Back to MCP Trust Indexm8ven
62
/ 100
1 month ago
glama

GPT Commander

A security-first MCP server that provides LLMs with structured tools for filesystem, process, search, build/test/lint, IDE integration, and more.

→ PushPullCommitPush/GPT-Commander---An-LLM-facing-software-engineering-substrate· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
⚠️
Known vulnerabilities in dependencies: 3 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 1 credential: GPT_DC_TLS_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies3 high1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.0.0GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.0.0GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

highws@8.19.0GHSA-96hv-2xvq-fx4p

ws: Memory exhaustion DoS from tiny fragments and data chunks

lowws@8.19.0GHSA-58qx-3vcg-4xpx

ws: Uninitialized memory disclosure

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configCLAUDE_PATH— $HOME/.local/bin/claude
configCODEX_PATH— /opt/homebrew/bin/codex
configGEMINI_PATH— /opt/homebrew/bin/gemini
configGPT_DC_ABSOLUTE_ENDPOINT— "https://your-host.example/desktop" \
configGPT_DC_CONFIG— "": "/optional/custom/config.json"
configGPT_DC_ENDPOINT_HOST
configGPT_DC_ENDPOINT_PATH
configGPT_DC_ENDPOINT_PORT
configGPT_DC_ENDPOINT_SCHEME
configGPT_DC_HOST— 127.0.0.1 GPT_DC_PORT=3333 \
configGPT_DC_PORT— GPT_DC_HOST=127.0.0.1 =3333 \
configGPT_DC_TAILNET_HOST— (allowed host list)
configGPT_DC_TLS_CERT— GPT_DC_TLS_KEY, (optional HTTPS)
🔐 secretGPT_DC_TLS_KEY— , GPT_DC_TLS_CERT (optional HTTPS)
configOLLAMA_HOST— "http://127.0.0.1:11434" node dist/ollama-mcp.js
configOLLAMA_TIMEOUT_MS— (default 120000)
configSHELL— "defaultShell": "$",
configCOMMANDER_MCP_URL
configMCP_URL
configMCP_ENDPOINT
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 2 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/pushpullcommitpush-gpt-commander-an-llm-facing-software-engineering-su-1ggsws)](https://m8ven.ai/mcp/pushpullcommitpush-gpt-commander-an-llm-facing-software-engineering-su-1ggsws)
commit: fe03ddf01761f5ab6e211da8327aa23c4bfde20f
code hash: a2cfd4cd0553a1f8136b9388b191c0c68ab6e1feae892705a12d1d792410f129
verified: 6/22/2026, 12:47:38 PM
view raw JSON →