An MCP authorization server implementing OAuth2/OIDC flows, supporting dynamic client registration, PKCE, consent screens, and client ID metadata documents for MCP authorization.
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
Nest Affected by DoS via Recursive handleData in JsonSocket (TCP Transport)
TypeORM vulnerable to SQL injection via crafted request to repository.save or repository.update
nest allows a remote attacker to execute arbitrary code via the Content-Type header
@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')
TypeORM: migration:generate template-literal code injection
process.env. You'll be asked to provide them before it can run.GITHUB_CLIENT_ID— xxx GITHUB_CLIENT_SECRET=yyy JWT_SECRET=<32+ chars> PORT=3014 npm startGITHUB_CLIENT_SECRET— GITHUB_CLIENT_ID=xxx =yyy JWT_SECRET=<32+ chars> PORT=3014 npm startJWT_SECRET— GITHUB_CLIENT_ID=xxx GITHUB_CLIENT_SECRET=yyy =<32+ chars> PORT=3014 npm startMCP_CIMD— 1 Accepts URL-shaped client_ids, and hosts GET /client-metadata.json + GET /demo-callback so the client side of the demo runs locally too. Implies consent — McpAuthModule forces it on.MCP_CONSENT— 1 Turns on the interactive consent screen (consent: { enabled: true }).MCP_FAKE_AUTH— PORT=3005 =1 MCP_FAKE_IDP=1 npm startMCP_FAKE_IDP— PORT=3005 MCP_FAKE_AUTH=1 =1 npm startPORT— 3005 MCP_FAKE_AUTH=1 MCP_FAKE_IDP=1 npm start[](https://m8ven.ai/mcp/rinormaloku-mcp-inspector-v2-bug-authz-3aby98)