Respan MCP Server (respanai/respan-mcp) is an MCP server listed on the M8ven Trust Index. It scores 52 out of 100, grade D. It declares 60 tools. No publisher has claimed this listing.
Enables AI assistants to access and manage Respan logs, traces, customers, and prompts for monitoring and management.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
respanai
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
list_experimentsList all experiments in your organization.
get_experimentRetrieve detailed information about a specific experiment by its ID.
create_experimentCreate and run an experiment. Processes a dataset's inputs through a workflow chain (prompt / model / passthrough) and scores results with evaluator pipelines. REQUIRED: dataset_id, workflow, evaluator_workflow_ids. WORKFLOW TYPES (these are how each dataset row produces an output): - "prompt": Us…
list_experiment_spansList all spans (execution traces) for a specific experiment.
get_experiment_spanRetrieve detailed information about a specific span within an experiment.
delete_experimentPermanently delete an experiment and its spans. This action cannot be undone.
get_experiment_score_averagesCompute average score per evaluator for an experiment by walking the spans client-side. Use this when the backend summary/histogram endpoints return empty score aggregates (known issue on some experiments). Returns avg, min, max, and count per evaluator. Pages through up to max_spans (default 500).
list_promptsList all prompts in your Respan organization. Returns a paginated list of all prompts you have created in Respan. RESPONSE FIELDS (per prompt): - id: Unique prompt identifier (use this for other prompt operations) - name: Prompt name/title - description: Prompt description - created_at: Creation t…
get_prompt_detailRetrieve detailed information about a specific prompt. Returns complete prompt data including: - id: Unique prompt identifier - name: Prompt name/title - description: Prompt description - messages: The prompt template messages (array of role/content objects) - model: Default model for this prompt -…
list_prompt_versionsList all versions of a specific prompt. Returns all versions of a prompt, allowing you to track changes over time. RESPONSE FIELDS (per version): - id: Version identifier - version: Version number (integer, starts at 1) - prompt_id: Parent prompt identifier - messages: The prompt template for this…
get_prompt_version_detailRetrieve detailed information about a specific version of a prompt. Returns complete version data including: - id: Version identifier - version: Version number - prompt_id: Parent prompt identifier - messages: Full prompt template messages array - Each message has: role (system/user/assistant), c…
create_promptCreate a new prompt template. Only sets name and description. Use create_prompt_version to add content.
update_promptUpdate a prompt's name and/or description.
create_prompt_versionCreate a new version of a prompt. The version is always created as NOT deployed.
update_prompt_versionUpdate an existing prompt version. Always keeps deploy: false.
deploy_prompt_versionDeploy a specific prompt version, making it the active version that experiments (and other workflows) will use. Background: when you create a prompt version, it starts as a draft (not deployed). The platform requires at least one DEPLOYED version before a prompt can be referenced by version number …
list_workflowsList all workflows (automations, monitors, evaluator pipelines) in your organization.
filter_workflowsFilter workflows by type and other fields. Use the filters parameter to scope by type: - { "type": { "value": ["automations"], "operator": "eq" } } - { "type": { "value": ["monitors"], "operator": "eq" } } - { "type": { "value": ["evaluators"], "operator": "eq" } }
get_workflowRetrieve detailed information about a workflow including its task definitions.
create_workflowCreate a new workflow. Workflows are event-driven pipelines with chained tasks. TYPES: - "monitors": Aggregation + threshold monitoring with notifications (default, visible on Monitors page) - "automations": Triggered actions on log/trace events (Automations page) TRIGGER EVENT TYPES: - "request_l…
update_workflowUpdate a workflow's configuration, tasks, or metadata.
list_workflow_versionsList all versions of a workflow.
get_workflow_versionRetrieve a specific version of a workflow.
commit_workflowCommit the current draft of a workflow/pipeline, locking it as a read-only version that can be deployed. REQUIRED before deploy_workflow. The deploy endpoint rejects calls if no committed version exists. Calls POST /api/workflows/{id}/commits/ (the correct platform endpoint — different from the SDK…
deploy_workflowDeploy a committed workflow/pipeline version as the active (live) version. Calls POST /api/workflows/{id}/deployments/ (the correct platform endpoint — different from the SDK's deployWorkflow). If version is omitted, deploys the latest committed version. REQUIREMENT: must call commit_workflow firs…
undeploy_workflowUndeploy a workflow, stopping it from processing events.
validate_workflowValidate a workflow by running it against a sample log. Returns validation results and any errors.
list_datasetsList all datasets in your organization.
get_datasetRetrieve detailed information about a specific dataset.
create_datasetCreate a new dataset. MODES: - Empty dataset: pass is_empty=true. No time range needed. - Sampled from logs: pass start_time, end_time, and optionally sampling (1-100) and initial_log_filters. - Duplicate existing: pass source_dataset_id to copy logs from another dataset.
update_datasetUpdate a dataset's name and/or description.
list_dataset_logsList all logs (data points) in a dataset with pagination and filtering.
retrieve_dataset_logRetrieve a specific log from a dataset by its unique ID.
import_dataset_logsImport existing logs into a dataset by time range and filters. Runs in the background.
delete_datasetPermanently delete a dataset and all its logs. This action cannot be undone.
replace_dataset_logReplace (full overwrite) a log in a dataset. Updates input, output, expected_output, and/or metadata fields.
remove_dataset_logsRemove one or more logs from a dataset by filter. To delete a single log, pass filter { unique_id: { operator: "eq", value: "<log_id>" } }. Pass is_deleting_all_logs=true to wipe the dataset contents.
