grade F

3 days ago

pulsemcp

AurelianFlo

EDD memos, OFAC screening, Monte Carlo reports, and document output via remote MCP.

→ kelm2021/aurelianflo · listed on pulsemcp

Install from

PulseMCP

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

🚨

Secret credentials may flow to a network call

1 flow detected: USDA_API_KEY. We can’t prove the destination matches the brand the credential belongs to.

🚨

Known vulnerabilities in dependencies: 1 critical, 4 high

Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.

⚠️

Tests do not pass

Either the test suite is broken or the code regressed. Either way the published behaviour can’t be verified by the publisher’s own tests.

🔐

You'll be asked for 17 credentials: AIRNOW_API_KEY, ALPHA_VANTAGE_API_KEY, API_SPORTS_API_KEY, CENSUS_API_KEY, CONGRESS_API_KEY, COURTLISTENER_API_TOKEN, FINNHUB_API_KEY, FRED_API_KEY, KV_REST_API_TOKEN, METRICS_DASHBOARD_PASSWORD, RESTRICTED_PARTY_SCREEN_DEMO_PRIVATE_KEY, SIWX_DEMO_PRIVATE_KEY, THESPORTSDB_API_KEY, THE_ODDS_API_KEY, USDA_API_KEY, WHOISJSON_API_KEY, X402_DEMO_PRIVATE_KEY

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

🔐 secretAIRNOW_API_KEY

🔐 secretALPHA_VANTAGE_API_KEY

🔐 secretAPI_SPORTS_API_KEY

configAPI_URL

configAURELIANFLO_MCP_NETWORK

configAURELIANFLO_MCP_RECIPIENT

configAURELIANFLO_MCP_UPSTREAM_BASE_URL

🔐 secretCENSUS_API_KEY

configCHROMIUM_PACK_URL

🔐 secretCONGRESS_API_KEY

🔐 secretCOURTLISTENER_API_TOKEN

🔐 secretFINNHUB_API_KEY

🔐 secretFRED_API_KEY

🔐 secretKV_REST_API_TOKEN

configKV_REST_API_URL

🔐 secretMETRICS_DASHBOARD_PASSWORD

configMETRICS_NAMESPACE

configMETRICS_STORE_FILE

configPORT

configPUBLIC_BASE_URL

🔐 secretRESTRICTED_PARTY_SCREEN_DEMO_PRIVATE_KEY

configSEC_USER_AGENT

configSHORT_URL_BASE

configSIM_CANARY_BASE_URL

configSIM_CANARY_MAX_USD_MICROS

configSIM_CANARY_SEED

configSIWX_DEMO_MAX_AMOUNT_ATOMIC

🔐 secretSIWX_DEMO_PRIVATE_KEY

configSIWX_DEMO_URL

configSIWX_EVM_CHAIN_ID

configSIWX_EVM_RPC_URL

configSMITHERY_GATEWAY_URL

🔐 secretTHESPORTSDB_API_KEY

🔐 secretTHE_ODDS_API_KEY

configUPSTREAM_CONTACT_EMAIL

🔐 secretUSDA_API_KEY

configWALLET_ADDRESS

🔐 secretWHOISJSON_API_KEY

🔐 secretX402_DEMO_PRIVATE_KEY

configX402_FACILITATOR

configX402_FACILITATOR_URL

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/kelm2021-aurelianflo-11h8sw)](https://m8ven.ai/mcp/kelm2021-aurelianflo-11h8sw)

commit: 8a07b9f69efb57ffb9a380ace99b2469bee96180

code hash: 5bfbd39062cb70056de50a1d23984a599ee588f4290bb1800d84282de89c10dc

verified: 4/18/2026, 5:55:07 PM

view raw JSON →