Back to MCP Trust Indexm8ven
54
/ 100
1 month ago
glama

Investors MCP Server

Enables semantic search and ingestion of investor content using Upstash Vector and Vercel Blob storage, with optional filtering by author, company, and date.

→ prismteam-ai/investors-mcp· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
⚠️
Known vulnerabilities in dependencies: 10 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
🔐
You'll be asked for 13 credentials: AI_GATEWAY_API_KEY, ASANA_ACCESS_TOKEN, AUTOMATION_TRIGGER_TOKEN, BLOB_READ_WRITE_TOKEN, CRON_SECRET, GOOGLE_CLIENT_SECRET, MCP_WRITE_TOKEN, NEXTAUTH_SECRET, UPSTASH_VECTOR_REST_TOKEN, X_AUTH_TOKEN, X_BEARER_TOKEN, X_CSRF_TOKEN, X_WEB_BEARER_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies10 high2 medium11 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

highmcp-handler@1.0.1GHSA-w2fm-25vw-vh7f

mcp-handler has a tool response leak across concurrent client sessions ('Race Condition')

highnext@15.2.6GHSA-267c-6grr-h53f

Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes

highnext@15.2.6GHSA-26hh-7cqf-hhc6

Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up

highnext@15.2.6GHSA-36qx-fr4f-26g5

Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n

highnext@15.2.6GHSA-8h8q-6873-q5fj

Next.js Vulnerable to Denial of Service with Server Components

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
🔐 secretAI_GATEWAY_API_KEY— your API key
🔐 secretASANA_ACCESS_TOKEN— Asana Required to create tasks from monitored posts
configASANA_ARTICLE_THRESHOLD_ASSIGNEE_GID— Asana Optional assignee when a post meets the article recommendation threshold
configASANA_ASSIGNEE_GID— Asana Optional default assignee for created tasks
configASANA_PROJECT_GID— Asana Project where monitored-post tasks are created
configASANA_SECTION_GID— Asana Optional section to place newly created tasks into
configASANA_SIMILARITY_SCORE_CUSTOM_FIELD_GID— Asana Optional shared number custom field GID for both parent tasks and recommendation subtasks
configASANA_SUBTASK_SIMILARITY_SCORE_CUSTOM_FIELD_GID— Asana Optional subtask-specific number custom field GID; overrides the shared GID for recommendation subtasks
configASANA_TASK_SIMILARITY_SCORE_CUSTOM_FIELD_GID— Asana Optional parent-task-specific number custom field GID; overrides the shared GID for parent tasks
configASANA_WORKSPACE_GID— Asana Optional workspace override for task creation
configAUTH_ALLOWED_GOOGLE_DOMAIN— Recommended value for :
configAUTOMATION_ASANA_DEDUPE_SCAN_TASKS
configAUTOMATION_ASANA_ENRICHMENT_ENABLED
configAUTOMATION_ASANA_ENRICHMENT_TIMEOUT_MS
configAUTOMATION_ASANA_EXISTING_TASK_DEDUPE_ENABLED
configAUTOMATION_ASANA_RECOMMENDATION_MODEL
configAUTOMATION_ASANA_SIMILARITY_TOPK
configAUTOMATION_ASANA_TASK_CACHE_TTL_MS
configAUTOMATION_AUTO_BACKFILL_MAX_POSTS_PER_AUTHOR
configAUTOMATION_AUTO_BACKFILL_WINDOW_HOURS
configAUTOMATION_MAX_NEW_POSTS_PER_AUTHOR_PER_RUN
configAUTOMATION_MONITOR_RUN_BUDGET_MS
configAUTOMATION_MONITOR_RUN_LOCK_TTL_SECONDS
configAUTOMATION_NETWORK_FETCH_TIMEOUT_MS
configAUTOMATION_PER_AUTHOR_FETCH_TIMEOUT_MS
configAUTOMATION_PER_POST_ASANA_TIMEOUT_MS
configAUTOMATION_PER_POST_INGEST_TIMEOUT_MS
configAUTOMATION_RECORD_SKIPPED_POLLS
configAUTOMATION_REFERENCE_FETCH_TIMEOUT_MS
configAUTOMATION_SOOFI_CONTEXT_CONTENT_TYPE
configAUTOMATION_SOOFI_CONTEXT_SEGMENT_TYPE
🔐 secretAUTOMATION_TRIGGER_TOKEN— Self-generated Bearer token for /api/automation/monitor-x trigger endpoint
configAUTOMATION_WATCH_AUTHORS— Optional list Optional comma-separated subset of watched authors
🔐 secretBLOB_READ_WRITE_TOKEN— This automatically sets
🔐 secretCRON_SECRET— Self-generated Optional. If set, Vercel Cron can authenticate to trigger endpoint
configDATABASE_URL
configDATABASE_URL_UNPOOLED
configGOOGLE_APPLICATION_CREDENTIALS
configGOOGLE_CHAT_AMBIGUOUS_REPLY_MODEL
configGOOGLE_CHAT_AMBIGUOUS_REPLY_TIMEOUT_MS
configGOOGLE_CHAT_INTENT_MODEL
configGOOGLE_CHAT_SHARED_INTENT_MODEL
configGOOGLE_CHAT_SHARED_INTENT_TIMEOUT_MS
configGOOGLE_CLIENT_ID
🔐 secretGOOGLE_CLIENT_SECRET
🔐 secretMCP_WRITE_TOKEN— Self-generated Optional. Bearer token for write operations (addInvestorParagraph)
🔐 secretNEXTAUTH_SECRET
configPOSTGRES_URL
configPOSTGRES_URL_NON_POOLING— url> node scripts/report-x-monitor-runs.mjs \
configRAG_AUTOREPLY_MODEL— Optional Legacy draft-model override (currently unused by Asana task creation)
🔐 secretUPSTASH_VECTOR_REST_TOKEN— This automatically sets UPSTASH_VECTOR_REST_URL and
configUPSTASH_VECTOR_REST_URL— This automatically sets and UPSTASH_VECTOR_REST_TOKEN
configVERCEL
🔐 secretX_AUTH_TOKEN
🔐 secretX_BEARER_TOKEN— X Developer Portal Optional. Enables authenticated X API article/full-text enrichment in ingestion scripts
🔐 secretX_CSRF_TOKEN
configX_CT0
configX_MONITOR_TWSTALKER_ORIGIN— Optional TwStalker base URL override (default https://twstalker.com)
configX_MONITOR_X_API_ORIGIN
configX_REFERENCE_CHAIN_MAX_DEPTH
configX_REFERENCE_CHAIN_MAX_STATUSES
configX_WEB_ARTICLE_ENTITY_OPERATION
configX_WEB_ARTICLE_ENTITY_QUERY_ID
🔐 secretX_WEB_BEARER_TOKEN
configX_WEB_TWEET_RESULT_OPERATION
configX_WEB_TWEET_RESULT_QUERY_ID
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/prismteam-ai-investors-mcp-1x1dp2)](https://m8ven.ai/mcp/prismteam-ai-investors-mcp-1x1dp2)
commit: 4cfedbec6e55be6ced1583e0d66df84a02abdc8e
code hash: 3e15c63f68c596b0964b616766273855e2c855cdff1975822ab21f6108eeff56
verified: 6/19/2026, 10:54:11 AM
view raw JSON →