/ 100

4 days ago

npm

evalstate/hf-mcp-server

Official Hugging Face MCP Server

→ evalstate/hf-mcp-server· npm: @llmindset/hf-mcp-server· listed on npm

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

npm

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 3 credentials: DEFAULT_HF_TOKEN, HF_TOKEN, LOGGING_HF_TOKEN

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configANALYTICS_MODE

configCORS_ALLOWED_ORIGINS

🔐 secretDEFAULT_HF_TOKEN— docker run --rm -p 3000:3000 -e =hf_xxx hf-mcp-server

configGRADIO_DISCOVERY_CONCURRENCY

configGRADIO_SCHEMA_CACHE_TTL

configGRADIO_SCHEMA_TIMEOUT

configGRADIO_SPACE_CACHE_TTL

configGRADIO_SPACE_INFO_TIMEOUT

configHF_API_TIMEOUT— Timeout for Hugging Face API requests in milliseconds (default: 12500ms / 12.5 seconds)

configHF_SKILLS_DIR— To expose the shared Hugging Face skills catalog from a Space, mount the bucket and keep pointed at its latest distribution directory:

🔐 secretHF_TOKEN— If running with stdio transport, is used if DEFAULT_HF_TOKEN is not set.

configHSTS

configLOGGING_BATCH_SIZE

configLOGGING_DATASET_ID

configLOGGING_FLUSH_INTERVAL

🔐 secretLOGGING_HF_TOKEN

configLOG_LEVEL

configLOG_QUERY_EVENTS

configLOG_SYSTEM_EVENTS

configMCP_CLIENT_CONNECTION_CHECK— 90000ms How often to check for stale sessions

configMCP_CLIENT_CONNECTION_TIMEOUT— 300000ms Remove sessions inactive for this duration

configMCP_CLIENT_HEARTBEAT_INTERVAL— 30000ms How often to check connection health

configMCP_PING_ENABLED— true Enable ping keep-alive for sessions

configMCP_PING_FAILURE_THRESHOLD

configMCP_PING_INTERVAL— 30000ms Interval between ping cycles

configMCP_STRICT_COMPLIANCE— set to True for GET 405 rejects in JSON Mode (default serves a welcome page).

configSEARCH_ENABLES_FETCH— When set to true, automatically enables the hf_doc_fetch tool whenever hf_doc_search is enabled

configTRANSPORT— docker run -i --rm -e =stdio -p 3000:3000 -e DEFAULT_HF_TOKEN=hf_xxx hf-mcp-server

configVITEST

configVITE_BUILD_TARGET

configWEB_APP_PORT

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/llmindset-hf-mcp-server-11turd)](https://m8ven.ai/mcp/llmindset-hf-mcp-server-11turd)

commit: 7fdd99171cae0a5119ae2decc14bb02b3f1af7b5

code hash: f25770dc2266f5de7226eee81aac8174fd9fa8cd1688b6f326bb640c16ebce80

verified: 6/1/2026, 1:03:26 PM

view raw JSON →