Back to MCP Trust Indexm8ven
41
/ 100
1 month ago
glama

Packrift MCP Server

Enables AI agents to search a Shopify packaging-supplies catalog, get live pricing and inventory, recommend boxes, estimate shipping, and generate checkout URLs.

→ Packrift/packrift-mcp· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
⚠️
Known vulnerabilities in dependencies: 1 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 3 credentials: CLOUDFLARE_API_TOKEN, MCP_STATS_TOKEN, SHOPIFY_PACKRIFT_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies1 high4 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

highwrangler@3.95.0GHSA-36p8-mvp6-cv38

Wrangler affected by OS Command Injection in `wrangler pages deploy`

lowhono@4.12.18GHSA-2gcr-mfcq-wcc3

Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

lowhono@4.12.18GHSA-3hrh-pfw6-9m5x

Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

lowhono@4.12.18GHSA-f577-qrjj-4474

Hono: JWT middleware accepts any Authorization scheme, not only Bearer

lowhono@4.12.18GHSA-xrhx-7g5j-rcj5

Hono: IP Restriction bypasses static deny rules for non-canonical IPv6

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configAI_SALES_SKU_PAGE_TELEMETRY
🔐 secretCLOUDFLARE_API_TOKEN
configCLOUDFLARE_PACKRIFT_ZONE_ID
configMCP_ENDPOINT
configMCP_EVAL_ENDPOINT
🔐 secretMCP_STATS_TOKEN— endpoint requires and does not expose customer PII.
configPACKRIFT_ATTRIBUTION_NOTE_DIR
configPACKRIFT_GA4_AUTH_MODE
configPACKRIFT_GA4_PROPERTY_ID
configPACKRIFT_MCP_EXPECTED_VERSION
configPORT— Dockerfile starts the Packrift MCP server on =8787.
configSHOPIFY_API_VERSION— defaults to 2025-04
🔐 secretSHOPIFY_PACKRIFT_TOKEN— Running the container without still exposes MCP
configSHOPIFY_STORE_DOMAIN— defaults to packrift.myshopify.com
configSTOREFRONT_DOMAIN— defaults to packrift.com
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 3 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/packrift-packrift-mcp-1whm67)](https://m8ven.ai/mcp/packrift-packrift-mcp-1whm67)
commit: 4ac345ced7aa031a0021948383ca59855672d505
code hash: ec6b203792fc79b76ba0271ff8c44540a316f709aef146b0beb7331a215c2dac
verified: 6/11/2026, 11:09:38 AM
view raw JSON →