brain (michaelbrowk/brain) is an MCP server listed on the M8ven Trust Index. It scores 50 out of 100, grade D. It declares 37 tools. No publisher has claimed this listing.

D
Caution
50/100

brain

A notes app you keep on your own server. Markdown files, git on every save, MCP for Claude. MIT.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

michaelbrowk

Source: github_repo_search

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
🚨
Known vulnerabilities in dependencies: 2 critical, 1 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 3 credentials: AUTH_SECRET, MCP_TOKEN, OPENROUTER_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes37 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

save_mail_attachment
send_mail

Send a new message from one connected account. The account is yours to name and every send needs an idempotency key. Text only, no HTML. The message is marked as an agent's inside Brain: the owner sees it in Settings, Connections.

reply_mail

Reply to one message in a thread. The recipients are derived from the message being answered, Reply-To over From, with this account's own addresses dropped; there is no `to` here. To write to someone else, send a new message. Text only, no HTML.

get_mail_send_status

Report what became of one send: its status, and the thread its Sent copy landed in once the provider has one. A send whose account has no Sent folder keeps a null thread for good. Name the account as well after a send answered `state` unknown, so the owner's Sent row can still say which app wrote th

list_mail_accounts

List the connected mail accounts, each with whether this host can send from it and why not when it cannot.

list_mail_threads

List one account's threads in one system mailbox, newest first. Pass `nextCursor` back as `cursor` for the next page.

search_mail

Search cached thread headers and previews. Message bodies are never searched. With no `accountId` every account is searched and the results merge newest first behind one cursor.

get_mail_thread

Read one thread: its row and every message's headers, preview and whether a body is already cached. Bodies come from read_mail_message.

read_mail_message

Read one message's plain-text body and its attachment list. Answers `state` fetching when the body is still on its way, and the caller asks again.

update_mail_thread

Sort one thread: mark it read or unread, star it, archive it, move it to trash or spam, or restore it from either. Exactly one of the six per call, which is the shape the service's own PATCH takes. There is no purge: a thread in the trash stays there until the person empties it.

list_tasks

List the tasks of one list, or every record on one note. Pass the caller's own local calendar date as `today`; leave it out and Brain uses the owner's own time zone. Every list but `logbook` answers `{tasks}`, one record each; `logbook` answers `{entries}`, one per completion, because a repeating ta

get_task

Read one task record, including whether its note line was removed and which page it is linked to.

create_task

Make a task. It is unlinked: it owns its own completion and belongs to no note. To turn a checkbox line of a note into a task, use promote_task_line. `time` and `evening` are statements about a day, so both need `when` to be a day rather than `someday`.

promote_task_line

Turn one checkbox line of a note into a task linked to that line. `line` is a zero-based markdown line number, or the line's own text with runs of whitespace collapsed. The note's category is inherited unless one is named here. The line keeps owning the task's title and its completion. Takes no `rev

update_task

Change one task. A field left out is left alone and `null` clears it. `when` takes a day, the word `someday`, or null for the Inbox. `time` and `evening` are statements about a day, so a change that parks the task or sends it back to the Inbox clears both whether or not they are named here. Clearing

complete_task

Tick one task. `today` is the caller's own local calendar date and is required: the answer says which list the record is in for that day, and a repeating task's next occurrence is computed from it. The server has no timezone of the caller's to fall back on. A completion stays in the list it was in,

reopen_task

Untick one task. `today` is the caller's own local calendar date and is required: the answer says which list the record lands back in for that day. Unticking a repeating task restores the instance its newest completion came from.

delete_task

Delete one task record. A linked task's checkbox line stays in its note; the record that pointed at it is what goes.

list_tree

List the full page tree of the notebook (ids, titles, icons, nesting).

connection_check

Verify this MCP connection can authenticate and read Brain without changing any pages. Reports whether write, import, and mail access are authorized, but does not exercise those permissions.

read_page

Read a page's markdown by id. Returns meta, markdown, and rev (needed for write_page).

write_page

Replace a page's markdown. Pass the rev from read_page for conflict safety; omit to force.

append_page
create_page

Create a page. parentId null/omitted = top level. Returns the new page's meta (id).

