/ 100

9 days ago

glama

docforge

Item: docforge
Rating: 74
Author: M8ven

Agent-grade document production powered by Typst: templates with JSON schemas, deterministic compile/lint/repair, PNG previews and visual QA

→ PrecisionUtilityGuild/docforge · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 3 credentials: SLACK_APP_TOKEN, SLACK_BOT_TOKEN, SLACK_SIGNING_SECRET

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// known CVEs in dependencies1 medium

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

mediumajv@8.17.1GHSA-2g4f-4pwh-qvx6

ajv has ReDoS when using `$data` option

Depend on this server? Get alerted when its CVEs change.Watch this server free →

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configDOCFORGE_COMPILE_TIMEOUT_MS— 30000 Compile timeout

configDOCFORGE_DATA_ROOT— "": "/absolute/path/for/your/documents"

configDOCFORGE_DOCUMENT_TTL_MS— 86400000 Idle document handle TTL (24h)

configDOCFORGE_NPM_CACHE

configDOCFORGE_TEMPLATE_SOURCE_DIRS— Extra allowed dirs for custom template sources

configDOCFORGE_TYPST_PACKAGE_CACHE_PATH— Typst package cache override

configDOCFORGE_TYPST_PACKAGE_PATH— vendor/... Offline Typst package source

configDOCFORGE_TYPST_PATH— typst Typst CLI binary

configDOCFORGE_VISUAL_THRESHOLD— 0.02 Visual-regression diff threshold

configFORGE_CONFIRM_PREVIEW

configFORGE_MCP— (src/forge/mcp-client.ts). Set =off to force the in-process fallback.

configFORGE_MCP_SERVER_ENTRY— dist/index.js Override MCP child entry

configPOLL_MESSAGE_LIMIT

configPOLL_OUTPUT

configPORT

configSEED_DELAY_MS

configSEED_GENERAL_CHANNEL

configSEED_INCIDENT_CHANNEL

configSEED_SALES_CHANNEL

configSEED_STATUS_CHANNEL

🔐 secretSLACK_APP_TOKEN— cp .env.sample .env # fill SLACK_BOT_TOKEN +

🔐 secretSLACK_BOT_TOKEN— cp .env.sample .env # fill + SLACK_APP_TOKEN

configSLACK_LOG_LEVEL— info Set debug for Slack agent diagnostics

🔐 secretSLACK_SIGNING_SECRET

configSLACK_SOCKET_MODE— e =false \

configTYPST_VERSION_PIN— [Typst](https://typst.app/) 0.14.2+ (pinned — typst --version must be ≥ in src/config.ts)

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/precisionutilityguild-docforge-1stzlt)](https://m8ven.ai/mcp/precisionutilityguild-docforge-1stzlt)

commit: 8956a422a34f1496fd8294fd25dcbd9d04d07b81

code hash: 1b06afdca111c4d2ef932ef9c684064f738097ac5ab06cb2f11d53b4849a8f2d

verified: 7/22/2026, 8:40:07 AM

view raw JSON →