/ 100

1 month ago

glama

RC Engine

An AI-native product development pipeline that guides users from idea to shipping with structured research, architecture, build, validation, and traceability using 52 tools across 4 domains.

→ originalrashmi/rc-engine-product-framework · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

🚨

Secret credentials may flow to a network call

1 flow detected: GOOGLE_FONTS_API_KEY. We can’t prove the destination matches the brand the credential belongs to.

🚨

Known vulnerabilities in dependencies: 1 critical, 3 high

Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.

⚠️

Tests do not pass

Either the test suite is broken or the code regressed. Either way the published behaviour can’t be verified by the publisher’s own tests.

🔐

You'll be asked for 7 credentials: ANTHROPIC_API_KEY, GEMINI_API_KEY, GOOGLE_API_KEY, GOOGLE_FONTS_API_KEY, GOOGLE_GEMINI_API_KEY, OPENAI_API_KEY, PERPLEXITY_API_KEY

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// known CVEs in dependencies1 critical3 high1 medium1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

criticalvitest@4.0.18GHSA-5xrq-8626-4rwp

When Vitest UI server is listening, arbitrary file can be read and executed

highexpress-rate-limit@8.2.1GHSA-46wh-pxpv-q5gq

express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting on servers with dual-stack network

highvite@7.3.1GHSA-p9ff-h696-f583

Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket

highvite@7.3.1GHSA-v2wj-q39q-566r

Vite: `server.fs.deny` bypassed with queries

mediumvite@7.3.1GHSA-4w7w-66w2-5vf9

Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling

Depend on this server? Get alerted when its CVEs change.Watch this server free →

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

🔐 secretANTHROPIC_API_KEY— Edit .env with your API keys (at minimum, )

configCLAUDE_MODEL

🔐 secretGEMINI_API_KEY

configGEMINI_MODEL

🔐 secretGOOGLE_API_KEY

🔐 secretGOOGLE_FONTS_API_KEY

🔐 secretGOOGLE_GEMINI_API_KEY

configMAX_TOKENS

🔐 secretOPENAI_API_KEY

configOPENAI_MODEL

🔐 secretPERPLEXITY_API_KEY

configPERPLEXITY_MODEL

configRC_VERDICT_PROCEED_THRESHOLD

configRC_VERDICT_RECONSIDER_THRESHOLD

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/originalrashmi-rc-engine-product-framework-1d5508)](https://m8ven.ai/mcp/originalrashmi-rc-engine-product-framework-1d5508)

commit: ea2e2f492827ef068f87c6e9305484c2d6fb3618

code hash: d1aeef1f18ac0caa3419f30830d8ecd9e0b0410239d46903890ec86115ec534b

verified: 6/11/2026, 12:08:37 PM

view raw JSON →