nxt-ai-assistant (nxtgrid/nxt-ai-assistant) is an MCP server listed on the M8ven Trust Index. It scores 74 out of 100, grade C. It declares 112 tools. No publisher has claimed this listing.

Back to MCP Trust IndexM8ven
C
Emerging
74/100

nxt-ai-assistant

A production-ready chat orchestrator using Google's Gemini API with dynamic system instructions from Google Docs, RAG knowledge retrieval, and MCP tool integration.

→ nxtgrid/nxt-ai-assistant· listed on github_code

Emerging. No concerning findings. Grades remain capped until the project builds reputation through adoption. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

nxtgrid

Source: github_code

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

GitHub

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
🚨
Secret credentials may flow to a network call
22 flows detected: VRM_TOKEN, API_KEY, SUPABASE_SERVICE_ROLE_KEY. We can’t prove the destination matches the brand the credential belongs to.
🔐
You'll be asked for 35 credentials: MCP_GATEWAY_TOKEN_SECRET, CHAT_DB_SERVICE_KEY, SUPABASE_KEY, VRM_TOKEN, SUPABASE_SERVICE_KEY, GRAFANA_PASSWORD, GRID_DESIGN_APP_KEY, MAIN_SUPABASE_KEY, API_KEY, AUTH_DB_PASSWORD, JIRA_API_TOKEN, TAVILY_API_KEY, CALIN_V1_PASSWORD, CALIN_V2_PASSWORD, CHIRPSTACK_API_KEY, SUPABASE_JWT_SECRET, SUPABASE_USER_PASSWORD, PAYMENT_PROCESSOR_SECRET_KEY, IDENTITY_ASSERTION_KEY, JIRA_WEBHOOK_SECRET, TELEGRAM_BOT_TOKEN, NOTIFY_SHARED_SECRET, GOOGLE_CLIENT_SECRET, AUTH_CLIENT_SECRET, AUTH_SUPABASE_KEY, AUTH_SUPABASE_ANON_KEY, METERING_BEARER_TOKEN, METERING_API_KEY, TIMESCALE_PASSWORD, MINI_APP_HMAC_SECRET, GOOGLE_API_KEY, OPENROUTER_API_KEY, AUTH_COOKIE_SECRET, DIGITALOCEAN_API_TOKEN, OPEN_ROUTER_BEARER_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
🔐 secretMCP_GATEWAY_TOKEN_SECRETTurning it off. Unset either MCP_GATEWAY_BASE_URL or . The gateway is then never mounted — no code change, no separate deploy, and nothing else in the service is affected.
configMCP_GATEWAY_BASE_URLTurning it off. Unset either or MCP_GATEWAY_TOKEN_SECRET. The gateway is then never mounted — no code change, no separate deploy, and nothing else in the service is affected.
configCHAT_DB_URLconversations, RAG chunks, prompts, skills, escalations, and anything this repo migrates
🔐 secretCHAT_DB_SERVICE_KEYconversations, RAG chunks, prompts, skills, escalations, and anything this repo migrates
🔐 secretSUPABASE_KEY
configVRM_MQTT_USER
🔐 secretVRM_TOKENField/grid systems — VRM (, MQTT), ChirpStack, Calin v1/v2, metering and Tiamat APIs
configEQUIPMENT_CONTROL_ALLOWED_USERS
configORGANIZATION_NAME
configSTAFF_ORG_IDcontrols which organization_id in your accounts table gets staff-mode access (full tools, staff instructions). The default is 2 — change it to match your own database:
configEQUIPMENT_DIAGNOSTICS_DEFAULT_TIME_RANGE
configEQUIPMENT_DIAGNOSTICS_OUTAGE_THRESHOLD_W
configEQUIPMENT_DIAGNOSTICS_CHART_WIDTH
configEQUIPMENT_DIAGNOSTICS_CHART_HEIGHT
configDEFAULT_TIMEZONE✅ Natural language time parsing with timezone configurable via env var
🔐 secretSUPABASE_SERVICE_KEY
configGRAFANA_URL
configGRAFANA_USERNAME
🔐 secretGRAFANA_PASSWORD
configGRAFANA_METADATA_TIMEOUT
configGRAFANA_VARIABLE_TIMEOUT
configGRAFANA_QUERY_TIMEOUT
configGRAFANA_ENABLED_PANELS
configGRAFANA_PANELS_METADATA
configGRAFANA_DASHBOARD_VARIABLES
configGRAFANA_ENABLED
configGRAFANA_ACTIONS_ENABLED
configGRID_DESIGN_APP_ID
🔐 secretGRID_DESIGN_APP_KEY
configAPPSHEET_REGION
configGRID_DESIGN_ACTIONS_ENABLED
configGRID_DESIGN_BACKEND
configGRID_DESIGN_GRIDS_TABLE
configGRID_DESIGN_DESIGNS_TABLE
configGRID_DESIGN_BOM_TABLE
configGRID_DESIGN_ACTIONS_TABLE
configMAIN_SUPABASE_URL
🔐 secretMAIN_SUPABASE_KEY
configGRID_DESIGN_COMPONENTS_DB_TABLE
configGRID_DESIGN_AUTOPOPULATE_WAIT
configGRID_DESIGN_BOM_WAIT
configCHAT_ORCHESTRATOR_URL
🔐 secretAPI_KEYmust match the API_KEY env var. To verify:
configAUTH_DB_HOST
configAUTH_DB_PORT
configAUTH_DB_USER
🔐 secretAUTH_DB_PASSWORD
