/ 100

1 month ago

glama

SpecForge

Item: SpecForge
Rating: 43
Author: M8ven

SpecForge is a Model Context Protocol (MCP) server that connects an LLM client to a fully autonomous code-fixing pipeline. Point it at a GitHub issue, and it reads the repo, plans a fix, writes the code, tests it, and opens a pull request.

→ Johnbliss60/SpecForge · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

🚨

Secret credentials may flow to a network call

1 flow detected: EXPO_PUBLIC_CREATE_TEMP_API_KEY. We can’t prove the destination matches the brand the credential belongs to.

🔐

You'll be asked for 10 credentials: APPLE_CLIENT_SECRET, CYOPS_API_KEY, EXPO_PUBLIC_CREATE_TEMP_API_KEY, EXPO_PUBLIC_GOOGLE_MAPS_API_KEY, EXPO_PUBLIC_REVENUE_CAT_APP_STORE_API_KEY, EXPO_PUBLIC_REVENUE_CAT_PLAY_STORE_API_KEY, EXPO_PUBLIC_REVENUE_CAT_TEST_STORE_API_KEY, GITHUB_TOKEN, GOOGLE_CLIENT_SECRET, MINIMAX_API_KEY

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configAPPLE_APP_BUNDLE_IDENTIFIER

configAPPLE_CLIENT_ID

🔐 secretAPPLE_CLIENT_SECRET

configBETTER_AUTH_URL

🔐 secretCYOPS_API_KEY— cyops_xxxxxxxxxxxxxxxxxxxx

configCYOPS_GATEWAY_URL

configDATABASE_URL

configEXPO_PUBLIC_ANALYTICS_ENDPOINT

configEXPO_PUBLIC_APP_URL

configEXPO_PUBLIC_BASE_URL

configEXPO_PUBLIC_CREATE_ENV

🔐 secretEXPO_PUBLIC_CREATE_TEMP_API_KEY

configEXPO_PUBLIC_DEV_SERVER_ID

🔐 secretEXPO_PUBLIC_GOOGLE_MAPS_API_KEY

configEXPO_PUBLIC_HOST

configEXPO_PUBLIC_IS_ANYTHING_APP

configEXPO_PUBLIC_LOGS_ENDPOINT

configEXPO_PUBLIC_PROJECT_GROUP_ID

configEXPO_PUBLIC_PROXY_BASE_URL

🔐 secretEXPO_PUBLIC_REVENUE_CAT_APP_STORE_API_KEY

🔐 secretEXPO_PUBLIC_REVENUE_CAT_PLAY_STORE_API_KEY

🔐 secretEXPO_PUBLIC_REVENUE_CAT_TEST_STORE_API_KEY

configEXPO_PUBLIC_SENTRY_DSN

🔐 secretGITHUB_TOKEN— ghp_xxxxxxxxxxxxxxxxxxxx

configGOOGLE_CLIENT_ID

🔐 secretGOOGLE_CLIENT_SECRET

🔐 secretMINIMAX_API_KEY

configNEXT_PUBLIC_CREATE_AUTH_PROVIDERS

configNEXT_PUBLIC_CREATE_BASE_URL

configNEXT_PUBLIC_CREATE_ENV

configNEXT_PUBLIC_CREATE_HOST

configNEXT_PUBLIC_PROJECT_GROUP_ID

configPUBLISH_PACKAGE_REQUIREMENTS

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 1 concrete improvement we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/johnbliss60-specforge-v6przs)](https://m8ven.ai/mcp/johnbliss60-specforge-v6przs)

commit: d8db84abfbbbb2ec1dc8d43ef5c7523e11b36c20

code hash: e5654ad1e9105f425bd622b02416eebe213e777b1179f99becc6964aa2a2a4a7

verified: 6/18/2026, 10:30:05 AM

view raw JSON →