Back to MCP Trust Indexm8ven
54
/ 100
1 month ago
glama

MCP Coding Agents

A transport-agnostic MCP server that integrates multiple AI coding agents (Claude Code, Gemini, and Codex) with built-in tools for command execution, calculations, and streaming capabilities. Supports both STDIO and HTTP transports for flexible deployment.

→ kadreio/mcp-coding-agents· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
⚠️
Known vulnerabilities in dependencies: 17 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
🔐
You'll be asked for 2 credentials: ANTHROPIC_API_KEY, CLAUDE_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies17 high1 medium5 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@anthropic-ai/claude-code@1.0.58GHSA-4fgq-fpq9-mr3g

Claude Code can execute commands prior to the startup trust dialog

high@anthropic-ai/claude-code@1.0.58GHSA-66q4-vfjg-2qhh

Claude Code Vulnerable to Command Injection via Directory Change Bypasses Write Protection

high@anthropic-ai/claude-code@1.0.58GHSA-7mv8-j34q-vp7q

@anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File Writes

high@anthropic-ai/claude-code@1.0.58GHSA-ff64-7w26-62rf

Claude Code has Sandbox Escape via Persistent Configuration Injection in settings.json

high@anthropic-ai/claude-code@1.0.58GHSA-j4h9-wv2m-wrf7

Claude Code vulnerable to arbitrary code execution caused by maliciously configured git email

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
🔐 secretANTHROPIC_API_KEY— sk-ant-... # Required for Claude Code
🔐 secretCLAUDE_API_KEY
configCLAUDE_API_KEYS
configCLAUDE_CODE_AUTH_ENABLED
configCLAUDE_CODE_DEFAULT_CWD— /path # Default working directory
configCLAUDE_CODE_DEFAULT_MODEL— ... # Default Claude model
configCLAUDE_CODE_DEFAULT_PERMISSION_MODE
configCLAUDE_CODE_ENABLE— true # Enable/disable Claude Code tool
configCLAUDE_CODE_EXECUTABLE_PATH— /path/to/claude # Path to Claude executable (auto-detected if not set)
configCLAUDE_CODE_INCLUDE_SYSTEM_MESSAGES
configCLAUDE_CODE_MAX_MESSAGES— 100 # Max messages to return
configCLAUDE_CODE_MAX_TURNS
configMCP_DATABASE_PATH— /path/to/sessions.db # Custom database location
configPORT— 3050 # HTTP server port (default: 3050)
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 3 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/kadreio-mcp-coding-agents-1v1r1q)](https://m8ven.ai/mcp/kadreio-mcp-coding-agents-1v1r1q)
commit: b8b9cc1b67639e194cd20fadbbcadf6ef31b3ff8
code hash: 078d3f2b5d815ac12ebbb6f97abadb06493e6f3112419bc326d01a632ccdd8c5
verified: 6/17/2026, 12:35:02 PM
view raw JSON →