C
Emerging
74/100
1 day ago

Emerging. No concerning findings. Grades remain capped until the project builds reputation through adoption. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

Jacktoolsnet

Source: github_code

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
🚨
Secret credentials may flow to a network call
1 flow detected: KLIPY_API_KEY. We can’t prove the destination matches the brand the credential belongs to.
🔐
You'll be asked for 15 credentials: BACKEND_DB_PASSWORD, DB_PASSWORD, DEEPL_API_KEY, ENCRYPTION_KEY_PASSWORD, JWT_SECRET, KLIPY_API_KEY, POW_SECRET, SIGNING_KEY_PASSWORD, STICKER_RENDER_TOKEN_SECRET, TENOR_API_KEY, TENOR_CLIENT_KEY, UNSPLASH_ACCESS_KEY, VAPID_KEY_PASSWORD, VAPID_PRIVATE_KEY, VAPID_PUBLIC_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configADMIN_BASE_URL
configADMIN_LOG_URL
configADMIN_PORT
configADMIN_PROXY_TIMEOUT_MS
configAPP_STAGE
configAPP_URL
configBACKEND_DATABASE_URL
configBACKEND_DB_HOST
configBACKEND_DB_NAME
🔐 secretBACKEND_DB_PASSWORD
configBACKEND_DB_POOL_MAX
configBACKEND_DB_PORT
configBACKEND_DB_SSL
configBACKEND_DB_USER
configBASE_URL
configCONTACT_MESSAGE_MAX_BYTES
configCONTACT_MESSAGE_TOMBSTONE_RETENTION_DAYS
configCONTACT_PROFILE_MAX_BYTES
configCONTACT_PROFILE_REQUEST_TTL_SECONDS
configCONTACT_PROFILE_RESPONSE_TTL_SECONDS
configCONTACT_PUSH_BODY
configDB_HOST
configDB_MAX_PENDING_REQUESTS
configDB_NAME
configDB_OVERLOAD_RETRY_AFTER_SECONDS
🔐 secretDB_PASSWORD
configDB_POOL_MAX
configDB_PORT
configDB_SSL
configDB_USER
🔐 secretDEEPL_API_KEY
configDEPLOYMENT_STAGE
configDSA_EVIDENCE_MAX_FILE_MB
configDSA_REPORTS_PER_IP_PER_HOUR
🔐 secretENCRYPTION_KEY_PASSWORD
configEXIT_ON_UNHANDLED
configFRONTEND_URL_Q
configGEODATA_AVAILABILITY_CACHE_MS
configGEODATA_BASE_URL
configGEODATA_EXPORT_PROXY_TIMEOUT_MS
configGEODATA_PORT
configGEODATA_PROXY_TIMEOUT_MS
configGEODATA_PUBLIC_RATE_LIMIT
configGEODATA_PUBLIC_RATE_LIMIT_WINDOW_MS
configGEOSTATISTIC_EXTERNAL_TIMEOUT_MS
configJWT_AUD
configJWT_ISS
🔐 secretJWT_SECRET
🔐 secretKLIPY_API_KEY
configKLIPY_API_TIMEOUT_MS
configKLIPY_BASE_URL
configKLIPY_CONTENT_FILTER
configKLIPY_FORMAT_FILTER
configKLIPY_PER_PAGE
configLOCAL_PUBLIC_SHARE_BASE_URL
configLOG_FORWARD_CONCURRENCY
configLOG_FORWARD_MAX_QUEUE
configLOG_RETENTION_ERROR
configLOG_RETENTION_INFO
configLOG_RETENTION_WARN
configNOMINATIM_BASE_URL
configNOMINATIM_PORT
configOPENAI_API_KEY_MODERATION
configOPENAI_MODERATION_MODEL
configOPENMETEO_BASE_URL
configOPENMETEO_PORT
configOPENMETEO_PROXY_TIMEOUT_MS
configOPENMETEO_UPSTREAM_TIMEOUT_MS
configORIGIN
configPIN_SALT
configPOW_DIFFICULTY
configPOW_EVIDENCE_DIFFICULTY
configPOW_MAX_DIFFICULTY
configPOW_REQUIRE_TTL_MS
🔐 secretPOW_SECRET
configPOW_SUSPICIOUS_THRESHOLD
configPOW_THRESHOLD
configPOW_TTL_MS
configPOW_WINDOW_MS
configPUBLIC_APP_URL_Q
configPUBLIC_APP_URL_Q_STAGE
configPUBLIC_MESSAGE_SEARCH_CACHE_MAX
configPUBLIC_MESSAGE_SEARCH_CACHE_TTL_MS
configPUBLIC_SHARE_BASE_URL
configPUBLIC_SHARE_BASE_URL_Q
