Back to MCP Trust Indexm8ven
68
/ 100
1 month ago
glama

action1-mcp-server

A production-grade MCP server that wraps the entire Action1 REST API, enabling Claude or any MCP host to manage endpoints, run scripts, deploy updates, and more via natural language with safety guards.

→ mguttmann/action1-mcp· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
⚠️
Known vulnerabilities in dependencies: 2 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
✅
166 tools verified — handlers match their declared behaviour
83 read-only tools verified — handlers contain no write/delete/exec
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 2 credentials: ACTION1_CLIENT_SECRET, MCP_HTTP_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies2 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.0.4GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.0.4GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configACTION1_ALLOW_DESTRUCTIVE— Three-layer destructive guard — env
configACTION1_BASE_URL— yes — Region-specific instance, e.g. https://app.eu.action1.com/api/3.0.
configACTION1_CLIENT_ID— yes — OAuth2 client id from Action1 → Settings → API Credentials.
🔐 secretACTION1_CLIENT_SECRET— yes — OAuth2 client secret. Shown once at credential creation.
configACTION1_DESTRUCTIVE_AUTO_CONFIRM— for isolated single-operator
configACTION1_LAST_SEEN_STALE_MINUTES— no 10 Minutes since last_seen before an endpoint is treated as offline (range 1–1440). Tune up for fleets that check in infrequently.
configACTION1_LOG_LEVEL— no info One of debug, info, notice, warn, warning, error, critical, alert, emergency.
configACTION1_ORG_ID— recommended — Default org UUID. Each tool can override via org_id.
configHOST— no 127.0.0.1 HTTP transport host.
configMCP_HTTP_ALLOWED_ORIGINS— no unset Comma-separated allowlist for browser Origin headers. Required when binding to a non-loopback host — the server hard-fails to start otherwise.
🔐 secretMCP_HTTP_TOKEN— auth via (constant-time compare), a 1 MB body limit,
configPORT— no 3000 HTTP transport port.
configTRUST_PROXY— no false Reverse-proxy hop trust for correct client IPs in rate-limiting. One of false / true / loopback / a CIDR. Enable only for trusted upstream proxies.
configVITEST
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/mguttmann-action1-mcp-dy8uuu)](https://m8ven.ai/mcp/mguttmann-action1-mcp-dy8uuu)
commit: 324a1833d9d4164985e551f12f73821c88f97298
code hash: 7284312c12a216c23b33ca872317bf386a7c2f4ce2016317d89327624676fb67
verified: 6/15/2026, 12:56:33 PM
view raw JSON →