COBie MCP (roynertr/cobie-mcp) is an MCP server listed on the M8ven Trust Index. It scores 54 out of 100, grade D. It declares 63 tools. No publisher has claimed this listing.

Caution

54/100

COBie MCP

Item: COBie MCP
Rating: 54
Author: M8ven

MCP server for COBie Excel validation, updates, and PDF extraction.

→ roynertr/cobie-mcp · listed on glama

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every push why connect →

Who stands behind it

roynertr

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

Glamanot scored here

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 2 credentials: OPENAI_API_KEY, DOMAIN_API_TOKEN

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// tools this server exposes63 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

get_update_workflow

Return the recommended workflow to update COBie workbooks. Call this first.

get_actor_contact_schema

Return the expected structure for actor_contact with accepted aliases.

get_document_schema

Return the expected structure for COBie Document with validation rules and examples.

validate_document_input

Validate Document input before creation (proactive check).

add_document

Add a new COBie Document row to link a file/reference to a COBie entity.

get_cobie_headers

Return workbook headers for each sheet (row 1 only).

list_runtime_skills

List available runtime skills for orchestration (agentic affordance).

get_runtime_skill

Get full runtime skill by name (agentic affordance).

suggest_runtime_skill

Suggest runtime skill from user intent and workflow state (agentic affordance).

organize_document_file

Copy/move a file to the standard COBie document location.

suggest_document_path

Return recommended Directory and File for add_document.

search_entities

Search COBie entities (contact, space, floor, type, component, document) by type and optional query.

get_entity_details

extract_from_submittal

Extract text, structured fields, and tables from a PDF submittal.

extract_from_text

Extract content from a text file (.txt).

extract_from_excel_attachment

Extract highlights from an Excel attachment (not a COBie workbook).

validate_cobie

Validate a COBie workbook and generate an HTML report.

validate_draft_result

Validate the workbook state after applying a draft, without modifying the original file.

handover_readiness

Assess handover readiness for the workbook or a single entity (e.g. Component by Name).

update_cobie

Update COBie workbook with structured instructions or natural language text.

preview_update

Preview COBie updates (dry-run) and return diff. Explicit preview gate.

capture_installation

Capture equipment installation data in the COBie workbook (construction phase).

load_cobie_summary

list_sheet_rows

List rows from any COBie worksheet. Read-only. Returns columns, rows with rowIndex for stable identity.

list_floors

List all floors from the Floor sheet or project graph when canonical mode is enabled.

list_spaces

List spaces, optionally filtered by Floor, from workbook or project graph.

list_components

List components, optionally filtered by Space.

normalize_cobie_workbook

Shadow canonical normalization for a COBie workbook without modifying the file.

lookup_component_location

Resolve a Component's assigned Space and Floor without LLM routing.

import_cobie_to_graph

Import a COBie Excel workbook into the project-scoped canonical graph (idempotent upsert).

apply_update_to_graph

Apply confirmed COBie updates to the canonical project graph (not Excel).

export_cobie_from_graph

Export a derived COBie Excel snapshot from the canonical project graph.

validate_graph_export

Validate a graph-exported COBie workbook.

graph_list_floors

List floors from the canonical project graph.

graph_list_spaces_by_floor

List spaces from the canonical project graph, optionally filtered by floor.

graph_count_spaces_by_floor

Count spaces on a floor from the canonical project graph.

graph_list_components_by_space

List components located in a space from the canonical project graph.

graph_count_components_by_space

Count components located in a space from the canonical project graph.

graph_find_component_by_name

Find components by name in the canonical project graph.

graph_get_component_details

Get component details and related type/location from the canonical project graph.

graph_get_component_location

Resolve component location (space/floor) from the canonical project graph.

graph_get_type_components

List components of a type from the canonical project graph.

graph_get_system_components

List components in a system from the canonical project graph.

get_project_graph_stats

Return project-scoped graph load stats (node/relationship counts).

compute_workbook_source_hash

Compute canonical source hash for a COBie workbook (for graph sync checks).

sync_project_embeddings

Build or refresh derived EntityEmbedding nodes for a project graph.

semantic_search_project

Semantic search over derived project embeddings; results are expanded from the canonical graph.

get_vector_status

Return vector index readiness for a project.

lookup_component_location_tool

Deprecated alias for lookup_component_location.

graph_list_floors_tool

Deprecated alias for graph_list_floors.

graph_list_spaces_by_floor_tool

Deprecated alias for graph_list_spaces_by_floor.

graph_count_spaces_by_floor_tool

Deprecated alias for graph_count_spaces_by_floor.

graph_list_components_by_space_tool

Deprecated alias for graph_list_components_by_space.

graph_count_components_by_space_tool

Deprecated alias for graph_count_components_by_space.

graph_find_component_by_name_tool

Deprecated alias for graph_find_component_by_name.

graph_get_component_details_tool

Deprecated alias for graph_get_component_details.

graph_get_component_location_tool

Deprecated alias for graph_get_component_location.

graph_get_type_components_tool

Deprecated alias for graph_get_type_components.

graph_get_system_components_tool

Deprecated alias for graph_get_system_components.

sync_project_embeddings_tool

Deprecated alias for sync_project_embeddings.

semantic_search_project_tool

Deprecated alias for semantic_search_project.

get_vector_status_tool

Deprecated alias for get_vector_status.

get_cobie_hierarchy

Read-only aggregated COBie hierarchy (floors) via domain HierarchyService.

// environment variables

To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.

configHEALTH_SERVER_PORT

configENABLE_HEALTH_SERVER"": "false"

configMCP_TRANSPORT

configDOMAIN_API_HOST

configDOMAIN_API_PORT

🔐 secretOPENAI_API_KEY

configQUERY_MODEL

configDEFAULT_MODEL

configOPENAI_MODEL

🔐 secretDOMAIN_API_TOKEN

Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.

deployDATABASE_URL

// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

63/63 tools missing one or more hints — get_update_workflow (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_actor_contact_schema (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_document_schema (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +60 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Destructive tools are labelled

1 tool perform destructive updates without destructiveHint — validate_draft_result deletes at line 1593 (tmp_path.unlink())

Add destructiveHint:true to any tool whose handler calls .delete(), .upsert(), .update(), unlink, rm, DELETE, DROP, REPLACE INTO, or any operation that overwrites existing data.

Tool inputs are validated

59/63 tool handlers declare input schemas (94%)

Declare an inputSchema with zod/joi/yup on every tool definition.

Tool handlers catch errors

Only 23/63 tool handlers wrap calls in try/catch (37%)

Wrap each tool handler body in try/catch and return a structured error response.

Tests exist

No test files found

Add tests that exercise each declared tool.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail

The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.

// improvement guidance — verified publishers only

We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Verified](https://m8ven.ai/badge/mcp/roynertr/cobie-mcp?variant=verified)](https://m8ven.ai/mcp/roynertr/cobie-mcp)

Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.

commit: 571a8945f7d53e932872d4f87a95edae104d5319

code hash: 1262d0fba3ef6ee969fe4b317173d150fd2ee4ae1376b6de4a571b86bc8ae30a

view raw JSON →

Check MCPs from inside your assistant

Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check

check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern

How to add it →Free · no account needed · works in any MCP client