Respan MCP Server (respanai/respan-mcp) is an MCP server listed on the M8ven Trust Index. It scores 52 out of 100, grade D. It declares 60 tools. No publisher has claimed this listing.

D
Caution
52/100

Respan MCP Server

Enables AI assistants to access and manage Respan logs, traces, customers, and prompts for monitoring and management.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

respanai

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Known vulnerabilities in dependencies: 5 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
🔐
You'll be asked for 2 credentials: OAUTH_SECRET, RESPAN_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes60 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

list_experiments

List all experiments in your organization.

get_experiment

Retrieve detailed information about a specific experiment by its ID.

create_experiment

Create and run an experiment. Processes a dataset's inputs through a workflow chain (prompt / model / passthrough) and scores results with evaluator pipelines. REQUIRED: dataset_id, workflow, evaluator_workflow_ids. WORKFLOW TYPES (these are how each dataset row produces an output): - "prompt": Us

list_experiment_spans

List all spans (execution traces) for a specific experiment.

get_experiment_span

Retrieve detailed information about a specific span within an experiment.

delete_experiment

Permanently delete an experiment and its spans. This action cannot be undone.

get_experiment_score_averages

Compute average score per evaluator for an experiment by walking the spans client-side. Use this when the backend summary/histogram endpoints return empty score aggregates (known issue on some experiments). Returns avg, min, max, and count per evaluator. Pages through up to max_spans (default 500).

list_prompts

List all prompts in your Respan organization. Returns a paginated list of all prompts you have created in Respan. RESPONSE FIELDS (per prompt): - id: Unique prompt identifier (use this for other prompt operations) - name: Prompt name/title - description: Prompt description - created_at: Creation t

get_prompt_detail

Retrieve detailed information about a specific prompt. Returns complete prompt data including: - id: Unique prompt identifier - name: Prompt name/title - description: Prompt description - messages: The prompt template messages (array of role/content objects) - model: Default model for this prompt -

list_prompt_versions

List all versions of a specific prompt. Returns all versions of a prompt, allowing you to track changes over time. RESPONSE FIELDS (per version): - id: Version identifier - version: Version number (integer, starts at 1) - prompt_id: Parent prompt identifier - messages: The prompt template for this

get_prompt_version_detail

Retrieve detailed information about a specific version of a prompt. Returns complete version data including: - id: Version identifier - version: Version number - prompt_id: Parent prompt identifier - messages: Full prompt template messages array - Each message has: role (system/user/assistant), c

create_prompt

Create a new prompt template. Only sets name and description. Use create_prompt_version to add content.

update_prompt

Update a prompt's name and/or description.

create_prompt_version

Create a new version of a prompt. The version is always created as NOT deployed.

update_prompt_version

Update an existing prompt version. Always keeps deploy: false.

deploy_prompt_version

Deploy a specific prompt version, making it the active version that experiments (and other workflows) will use. Background: when you create a prompt version, it starts as a draft (not deployed). The platform requires at least one DEPLOYED version before a prompt can be referenced by version number

list_workflows

List all workflows (automations, monitors, evaluator pipelines) in your organization.

filter_workflows

Filter workflows by type and other fields. Use the filters parameter to scope by type: - { "type": { "value": ["automations"], "operator": "eq" } } - { "type": { "value": ["monitors"], "operator": "eq" } } - { "type": { "value": ["evaluators"], "operator": "eq" } }

get_workflow

Retrieve detailed information about a workflow including its task definitions.

create_workflow

Create a new workflow. Workflows are event-driven pipelines with chained tasks. TYPES: - "monitors": Aggregation + threshold monitoring with notifications (default, visible on Monitors page) - "automations": Triggered actions on log/trace events (Automations page) TRIGGER EVENT TYPES: - "request_l

update_workflow

Update a workflow's configuration, tasks, or metadata.

list_workflow_versions

List all versions of a workflow.

get_workflow_version

Retrieve a specific version of a workflow.