notion_find_page

Find the Brain page for one Notion id and report server-computed import baseline, lease, and optional candidate-token ownership integrity without returning the token.

notion_inspect_candidate

Inspect one explicitly selected Brain page for preserve/adopt using only rev, placement, and redacted Notion binding state.

notion_adopt_page

Bind a verified existing Brain page to one Notion source without changing its content or hierarchy. Read the page immediately before adoption and pass its rev plus the conversion hash for that exact target.

notion_reserve_page

Atomically find-or-reserve a Notion page before converting content. Pass one maps ids; pass two supplies conversionHash and desired beforeId after every sibling id is known. Never retries at root.

notion_upload_attachment

Upload one converted Notion attachment under an active page reservation.

notion_verify_attachment

Read and hash one staged attachment under the matching active Notion reservation.

notion_verify_finalized_attachment

Read and hash one permanent attachment owned by an intact finalized Notion target.

notion_finalize_page

Finalize a reserved Notion page. Refuses stale tokens and concurrent edits. Finalize parents before children and each sibling group from last to first (the next beforeId target must already be stable).

notion_abort_page

Release a token-owned Notion reservation without overwriting the current page body.

update_meta

Update page metadata: title, icon, category, kanban status, view ('board' turns a page with children into a kanban board). public:false may revoke sharing; only the owner disclosure flow can enable it.

move_page
delete_page

Delete a page and its whole subtree. Soft-delete — recoverable from Trash.

search

Full-text search across all pages. Returns matching pages with snippets.

// known CVEs in dependencies2 critical1 high1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

criticalnext@16.2.11GHSA-2xp9-vwfh-vxw4

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

criticalnext@16.2.11GHSA-p293-qw3h-jr36

Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

highsharp@0.35.3GHSA-rgj7-g3m4-5g8c

sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545

lowvitest@4.1.10GHSA-82fw-gwwq-j7x9

Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
🔐 secretAUTH_SECRETwants 32 or more random bytes (openssl rand -hex 32).
configBRAIN_AUTH_STATE_DIR
configBRAIN_BACKUP_ROOT
configBRAIN_BUILD_SHA
configBRAIN_BUILD_TIME
configBRAIN_DIST_DIR
configBRAIN_E2E_PORT
configBRAIN_MCP_STATE_DIRWhere the MCP agent activity log, toggles and send marks live (default /var/lib/brain/mcp)
configBRAIN_PUBLIC_ORIGINis the exact origin your browser shows — scheme, host,
configBRAIN_SENDER_ICON_DIR
configBRAIN_SETTINGS_STATE_DIRWhere the owner's settings live, the time zone reminders fire in (default /var/lib/brain/settings)
configBRAIN_UPDATE_CHECKversion and the project URL. =off turns it off.
configBRAIN_UPDATE_STATE_DIRWhere the update check keeps its answer (default /var/lib/brain/update)
configGITHUB_SHA
🔐 secretMCP_TOKENstatic is the way in.
configNOTES_ROOTat: Docker Desktop shares /Users, /private and /tmp by
🔐 secretOPENROUTER_API_KEYOpenRouter key for AI features (emoji, smart-sort, assist)
configOPENROUTER_MODELOptional model override (default openai/gpt-4o-mini)
configBRAIN_BACKUP_TEST_LIMITS_JSON
configBRAIN_BACKUP_TEST_MODE
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

37/37 tools missing one or more hints — save_mail_attachment (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); send_mail (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); reply_mail (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +34 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Production dependencies are patched

2 critical, 0 high severity in production deps — next@16.2.11 (critical), next@16.2.11 (critical)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Dev dependencies

1 critical/high in dev-only deps (does not ship to users)

Upgrade dev dependencies when convenient.

Dependency freshness

3/39 production deps abandoned (no release in 2+ years): gray-matter@2023-07-12 (3.2y), @dnd-kit/utilities@2023-11-06 (2.9y), web-push@2024-01-16 (2.7y)

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/michaelbrowk/brain?variant=verified)](https://m8ven.ai/mcp/michaelbrowk/brain)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: c41ad22af04cd38daeffe010ad06a1e0d76cd69e
code hash: 4ca69f9dd9c7bf0d8258ca02a6a68a55c44b5bd7d7bd6e5fa2c005a14b7fe754
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client