Breaking-change diffs for npm packages, served over REST and MCP, so coding agents stop writing code against outdated API knowledge.
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
When Vitest UI server is listening, arbitrary file can be read and executed
Fastify's Content-Type header tab character allows body validation bypass
Fastify vulnerable to invalid content-type parsing, which could lead to validation bypass
node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal
Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction
process.env. You'll be asked to provide them before it can run.COMPUTE_CONCURRENCY— 2 Max simultaneous diff computationsDATABASE_URL— The code is cloud-agnostic: a plain container plus a . It currently runs on Render with Neon Postgres.PORT— 3000 Listen portRATE_LIMIT_DIFF_MAX— 30 Per-IP /v1/diff requests per minuteRATE_LIMIT_RESOLVE_MAX— 120 Per-IP /v1/resolve requests per minuteTRUST_PROXY— unset Set true behind a PaaS proxy so the rate limiter sees real client IPsVDIFF_API_URL[](https://m8ven.ai/mcp/mcurmi05-vdiff-1065ng)