nxt-ai-assistant (nxtgrid/nxt-ai-assistant) is an MCP server listed on the M8ven Trust Index. M8ven has not graded it: there is no public source to read and no endpoint we can reach, so there is nothing for us to inspect. No publisher has claimed this listing.

Caution

74/100

14 days ago

nxt-ai-assistant

Item: nxt-ai-assistant
Rating: 74
Author: M8ven

A production-ready chat orchestrator using Google's Gemini API with dynamic system instructions from Google Docs, RAG knowledge retrieval, and MCP tool integration.

→ nxtgrid/nxt-ai-assistant · listed on github_code

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every push why connect →

Who stands behind it

nxtgrid

Source: github_code

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

GitHub

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

🚨

Secret credentials may flow to a network call

7 flows detected: VRM_TOKEN, TELEGRAM_BOT_TOKEN, API_KEY. We can’t prove the destination matches the brand the credential belongs to.

🔐

You'll be asked for 39 credentials: CHAT_DB_SERVICE_KEY, SUPABASE_KEY, VRM_TOKEN, SUPABASE_SERVICE_KEY, GRAFANA_PASSWORD, GRID_DESIGN_APP_KEY, MAIN_SUPABASE_KEY, API_KEY, AUTH_DB_PASSWORD, JIRA_API_TOKEN, TAVILY_API_KEY, CALIN_V1_PASSWORD, CALIN_V2_PASSWORD, CHIRPSTACK_API_KEY, SUPABASE_JWT_SECRET, SUPABASE_USER_PASSWORD, PAYMENT_PROCESSOR_SECRET_KEY, GOOGLE_API_KEY, IDENTITY_ASSERTION_KEY, JIRA_WEBHOOK_SECRET, TELEGRAM_BOT_TOKEN, NOTIFY_SHARED_SECRET, AUTH_SUPABASE_KEY, AUTH_SUPABASE_ANON_KEY, METERING_BEARER_TOKEN, METERING_API_KEY, TIMESCALE_PASSWORD, MINI_APP_HMAC_SECRET, OPENROUTER_API_KEY, GOOGLE_CLIENT_SECRET, AUTH_CLIENT_SECRET, AUTH_COOKIE_SECRET, DIGITALOCEAN_API_TOKEN, OPEN_ROUTER_BEARER_TOKEN, GRID_DESIGN_API_KEY, DO_SPACES_KEY, AWS_SECRET_ACCESS_KEY, DO_SPACES_SECRET, OPENAI_API_KEY

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// environment variables

To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.

configCHAT_DB_URL"": "...",

🔐 secretCHAT_DB_SERVICE_KEYyour-service-role-key

🔐 secretSUPABASE_KEYCHAT_DB_SERVICE_KEY=your-service-role-key # or

configVRM_MQTT_USER

🔐 secretVRM_TOKEN

configEQUIPMENT_CONTROL_ALLOWED_USERS

configORGANIZATION_NAME

configSTAFF_ORG_IDcontrols which organization_id in your accounts table gets staff-mode access (full tools, staff instructions). The default is 2 — change it to match your own database:

configEQUIPMENT_DIAGNOSTICS_DEFAULT_TIME_RANGE

configEQUIPMENT_DIAGNOSTICS_OUTAGE_THRESHOLD_W

configEQUIPMENT_DIAGNOSTICS_CHART_WIDTH

configEQUIPMENT_DIAGNOSTICS_CHART_HEIGHT

configDEFAULT_TIMEZONE✅ Natural language time parsing with timezone configurable via env var