summarize_dataset_logsGet aggregated summary statistics for logs in a dataset. Pass filters to scope the summary; omit filters to summarize all logs.
bulk_create_dataset_logsCreate one or more logs in a dataset. Pass a single-item array to insert one log. Each log can include input, output, expected_output, metadata, and metrics.
list_dataset_eval_runsList evaluation run results for a dataset. Shows past eval runs with status and results.
list_evaluatorsList all evaluators in your organization with pagination.
get_evaluatorRetrieve detailed information about a specific evaluator including its config.
create_evaluatorCreate a new evaluator (grader). Evaluators score LLM outputs. REQUIRED: name, type, score_value_type. TYPES: - "llm": LLM-based evaluation. Requires llm_config with model + evaluator_definition. - "code": Code-based evaluation. Requires code_config with eval_code_snippet. - "human": Manual human …
test_evaluatorTest-run a grader with sample inputs to verify it scores correctly BEFORE committing. Required keys in inputs: at least "input" and "output". Optional: "expected_output", "metrics", "metadata". Example: { "evaluator_id": "abc123", "inputs": { "input": "What is 2+2?", "output": "4", "expected_o…
commit_evaluatorCommit the current draft of a grader, creating a new read-only version. IMPORTANT: Only commit AFTER a successful test_evaluator run. After committing, use create_evaluation_pipeline to wrap the grader in a V2 pipeline that renders in the UI.
list_evaluator_versionsList all versions (commits) of an evaluator.
update_evaluatorUpdate an existing evaluator's configuration.
delete_evaluatorPermanently delete an evaluator. This action cannot be undone.
run_evaluatorRun an evaluator on a single log/span to verify it works. This is for quick verification of one record (e.g. confirm an evaluator scores as expected before running broader experiments). For scoring many records, create an experiment instead. Returns the actual score (boolean_value / numerical_valu…
create_evaluation_pipelineCreate an evaluator pipeline (V2 — Blockly visual editor compatible) that renders in the Evaluators page UI. Pipelines wrap committed graders into a workflow. Use this AFTER creating + committing a grader with create_evaluator + commit_evaluator. PATTERNS: - Single grader: steps=[{grader_id:…
list_evaluation_pipelinesList evaluator pipelines (V2). These are the items shown on the Evaluation Pipelines page in the UI.
get_evaluation_pipelineGet an evaluator pipeline by ID. Accepts both the family workflow_id and the version PK.
update_evaluation_pipelineUpdate an evaluator pipeline. Provide the FULL updated structure (steps, combine, weights). Existing graders are replaced. Tasks are rebuilt automatically.
list_logsList and filter LLM request logs. Supports pagination, sorting, time range, and server-side filtering. IMPORTANT: Use the "filters" parameter to filter results server-side. Do NOT fetch all logs and filter client-side. PARAMETERS: - page_size: Number of logs per page (1-50, default 20) - page: Pag…
get_log_detailRetrieve complete details of a single log via GET /api/request-logs/{id}/. Returns full information including: - Full input/output content (input and output fields) - Type-specific fields based on log_type (chat, embedding, workflow, etc.) - Credit and budget check results (limit_info) - Evaluation…
get_spans_summaryRetrieve aggregated summary statistics for log spans. Returns total_count, total_cost, total_tokens, avg_latency etc. Useful for getting quick insights into your LLM usage without fetching all individual spans. PARAMETERS: - start_time: Start time in ISO 8601 format (required) - end_time: End time…
list_tracesList and filter traces with sorting, pagination, and server-side filtering. A trace represents a complete workflow execution containing multiple spans (individual operations). IMPORTANT: Use the "filters" parameter to filter results server-side. Do NOT fetch all traces and filter client-side. PAR…
get_trace_treeRetrieve the complete hierarchical span tree of a single trace. Returns detailed trace information with the full span_tree structure showing: - All spans in the trace with parent-child relationships - Full input/output for each span - Timing and performance metrics per span - Model and token usage …
list_customersList customers/users with pagination and sorting. Retrieves a paginated list of customers who have made API requests through Respan. QUERY PARAMETERS: - page_size: Number of customers per page (max 50 for MCP, API supports up to 1000) - page: Page number (default 1) - sort_by: Sort field. Prefix w…
get_customer_detailRetrieve detailed information about a specific customer including budget usage. Returns customer profile and budget data: IDENTIFICATION: - id: Internal customer ID - customer_identifier: Your unique identifier for this customer - email: Customer email (if provided) - name: Customer name (if provi…
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
vite: `server.fs.deny` bypass on Windows alternate paths
Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket
Vite: `server.fs.deny` bypassed with queries
OAUTH_SECRETRESPAN_API_BASE_URLFor custom API endpoints, set the environment variable:RESPAN_API_KEY"": "YOUR_RESPAN_API_KEY"Tool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
60/60 tools missing one or more hints — list_experiments (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_experiment (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); create_experiment (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +57 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tool inputs are validated
56/60 tool handlers declare input schemas (93%)
Declare an inputSchema with zod/joi/yup on every tool definition.
Tool handlers catch errors
Only 3/60 tool handlers wrap calls in try/catch (5%)
Wrap each tool handler body in try/catch and return a structured error response.
License file
No license file
Add a LICENSE file (MIT, Apache-2.0, etc.).
Tests exist
No test files found
Add tests that exercise each declared tool.
Shell command execution
1 child_process call — runs shell commands
Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.
Production dependencies are patched
0 critical, 5 high severity in production deps — @modelcontextprotocol/sdk@1.25.1 (high), @modelcontextprotocol/sdk@1.25.1 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/respanai/respan-mcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check