6
grade F
10 days ago
glama
Coding MCP Server
A production-oriented MCP server for coding agents that enables multi-project management through secure file operations, Git integration, and safe command execution. It supports project discovery across multiple root directories and provides robust audit logging with both STDIO and HTTP transport options.
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
// key findings
⚠️
Known vulnerabilities in dependencies: 6 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
// required environment variables
This server reads these from
process.env. You'll be asked to provide them before it can run.config
ALLOWED_COMMANDS— Commands run inside the project directory. Only commands on the allowlist are permitted.config
AUDIT_LOG_FILE— Path to the audit log for mutating operations.config
AUTH_API_KEYS— Comma-separated list of keys in key:role:id format.config
AUTH_HEADER_NAME— HTTP header used to pass the API key (default x-api-key).config
COMMAND_TIMEOUT_MS— Timeout for command execution (milliseconds).config
ENABLE_AUTH— Enable API-key authentication for the HTTP transport.config
ENABLE_HTTP— "": "false"config
ENABLE_OTEL— Enable OpenTelemetry tracing.config
ENABLE_STDIO— "": "true",config
HTTP_HOST— HTTP server bind address (default 127.0.0.1).config
HTTP_MODE— HTTP transport mode: streamable or sse.config
HTTP_PORT— HTTP server port (default 3000).config
HTTP_REQUEST_LOG_FILE— Path to the HTTP request log.config
LOG_FORMATconfig
LOG_LEVEL— Log verbosity: trace, debug, info, warn, error.config
LOG_SHOW_TIMEconfig
MAX_FILE_SIZE— Maximum file size for read operations (bytes).config
MAX_OUTPUT_SIZE— Maximum command or resource output size (bytes).config
MCP_CONFIG_PATH— Use environment variables directly or provide a JSON/YAML config file via .config
OTEL_EXPORTER_OTLP_ENDPOINT— OTLP HTTP endpoint for trace export.config
OTEL_EXPORTER_OTLP_HEADERS— Headers for the OTLP exporter in key=value,key2=value2 format.config
OTEL_SERVICE_NAME— Service name reported in traces.config
PROJECTS_ROOT— Single root directory (legacy compatibility).config
PROJECTS_ROOTS— "": "/projects"config
PROTECTED_PATHS— Comma-separated path patterns that cannot be modified.config
REGISTRY_FILE— Path to the project registry JSON file.config
RETRY_BASE_DELAY_MS— Base delay between retries (milliseconds).config
RETRY_MAX_ATTEMPTS— Number of retry attempts for transient failures.// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[](https://m8ven.ai/mcp/kieutrongthien-coding-mcp-1i5v4f)commit: 112cabc9ebf204f9372715a22a3db1dd1dc2f4ad
code hash: 9c42ab2d3941304f3db66307502d011c2788e6376f444fbf5bcdd44d91bab767
verified: 4/11/2026, 2:22:46 PM