commit_workflow

Commit the current draft of a workflow/pipeline, locking it as a read-only version that can be deployed. REQUIRED before deploy_workflow. The deploy endpoint rejects calls if no committed version exists. Calls POST /api/workflows/{id}/commits/ (the correct platform endpoint — different from the SDK

deploy_workflow

Deploy a committed workflow/pipeline version as the active (live) version. Calls POST /api/workflows/{id}/deployments/ (the correct platform endpoint — different from the SDK's deployWorkflow). If version is omitted, deploys the latest committed version. REQUIREMENT: must call commit_workflow firs

undeploy_workflow

Undeploy a workflow, stopping it from processing events.

validate_workflow

Validate a workflow by running it against a sample log. Returns validation results and any errors.

list_datasets

List all datasets in your organization.

get_dataset

Retrieve detailed information about a specific dataset.

create_dataset

Create a new dataset. MODES: - Empty dataset: pass is_empty=true. No time range needed. - Sampled from logs: pass start_time, end_time, and optionally sampling (1-100) and initial_log_filters. - Duplicate existing: pass source_dataset_id to copy logs from another dataset.

update_dataset

Update a dataset's name and/or description.

list_dataset_logs

List all logs (data points) in a dataset with pagination and filtering.

retrieve_dataset_log

Retrieve a specific log from a dataset by its unique ID.

import_dataset_logs

Import existing logs into a dataset by time range and filters. Runs in the background.

delete_dataset

Permanently delete a dataset and all its logs. This action cannot be undone.

replace_dataset_log

Replace (full overwrite) a log in a dataset. Updates input, output, expected_output, and/or metadata fields.

remove_dataset_logs

Remove one or more logs from a dataset by filter. To delete a single log, pass filter { unique_id: { operator: "eq", value: "<log_id>" } }. Pass is_deleting_all_logs=true to wipe the dataset contents.

summarize_dataset_logs

Get aggregated summary statistics for logs in a dataset. Pass filters to scope the summary; omit filters to summarize all logs.

bulk_create_dataset_logs

Create one or more logs in a dataset. Pass a single-item array to insert one log. Each log can include input, output, expected_output, metadata, and metrics.

list_dataset_eval_runs

List evaluation run results for a dataset. Shows past eval runs with status and results.

list_evaluators

List all evaluators in your organization with pagination.

get_evaluator

Retrieve detailed information about a specific evaluator including its config.

create_evaluator

Create a new evaluator (grader). Evaluators score LLM outputs. REQUIRED: name, type, score_value_type. TYPES: - "llm": LLM-based evaluation. Requires llm_config with model + evaluator_definition. - "code": Code-based evaluation. Requires code_config with eval_code_snippet. - "human": Manual human

test_evaluator

Test-run a grader with sample inputs to verify it scores correctly BEFORE committing. Required keys in inputs: at least "input" and "output". Optional: "expected_output", "metrics", "metadata". Example: { "evaluator_id": "abc123", "inputs": { "input": "What is 2+2?", "output": "4", "expected_o

commit_evaluator

Commit the current draft of a grader, creating a new read-only version. IMPORTANT: Only commit AFTER a successful test_evaluator run. After committing, use create_evaluation_pipeline to wrap the grader in a V2 pipeline that renders in the UI.

list_evaluator_versions

List all versions (commits) of an evaluator.

update_evaluator

Update an existing evaluator's configuration.

delete_evaluator

Permanently delete an evaluator. This action cannot be undone.

run_evaluator

Run an evaluator on a single log/span to verify it works. This is for quick verification of one record (e.g. confirm an evaluator scores as expected before running broader experiments). For scoring many records, create an experiment instead. Returns the actual score (boolean_value / numerical_valu

create_evaluation_pipeline

Create an evaluator pipeline (V2 — Blockly visual editor compatible) that renders in the Evaluators page UI. Pipelines wrap committed graders into a workflow. Use this AFTER creating + committing a grader with create_evaluator + commit_evaluator. PATTERNS: - Single grader: steps=[{grader_id:

list_evaluation_pipelines

List evaluator pipelines (V2). These are the items shown on the Evaluation Pipelines page in the UI.