🔐 secretSUPABASE_SERVICE_KEY

configGRAFANA_URL

configGRAFANA_USERNAME

🔐 secretGRAFANA_PASSWORDyour-grafana-password

configGRAFANA_METADATA_TIMEOUT

configGRAFANA_VARIABLE_TIMEOUT

configGRAFANA_QUERY_TIMEOUT

configGRAFANA_ENABLED_PANELS

configGRAFANA_PANELS_METADATA

configGRAFANA_DASHBOARD_VARIABLES

configGRAFANA_ENABLED

configGRAFANA_ACTIONS_ENABLED

configGRID_DESIGN_APP_ID

🔐 secretGRID_DESIGN_APP_KEY

configAPPSHEET_REGION

configGRID_DESIGN_ACTIONS_ENABLED

configGRID_DESIGN_BACKEND

configGRID_DESIGN_GRIDS_TABLE

configGRID_DESIGN_DESIGNS_TABLE

configGRID_DESIGN_BOM_TABLE

configGRID_DESIGN_ACTIONS_TABLE

configMAIN_SUPABASE_URL

🔐 secretMAIN_SUPABASE_KEY

configGRID_DESIGN_COMPONENTS_DB_TABLE

configGRID_DESIGN_AUTOPOPULATE_WAIT

configGRID_DESIGN_BOM_WAIT

configCHAT_ORCHESTRATOR_URL

🔐 secretAPI_KEYyour-orchestrator-api-key

configAUTH_DB_HOSTdb.your-auth-project.supabase.co

configAUTH_DB_PORT

configAUTH_DB_USERreadonly_user

🔐 secretAUTH_DB_PASSWORDyour_password

configAUTH_DB_NAME

configJIRA_BASE_URL

configJIRA_USERNAMEyour-email@example.com

🔐 secretJIRA_API_TOKENyour-api-token

configJIRA_OPS_CLOUD_ID

configJIRA_OPS_SCHEDULE_ID

configJIRA_ORGANIZATION_FIELD_ID

🔐 secretTAVILY_API_KEY

configESCALATION_TELEGRAM_CHAT_ID

configMETA_ACTIONS_ENABLED

configCALIN_V1_BASE_URL

configCALIN_V1_USERNAME

🔐 secretCALIN_V1_PASSWORD

configCALIN_V1_COMPANY

configCALIN_V2_BASE_URL

configCALIN_V2_USERNAME

🔐 secretCALIN_V2_PASSWORD

configCALIN_V2_COMPANY

configCHIRPSTACK_BASE_URL

🔐 secretCHIRPSTACK_API_KEY

configCHIRPSTACK_TENANT_ID

🔐 secretSUPABASE_JWT_SECRET

configSUPABASE_USER_EMAIL

🔐 secretSUPABASE_USER_PASSWORD

configPAYMENT_PROCESSOR_API_URL

🔐 secretPAYMENT_PROCESSOR_SECRET_KEY

configNIGERIA_IMPORT_TARIFF_SHEET_ID

🔐 secretGOOGLE_API_KEYyour-gemini-api-key

configNIGERIA_IMPORT_STANDARDS_PDF_ID

configSOLAR_ACTIONS_ENABLED

configHOST

configNICEGUI_RELOAD

🔐 secretIDENTITY_ASSERTION_KEY

configCORS_ALLOWED_ORIGINS

configAPP_URL

configMINI_APP_FORMS_ENABLED

configMETRICS_ENABLED

configMETRICS_TIMEZONE

configMETRICS_SCHEDULE_HOUR

configGRAFANA_SYNC_HOUR

configJIRA_SWEEP_ENABLED

🔐 secretJIRA_WEBHOOK_SECRETa-long-random-string # see "Jira Webhook" below

🔐 secretTELEGRAM_BOT_TOKENyour-telegram-bot-token

configBOT_ENABLED

🔐 secretNOTIFY_SHARED_SECRETyour-shared-secret

configNOTIFY_ENDPOINT_ENABLEDDisable the endpoint entirely: =false — /notify 503s.

configVERIFICATION_ENABLED

configAUTH_SUPABASE_URL=https://your-auth-project.supabase.co

🔐 secretAUTH_SUPABASE_KEY=your_auth_service_key

🔐 secretAUTH_SUPABASE_ANON_KEY

configMETERING_API_URL

🔐 secretMETERING_BEARER_TOKENyour-bearer-token

🔐 secretMETERING_API_KEYyour-api-key

configTIMESCALE_HOST

configTIMESCALE_PORT

configTIMESCALE_DATABASE

configTIMESCALE_USER

🔐 secretTIMESCALE_PASSWORD

configVRM_BATCH_MAX_CONCURRENT

configCUSTOMER_METER_ACTIONS_ENABLED

configCUSTOMER_METER_POWER_LIMIT_OPTIONS

configPLATFORM_BASE_URL

configMINI_APP_BASE_URL

🔐 secretMINI_APP_HMAC_SECRET

configMCP_DISABLED_TOOLS

configVRM_USER_ID

configNO_REPLY_CHAT_IDS

configTELEGRAM_BOT_USERNAMEYourBotName # without the @ prefix

configTOOLS_SERVICE_URL

configLLM_PROVIDEROpenRouter compatibility (optional; keep =gemini unless testing it)

🔐 secretOPENROUTER_API_KEY=your-openrouter-api-key

configGEMINI_TEMPERATURE

configFALLBACK_MODELgemini-2.5-flash-lite

configALLOW_PARALLEL_CALLS

configMAX_TOOL_ROUNDS

configGOOGLE_CLIENT_IDyour-oauth-client-id.apps.googleusercontent.com

configAUTH_CLIENT_ID

🔐 secretGOOGLE_CLIENT_SECRETyour-oauth-client-secret

🔐 secretAUTH_CLIENT_SECRET

🔐 secretAUTH_COOKIE_SECRET

configAUTH_REDIRECT_URI

configGRID_DESIGN_DEV_NO_AUTH1 # bypasses Google OAuth entirely — never set this in production

