MCP-Writing-Servers (RLRyals/MCP-Writing-Servers) is an MCP server listed on the M8ven Trust Index. It scores 52 out of 100, grade D. It declares 258 tools. No publisher has claimed this listing.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

RLRyals

Source: github_repo_search

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
🚨
Secret credentials may flow to a network call
1 flow detected: GITHUB_TOKEN. We can’t prove the destination matches the brand the credential belongs to.
⚠️
Known vulnerabilities in dependencies: 3 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 2 credentials: BACKUP_ENCRYPTION_KEY, GITHUB_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes258 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

list_authors

List all authors

get_author

Get author details

create_author

Create author

update_author

Update author

list_books

List books

get_book

Get book details

create_book

Create book

update_book

Update book

delete_book

Delete a book and all its chapters/scenes

create_chapter

Create chapter

update_chapter

Update chapter

get_chapter

Get chapter details

list_chapters

List chapters

delete_chapter

Delete chapter & scenes

create_scene

Create scene

update_scene

Update scene

get_scene

Get scene details

list_scenes

List scenes

delete_scene

Delete scene

reorder_scenes

Reorder scenes

analyze_scene_flow

Analyze scene flow & pacing

get_book_structure

Get book structure

analyze_book_progress

Analyze writing progress

validate_book_consistency

Check consistency issues

list_characters

List/search characters. Provide series_id, search, or both. Unscoped listing not supported.

get_character

Get character details

create_character

Create a character. Canonical entry point for new characters — a raw database-admin insert on the characters table skips this and won't be visible to knowledge/relationship/continuity tools.

update_character

Update core character fields (name, type, status). Prefer this over raw database-admin CRUD so status changes stay consistent with arc and continuity tracking.

add_character_detail

Add/update character detail

get_character_details

Get character details

update_character_detail

Update character detail

delete_character_detail

Delete character detail

add_character_knowledge

Record what a character knows, when, and how — maintains knowledge-state continuity. A raw table write bypasses the checks that catch "character knows something before they learned it" plot holes.

add_character_knowledge_with_chapter

Add knowledge w/ chapter ref

update_character_knowledge

Correct an existing character knowledge entry. Identify by `id`. Only provided fields are changed.

delete_character_knowledge

Delete a character knowledge entry. Identify by `id`.

check_character_knowledge

Check character knowledge

get_characters_who_know

Find who knows about something

track_character_presence

Record a character's presence/state in a chapter or scene — feeds continuity and knowledge-timing checks. A raw insert bypasses those checks.

get_character_timeline

Get character timeline

check_character_continuity

Validate a character's state and knowledge stay consistent across a chapter range — catches contradictions a raw CRUD read can't, because it has no notion of "consistent."

get_characters_in_chapter

Get chapter characters

db_query_audit_logs

Query audit logs to review database operations history. Allows filtering by: - Date range (start_date, end_date) - Table name - Operation type (CREATE, READ, UPDATE, DELETE, BATCH_INSERT, BATCH_UPDATE, BATCH_DELETE) - User ID - Success/failure status - Pagination (limit, offset) Use cases: - Compl

db_get_audit_summary

Get comprehensive audit summary statistics. Provides aggregated statistics including: - Total operations count - Success/failure rates - Tables accessed - Unique users - Average and max execution times - Operations breakdown by type - Top tables by activity Useful for: - High-level compliance repo

db_backup_full

Create a full database backup including all tables, schemas, and data. Supports compression and returns backup file details with size, record count, and checksum.

db_backup_table

Create a backup of specific database table(s). Supports data-only, schema-only, or full backups with optional compression.

db_backup_incremental

Create an incremental backup containing only changes since the last backup. Requires a base backup and tracks changes via updated_at timestamps.

db_export_json

Export table data to JSON format for data migration or analysis. Supports filtering with WHERE conditions and record limits.

db_export_csv

Export table data to CSV format with proper escaping and UTF-8 encoding. Includes column headers and supports filtering.

db_restore_full

Restore complete database from a backup file. Validates backup integrity before restore and supports conflict resolution strategies.

db_restore_table

Restore a specific table from a table backup file. Validates foreign key constraints and handles record conflicts.

db_import_json

Import data from JSON export file into a table. Validates JSON structure and supports upsert operations.

db_import_csv

Import data from CSV file into a table. Supports header row detection, type conversion, and conflict resolution.

db_list_backups

List all available backups with metadata including size, date, tables, and record counts. Supports filtering and sorting.

db_delete_backup

Delete a backup file and its associated manifest. Returns freed disk space. USE WITH CAUTION - deletion is permanent.

db_validate_backup

Validate backup file integrity by checking checksums, file format, SQL syntax, and dependencies. Returns detailed validation report.

db_batch_insert

Insert multiple records (1-1000) into a table in a single atomic transaction. All records are inserted or none are (all-or-nothing). Returns all inserted IDs.

db_batch_update

Update multiple sets of records in a single atomic transaction. Each update can have different WHERE conditions and data. All updates succeed or all fail (all-or-nothing).

db_batch_delete

Delete multiple sets of records in a single atomic transaction. Each delete can have different WHERE conditions. All deletes succeed or all fail (all-or-nothing). Supports soft delete.

db_query_records

Query database records with filtering, pagination, and sorting. Supports complex WHERE conditions and multiple sort orders.

db_insert_record

Insert a new record into a database table with field validation. Supports all standard PostgreSQL data types.

db_update_records

Update existing records in a database table. Supports partial updates and WHERE conditions to target specific records.

db_delete_records

Delete records from a database table. Supports soft-delete (setting deleted_at) or hard delete.

db_get_schema

Get detailed schema information for a table including columns, data types, constraints, and indexes. Results are cached for 5 minutes for performance.

