Warning. Serious findings were identified. Review the full report before connecting. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
mansourMP
Source: github_code
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
EAS_BUILD_PROFILEEAS_PROJECT_IDEMPYRALIS_AUTH_ALLOWED_ORIGINSEMPYRALIS_BLUEBUBBLES_PASSWORDEMPYRALIS_BLUEBUBBLES_SERVER_URLEMPYRALIS_IMESSAGE_BRIDGE_PORTEMPYRALIS_IMESSAGE_BRIDGE_TOKENEMPYRALIS_LOCAL_BRIDGE_HARNESS_PORTEMPYRALIS_SIGNAL_BRIDGE_PORTEMPYRALIS_SIGNAL_BRIDGE_TOKENEMPYRALIS_SIGNAL_CLI_ACCOUNTEMPYRALIS_SIGNAL_CLI_RPC_URLEMPYRALIS_WEB_URLEXPO_PUBLIC_API_URLEXPO_PUBLIC_APP_ENVEXPO_PUBLIC_EAS_PROJECT_IDEXPO_PUBLIC_EMPYRALIST_API_URLEXPO_PUBLIC_EMPYRALIS_DEPLOY_ENVEXPO_PUBLIC_RUNTIME_URLEXPO_PUBLIC_UPDATES_URLGOOGLE_AUTH_CLIENT_IDGOOGLE_AUTH_CLIENT_SECRETGOOGLE_AUTH_WEB_CLIENT_IDGOOGLE_AUTH_WEB_CLIENT_SECRETGOOGLE_CLIENT_IDGOOGLE_CLIENT_SECRETGOOGLE_OAUTH_CLIENT_IDGOOGLE_OAUTH_CLIENT_SECRETGOOGLE_OAUTH_REDIRECT_URIGOOGLE_WEB_CLIENT_IDGOOGLE_WEB_CLIENT_SECRETLOG_LEVELNEXT_DIST_DIRPLAYWRIGHT_BACKEND_PORTPLAYWRIGHT_DISABLE_WEBSERVERPLAYWRIGHT_FRONTEND_PORTPLAYWRIGHT_REUSE_EXISTING_SERVERORION_ENVENVORION_RUNTIME_HOSTHOSTORION_RUNTIME_PORTOPENAI_API_KEYOPENAI_RESPONSES_URLORION_MODELORION_GOALRUNTIME_KEYORION_API_KEYEMPYRALIS_DEV_ALLOW_HTTP_MCPLOCAL_SHELL_TIMEOUTLOCAL_FILE_READ_MAX_BYTESENVIRONMENTEMPYRALIS_TOOL_BROKER_SECRETEMPYRALIS_SECRETS_BROKER_SECRETSTABILITY_API_KEYSTABLE_DIFFUSION_MODEL_IDEMPYRALIS_PLATFORM_REGISTRY_KEYEMPYRALIS_NICHES_FILEORION_NICHES_FILEORION_COGNITIVE_SKILL_REPLAY_MIN_CONFIDENCEORION_COGNITIVE_SKILL_REPLAY_ENABLEDORION_COGNITIVE_OPERATOR_APPROVAL_LEVELS_AUTOORION_COGNITIVE_OPERATOR_STRICT_APPROVAL_ALLORION_COGNITIVE_OPERATOR_APPROVAL_LEVELS_STRICTORION_COGNITIVE_OPERATOR_APPROVAL_LEVELS_GUARDEDORION_COGNITIVE_SKILL_DECAY_INTERVAL_SECONDSORION_COGNITIVE_SKILL_DECAY_MAX_AGE_SECONDSORION_COGNITIVE_SKILL_DECAY_MIN_SAMPLESORION_COGNITIVE_SKILL_DECAY_MIN_SUCCESS_RATEORION_COGNITIVE_RUN_MODEORION_API_URLORION_COGNITIVE_WORKSPACE_IDORION_COGNITIVE_TRUST_MODEORION_COGNITIVE_EXECUTION_TARGETORION_COGNITIVE_RUN_POLL_SECONDSORION_COGNITIVE_RUN_WAIT_SECONDSORION_COGNITIVE_OPERATOR_ENABLEDORION_COGNITIVE_OPERATOR_ROOTORION_COGNITIVE_OPERATOR_TIMEOUT_SECONDSORION_COGNITIVE_OPERATOR_MAX_OUTPUT_CHARSORION_COGNITIVE_OPERATOR_ALLOW_SHELL_FALLBACKORION_LOCAL_COMPANION_COMMAND_ALLOW_PREFIXESORION_COGNITIVE_OPERATOR_ALLOW_PREFIXESORION_COGNITIVE_OPERATOR_TRUST_MODECHEAP_MODELSMART_MODELEMBEDDING_MODELOPENAI_EMBEDDINGS_URLOPENAI_CHAT_COMPLETIONS_URLANTHROPIC_MESSAGES_URLOPENAI_ACCESS_TOKENANTHROPIC_API_KEYGEMINI_API_KEYGOOGLE_API_KEYVERTEX_ACCESS_TOKENVERTEX_PROJECT_IDVERTEX_LOCATIONEMPYRALIS_STATE_HOMEEMPYRALIS_AUTONOMOUS_CONTROL_MODELEMPYRALIS_AUTONOMOUS_ALLOW_DANGEROUS_CLASSESEMPYRALIS_AUTONOMOUS_ROLEEMPYRALIS_AUTONOMOUS_IS_ADMINEMPYRALIS_SUPERVISOR_SECRETEMPYRALIS_CERT_GATEWAY_IDEMPYRALIS_CERT_WORKSPACE_IDEMPYRALIS_CERT_TENANT_IDEMPYRALIS_CERT_SELF_HOSTED_PROFILE_IDEMPYRALIS_CERT_SELF_HOSTED_NODE_TOKENEMPYRALIS_CERT_SELF_HOSTED_NODE_IDEMPYRALIS_CERT_EMAILEMPYRALIS_CERT_PASSWORDEMPYRALIS_CERT_BEARER_TOKENEMPYRALIS_CERT_RUNTIME_KEYEMPYRALIS_CERT_BACKEND_URLEMPYRALIS_CERT_GATEWAY_FILE_PATHEMPYRALIS_CERT_GATEWAY_SAFE_COMMANDEMPYRALIS_CERT_GATEWAY_RISKY_COMMANDEMPYRALIS_CERT_GATEWAY_LONG_COMMANDEMPYRALIS_CERT_SELF_HOSTED_SAFE_COMMANDEMPYRALIS_CERT_SELF_HOSTED_LONG_COMMANDEMPYRALIS_CERT_GATEWAY_CHAT_MESSAGEORION_LOCAL_WORKER_USE_LLMORION_LOCAL_WORKER_LLM_REQUIREDORION_MACHINE_ENROLLMENT_TOKENCREW_API_KEYORION_RUNTIME_POLICY_MODE_DEFAULTORION_MAX_LOCAL_OPSORION_LOCAL_COMPANION_ROOTORION_LOCAL_FILE_LOCK_TIMEOUT_SECONDSORION_LOCAL_FILE_LOCK_POLL_SECONDSORION_LOCAL_WORKER_MAX_TOKENSORION_DISABLE_OPENAI_API_KEYORION_AUTH_MODEORION_LOCAL_WORKER_OPENAI_TOKENCODEX_OAUTH_TOKENOPENAI_OAUTH_TOKENCODEX_AUTH_FILEORION_LOCAL_WORKER_OPENAI_API_KEYORION_LOCAL_WORKER_ANTHROPIC_API_KEYORION_LOCAL_WORKER_ANTHROPIC_MODELORION_LOCAL_WORKER_GEMINI_API_KEYORION_LOCAL_WORKER_QWEN_API_KEYQWEN_API_KEYDASHSCOPE_API_KEYORION_LOCAL_WORKER_DEEPSEEK_API_KEYDEEPSEEK_API_KEYORION_LOCAL_WORKER_MISTRAL_API_KEYMISTRAL_API_KEYORION_LOCAL_WORKER_GROQ_API_KEYGROQ_API_KEYORION_LOCAL_WORKER_OPENROUTER_API_KEYOPENROUTER_API_KEYORION_LOCAL_WORKER_AZURE_OPENAI_API_KEYAZURE_OPENAI_API_KEYORION_LOCAL_WORKER_CUSTOM_OPENAI_COMPATIBLE_API_KEYCUSTOM_OPENAI_COMPATIBLE_API_KEYORION_LOCAL_WORKER_OLLAMA_CLOUD_API_KEYOLLAMA_API_KEYORION_LOCAL_WORKER_OLLAMA_URLORION_LOCAL_WORKER_OLLAMA_ENABLEDORION_LOCAL_WORKER_CODEX_MODELCODEX_MODELORION_LOCAL_WORKER_OPENAI_MODELORION_LOCAL_WORKER_CLAUDE_CODE_MODELORION_LOCAL_WORKER_GEMINI_MODELORION_LOCAL_WORKER_OLLAMA_MODELORION_LOCAL_WORKER_OLLAMA_CLOUD_MODELORION_LOCAL_WORKER_QWEN_MODELORION_LOCAL_WORKER_DEEPSEEK_MODELORION_LOCAL_WORKER_MISTRAL_MODELORION_LOCAL_WORKER_QWEN_URLORION_LOCAL_WORKER_DEEPSEEK_URLORION_LOCAL_WORKER_MISTRAL_URLORION_LOCAL_WORKER_GROQ_URLORION_LOCAL_WORKER_OPENROUTER_URLORION_LOCAL_WORKER_OPENAI_URLORION_LOCAL_WORKER_GROQ_MODELORION_LOCAL_WORKER