/ 100

12 days ago

glama

nestr-dev/nestr-mcp

Item: nestr-dev/nestr-mcp
Rating: 74
Author: M8ven

MCP server that connects AI assistants like Claude to your Nestr workspace, enabling task, project, role management, and organizational insights through natural language.

→ nestr-dev/nestr-mcp · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

⚠️

Known vulnerabilities in dependencies: 1 high

Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 6 credentials: GA4_API_SECRET, NESTR_API_KEY, NESTR_OAUTH_CLIENT_SECRET, NESTR_OAUTH_TOKEN, OAUTH_ENCRYPTION_KEY, OPENAI_CHALLENGE_TOKEN

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// known CVEs in dependencies1 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.25.2GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

Depend on this server? Get alerted when its CVEs change.Watch this server free →

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

🔐 secretGA4_API_SECRET— Measurement Protocol API secret

configGA4_DEBUG— Set to true to validate events without recording

configGA4_MEASUREMENT_ID— GA4 Measurement ID (e.g., G-XXXXXXXXXX)

configGTM_ID— Google Tag Manager container ID for landing page -

configMCPCAT_ENABLE_REPLAY— Enable session replay (default: false)

configMCPCAT_PROJECT_ID— MCPcat project ID (from [mcpcat.io](https://mcpcat.io))

configMCP_RESOURCE_URL

configNESTR_API_BASE— API base URL https://app.nestr.io/api

🔐 secretNESTR_API_KEY— "": "your-api-key-here"

configNESTR_GTM_ID

configNESTR_OAUTH_CLIENT_ID— OAuth client ID for hosted OAuth flow -

🔐 secretNESTR_OAUTH_CLIENT_SECRET— OAuth client secret -

🔐 secretNESTR_OAUTH_TOKEN— OAuth token (respects user permissions)

🔐 secretOAUTH_ENCRYPTION_KEY— 32-byte base64 key for encrypting OAuth sessions at rest -

configOAUTH_STORAGE_DIR

🔐 secretOPENAI_CHALLENGE_TOKEN

configPORT— HTTP server port 3000

configREDIS_URL

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 2 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/nestr-dev-nestr-mcp-11hied)](https://m8ven.ai/mcp/nestr-dev-nestr-mcp-11hied)

commit: 5032f8ad552fcea47901db3c657e4a532507e1dc

code hash: 2308081e0900fcbf7131d33ad6555f2e2ab15e9a20cee5c7b4ea903a0bc12a69

verified: 7/19/2026, 8:45:04 AM

view raw JSON →