Site (RaphaelVitoi/Site) is an MCP server listed on the M8ven Trust Index. It scores 74 out of 100, grade C. It declares 17 tools. No publisher has claimed this listing.

Emerging

74/100

Site

Item: Site
Rating: 74
Author: M8ven

NEXUS SOTA v7.0 GOLD — Monorepo de Alta Performance: Motor de Equidade Vitoi (WASM), DAG Multi-Agente e Frontend Next.js

→ RaphaelVitoi/Site · listed on github_code

Emerging. No concerning findings. Grades remain capped until the project builds reputation through adoption. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every push why connect →

Who stands behind it

RaphaelVitoi

Source: github_code

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

GitHub

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings

🚨

Secret credentials may flow to a network call

5 flows detected: TODOIST_API_TOKEN, API_SECRET_TOKEN. We can’t prove the destination matches the brand the credential belongs to.

🔐

You'll be asked for 8 credentials: GEMINI_API_KEY, API_SECRET_TOKEN, GEMINI_PRO_RPM_PER_KEY, GEMINI_FLASH_RPM_PER_KEY, VITOI_AUTH_TOKEN, TAVILY_API_KEY, SUPABASE_JWT_SECRET, GOOGLE_API_KEY

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// tools this server exposes17 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

create_task

Create a new task in Todoist. Supports due dates, priority (1-4), labels, project_id, section_id, and markdown description.

get_tasks

Get active tasks from Todoist. Can filter by project_id, section_id, label, or natural language filter query.

get_task

Get a specific Todoist task by ID.

update_task

Update an existing task's title, description, due date, priority, or labels.

close_task

Complete / close a task in Todoist.

reopen_task

Reopen / uncomplete a previously completed task in Todoist.

delete_task

Delete a task permanently from Todoist.

get_projects

Get all projects in Todoist.

create_project

Create a new project in Todoist.

get_labels

Get all personal labels in Todoist.

create_label

Create a new label in Todoist.

figma_dev_mode_status

Returns the connection status to Figma Dev Mode on port 3845. Launch Figma Desktop and enable Dev Mode to access live canvas tools.

execute_sota_task

Executa uma tarefa atraves do engine SOTA Task Executor.

list_sota_tasks

Lista tarefas pendentes do sistema SOTA.

delegate_pmev_to_jules

Delega simulacoes intensivas de Teoria dos Jogos PMev ou refatoracoes de grande porte para o Google Jules.

get_jules_task_status

Consulta o status e o progresso de uma sessao em execucao no Google Jules.

dynamic_tool_51

// environment variables

To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.

🔐 secretGEMINI_API_KEY

configSIMULATE_INFERENCE

configLOCAL_LLAMA_URL

configGEMINI_MODEL_ID

configLOCAL_MAX_TOKENS

configCOMPLEXITY_THRESHOLD

configHOST

configROUTER_URL

configBENCH_REQUESTS

configBENCH_CONCURRENCY

configBENCH_TIMEOUT

configBENCH_OUTPUT_JSON

configENABLE_LOGGING

configORCHESTRATOR_HOST

🔐 secretAPI_SECRET_TOKEN

configHF_HUB_OFFLINE

configTOKENIZERS_PARALLELISM

configGDRIVE_PDF_PATH

configLOG_LEVEL

configGEMINI_HEALTH_FLASH_MODEL

configGEMINI_HEALTH_PRO_MODEL

configFASTAPI_DEBUG

configUVICORN_RELOAD

configPYTHONDONTWRITEBYTECODE

configDEFAULT_GEMINI_FAST_MODEL

configOPENROUTER_ALTERNATIVE_MODELS

configSQLITE_DB_PATH

configGEMINI_MODEL_KEY_BLOCK_MINUTES

configROUTE_COOLDOWN_MINUTES

configROUTE_FAILURE_THRESHOLD

configDEEPSEEK_ROUTE_COOLDOWN_MINUTES

configDEEPSEEK_ROUTE_FAILURE_THRESHOLD

🔐 secretGEMINI_PRO_RPM_PER_KEY

🔐 secretGEMINI_FLASH_RPM_PER_KEY

🔐 secretVITOI_AUTH_TOKEN

configNEXUS_CHAOS_LAMBDA

configPERPLEXITY_MODEL

configUV_PROJECT_ENVIRONMENT

🔐 secretTAVILY_API_KEY

🔐 secretSUPABASE_JWT_SECRET

configNEXUS_TRUSTED_ORIGINS

🔐 secretGOOGLE_API_KEY

configSOTA_VOICE_TMP

Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.

deployPORT

// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

17/17 tools missing one or more hints — create_task (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_tasks (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_task (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +14 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool test coverage

7/17 tools referenced in tests (41%)

Write tests that reference each tool by name so every tool has at least one test.

Secrets stay with their owner

1 secret sent to a request target we could not resolve (API_SECRET_TOKEN → dynamic) — often a configured endpoint, not necessarily third-party

Audit where credentials are sent. A NOTION_TOKEN should only reach api.notion.com — never a third-party host.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail

The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.

// improvement guidance — verified publishers only

We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/raphaelvitoi/site)](https://m8ven.ai/mcp/raphaelvitoi/site)

Shows your grade and updates automatically. Prefer no grade? Append ?variant=verified to the badge URL.

commit: fed9c19ff160601e0d8318052c88c676bf2935cb

code hash: 9274530e11f4cb5c0c79393b02920c47e186142d7db15bc6cdd555db829f5f15

view raw JSON →

Check MCPs from inside your assistant

Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check

check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern

How to add it →Free · no account needed · works in any MCP client