_OPENROUTER_MODELORION_LOCAL_WORKER_TEMPERATUREORION_LOCAL_WORKER_LLM_TIMEOUT_SECONDSORION_LOCAL_WORKER_ANTHROPIC_URLORION_LOCAL_WORKER_GEMINI_URLORION_LOCAL_WORKER_OLLAMA_TIMEOUT_SECONDSORION_LOCAL_WORKER_OLLAMA_NUM_PREDICTORION_LOCAL_WORKER_CODEX_TIMEOUT_SECONDSORION_LOCAL_WORKER_CODEX_REASONING_EFFORTORION_LOCAL_WORKER_CODEX_RESPONSES_URLORION_LOCAL_WORKER_OPENAI_RESPONSES_URLORION_LOCAL_WORKER_CLAUDE_CODE_TIMEOUT_SECONDSORION_LOCAL_WORKER_OLLAMA_CLOUD_URLORION_LOCAL_WORKER_OLLAMA_CLOUD_NUM_PREDICTORION_LOCAL_WORKER_OLLAMA_CLOUD_TIMEOUT_SECONDSORION_LOCAL_WORKER_PROVIDER_ORDERORION_LOCAL_WORKER_PROVIDERORION_LOCAL_WORKER_USE_CODEX_CLIORION_LOCAL_WORKER_PREFER_DIRECT_OPENAIORION_LOCAL_WORKER_FALLBACK_PROVIDERORION_LOCAL_WORKER_PROVIDER_FALLBACKORION_RUNTIME_SESSION_ROOTORION_SPREADSHEET_ROOTORION_OPS_DAEMON_AUTORECOVERORION_OPS_DAEMON_HEALTH_POLL_SECONDSORION_OPS_DAEMON_FAILURE_THRESHOLDORION_OPS_DAEMON_RECOVERY_COOLDOWN_SECONDSORION_OPS_DAEMON_MAX_RECOVERIES_PER_HOURORION_OPS_DAEMON_REQUIRE_WORKERORION_OPS_DAEMON_REQUIRE_TELEGRAMORION_OPS_DAEMON_STARTUP_GRACE_SECONDSORION_OPS_DAEMON_ALLOW_REMOTEORION_TELEGRAM_AUTOPILOT_WORKSPACE_IDWORKSPACE_IDORION_OPS_DAEMON_HOSTORION_OPS_DAEMON_PORTEMPYRALIS_DESKTOP_ELECTRON_BINORION_DESKTOP_ELECTRON_BINORION_STATE_HOMEEMPYRALIS_VIRAL_FACTORY_DB_PATHORION_VIRAL_FACTORY_DB_PATHRUNTIME_URLORION_ACCOUNT_SHELL_CACHE_TTL_SECONDSCLOUD_SESSION_MANAGER_URLCLOUD_SESSION_HMAC_SECRETAPI_SECRETCLOUD_SESSION_MANAGER_ENABLEDORION_OPS_DAEMON_ENABLEDEMPYRALIS_VISION_API_KEYORION_JWT_EXP_SECONDSORION_MOBILE_JWT_EXP_SECONDSORION_MOBILE_REFRESH_EXP_SECONDSORION_PUBLIC_REGISTRATION_ENABLEDORION_ADMIN_USER_IDSORION_ADMIN_EMAILSORION_SERVICE_RATE_LIMIT_PER_MINUTEORION_AUTH_LOGIN_RATE_LIMIT_PER_MINUTEORION_AUTHENTICATED_API_RATE_LIMIT_PER_MINUTEORION_MOBILE_AUTHENTICATED_API_RATE_LIMIT_PER_MINUTEORION_MODEL_INVOCATION_RATE_LIMIT_PER_MINUTEORION_MOBILE_MODEL_INVOCATION_RATE_LIMIT_PER_MINUTEORION_AUTH_CSRF_FAILURE_RATE_LIMIT_PER_MINUTEORION_AUTH_REFRESH_RATE_LIMIT_PER_MINUTEORION_MOBILE_BETA_AUTO_SIGNIN_ENABLEDEMPYRALIS_AUTH_ACCESS_COOKIEEMPYRALIS_AUTH_REFRESH_COOKIEEMPYRALIS_AUTH_CSRF_COOKIEEMPYRALIS_AUTH_ACCESS_COOKIE_MAX_AGE_SECONDSEMPYRALIS_AUTH_REFRESH_COOKIE_MAX_AGE_SECONDSORION_PROVIDER_JWKS_CACHE_TTL_SECONDSORION_PROVIDER_JWKS_STALE_TTL_SECONDSORION_PROVIDER_JWKS_RETRY_ATTEMPTSORION_PROVIDER_HTTP_TIMEOUT_SECONDSORION_AUTH_HOT_CACHE_TTL_SECONDSEMPYRALIS_AUTH_COOKIE_DOMAINEMPYRALIS_AUTH_COOKIE_SAMESITEORION_AUTH_REQUIREDORION_LOCAL_DEV_AUTH_ROLEORION_LOCAL_DEV_WORKSPACE_IDSORION_LOCAL_DEV_USER_IDORION_LOCAL_DEV_EMAILORION_LOCAL_DEV_TENANT_IDEMPYRALIS_STRIPE_SECRET_KEYSTRIPE_SECRET_KEYEMPYRALIS_STRIPE_WEBHOOK_SECRETEMPYRALIS_STRIPE_PRICE_IDSEMPYRALIS_BILLING_FRONTEND_ORIGINFRONTEND_ORIGINSEMPYRALIS_BILLING_SUCCESS_URLEMPYRALIS_BILLING_CANCEL_URLEMPYRALIS_BILLING_CREDIT_SUCCESS_URLEMPYRALIS_BILLING_CREDIT_CANCEL_URLEMPYRALIS_BILLING_PORTAL_RETURN_URLORION_BROWSER_ENGINE_ROOTORION_BROWSER_ATTACH_CDP_URLDISPLAYTAURI_ENVEMPYRALIS_PUBLIC_FRONTEND_ORIGINBACKEND_PUBLIC_ORIGINBACKEND_PUBLIC_HOSTEMPYRALIS_API_URLEMPYRALIS_API_KEYEMPYRALIS_WORKSPACE_IDEMPYRALIS_TRUSTED_PROXY_CIDRSEMPYRALIS_DEPLOY_ENVEMPYRALIS_EXTERNAL_AGENT_LOCAL_STOREPYTEST_CURRENT_TESTORION_TELEGRAM_AUTOPILOT_PUBLIC_BASE_URLDISCORD_APP_PUBLIC_KEYORION_WORKSPACE_LOOKUP_CACHE_TTL_SECONDSNEXT_PUBLIC_APP_URLSENTRY_DSNPORTDATABASE_URLDependencies
2 dependencies, 1 flagged: @playwright/test
Tool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
8/8 tools missing one or more hints — list_spaces (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_space_status (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_recent_alerts (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +5 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
License file
No license file
Add a LICENSE file (MIT, Apache-2.0, etc.).
Tool test coverage
Only 2/8 tools referenced in tests (25%)
Write tests that reference each tool by name so every tool has at least one test.
No eval / new Function
1 eval() or new Function() call — dynamic code execution
Replace eval / Function with explicit parsing or safer alternatives.
Shell command execution
2 child_process/subprocess calls in production code — runs shell commands (empyralis-gateway/src/browser/worker.ts:49, empyralis-gateway/src/health/service-inventory.ts:152)
Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.
Secrets stay with their owner
8 secret/sensitive values flow into network calls (API_WALL_SMOKE_PASSWORD → dynamic, EMPYRALIS_CERT_RUNTIME_KEY → dynamic) (3 other flows matched canonical API hosts)
Audit where credentials are sent. A NOTION_TOKEN should only reach api.notion.com — never a third-party host.
Secrets not logged
7 secret values sent to console.log
Redact or omit secret values from log output.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/mansourmp-multi-agent-orchestrator-project-ka15fx)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check