Universal-MCP-Ecosystem (robertsn808/Universal-MCP-Ecosystem) is an MCP server listed on the M8ven Trust Index. It scores 58 out of 100, grade D. It declares 477 tools. No publisher has claimed this listing.

D
Caution
58/100

Universal-MCP-Ecosystem

Model Context Protocol

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

robertsn808

Source: github_code

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Known vulnerabilities in dependencies: 16 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 8 credentials: FUNCTION_TAG_KEY, FUNCTION_INPUT_SCHEMA_ARN_TAG_KEY, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, KB_INCLUSION_TAG_KEY, GITHUB_TOKEN, STATE_MACHINE_TAG_KEY, STATE_MACHINE_INPUT_SCHEMA_ARN_TAG_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes420 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

aws_query

Query AWS services and resources

database_query

Execute database queries across all applications

process_payment

Process payments through UPP

trigger_workflow

Trigger N8N automation workflows

generate_report

Generate business analytics reports

dynamodb_data_modeling

Retrieves the complete DynamoDB Data Modeling Expert prompt.

put_resource_policy

Attaches a resource-based policy document (max 20 KB) to a DynamoDB table or stream. You can control permissions for both tables and their indexes through the policy.

get_resource_policy

Returns the resource-based policy document attached to a DynamoDB table or stream in JSON format.

scan

Returns items and attributes by scanning a table or secondary index. Reads up to Limit items or 1 MB of data, with optional FilterExpression to reduce results.

query

Returns items from a table or index matching a partition key value, with optional sort key filtering.

update_item

Edits an existing item's attributes, or adds a new item to the table if it does not already exist.

get_item

Returns attributes for an item with the given primary key. Uses eventually consistent reads by default, or set ConsistentRead=true for strongly consistent reads.

put_item

Creates a new item or replaces an existing item in a table. Use condition expressions to control whether to create new items or update existing ones.

delete_item

Deletes a single item in a table by primary key. You can perform a conditional delete operation that deletes the item if it exists, or if it has an expected attribute value.

update_time_to_live

Enables or disables Time to Live (TTL) for the specified table. Note: The epoch time format is the number of seconds elapsed since 12:00:00 AM January 1, 1970 UTC.

update_table

Modifies table settings including provisioned throughput, global secondary indexes, and DynamoDB Streams configuration. This is an asynchronous operation.

list_tables

Returns a paginated list of table names in your account.

create_table

Creates a new DynamoDB table with optional secondary indexes. This is an asynchronous operation.

describe_table

Returns table information including status, creation time, key schema and indexes.

create_backup

Creates a backup of a DynamoDB table.

describe_backup

Describes an existing backup of a table.

list_backups

Returns a list of table backups.

restore_table_from_backup

Creates a new table from a backup.

describe_limits

Returns the current provisioned-capacity quotas for your AWS account and tables in a Region.

describe_time_to_live

Returns the Time to Live (TTL) settings for a table.

describe_endpoints

Returns DynamoDB endpoints for the current region.

describe_export

Returns information about a table export.

list_exports

Returns a list of table exports.

describe_continuous_backups

Returns continuous backup and point in time recovery status for a table.

untag_resource

Removes tags from a DynamoDB resource.

tag_resource

Adds tags to a DynamoDB resource.

list_tags_of_resource

Returns tags for a DynamoDB resource.

delete_table

The DeleteTable operation deletes a table and all of its items. This is an asynchronous operation that puts the table into DELETING state until DynamoDB completes the deletion.

update_continuous_backups

Enables or disables point in time recovery for the specified table.

list_imports

Lists imports completed within the past 90 days.

lambda_function

Tool for invoking a specific AWS Lambda function with parameters.

run_query

Run a SQL query using boto3 execute_statement

get_table_schema

Fetch table columns and comments from Postgres using RDS Data API

KendraListIndexesTool

List all Amazon Kendra indexes in the specified region.

