Back to MCP Trust Indexm8ven
56
/ 100
1 month ago
glama

VRMCP

Enables AI to control 3D VRM models via natural language, supporting expressions, animations, and bone manipulation in real-time through a web browser.

→ lvncer/vrmcp-nextjs-archive· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
🚨
Known vulnerabilities in dependencies: 1 critical, 12 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 1 credential: MCP_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies1 critical12 high4 medium10 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

criticalnext@16.0.1GHSA-9qr9-h5gf-34mp

Next.js is vulnerable to RCE in React flight protocol

high@modelcontextprotocol/sdk@0.5.0GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@0.5.0GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

highnext@16.0.1GHSA-267c-6grr-h53f

Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes

highnext@16.0.1GHSA-26hh-7cqf-hhc6

Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
🔐 secretMCP_API_KEY— API キー（認証用） ⚠️
configMCP_REMOTE_URL— リモート MCP サーバー URL https://vrm-mcp-xxx.vercel.app/api/mcp/sse
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/lvncer-vrmcp-nextjs-archive-yp3w75)](https://m8ven.ai/mcp/lvncer-vrmcp-nextjs-archive-yp3w75)
commit: bf55d4b75d9f2b56acf0a5f4587d9e98dafa8794
code hash: c903c4f8a8f409cae2110eda7c41faf77ec554fab5ebc982e5a458fa951ae9b0
verified: 6/21/2026, 10:20:47 AM
view raw JSON →