Back to MCP Trust Indexm8ven
F
Warning
26/100
17 hours ago

agnes-the-ai-analyst

Agnes — self-hosted AI harness for organizations: governed data access, agents as an API, a skills marketplace, corporate memory, and hosted data apps — one RBAC/audit spine behind web chat, Slack, MCP, and CLI

→ keboola/agnes-the-ai-analyst· listed on github_code

Warning. Serious findings were identified. Review the full report before connecting. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

keboola

Source: github_code

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

GitHub

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
🚨
Code appears obfuscated
1 file are unreadable to a human reviewer. Cannot audit what they do.
🔐
You'll be asked for 10 credentials: AGNES_TOKEN, JWT_SECRET_KEY, ANTHROPIC_IDENTITY_TOKEN, ANTHROPIC_API_KEY, E2B_API_KEY, SEED_ADMIN_PASSWORD, SCHEDULER_API_TOKEN, AGNES_GWS_CLIENT_SECRET, LLM_API_KEY, GITHUB_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
🔐 secretAGNES_TOKEN
configAGNES_URL
configTESTING
🔐 secretJWT_SECRET_KEY
🔐 secretANTHROPIC_IDENTITY_TOKEN
configANTHROPIC_IDENTITY_TOKEN_FILE
🔐 secretANTHROPIC_API_KEY
🔐 secretE2B_API_KEY
configSERVER_URL
configAGNES_INTERNAL_URL
configAGNES_REBUILD_ON_BOOT
configUVICORN_WORKERS
configAGNES_STATE_CHECKPOINT_INTERVAL_S
configAGNES_THREADPOOL_SIZE
configSEED_ADMIN_EMAIL
🔐 secretSEED_ADMIN_PASSWORD
configCORS_ORIGINS
configAGNES_VERSION
configRELEASE_CHANNEL
configLOCAL_DEV_GROUPS
configAGNES_NO_UPDATE_CHECK
configAGNES_SELF_UPGRADE_IN_PROGRESS
configDATA_DIR
configAPI_URL
🔐 secretSCHEDULER_API_TOKEN
configSCHEDULER_INITIAL_WORKSPACE_SCHEDULE
configSCHEDULER_VERIFICATION_SCHEDULE
configSCHEDULER_AGENT_SCHEDULES
configAGNES_MCP_INTERNAL_URL
configAGNES_DATA_DIR
configAGNES_MCP_SESSION_POOL
configAGNES_CONFIG_DIR
configKEBOOLA_STACK_URL
configBIGQUERY_PROJECT
configBIGQUERY_LOCATION
configDATA_SOURCE
configSLACK_TRANSPORT
configAGNES_HOME_ROUTE
configPUBLIC_URL
configAGNES_GWS_CLIENT_ID
🔐 secretAGNES_GWS_CLIENT_SECRET
configAGNES_GWS_OAUTHLIB_INSECURE_TRANSPORT
configAGNES_GWS_PROJECT_ID
configAGNES_INSTANCE_EXPERIENCE
configAGNES_INSTANCE_THEME
configAGNES_UI_LAYOUT
configAGNES_HOME_SHOW_AUTOMODE
configAGNES_HOME_SHOW_STATUS_FRAME
configAGNES_INSTANCE_COPYRIGHT
configAGNES_INSTANCE_BRAND
configAGNES_PRIVACY_POLICY_URL
configAGNES_INSTANCE_BRAND_SHORT
configAGNES_INSTANCE_LOGO_SVG
configAGNES_INSTANCE_FAVICON
configAGNES_INSTANCE_OVERVIEW
configAGNES_INSTANCE_SUPPORT
configAGNES_INSTANCE_HIDE_LOGIN_FEATURES
configAGNES_SSRF_ALLOWED_HOSTS
configAGNES_INSTANCE_CUSTOM_PREAMBLE
configAGNES_WORKSPACE_DIR_NAME
configAGNES_INSTANCE_ADMIN_EMAIL
configAGNES_INFRA_REPO_URL
configAGNES_ATLASSIAN_BASE_URL
configAGNES_DATA_APPS_ENABLED
configAGNES_DATA_APPS_RUNTIME_IMAGE
🔐 secretLLM_API_KEY
configAGNES_DISTRIBUTION_SIGNED_URLS
configAGNES_DISTRIBUTION_OBJECT_STORE_ENDPOINT_URL
configAGNES_DISTRIBUTION_OBJECT_STORE_BUCKET
configAGNES_DISTRIBUTION_OBJECT_STORE_PREFIX
configAGNES_DISTRIBUTION_OBJECT_STORE_REGION
configAGNES_DISTRIBUTION_OBJECT_STORE_ACCESS_KEY_ENV
configAGNES_DISTRIBUTION_OBJECT_STORE_SECRET_KEY_ENV
configLOG_LEVEL
configAGNES_ROLE
configSTATE_DIR
configLOCAL_DEV_MODE
configAGNES_STREAM_RETRIES
configAGNES_QUERY_TIMEOUT
configAGNES_PULL_CHUNK_PARALLELISM
configAGNES_PULL_CHUNK_THRESHOLD_BYTES
configAGNES_SERVER
configAGNES_SESSION_ID
configAGNES_TOKEN_RENEW_DAYS
configCONFIG_DIR
configAGNES_DB_URL
configDEMO_EXTRACT_DIR
configGITHUB_REPOSITORY
🔐 secretGITHUB_TOKEN
configSINCE
configSLACK_WEBHOOK_URL
configAGNES_ANALYTICS_BACKEND
configAGNES_DUCKLAKE_DATA_PATH
configAGNES_DUCKLAKE_SNAPSHOT_RETENTION_DAYS
configAGNES_DB_SELF_HEAL
configAGNES_GROUP_EVERYONE_EMAIL
configAGNES_GROUP_ADMIN_EMAIL
configAGNES_DUCKDB_TZ_STRICT
Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.
deployPORT
deployDATABASE_URL
deployAGNES_DUCKLAKE_CATALOG_DSN
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

100/100 tools missing one or more hints — server_info (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); catalog (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); collections_list (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +97 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool test coverage

74/100 tools referenced in tests (74%)

Write tests that reference each tool by name so every tool has at least one test.

Shell command execution

6 child_process/subprocess calls in production code — runs shell commands (app/api/mcp/tools_generator.py:42, app/api/mcp/tools_generator.py:157, app/api/mcp/tools_generator.py:163)

Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.

Readable source code

1 file appear obfuscated

Ship unminified, readable source.

Secrets not logged

6 secret values sent to console.log

Redact or omit secret values from log output.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/keboola-agnes-the-ai-analyst-1x8ry1?variant=verified)](https://m8ven.ai/mcp/keboola-agnes-the-ai-analyst-1x8ry1)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: f87b4e8b02aaa1e1752a350e050b6c160fcb125a
code hash: bb5f0f822f83cf2cf4b43043d0dbdb7f274606924c805f953dd9bf7b3c5ffcab
verified: 8/19/2026, 9:32:01 AM
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client