KendraQueryTool

Query Amazon Kendra and retrieve content from the response.

listKeyspaces

Lists all keyspaces in the Cassandra/Keyspaces database - args: none

listTables

Lists all tables in a specified keyspace - args: keyspace

describeKeyspace

Gets detailed information about a keyspace - args: keyspace

describeTable

Gets detailed information about a table - args: keyspace, table

executeQuery

Executes a read-only SELECT query against the database - args: keyspace, query

analyzeQueryPerformance

Analyzes the performance characteristics of a CQL query - args: keyspace, query

create_broker

Create a ActiveMQ or RabbitMQ broker on AmazonMQ.

create_configuration

Create configuration for AmazonMQ broker.

get_graph_status

Get the status of the currently configured Amazon Neptune graph.

get_graph_schema

Get the schema for the graph including the vertex and edge labels as well as the (vertex)-[edge]->(vertex) combinations.

run_opencypher_query

Executes the provided openCypher against the graph.

run_gremlin_query

Executes the provided Tinkerpop Gremlin against the graph.

QBusinessQueryTool

MCP tool to query Amazon Q Business and return a formatted response.

AuthorizeQIndex

Generate the OIDC authorization URL for Q index authentication.

CreateTokenWithIAM

Get a token using the authorization code through IAM.

AssumeRoleWithIdentityContext

Assume an IAM role using the identity context from the token.

SearchRelevantContent

Search for relevant content in an Amazon Q Business application.

list_collections

Returns a list of collection IDs in your AWS account.

index_faces

Detects faces in an image and adds them to the specified collection.

search_faces_by_image

Searches for faces in a collection that match a face in the supplied image.

detect_labels

Detects objects, scenes, concepts, and activities in an image.

detect_moderation_labels

Detects unsafe or inappropriate content in an image.

recognize_celebrities

Recognizes celebrities in an image.

compare_faces

Compares a face in the source image with faces in the target image.

detect_text

Detects text in an image.

readonly_query

Run a read-only SQL query against the configured Aurora DSQL cluster. Aurora DSQL is distributed SQL database with Postgres compatibility. The following table summarizes `SELECT` functionality that is expected to work. Items not in this table may also be supported, as this is a point in time snapsh

transact

Write or modify data using SQL, in a transaction against the configured Aurora DSQL cluster. Aurora DSQL is a distributed SQL database with Postgres compatibility. This tool will automatically insert `BEGIN` and `COMMIT` statements; you only need to provide the statements to run within the transact

get_schema

Get the schema of the given table

call_aws

Call AWS with the given CLI command and return the result as a dictionary.

getprojects

Get a list of data automation projects.

getprojectdetails

Get details of a data automation project.

analyzeasset

Analyze an asset using a data automation project.

generate_diagram
get_diagram_examples

Get example code for different types of diagrams.

list_icons

List available icons from the diagrams package, with optional filtering.

list_workflows

List available HealthOmics workflows.

create_workflow

Create a new HealthOmics workflow.

get_workflow

Get details about a specific workflow.

create_workflow_version

Create a new version of an existing workflow.

list_workflow_versions

List versions of a workflow.

start_run
list_runs

List workflow runs.

get_run

Get details about a specific run.

list_run_tasks

List tasks for a specific run.

get_run_task

Get details about a specific task.

get_run_logs

Retrieve high-level run logs that show workflow execution events.

get_run_manifest_logs

Retrieve run manifest logs produced when a workflow completes or fails.

get_run_engine_logs

Retrieve engine logs containing STDOUT and STDERR from the workflow engine process.

get_task_logs

Retrieve logs for a specific workflow task containing STDOUT and STDERR.

analyze_run_performance

Analyze AWS HealthOmics workflow run performance and provide optimization recommendations.

diagnose_run_failure

Provides comprehensive diagnostic information for a failed workflow run.

package_workflow

Package workflow definition files into a base64-encoded ZIP.

