Liara MCP Server (razavioo/liara-mcp) is an MCP server listed on the M8ven Trust Index. It scores 54 out of 100, grade D. It declares 108 tools. No publisher has claimed this listing.

Caution

54/100

Liara MCP Server

Item: Liara MCP Server
Rating: 54
Author: M8ven

Enables AI assistants to deploy and manage applications, databases, object storage, VMs, DNS, and infrastructure on the Liara cloud platform through natural language commands.

→ razavioo/liara-mcp · listed on glama

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every push why connect →

Who stands behind it

razavioo

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

Glamanot scored here

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings

🚨

Known vulnerabilities in dependencies: 1 critical, 12 high

Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.

🔐

You'll be asked for 1 credential: LIARA_API_TOKEN

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// tools this server exposes108 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

liara_list_apps

List all apps/projects in your Liara account

liara_get_app

Get detailed information about a specific app

liara_create_app

Create a new app

liara_delete_app

Delete an app

liara_start_app

Start an app (scale up)

liara_stop_app

Stop an app (scale down)

liara_restart_app

Restart an app

liara_resize_app

Change app plan (resize resources)

liara_manage_app

Comprehensive app management: list apps, get details, create, delete, start, stop, restart, or resize apps

liara_manage_env_vars

Manage environment variables: list, set single/multiple, or delete single/multiple variables

liara_manage_databases

Database lifecycle management: list, get details, create, delete, start, stop, restart, or resize databases

liara_manage_database_backups

Database backup management: create, list, get download URL, restore, or delete backups

liara_manage_buckets

Storage bucket lifecycle management: list, get details, create, delete, or get credentials

liara_manage_bucket_objects

Bucket object operations: list objects, upload, get download URL, or delete objects

liara_get_infrastructure_overview

Get a comprehensive overview of all Liara infrastructure: apps, databases, buckets, networks

liara_manage_deployment

Deployment management: list releases and sources

liara_list_databases

List all databases in your Liara account

liara_get_database

Get details of a specific database

liara_get_database_connection

Get database connection information (host, port, credentials)

liara_update_database

Update database settings such as plan (resize) or version. At least one of planID or version must be provided.

liara_create_database

Create a new database

liara_delete_database

Delete a database

liara_start_database

Start a database

liara_stop_database

Stop a database

liara_resize_database

Change database plan (resize resources)