configGRAFANA_FOLDER_NAME

configGRAFANA_ENABLED_DASHBOARDS

configGRAFANA_FORCE_FULL_REINDEX

🔐 secretDIGITALOCEAN_API_TOKENyour-do-api-token

configDIGITALOCEAN_APP_IDyour-do-app-id

configANANSI_BOT_HEALTH_URL

🔐 secretOPEN_ROUTER_BEARER_TOKENis also accepted as a local alias

configSTAFF_ORG_NAME

configOPENROUTER_MODEL=google/gemini-2.5-flash

configSETTINGS_FILE

configSETTINGS_BACKEND

configGRID_DESIGN_ALLOWED_USERS

🔐 secretGRID_DESIGN_API_KEY

configGRID_DESIGN_SHOW_FIELD_OPS

configFOOTPRINT_SPECULATIVE_GOOGLE

configFOOTPRINT_SPECULATIVE_GOOGLE_MIN_GRID3

configGOOGLE_OPEN_BUILDINGS_MIN_CONFIDENCE

configFOOTPRINT_CROSSCHECK_MIN_RATIO

configAWS_ACCESS_KEY_ID

🔐 secretDO_SPACES_KEY

🔐 secretAWS_SECRET_ACCESS_KEY

🔐 secretDO_SPACES_SECRET

configDO_SPACES_REGION

configGRID3_GPKG_PATH

configLAYOUT_POLE_DEDUP_DISTANCE_M

configLAYOUT_SNAP_NODE_TOLERANCE_M

configLAYOUT_MERGE_GAP_THRESHOLD_M

configLAYOUT_REDISTRIBUTE_GAP_MAX_M

configLAYOUT_PATH_WEIGHT_PENALTY

configLAYOUT_MAX_BRIDGE_DISTANCE_M

configLAYOUT_PLANT_CONNECT_DISTANCE_M

configLAYOUT_PLANT_CONNECT_K

configLAYOUT_POWER_FACTOR

configLAYOUT_KW_PER_HOUSEHOLD

configQGIS_TEMPLATE_FILE_ID

configLAYOUT_SQM_PER_KWP

configLAYOUT_CORRIDOR_CLEARANCE_M

configLAYOUT_KWP_PER_BUILDING

configLAYOUT_MIN_ESTIMATED_KWP

configLAYOUT_ROAD_CLIP_BUFFER_M

configLAYOUT_PATH_REDUNDANCY_DISTANCE_M

configLAYOUT_SITE_SETBACK_M

configLAYOUT_BUILDING_BUFFER_M

configLAYOUT_ROAD_SETBACK_M

configLAYOUT_CANOPY_THRESHOLD_M

configLAYOUT_WATERWAY_BUFFER_M

configLAYOUT_MIN_CANDIDATE_SEPARATION_M

configLAYOUT_MAX_CANDIDATES

configSETTLEMENT_MANIFEST_JSONFor container/S3 deploys you can instead set to the inline manifest JSON.

configSETTLEMENT_DATA_DIR2. Put them in one directory (local path or s3:// prefix) and point at it.

configVERTEX_AI_LOCATION

configOPENROUTER_BASE_URL

configOPENROUTER_HTTP_REFERER=https://yourapp.example.com

configOPENROUTER_APP_TITLE

configEMBEDDING_MODEL

🔐 secretOPENAI_API_KEY

Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.

deploySUPABASE_URL

deploySUPABASE_ANON_KEY

deploySUPABASE_SERVICE_ROLE_KEY

deployPORT

// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

88/88 tools missing one or more hints — _tool_meter_information (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); _tool_customer_get_meter_consumption (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); _tool_customer_get_grid_chat_chronology (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +85 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool test coverage

Only 7/88 tools referenced in tests (8%)

Write tests that reference each tool by name so every tool has at least one test.

Secrets stay with their owner

3 secret/sensitive values flow into network calls (VRM_TOKEN → dynamic, API_KEY → dynamic) (4 other flows matched canonical API hosts)

Audit where credentials are sent. A NOTION_TOKEN should only reach api.notion.com — never a third-party host.

Secrets not logged

27 secret values sent to console.log

Redact or omit secret values from log output.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail

The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.

// improvement guidance — verified publishers only

We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Verified](https://m8ven.ai/badge/mcp/nxtgrid-nxt-ai-assistant-aa209x?variant=verified)](https://m8ven.ai/mcp/nxtgrid-nxt-ai-assistant-aa209x)

Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.

commit: 665649c56d827f5b5711b9bdb628123e0d593ba8

code hash: 1407883ce584aa5377d38415d60e7229d8aa85f35676172e1ba39949ec494485

verified: 8/12/2026, 7:43:34 AM

view raw JSON →

Check MCPs from inside your assistant

Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check

check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern

How to add it →Free · no account needed · works in any MCP client