Back to MCP Trust Indexm8ven
57
/ 100
1 month ago
github_topic

ironcurtain

A secure* runtime for autonomous AI agents. Policy from plain-English constitutions. (*https://ironcurtain.dev)

→ provos/ironcurtain· listed on github_topic
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

GitHub

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
🚨
Known vulnerabilities in dependencies: 2 critical, 6 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 3 credentials: ANTHROPIC_API_KEY, GOOGLE_GENERATIVE_AI_API_KEY, OPENAI_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies2 critical6 high1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

criticalshell-quote@1.8.3GHSA-w7jw-789q-3m8p

shell-quote quote() does not escape newlines in object .op values

criticalvitest@4.0.18GHSA-5xrq-8626-4rwp

When Vitest UI server is listening, arbitrary file can be read and executed

highminimatch@10.2.1GHSA-23c5-xmqv-rm74

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

highminimatch@10.2.1GHSA-7r86-cg39-jmmj

minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

highnode-forge@1.3.3GHSA-2328-f5f3-gj25

Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configALLOWED_DIRECTORY
🔐 secretANTHROPIC_API_KEY— export =sk-ant-...
configAUDIT_LOG_PATH
🔐 secretGOOGLE_GENERATIVE_AI_API_KEY— Missing API key Set the environment variable (ANTHROPIC_API_KEY, , or OPENAI_API_KEY) or add the corresponding key to ~/.ironcurtain/config.json.
configHTTPS_PROXY
configHTTP_PROXY
configIRONCURTAIN_HOME
configNPX_PATH
🔐 secretOPENAI_API_KEY— Missing API key Set the environment variable (ANTHROPIC_API_KEY, GOOGLE_GENERATIVE_AI_API_KEY, or ) or add the corresponding key to ~/.ironcurtain/config.json.
configPORT
configRESET_PORT
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/provos-ironcurtain-1kubo4)](https://m8ven.ai/mcp/provos-ironcurtain-1kubo4)
commit: 751c142f5fd5208a3327c673c29b43a73fcbd814
code hash: a376d681619eebe142296f4cbcdf9e1f425894aa95e88b65fed83993ce2408fc
verified: 6/15/2026, 1:34:57 PM
view raw JSON →