iris-eval/mcp-server

MCP-native agent evaluation and observability server. Log traces, evaluate output quality with 12 built-in rules (PII detection, prompt injection, cost thresholds), and track agent costs. Real-time dashboard, OTel-compatible spans. Self-hosted, MIT licensed.

→ iris-eval/mcp-server · listed on glama

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

🚨

Secret credentials may flow to a network call

2 flows detected: DEVTO_API_KEY. We can’t prove the destination matches the brand the credential belongs to.

🔐

You'll be asked for 4 credentials: DEVTO_API_KEY, IRIS_API_KEY, KV_REST_API_TOKEN, WAITLIST_ADMIN_KEY

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

🔐 secretDEVTO_API_KEY

configDRY_RUN

configIRIS_ALLOWED_ORIGINS— Comma-separated allowed CORS origins

configIRIS_ALREADY_RUNNING

🔐 secretIRIS_API_KEY— API key for HTTP authentication

configIRIS_DASHBOARD— Enable dashboard (true/false)

configIRIS_DASHBOARD_PORT

configIRIS_DB_PATH— Database path

configIRIS_LOG_LEVEL— Log level: debug, info, warn, error

configIRIS_PORT

configIRIS_TRANSPORT— Transport type

🔐 secretKV_REST_API_TOKEN

configKV_REST_API_URL

configMAX_NEW

configRATE_LIMIT_SALT

🔐 secretWAITLIST_ADMIN_KEY

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/iris-eval-mcp-server-1owzx9)](https://m8ven.ai/mcp/iris-eval-mcp-server-1owzx9)

commit: acbcd0ab2b9335523b20e587b52bea8de5249441

code hash: c521c916091614b1325813c9ef184594aba57786663d6b9770573857d92891c7

verified: 4/11/2026, 2:35:09 PM

view raw JSON →