Back to MCP Trust Indexm8ven
0
/ 100
9 hours ago
glama

bsp-mcp-server

Provides a unified block-spindle-pscale function for reading, writing, and managing locks on JSON blocks across federated beaches, sed collectives, and bilateral grains.

→ pscale-commons/bsp-mcp-server· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
🚨
Secret credentials may flow to a network call
9 flows detected: ANTHROPIC_API_KEY. We can’t prove the destination matches the brand the credential belongs to.
🚨
Reads files from sensitive locations
Touches: ~/.config/genus-one/anthropic-key, ~/.config/mobius/anthropic-key
⚠️
Known vulnerabilities in dependencies: 3 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 3 credentials: ANTHROPIC_API_KEY, GENUS_SECRET, GENOME_SECRET
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies3 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.12.1GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.12.1GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.12.1GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
🔐 secretANTHROPIC_API_KEY
configANTHROPIC_BASE_URL
configAUTHOR_PORT
configBEACH_REPO
configBEACH_TIMEOUT_MS
configCHECK_PORT
configDEFAULT_BEACH— Default beach is https://beach.happyseaurchin.com — override via the env var.
configGENUS_BEACH
configGENUS_HANDLE
configMCP_PATH— Default port 3001, MCP path /mcp/v1. Override with PORT, , and DEFAULT_BEACH env vars.
configPLAYABLE_PORT
configPOOL_PORT
configPORT— Default port 3001, MCP path /mcp/v1. Override with , MCP_PATH, and DEFAULT_BEACH env vars.
configPSCALE_BEACH
configRIG_PORT
configSEED_PORT
configSMOKE_BEACH
configSPEED_PORT
configSPOOL_BEACH
configGENUS_AGENT
configGENUS_TEACHING
🔐 secretGENUS_SECRET
configGENUS_KEY_FILE
configGENUS_HAIKU
configGENUS_SONNET
configGENUS_OPUS
configGENUS_MODEL
configGENUS_F_MODEL
configGENUS_MAX_TOKENS
configGENUS_THINK
configGENUS_RIPENESS
configGENUS_COUPLE_GAIN
configGENUS_COUPLE_ALPHA
configGENUS_COUPLE
configGENUS_CONCENTRATE
configGENUS_NOW
🔐 secretGENOME_SECRET
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/pscale-commons-bsp-mcp-server-1fhgi1)](https://m8ven.ai/mcp/pscale-commons-bsp-mcp-server-1fhgi1)
commit: 4c9707b52ff8b13558ffa4e063f18d409acf1d7a
code hash: a6fc5120b5d0d130d85adda278e81b73dc06083f7918669869a744a271c3ae7d
verified: 7/31/2026, 9:15:12 AM
view raw JSON →