54
/ 100
1 month ago
glama

MCP Local LLM Server

A privacy-first MCP server that provides local LLM-enhanced tools for code analysis, security scanning, and automated task execution using backends like Ollama and LM Studio. It enables symbol-aware code reviews and workspace exploration while ensuring that all code and analysis remain strictly on your local machine.

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
🚨
Known vulnerabilities in dependencies: 2 critical, 7 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 1 credential: OPENROUTER_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies2 critical7 high3 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

criticalhandlebars@4.7.8GHSA-2w6w-674q-4c4q

Handlebars.js has JavaScript Injection via AST Type Confusion

criticalvitest@4.0.14GHSA-5xrq-8626-4rwp

When Vitest UI server is listening, arbitrary file can be read and executed

highhandlebars@4.7.8GHSA-3mfm-83xf-c92r

Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block

highhandlebars@4.7.8GHSA-9cx6-37pm-9jff

Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation

highhandlebars@4.7.8GHSA-xhpv-hc6g-r9c6

Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configAGENT_DEBUG
configAGENT_DEBUG_JSON
configAGENT_HTTP_ALLOW_ANY
configAZURE_PIPELINES
configBITBUCKET_PIPELINES
configCLI_AUTO_VERIFY
configCLI_MAX_ITERATIONS
configCLI_ORCHESTRATION_BACKENDS
configCLI_ORCHESTRATION_ENABLED
configCLI_SCORE_THRESHOLD
configCOUNTER_FILE
configFAILS
configFAIL_ON_FILEPATH
configGITHUB_ACTIONS
configGITLAB_CI
configJENKINS_URL
configLLM_ADAPTER_JITTER
configLLM_ADAPTER_MAX_DELAY_MS
configLLM_ADAPTER_RETRIES
configLLM_ADAPTER_RETRY_BACKOFF
configLLM_ADAPTER_RETRY_DELAY_MS
configLLM_CHAT_RETRIES
configLLM_CHAT_RETRY_BACKOFF
configLLM_CHAT_RETRY_DELAY_MS
configLLM_CHAT_TIMEOUT_MS
configLLM_HTTP_TIMEOUT_MS
configMCP_CLIENT_RETRIES
configMCP_CLIENT_RETRY_BACKOFF
configMCP_CLIENT_RETRY_DELAY_MS
configMCP_DEBUG
configMCP_DEBUG_LEVEL
configMCP_DISABLE_GROUPS
configMCP_ENABLE_GROUPS
configMCP_LOCAL_LLM_BACKEND_ID
configMCP_LOCAL_LLM_CONFIG
configMCP_LOCAL_LLM_LMSTUDIO_BASE_URL
configMCP_LOCAL_LLM_MODEL
configMCP_LOCAL_LLM_SCENARIOS
configMCP_LOCAL_LLM_SETTINGS_PATH
configMCP_ORCHESTRATION_PLANS_DIR
configMCP_PARENT_PID
configMCP_STDIN_SHUTDOWN
configMCP_TOOL_MODE
🔐 secretOPENROUTER_API_KEY"": "sk-or-v1-your-key-here"
configSOTA_MODEL
configSUGGEST_REFACTORING_LLM_TIMEOUT_MS
configTESTING_MODE_ENABLED"": "true",
configTODOS_IMPLEMENT_LLM_RETRIES
configTODOS_IMPLEMENT_LLM_TIMEOUT_MS
configTRAVIS
configVITEST_LMSTUDIO_READY
configWORKSPACE_ROOT"": "${workspaceFolder}"
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/rodhayl-mcplocalhelper-1qdbj5)](https://m8ven.ai/mcp/rodhayl-mcplocalhelper-1qdbj5)
commit: d604b7a7d0be794ce93dcc83b042f2fe8e2f4b7a
code hash: b3dee65e9dbbb727c8425c7e33b71b346c51acab23ab59c8668c26e2a1fce490
verified: 6/12/2026, 11:31:18 AM
view raw JSON →