configAUTH_DB_NAME
configJIRA_BASE_URL
configJIRA_USERNAME
🔐 secretJIRA_API_TOKEN
configJIRA_OPS_CLOUD_ID
configJIRA_OPS_SCHEDULE_ID
configJIRA_ORGANIZATION_FIELD_ID
🔐 secretTAVILY_API_KEY
configESCALATION_TELEGRAM_CHAT_ID
configMETA_ACTIONS_ENABLED
configCALIN_V1_BASE_URL
configCALIN_V1_USERNAME
🔐 secretCALIN_V1_PASSWORD
configCALIN_V1_COMPANY
configCALIN_V2_BASE_URL
configCALIN_V2_USERNAME
🔐 secretCALIN_V2_PASSWORD
configCALIN_V2_COMPANY
configCHIRPSTACK_BASE_URL
🔐 secretCHIRPSTACK_API_KEY
configCHIRPSTACK_TENANT_ID
🔐 secretSUPABASE_JWT_SECRET
configSUPABASE_USER_EMAIL
🔐 secretSUPABASE_USER_PASSWORD
configPAYMENT_PROCESSOR_API_URL
🔐 secretPAYMENT_PROCESSOR_SECRET_KEY
configNIGERIA_IMPORT_TARIFF_SHEET_ID
configNIGERIA_IMPORT_STANDARDS_PDF_ID
configSOLAR_ACTIONS_ENABLED
configHOST
configNICEGUI_RELOAD
🔐 secretIDENTITY_ASSERTION_KEY
configCORS_ALLOWED_ORIGINS
configAPP_URL
configMINI_APP_FORMS_ENABLED
configMETRICS_ENABLED
configMETRICS_TIMEZONE
configMETRICS_SCHEDULE_HOUR
configJIRA_SWEEP_ENABLED
🔐 secretJIRA_WEBHOOK_SECRETthe same JIRA_WEBHOOK_SECRET value
🔐 secretTELEGRAM_BOT_TOKEN3. Copy the API token BotFather gives you — this is your .
configBOT_ENABLED
🔐 secretNOTIFY_SHARED_SECRET
configNOTIFY_ENDPOINT_ENABLEDDisable the endpoint entirely: =false — /notify 503s.
configVERIFICATION_ENABLED
configGOOGLE_CLIENT_ID
configAUTH_CLIENT_IDGoogle Workspace — OAuth sign-in (/SECRET), plus Docs/Drive/Sheets via a service account (GOOGLE_SERVICE_ACCOUNT_JSON, _DOC_ID) and an Apps Script helper (ANANSI_HELPER_)
🔐 secretGOOGLE_CLIENT_SECRET
🔐 secretAUTH_CLIENT_SECRET
configAUTH_SUPABASE_URL
🔐 secretAUTH_SUPABASE_KEY
🔐 secretAUTH_SUPABASE_ANON_KEY
configMETERING_API_URL
🔐 secretMETERING_BEARER_TOKEN
🔐 secretMETERING_API_KEY
configTIMESCALE_HOST
configTIMESCALE_PORT
configTIMESCALE_DATABASE
configTIMESCALE_USER
🔐 secretTIMESCALE_PASSWORD
configVRM_BATCH_MAX_CONCURRENT
configCUSTOMER_METER_ACTIONS_ENABLED
configCUSTOMER_METER_POWER_LIMIT_OPTIONS
configPLATFORM_BASE_URL
configMINI_APP_BASE_URL
🔐 secretMINI_APP_HMAC_SECRET
configMCP_DISABLED_TOOLS
configVRM_USER_ID
configNO_REPLY_CHAT_IDS
configTELEGRAM_BOT_USERNAME4. Set to your bot's @handle (without the @).
configTOOLS_SERVICE_URL
configLLM_PROVIDER
🔐 secretGOOGLE_API_KEY
🔐 secretOPENROUTER_API_KEY
configGEMINI_TEMPERATURE
configFALLBACK_MODEL
configALLOW_PARALLEL_CALLS
configMAX_TOOL_ROUNDS
🔐 secretAUTH_COOKIE_SECRET
configAUTH_REDIRECT_URI
configGRID_DESIGN_DEV_NO_AUTH
configEPISODIC_DISTILL_ENABLED
configEPISODIC_DISTILL_HOUR
configGRAFANA_FOLDER_NAME
configGRAFANA_ENABLED_DASHBOARDS
configGRAFANA_FORCE_FULL_REINDEX
configGRAFANA_SYNC_HOUR
🔐 secretDIGITALOCEAN_API_TOKEN
configDIGITALOCEAN_APP_ID
configANANSI_BOT_HEALTH_URL
🔐 secretOPEN_ROUTER_BEARER_TOKEN
configSTAFF_ORG_NAME
configOPENROUTER_MODEL
Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.
deployPORT
deploySUPABASE_URL
deploySUPABASE_ANON_KEY
deploySUPABASE_SERVICE_ROLE_KEY
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

112/112 tools missing one or more hints — dynamic_tool_326 (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); _tool_meter_information (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); _tool_customer_get_meter_consumption (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +109 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool test coverage

Only 24/112 tools referenced in tests (21%)

Write tests that reference each tool by name so every tool has at least one test.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 3 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/nxtgrid/nxt-ai-assistant)](https://m8ven.ai/mcp/nxtgrid/nxt-ai-assistant)
Shows your grade and updates automatically. Prefer no grade? Append ?variant=verified to the badge URL.
commit: fa14aabb9f993625b488af99b2074b01142e5876
code hash: 3ef659d2f46676e47cb45396f10aa3c0a15f949444eca0c9736556340f99907c
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client