liara_create_backup

Create a database backup

liara_list_backups

List backups for a database

liara_get_backup_download_url

Get download URL for a database backup

liara_restart_database

Restart a database

liara_restore_backup

Restore a database from a backup

liara_delete_backup

Delete a database backup

liara_upload_source

Upload source code (.tar.gz file) for deployment

liara_deploy_release

Deploy a release using a source ID

liara_list_releases

List all releases for an app

liara_get_release

Get details of a specific release

liara_rollback_release

Rollback to a previous release

liara_list_sources

List all uploaded sources for an app

liara_delete_source

Delete an uploaded source

liara_list_disks

List disks for an app

liara_create_disk

Create a new disk for an app

liara_delete_disk

Delete a disk

liara_get_disk

Get details of a specific disk

liara_resize_disk

Resize a disk

liara_create_ftp_access

Create FTP access for a disk

liara_list_ftp_accesses

List FTP accesses for a disk

liara_delete_ftp_access

Delete/revoke FTP access for a disk

liara_list_zones

List all DNS zones

liara_get_zone

Get details of a DNS zone

liara_create_zone

Create a new DNS zone

liara_delete_zone

Delete a DNS zone

liara_list_dns_records

List DNS records for a zone

liara_create_dns_record

Create a DNS record

liara_get_dns_record

Get details of a DNS record

liara_update_dns_record

Update a DNS record

liara_delete_dns_record

Delete a DNS record

liara_list_domains

List all domains attached to apps

liara_get_domain

Get details of a domain

liara_add_domain

Add a domain to an app

liara_remove_domain

Remove a domain from an app

liara_set_env_vars

Set or update environment variables for an app

liara_set_env_var

Set a single environment variable for an app

liara_get_env_vars

Get all environment variables for an app

liara_delete_env_var

Delete/unset an environment variable for an app

liara_delete_env_vars

Delete/unset multiple environment variables for an app

liara_list_mail_servers

List all mail servers

liara_get_mail_server

Get details of a mail server

liara_create_mail_server

Create a new mail server

liara_delete_mail_server

Delete a mail server

liara_send_email

Send an email via a mail server

liara_start_mail_server

Start a mail server

liara_stop_mail_server

Stop a mail server

liara_restart_mail_server

Restart a mail server

liara_list_networks

List all networks

liara_get_network

Get details of a network

liara_create_network

Create a new network

liara_delete_network

Delete a network

liara_get_metrics

Get app metrics summary

liara_get_logs

Get app logs

liara_list_plans

List available plans (apps, databases, or VMs)

liara_get_plan

Get details of a specific plan

liara_set_zero_downtime

Enable or disable zero-downtime deployment for an app

liara_set_default_subdomain

Enable or disable default subdomain for an app

liara_set_fixed_ip

Enable or disable static IP for an app (returns IP when enabling)

liara_set_read_only

Enable or disable read-only mode for an app

liara_list_buckets

List all storage buckets

liara_get_bucket

Get details of a specific bucket

liara_create_bucket

Create a new storage bucket

liara_delete_bucket

Delete a storage bucket

liara_get_bucket_credentials

Get S3-compatible credentials for a bucket

liara_list_objects

List objects in a bucket

liara_upload_object

Upload an object to a bucket

liara_get_object_download_url

Get download URL for an object

liara_delete_object

Delete an object from a bucket

liara_get_user

Get comprehensive user information including plans and teams

liara_list_vms

List all virtual machines

liara_get_vm

Get details of a virtual machine

liara_create_vm

Create a new virtual machine

liara_start_vm

Start a virtual machine

liara_stop_vm

Stop a virtual machine

liara_restart_vm

Restart a virtual machine

8 further tools are not listed here. The complete surface is in the source.

// known CVEs in dependencies1 critical12 high6 medium12 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

criticalvitest@1.6.1GHSA-5xrq-8626-4rwp

When Vitest UI server is listening, arbitrary file can be read and executed

high@modelcontextprotocol/sdk@0.5.0GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

highaxios@1.13.2GHSA-35jp-ww65-95wh

axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

highaxios@1.13.2GHSA-3g43-6gmg-66jw

axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

highaxios@1.13.2GHSA-43fc-jf86-j433

Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig

Depend on this server? Get alerted when its CVEs change.Watch this server free →

// environment variables

To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.

configLIARA_API_BASE_URL

🔐 secretLIARA_API_TOKENyour_api_token_here

configLIARA_MCP_CONSOLIDATEDSet =true environment variable to enable consolidated tools. This mode provides fewer, more powerful tools that combine related functionality:

configLIARA_TEAM_IDoptional_team_id

// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

108/108 tools missing one or more hints — liara_list_apps (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); liara_get_app (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); liara_create_app (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +105 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool test coverage

Only 0/108 tools referenced in tests (0%)

Write tests that reference each tool by name so every tool has at least one test.

Shell command execution

2 calls in production code run through a shell (bin/setup.js:22, bin/setup.js:74)

Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.

Production dependencies are patched

0 critical, 12 high severity in production deps — @modelcontextprotocol/sdk@0.5.0 (high), axios@1.13.2 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Dev dependencies

1 critical/high in dev-only deps (does not ship to users)

Upgrade dev dependencies when convenient.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail

The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.

// improvement guidance — verified publishers only

We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Verified](https://m8ven.ai/badge/mcp/razavioo/liara-mcp?variant=verified)](https://m8ven.ai/mcp/razavioo/liara-mcp)

Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.

commit: 6f2024169a6bd101de537495f1813247abc190f2

code hash: f6ab86d69030ed3d08e8bb1326fb6ed0bda7972f49602108342cb81e2ec9ce6f

view raw JSON →

Check MCPs from inside your assistant

Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check

check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern

How to add it →Free · no account needed · works in any MCP client