39
/ 100
23 days ago
glama

OffByOne Runtime MCP Server

MCP server for the OffByOne website factory, enabling agents to generate, validate, and manage full-stack web projects through safe, deterministic tools.

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
⚠️
Known vulnerabilities in dependencies: 1 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
🔐
You'll be asked for 3 credentials: LLM_API_KEY, OFFBYONE_TEST_MISSING_API_KEY, OFFBYONE_TEST_PRESENT_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies1 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

highplaywright@1.54.2GHSA-7mvr-c777-76hp

Playwright downloads and installs browsers without verifying the authenticity of the SSL certificate

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
🔐 secretLLM_API_KEY2. Generic env overrides , LLM_BASE_URL, and LLM_MODEL
configLLM_API_KEY_ENV
configLLM_BASE_URL2. Generic env overrides LLM_API_KEY, , and LLM_MODEL
configLLM_MODEL2. Generic env overrides LLM_API_KEY, LLM_BASE_URL, and
configLLM_PROGRESS_INTERVAL_MS
configLLM_PROTOCOL
configLLM_PROVIDER3. Selected provider key/defaults from --provider or
configLLM_RETRIESretries N sets LLM retry count for network errors, timeouts, 429s, and 5xx responses. The default is 2 or .
configLLM_RETRY_DELAY_MSretry-delay-ms N sets delay between retry attempts. The default is 1500 or .
configLLM_TIMEOUT_MS
configLLM_TRANSPORT
configOFFBYONE_APP_LOCAL_MODE
configOFFBYONE_AUTO_PAGE_RECOVERY
configOFFBYONE_BACKEND_LOCAL_MODE
configOFFBYONE_DB_LOCAL_MODE
configOFFBYONE_GENERATED_ROOT
configOFFBYONE_LAYOUT_LOCAL_MODE
configOFFBYONE_LAYOUT_RECOVERY_MODE
configOFFBYONE_PAGE_CONCURRENCY
configOFFBYONE_PAGE_FAST_FAIL_RETRIES
configOFFBYONE_PAGE_RECOVERY_MODE
configOFFBYONE_PLAN_LOCAL_MODE
configOFFBYONE_QUIET_LLM_TRANSPORT_LOGS
configOFFBYONE_RASTER_ASSETS
configOFFBYONE_SMOKE_HOST
🔐 secretOFFBYONE_TEST_MISSING_API_KEY
🔐 secretOFFBYONE_TEST_PRESENT_API_KEY
configOFFBYONE_UI_API_KEY_ENV
configOFFBYONE_UI_BASE_URL
configOFFBYONE_UI_MODEL
configPORTBackend: =3001, CORS_ORIGIN=http://localhost:5173, DATABASE_FILE=./data/app.sqlite
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/kurticeberg-offbyone-8q6dis)](https://m8ven.ai/mcp/kurticeberg-offbyone-8q6dis)
commit: d5ac81ddf615cd853e28395662cc0aec170dfbd6
code hash: a5075be2986d90230b3cff2561d14f51fb127dd85379cb7dcf37ad146ea138f1
verified: 7/8/2026, 8:42:12 AM
view raw JSON →