get_supported_regions

Get the list of AWS regions where HealthOmics is available.

search_places

Search for places using Amazon Location Service geo-places search_text API. Geocode the query using the geocode API to get BiasPosition. If no results, try a bounding box filter. Includes contact info and opening hours if present. Output is standardized and includes all fields, even if empty or not

get_place

Get details for a place using Amazon Location Service geo-places get_place API. Output is standardized and includes all fields, even if empty or not available.

reverse_geocode

Reverse geocode coordinates to an address using Amazon Location Service geo-places reverse_geocode API.

search_nearby

Search for places near a location using Amazon Location Service geo-places search_nearby API. If no results, expand the radius up to max_radius. Output is standardized and includes all fields, even if empty or not available.

search_places_open_now

Search for places that are open now using Amazon Location Service geo-places search_text API and filter by opening hours. If no open places, expand the search radius up to max_radius. Uses BiasPosition from geocode.

calculate_route

Calculate a route and return summary info and turn-by-turn directions.

optimize_waypoints

Optimize the order of waypoints using Amazon Location Service geo-routes optimize_waypoints API (V2).

320 further tools are not listed here. The complete surface is in the source.

// known CVEs in dependencies16 high5 medium9 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.17.3GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.17.3GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.17.3GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

highaxios@1.7.9GHSA-35jp-ww65-95wh

axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

highaxios@1.7.9GHSA-3g43-6gmg-66jw

axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configCORS_ORIGINS
configENABLE_ANALYTICS
configENABLE_AUTOMATION
configENABLE_AWS_INTEGRATION
configENABLE_PAYMENT_PROCESSING
configLOG_LEVEL
configAWS_REGION
configAWS_PROFILE
configFUNCTION_PREFIX
configFUNCTION_LIST
🔐 secretFUNCTION_TAG_KEY
configFUNCTION_TAG_VALUE
🔐 secretFUNCTION_INPUT_SCHEMA_ARN_TAG_KEY
configKENDRA_INDEX_ID
configNEPTUNE_ENDPOINT
configNEPTUNE_USE_HTTPS
configFASTMCP_LOG_LEVEL
configAWS_DOCUMENTATION_PARTITION
configAWS_ACCESS_KEY_ID
🔐 secretAWS_SECRET_ACCESS_KEY
🔐 secretAWS_SESSION_TOKEN
configAWS_EXECUTION_ENV
🔐 secretKB_INCLUSION_TAG_KEY
configBEDROCK_KB_RERANKING_ENABLED
configMCP_CLOUDWATCH_APPSIGNALS_LOG_LEVEL
🔐 secretGITHUB_TOKEN
configPROMETHEUS_URL
configLOG_FILE
configPYTEST_CURRENT_TEST
configMCP_SERVER_DISABLE_LOGGING
configSTATE_MACHINE_PREFIX
configSTATE_MACHINE_LIST
🔐 secretSTATE_MACHINE_TAG_KEY
configSTATE_MACHINE_TAG_VALUE
🔐 secretSTATE_MACHINE_INPUT_SCHEMA_ARN_TAG_KEY
configFASTMCP_LOG_FILE
Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.
deployPORT
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

477/477 tools missing one or more hints — aws_query (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); database_query (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); process_payment (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +474 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Secrets not logged

9 secret values sent to logger.info

Redact or omit secret values from log output.

Production dependencies are patched

0 critical, 16 high severity in production deps — @modelcontextprotocol/sdk@1.17.3 (high), @modelcontextprotocol/sdk@1.17.3 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/robertsn808/universal-mcp-ecosystem?variant=verified)](https://m8ven.ai/mcp/robertsn808/universal-mcp-ecosystem)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: ff50cd1732e59a45c50d03e2cb808da2b85bf67b
code hash: 2ffba7e1fcc22bb904101c3dd453f2ef774ab8c4f9740826942c96ab95d015f3
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client