Back to MCP Trust Indexm8ven
0
/ 100
27 days ago
glama

NeuroLink

TypeScript AI SDK with a built-in MCP client: 58+ MCP servers over 4 transports (stdio, HTTP, SSE, WebSocket), 24+ LLM providers behind one interface, streaming, tool calling, RAG, voice (TTS/STT/realtime), and task scheduling.

→ juspay/neurolink· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

GlamaGitHub

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
🚨
Secret credentials may flow to a network call
1 flow detected: LITELLM_API_KEY. We can’t prove the destination matches the brand the credential belongs to.
🚨
Code appears obfuscated
1 file are unreadable to a human reviewer. Cannot audit what they do.
⚠️
Known vulnerabilities in dependencies: 3 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 22 credentials: ALGOLIA_ADMIN_API_KEY, ALGOLIA_SEARCH_API_KEY, ANTHROPIC_API_KEY, BETTER_AUTH_SECRET, CLERK_PUBLISHABLE_KEY, CLERK_SECRET_KEY, FIREBASE_API_KEY, GEMINI_API_KEY, GOOGLE_AI_API_KEY, GOOGLE_GENERATIVE_AI_API_KEY, HUGGINGFACE_API_KEY, JWT_PUBLIC_KEY, JWT_SECRET, LITELLM_API_KEY, MISTRAL_API_KEY, NEUROLINK_OPENOBSERVE_PASSWORD, OAUTH2_CLIENT_SECRET, OPENAI_API_KEY, POSTHOG_API_KEY, SUPABASE_ANON_KEY, SUPABASE_JWT_SECRET, WORKOS_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies3 high1 medium6 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

highhono@4.12.21GHSA-88fw-hqm2-52qc

hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard

highws@8.20.1GHSA-96hv-2xvq-fx4p

ws: Memory exhaustion DoS from tiny fragments and data chunks

highvite@8.0.5GHSA-fx2h-pf6j-xcff

vite: `server.fs.deny` bypass on Windows alternate paths

mediumvite@8.0.5GHSA-v6wh-96g9-6wx3

launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows

low@opentelemetry/core@2.6.0GHSA-8988-4f7v-96qf

OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
🔐 secretALGOLIA_ADMIN_API_KEY
configALGOLIA_APP_ID
🔐 secretALGOLIA_SEARCH_API_KEY
🔐 secretANTHROPIC_API_KEY— sk-ant-...
configAUTH0_AUDIENCE
configAUTH0_CLIENT_ID
configAUTH0_DOMAIN
configAUTO_BADGE_DETECTION
configAWS_ACCESS_KEY_ID
configAWS_REGION
configBETTER_AUTH_BASE_URL
🔐 secretBETTER_AUTH_SECRET
configBIND_HOST
🔐 secretCLERK_PUBLISHABLE_KEY
🔐 secretCLERK_SECRET_KEY
configCOGNITO_CLIENT_ID
configCOGNITO_REGION
configCOGNITO_USER_POOL_ID
configCOMMIT_MSG_FILE
configDEFAULT_PROVIDER
configDOCS_BASE_URL
configENABLE_FALLBACK
configENABLE_STREAMING
🔐 secretFIREBASE_API_KEY
configFIREBASE_PROJECT_ID
configGA_TRACKING_ID
🔐 secretGEMINI_API_KEY
configGIT_BASE_BRANCH
🔐 secretGOOGLE_AI_API_KEY
configGOOGLE_AI_MODEL
configGOOGLE_AI_VIDEO_MODEL
configGOOGLE_APPLICATION_CREDENTIALS
configGOOGLE_AUTH_CLIENT_EMAIL
configGOOGLE_CLOUD_PROJECT
🔐 secretGOOGLE_GENERATIVE_AI_API_KEY
configGOOGLE_VERTEX_LOCATION
configGOOGLE_VERTEX_PROJECT
🔐 secretHUGGINGFACE_API_KEY
configJWT_AUDIENCE
configJWT_ISSUER
🔐 secretJWT_PUBLIC_KEY
🔐 secretJWT_SECRET
configKEYCLOAK_CLIENT_ID
configKEYCLOAK_REALM
configKEYCLOAK_SERVER_URL
🔐 secretLITELLM_API_KEY
configLITELLM_BASE_URL
configLITELLM_MODEL
configLITELLM_VIDEO_MODEL
🔐 secretMISTRAL_API_KEY
configMISTRAL_MODEL
configMODEL_SERVER_PORT
configNEUROLINK_OPENOBSERVE_BASIC_AUTH
configNEUROLINK_OPENOBSERVE_ORG
🔐 secretNEUROLINK_OPENOBSERVE_PASSWORD
configNEUROLINK_OPENOBSERVE_URL
configNEUROLINK_OPENOBSERVE_USER
configNEUROLINK_PROXY_TELEMETRY_MAX_LAG_SEC
configOAUTH2_AUTHORIZATION_URL
configOAUTH2_CLIENT_ID
🔐 secretOAUTH2_CLIENT_SECRET
configOAUTH2_JWKS_URL
configOAUTH2_TOKEN_URL
configOAUTH2_USERINFO_URL
configOG_IMAGE_SITE_URL
configOLLAMA_BASE_URL
🔐 secretOPENAI_API_KEY
configPORT
🔐 secretPOSTHOG_API_KEY
configPOSTHOG_HOST
configPROMPT_TYPE
configPROVIDER
🔐 secretSUPABASE_ANON_KEY
🔐 secretSUPABASE_JWT_SECRET
configSUPABASE_URL
configVERTEX_VIDEO_MODEL
🔐 secretWORKOS_API_KEY
configWORKOS_CLIENT_ID
configDOCS_URL
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/juspay-neurolink-1bq0lz)](https://m8ven.ai/mcp/juspay-neurolink-1bq0lz)
commit: 9521b4ec0bccf105a4f9bfce8974293e08fd35a5
code hash: 3b0eae8c50a2ec85328a001ae3044d50cc827a89a653c08e68a06d4d0146f764
verified: 7/4/2026, 9:10:25 AM
view raw JSON →