db_list_tables

List all accessible tables in the database with metadata such as row count estimates and table type. System tables are filtered by default.

db_get_relationships

Map foreign key relationships for a table, showing which tables it references (parent tables) and which tables reference it (child tables). Supports multi-hop relationship discovery.

db_list_table_columns

Get a lightweight list of column names and types for a table. Useful for autocomplete, suggestions, or quick reference. Faster than db_get_schema.

get_board

Gets a board plus its columns (ordered lanes) with per-column card counts — the board-render call.

list_cards

Lists cards with filters: board, assignee, agent, status, label, priority, agent_claimable_only, include_archived, include_workflow_phase, due_filter, q. The workhorse read tool.

create_card

Creates a card — full or quick-add (title-only is valid, the fast path). Board resolves to 'dev-backlog' if neither board_key nor board_id given. review_policy is defaulted by risk class unless explicitly provided.

claim_card

ATOMIC compare-and-swap claim. Two agents can NEVER both win the same card. NEVER pass an agent id that resolves to an active human identity (see list_identities) — human cards are permanently reserved.

update_card

Partial patch of a card — only provided keys change. assignee must be a registered active identity (unknown ids rejected); one resolving to an active human identity auto-clears agent_claimable (DB trigger). assignee:'__clear__' unassigns.

move_card

Changes a card's status/lane. Writes activity {action:'moved', from_status, to_status}. A review-required card moving to 'review' is auto-reassigned to 'rebecca'.

comment_card

Appends to a card comment thread. Agents report progress/results here before moving a card to review.

list_boards

Lists all boards with their total card counts.

get_card

Gets a single card plus its comments, links, activity log, and live workflow_phase if linked — the detail-drawer call.

add_card_link

Attaches a typed link (spec/github_issue/workflow_run/file/url/card) to a card, beyond the inline spec_ref/issue_ref fields.

archive_card

Archives a card (= move_card to 'archived').

list_identities

Lists registered kanban identities (human/persona/agent) — the set of ids create_card/update_card will accept as assignee. Defaults to active only. Always excludes the 'test:' id namespace (reserved for throwaway ids minted by tests).

upsert_identity

Registers a new identity or updates an existing one's display_name/kind/active. The ONLY sanctioned way to add an assignee value create_card/update_card will accept — there is no silent auto-create on write.

delete_identity

Hard-removes an identity row (e.g. a mis-registered or throwaway id). upsert_identity(active:false) is the softer 'hide from the dropdown' path (list_identities excludes inactive by default) — use delete_identity when the row should not exist at all. Not FK-enforced against kanban_cards.assignee: a

get_available_options

Get lookup table options

create_lookup_option

Create lookup option - Admin

update_lookup_option

Update lookup option - Admin

delete_lookup_option

Delete lookup option - Admin

assign_book_genres

Assign genres to book

assign_series_genres

Assign genres to series

analyze_chapter_pacing

Analyze pacing metrics for a chapter including scene distribution, energy modulation, and variance

analyze_book_pacing

Analyze pacing across an entire book with aggregated metrics and recommendations

track_stakes_escalation

Track stakes escalation in a scene according to NPE Rule #9

get_pressure_trajectory

Get pressure levels over time for a book to visualize escalation

log_information_reveal

Log an information reveal according to NPE Rule #8 (only reveal when it alters a choice)

validate_information_economy

Validate that all information reveals in a book follow NPE Rule #8

track_relationship_tension

Track bidirectional tension between two characters in a scene

get_relationship_tension_graph

Get tension trajectory between two characters across a book

calculate_npe_compliance

Calculate overall NPE compliance score for a book or chapter

get_npe_violations

Get all NPE rule violations for a book with severity filtering

create_causality_chain

Create a new NPE causality chain to track cause-effect relationships in narrative

add_causal_link

Add a cause→effect link to an NPE causality chain

validate_causality_chain

Validate an NPE causality chain has no breaks and maintains character agency

158 further tools are not listed here. The complete surface is in the source.

// known CVEs in dependencies3 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.17.5GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.17.5GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.17.5GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configBACKUP_COMPRESSION
configBACKUP_DIR
configBACKUP_ENCRYPT
🔐 secretBACKUP_ENCRYPTION_KEY
configBACKUP_NOTIFICATION_EMAIL
configBACKUP_RETENTION_DAYS
configBACKUP_SCHEDULE_FULL
configBACKUP_SCHEDULE_INCREMENTAL
🔐 secretGITHUB_TOKEN
configMCP_PORT
configMCP_SERVER_PORT
configMCP_STDIO_MODE
configPG_DUMP_PATH
configPSQL_PATH
configSERVER_NAME
configSERVER_PORT
Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.
deployDATABASE_URL
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

258/258 tools missing one or more hints — list_authors (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_author (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); create_author (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +255 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

License file

No license file

Add a LICENSE file (MIT, Apache-2.0, etc.).

Tool test coverage

Only 56/258 tools referenced in tests (22%)

Write tests that reference each tool by name so every tool has at least one test.

Secrets not logged

3 secret values sent to log

Redact or omit secret values from log output.

Production dependencies are patched

0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.17.5 (high), @modelcontextprotocol/sdk@1.17.5 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Domain consistency

npm scope @fictionlab doesn't match GitHub owner rlryals

Use the same org name across GitHub, npm, and your homepage so users can verify the publisher.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/rlryals/mcp-writing-servers?variant=verified)](https://m8ven.ai/mcp/rlryals/mcp-writing-servers)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: d4f9dac06c5dbf1001abb9b8eb176307b46d6e26
code hash: f19aa1cea85628eaba79335468a3be49635b62b16fe69d1680be21bb684a0ea6
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client