Maple is a unified MCP server for agent observability, safety control, and behavior evolution, acting as a monitoring and auditing layer for high-agency agents. It enables developers to capture session timelines, replay risky branches, detect anomalies using ML, and enforce action guardrails.
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE
React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets
React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint
React Router vulnerable to Denial of Service via reflected user input in single-fetch
Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket
process.env. You'll be asked to provide them before it can run.ANTHROPIC_API_KEY— If OPENAI_API_KEY and/or are set, Maple enables AI mode with automatic fallback.GOOGLE_CLIENT_IDHACKATHON_TOOLHUB_HOSTMAPLE_ADMIN_EMAILMAPLE_ADMIN_PASSWORDMAPLE_ADMIN_USERNAMEMAPLE_ALLOW_BRIDGE_OVERRIDE— Optional local-only override: =true.MAPLE_ALLOW_NO_AUTHMAPLE_ANTHROPIC_API_KEYMAPLE_AUTH_ALLOW_SELF_SIGNUPMAPLE_DB_PATHMAPLE_DEMO_DELAYMAPLE_DEMO_SESSIONMAPLE_DEMO_SOURCEMAPLE_DEMO_URLMAPLE_DEV_EMAILMAPLE_DEV_PASSWORDMAPLE_DEV_USERNAMEMAPLE_DOWNSTREAM_TOOLS_CACHE_TTL_MSMAPLE_ENABLE_DEMO_ROUTESMAPLE_ENABLE_JUDGE_UIMAPLE_ENABLE_LEGACY_SMITHERY_ROUTESMAPLE_FIREWALL_CHAT_ANTHROPIC_MODEL— claude-sonnet-4-6MAPLE_FIREWALL_CHAT_OPENAI_MODEL— gpt-4o-miniMAPLE_FIREWALL_CHAT_PRIMARY— openai # openai anthropicMAPLE_FIREWALL_CHAT_TIMEOUT_MSMAPLE_FIREWALL_DEFAULT_ACTION— allow # allow deny log_onlyMAPLE_FIREWALL_ENABLEDMAPLE_FIREWALL_LOG_DIR— ~/.maple/firewall-logsMAPLE_GPT_OAUTH_CLIENT_IDMAPLE_GPT_OAUTH_CLIENT_SECRETMAPLE_LOCK_BRIDGE_TARGET— Set =true to deny per-request bridgeUrl / token overrides.MAPLE_LOG_BODY_MAX_CHARSMAPLE_LOG_INCLUDE_BODIESMAPLE_LOG_LEVELMAPLE_LOG_REQUESTSMAPLE_MAX_SHARED_TRACESMAPLE_MCPSO_BASE_URLMAPLE_MCPSO_CACHE_TTL_MSMAPLE_MCPSO_ENABLEDMAPLE_MCPSO_TIMEOUT_MSMAPLE_MCP_EXECUTION_ORDERMAPLE_MCP_FIREWALL_DEFAULT_APPMAPLE_MCP_MARKETPLACE_AUTO_CONNECTMAPLE_MCP_MARKETPLACE_ENABLEDMAPLE_MCP_PROXY_ALLOWED_HOSTSMAPLE_MCP_PROXY_ALLOW_DYNAMIC_TARGETSMAPLE_MCP_PROXY_ALLOW_HTTPMAPLE_MCP_PROXY_ALLOW_PRIVATE_TARGETSMAPLE_MCP_PROXY_DEFAULT_TARGET_URLMAPLE_MCP_ROUTE_LOCKMAPLE_OPENAI_API_KEYMAPLE_SESSION_OWNER_SCOPEMAPLE_SESSION_POLLMAPLE_SESSION_POLL_MSMAPLE_SESSION_TTL_SECONDSMAPLE_SMITHERY_API_BASE_URLMAPLE_SMITHERY_API_KEYMAPLE_SMITHERY_ENABLEDMAPLE_SMITHERY_TIMEOUT_MSMAPLE_TOOLHUB_PORTMAPLE_TOOLHUB_TIMEOUT_MSMAPLE_TRACE_SESSION_IDMCP_URLOPENAI_API_KEY— If and/or ANTHROPIC_API_KEY are set, Maple enables AI mode with automatic fallback.OPENCLAW_BRIDGE_MODEOPENCLAW_BRIDGE_PORTOPENCLAW_BRIDGE_REQUIRE_AUTHOPENCLAW_BRIDGE_TOKEN— your_tokenOPENCLAW_BRIDGE_URL— In production, and OPENCLAW_BRIDGE_TOKEN must be explicitly set.OPENCLAW_GATEWAY_HISTORY_LIMITOPENCLAW_GATEWAY_SESSION_KEYOPENCLAW_GATEWAY_TOKENOPENCLAW_GATEWAY_WS_URLOPENCLAW_SESSIONS_DIRPORT— Railway provides automatically; do not hardcode it.SLACK_BOT_TOKEN— Bot mode: set and optionally SLACK_DEFAULT_CHANNELSLACK_DEFAULT_CHANNEL— Bot mode: set SLACK_BOT_TOKEN and optionallySLACK_WEBHOOK_URL— Incoming webhook mode: set[](https://m8ven.ai/mcp/omar2001ramadan-mcp-17v43o)