLIER_HOT_LEADSTAGE_MULTIPLIER_ACTIVE_BUYERSTAGE_MULTIPLIER_ACTIVE_SELLERSTAGE_MULTIPLIER_NURTURESTAGE_MULTIPLIER_NEW_LEADSTAGE_MULTIPLIER_COLDSTAGE_MULTIPLIER_CLOSEDSTAGE_MULTIPLIER_TRASHLINEAR_SYNC_ENVLINEAR_API_KEYFUB_SYSTEM_NAMEFUB_SYSTEM_KEYLINEAR_POLL_INTERVALFUB_POLL_INTERVALDEAL_CACHE_REFRESHLINEAR_SYNC_API_HOSTLINEAR_SYNC_API_PORTLINEAR_SYNC_LOG_LEVELLINEAR_DEVELOP_TEAM_IDLINEAR_TRANSACT_TEAM_IDLINEAR_GENERAL_TEAM_IDLINEAR_FUB_SYNCED_LABEL_IDTASK_SYNC_ENVTODOIST_API_TOKENTODOIST_USE_WEBHOOKSTODOIST_WEBHOOK_SECRETTODOIST_POLL_INTERVALTASK_SYNC_API_HOSTTASK_SYNC_API_PORTTASK_SYNC_LOG_LEVELCRAWL_TARGETCRAWL_USERCRAWL_PASSWORDDREAMS_LOG_LEVELNEXT_PUBLIC_API_URLNEXT_PUBLIC_GOOGLE_AUTH_ENABLEDNEXT_PUBLIC_GOOGLE_MAPS_API_KEYNEXT_PUBLIC_GOOGLE_MAPS_KEYNEXT_PUBLIC_SUPABASE_ANON_KEYNEXT_PUBLIC_SUPABASE_URLDATABASE_URLFUB_APP_URLSMTP_ENABLEDSMTP_SERVERSMTP_PORTSMTP_USERNAMESMTP_PASSWORDSENTRY_DSNSENTRY_TRACES_SAMPLE_RATESENTRY_RELEASETool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
18/18 tools missing one or more hints — call_tool (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); query_leads (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); query_properties (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +15 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
License file
No license file
Add a LICENSE file (MIT, Apache-2.0, etc.).
Tool test coverage
Only 1/18 tools referenced in tests (6%)
Write tests that reference each tool by name so every tool has at least one test.
Secrets stay with their owner
4 secret/sensitive values flow into network calls (FUB_API_KEY → dynamic, FUB_API_KEY → dynamic)
Audit where credentials are sent. A NOTION_TOKEN should only reach api.notion.com — never a third-party host.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/ipjoseph-mydreams-11i7g3)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check