configPUBLIC_SHARE_BASE_URL_Q_STAGE
configPUBLIC_SITE_URL
configPUBLIC_STAGE
configQ_FRONTEND_URL
configQ_PUBLIC_FRONTEND_URL
configQ_PUBLIC_SHARE_BASE_URL
configRESOLVE_DNS_TIMEOUT_MS
configRESOLVE_REQUEST_TIMEOUT_MS
configSERVICE_JWT_AUDIENCE
configSERVICE_JWT_AUDIENCE_ADMIN
configSERVICE_JWT_AUDIENCE_BACKEND
configSERVICE_JWT_AUDIENCE_GEODATA
configSERVICE_JWT_AUDIENCE_NOMINATIM
configSERVICE_JWT_AUDIENCE_OPENMETEO
configSERVICE_JWT_AUDIENCE_SOCKET
configSERVICE_JWT_AUDIENCE_STICKER
configSERVICE_JWT_AUDIENCE_TRIPGO
configSERVICE_JWT_AUDIENCE_VIATOR
configSERVICE_JWT_AUDIENCE_WIKIPEDIA
configSERVICE_JWT_ISSUER
configSERVICE_JWT_TRUSTED_JWKS
configSERVICE_JWT_TRUSTED_JWKS_PATH
🔐 secretSIGNING_KEY_PASSWORD
configSITE_URL
configSLOW_REQUEST_GEODATA_THRESHOLD_MS
configSLOW_REQUEST_LOG_ENABLED
configSLOW_REQUEST_LOG_MAX_PER_MINUTE
configSLOW_REQUEST_MESSAGE_CREATE_THRESHOLD_MS
configSLOW_REQUEST_MESSAGE_PUBLISH_THRESHOLD_MS
configSLOW_REQUEST_NOMINATIM_THRESHOLD_MS
configSLOW_REQUEST_THRESHOLD_MS
configSLOW_REQUEST_WIKIPEDIA_THRESHOLD_MS
configSOCKETIO_BASE_URL
configSOCKETIO_PORT
configSTAGE
configSTARTUP_DEBUG
configSTICKER_BASE_URL
configSTICKER_PORT
configSTICKER_PROXY_TIMEOUT_MS
configSTICKER_RENDER_TOKEN_AUDIENCE
configSTICKER_RENDER_TOKEN_ISSUER
🔐 secretSTICKER_RENDER_TOKEN_SECRET
configSTICKER_RENDER_TOKEN_TTL_SECONDS
🔐 secretTENOR_API_KEY
configTENOR_BASE_URL
🔐 secretTENOR_CLIENT_KEY
configTRIPGO_BASE_URL
configTRIPGO_PORT
configTRIPGO_PROXY_TIMEOUT_MS
configTRIPGO_PUBLIC_RATE_LIMIT
configTRIPGO_PUBLIC_RATE_LIMIT_WINDOW_MS
configTRUST_PROXY
🔐 secretUNSPLASH_ACCESS_KEY
configUNSPLASH_BASE_URL
🔐 secretVAPID_KEY_PASSWORD
🔐 secretVAPID_PRIVATE_KEY
🔐 secretVAPID_PUBLIC_KEY
configVAPID_SUBJECT
configVIATOR_BASE_URL
configVIATOR_PORT
configVIATOR_PROXY_TIMEOUT_MS
configWIKIPEDIA_BASE_URL
configWIKIPEDIA_PORT
configWIKIPEDIA_PROXY_TIMEOUT_MS
configWIKIPEDIA_PUBLIC_RATE_LIMIT
configWIKIPEDIA_PUBLIC_RATE_LIMIT_WINDOW_MS
Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.
deployDATABASE_URL
deployLOCAL_PUBLIC_APP_URL
deployPORT
deployPUBLIC_APP_URL
deployQ_PUBLIC_APP_URL
// quality suggestions

README present

No README found

Add a README.md describing the server and its tools.

License file

No license file

Add a LICENSE file (MIT, Apache-2.0, etc.).

Tests exist

No test files found

Add tests that exercise each declared tool.

Dependency freshness

1/19 production deps stale: web-push@2024-01-16 (2.6y)

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 3 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/jacktoolsnet-messagedrop-1f5us3)](https://m8ven.ai/mcp/jacktoolsnet-messagedrop-1f5us3)
Shows your grade and updates automatically. Prefer no grade? Append ?variant=verified to the badge URL.
commit: e32e3a59e7b95b77126a55d31ce9d0a90007675a
code hash: b55bb288cba2dca356de7cdcbcb13013bf4245f177e7fb8540f4b38d353b7ca7
verified: 8/19/2026, 3:24:22 AM
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client