get_evaluation_pipeline

Get an evaluator pipeline by ID. Accepts both the family workflow_id and the version PK.

update_evaluation_pipeline

Update an evaluator pipeline. Provide the FULL updated structure (steps, combine, weights). Existing graders are replaced. Tasks are rebuilt automatically.

list_logs

List and filter LLM request logs. Supports pagination, sorting, time range, and server-side filtering. IMPORTANT: Use the "filters" parameter to filter results server-side. Do NOT fetch all logs and filter client-side. PARAMETERS: - page_size: Number of logs per page (1-50, default 20) - page: Pag

get_log_detail

Retrieve complete details of a single log via GET /api/request-logs/{id}/. Returns full information including: - Full input/output content (input and output fields) - Type-specific fields based on log_type (chat, embedding, workflow, etc.) - Credit and budget check results (limit_info) - Evaluation

get_spans_summary

Retrieve aggregated summary statistics for log spans. Returns total_count, total_cost, total_tokens, avg_latency etc. Useful for getting quick insights into your LLM usage without fetching all individual spans. PARAMETERS: - start_time: Start time in ISO 8601 format (required) - end_time: End time

list_traces

List and filter traces with sorting, pagination, and server-side filtering. A trace represents a complete workflow execution containing multiple spans (individual operations). IMPORTANT: Use the "filters" parameter to filter results server-side. Do NOT fetch all traces and filter client-side. PAR

get_trace_tree

Retrieve the complete hierarchical span tree of a single trace. Returns detailed trace information with the full span_tree structure showing: - All spans in the trace with parent-child relationships - Full input/output for each span - Timing and performance metrics per span - Model and token usage

list_customers

List customers/users with pagination and sorting. Retrieves a paginated list of customers who have made API requests through Respan. QUERY PARAMETERS: - page_size: Number of customers per page (max 50 for MCP, API supports up to 1000) - page: Page number (default 1) - sort_by: Sort field. Prefix w

get_customer_detail

Retrieve detailed information about a specific customer including budget usage. Returns customer profile and budget data: IDENTIFICATION: - id: Internal customer ID - customer_identifier: Your unique identifier for this customer - email: Customer email (if provided) - name: Customer name (if provi

// known CVEs in dependencies5 high2 medium

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.25.1GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.25.1GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

highvite@8.0.3GHSA-fx2h-pf6j-xcff

vite: `server.fs.deny` bypass on Windows alternate paths

highvite@8.0.3GHSA-p9ff-h696-f583

Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket

highvite@8.0.3GHSA-v2wj-q39q-566r

Vite: `server.fs.deny` bypassed with queries

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
🔐 secretOAUTH_SECRET
configRESPAN_API_BASE_URLFor custom API endpoints, set the environment variable:
🔐 secretRESPAN_API_KEY"": "YOUR_RESPAN_API_KEY"
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

60/60 tools missing one or more hints — list_experiments (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_experiment (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); create_experiment (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +57 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool inputs are validated

56/60 tool handlers declare input schemas (93%)

Declare an inputSchema with zod/joi/yup on every tool definition.

Tool handlers catch errors

Only 3/60 tool handlers wrap calls in try/catch (5%)

Wrap each tool handler body in try/catch and return a structured error response.

License file

No license file

Add a LICENSE file (MIT, Apache-2.0, etc.).

Tests exist

No test files found

Add tests that exercise each declared tool.

Shell command execution

1 child_process call — runs shell commands

Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.

Production dependencies are patched

0 critical, 5 high severity in production deps — @modelcontextprotocol/sdk@1.25.1 (high), @modelcontextprotocol/sdk@1.25.1 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 8 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/respanai/respan-mcp?variant=verified)](https://m8ven.ai/mcp/respanai/respan-mcp)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: c828e9e975b4cf567ec5029c980d97563dee9955
code hash: eeeb8045f624430c73b5adad94ffa433aa3a4bfe5ab63833bedd62cfe195e1db
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client