rymi-live/rymi-mcp (rymi-live/rymi-mcp) is an MCP server listed on the M8ven Trust Index. It scores 54 out of 100, grade D. It declares 56 tools. No publisher has claimed this listing.

D
Caution
54/100

rymi-live/rymi-mcp

Lets any MCP-capable AI client create and manage AI voice agents without writing HTTP code.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

rymi-live

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
🚨
Known vulnerabilities in dependencies: 2 critical, 3 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 1 credential: RYMI_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes56 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

list_agents

List all your Rymi AI voice agents.

get_agent

Retrieve a single Rymi voice agent by ID.

list_llm_options

Fetch all available LLM models and voices you can use when creating or updating an agent. Always call this before create_agent to pick valid values.

list_voices

List available agent/TTS voices, optionally filtered by provider or model. Much smaller payload than list_llm_options — use this to pick a `voice` value for create_agent/update_agent.

preview_stack

Preview the resolved per-language model stack (STT/LLM/TTS), blockers, warnings, model diffs, and any required role upgrades for a set of supported languages — without saving. Use before create/update to confirm a multi-language setup is valid. Note: the concierge (realtime) role is not supported he

create_agent

Create a new Rymi AI voice agent. Call list_llm_options first to discover valid voice and model values. For a multi-language agent, set supported_languages (e.g. ["hi-IN","en-US"]).

update_agent

Update an existing Rymi voice agent's configuration. Only the fields you pass are changed; nullable fields accept null to clear them.

delete_agent

Permanently delete a Rymi voice agent.

clone_agent

Duplicate an existing agent. The copy gets " (Copy)" appended to its name.

list_calls_for_agent

List calls made with a specific agent.

validate_agent_publish

Check whether an agent is ready to go live. Returns a validation report without persisting any changes.

apply_agent_changes

Validate and resolve a flat key/value change-set against the AgentConfig field registry. Does NOT persist — follow up with update_agent.

enrich_company

Use AI + Google Search grounding to auto-generate a company description from a website URL, suitable for an agent's persona.

generate_agent_draft

Use AI to generate an agent configuration draft from a plain-text description.

estimate_call_cost

Estimate how much balance a call will consume for a given tier and duration. Results are usage estimates; surface remaining balance to customers in minutes.

set_auto_recharge

Configure auto-recharge. `pack_usd` must exceed `threshold_usd` or the API rejects it (recharge-loop guard).

set_spend_alerts

Configure spend-alert thresholds and low-balance / email preferences.

list_calls

List previous and active calls across your account.

list_active_calls

List calls currently in progress.

get_call

Retrieve details, participants, status, duration, and cost for a single call.

get_call_summary

Retrieve the post-call summary for a call.

get_call_transcript

Retrieve the full transcript for a call. May contain personal data — handle accordingly.

get_call_recording

Retrieve recording metadata (e.g. playback URL) for a call, when recording is enabled.

get_call_queue_stats

Retrieve current outbound call queue statistics.

reprocess_call

Re-run post-call intelligence (summary, extraction, evaluation) for a call.

create_call

WARNING: places a real, billable PSTN call. `from_number` is the caller ID shown to the recipient and must be a phone number registered to your account — omit it to use the agent's attached number. `identity` is the destination in strict E.164 (e.g. +15555550123).

batch_call

Queue up to 500 outbound PSTN recipients in one request. WARNING: places real phone calls and incurs per-minute charges. `from_number` is the caller ID shown to the recipient and must be a phone number registered to your account.

end_call

WARNING: immediately terminates an in-progress call. The call transitions to completed and post-call processing runs.

add_call_participant

WARNING: dials/adds participants to a live call (warm transfer / conference). PSTN additions are billable.

list_dnc

List all numbers on your Do-Not-Call registry.

check_dnc

Check whether phone numbers are on the Do-Not-Call registry. Read-only — adds nothing.

add_dnc

Add a phone number to the Do-Not-Call registry so outbound calls to it are blocked.

add_dnc_batch

Add up to 1000 numbers to the Do-Not-Call registry. Invalid numbers are skipped and returned in `invalid`.

remove_dnc

WARNING: removes a number from the Do-Not-Call registry, re-enabling outbound calls to it.

get_usage_summary

Get this account's usage summary: remaining voice-runtime MINUTES, Studio AI unit usage, and post-call intelligence usage. Voice balance is reported in minutes, not dollars.

list_agent_templates

List published agent templates. Use a template's `defaults` as the starting config for create_agent.

list_eval_runs

List previous evaluation runs for an agent.

get_eval_run

Retrieve a single evaluation run, including per-scenario scores.

run_evals

Run the evaluation suite for an agent. mode="synthetic" (default) uses the offline scorer; mode="live" runs the model-driven runner (consumes Studio AI units).

list_publishable_keys

List publishable (browser-safe) keys and which agent/channels each is scoped to. Returns key prefixes only, never full secrets.

list_knowledge_sources

List the knowledge sources (RAG context) attached to an agent.

list_agent_changes

List recorded configuration changes for an agent (for auditing or before an undo).

add_knowledge_source

Add a knowledge source to an agent from raw text or a URL (the URL is fetched and ingested).

delete_knowledge_source

Delete a knowledge source from an agent.

undo_agent_change

Undo a single recorded configuration change, reverting that field to its previous value.

list_numbers

List all phone numbers on your Rymi account and which agent each is attached to.

register_number

Register a phone number on your account, optionally attaching it to an agent.

attach_number

Attach an existing number to an agent so inbound calls route to it.

remove_number

Remove a phone number from your account. The number stops routing to any agent.

publish_agent

Publish a Rymi voice agent to make its current saved configuration live. IMPORTANT: this immediately makes the agent callable by end users. Returns published:false with a blockers list when the config has unresolved issues.

telephony_status

Report whether a telephony carrier is connected, and which provider/account.

list_telephony_numbers

List numbers available on the connected telephony carrier account.

list_webhooks

List your registered webhook endpoints. Signing secrets are never returned.

create_webhook

Register a webhook to receive call lifecycle events (e.g. call.completed, transcript.ready). URL must be public https. If you omit `secret`, one is generated and shown ONCE in the response — store it to verify signatures.

update_webhook

Update a webhook endpoint. Only provided fields change. Pass `secret` to rotate it.

delete_webhook

WARNING: stops event delivery to this endpoint.

// known CVEs in dependencies2 critical3 high1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

criticalvitest@1.6.0GHSA-5xrq-8626-4rwp

When Vitest UI server is listening, arbitrary file can be read and executed

criticalvitest@1.6.0GHSA-9crc-q9x8-hgqq

Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening

high@modelcontextprotocol/sdk@1.11.1GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.11.1GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.11.1GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
🔐 secretRYMI_API_KEYRun the server on your own machine with npx — it speaks stdio by default and talks to the Rymi REST API directly. The key is read from the environment variable.
configRYMI_MCP_PORTOptions: RYMI_MCP_READONLY=1 hides every mutating tool (including create_call, batch_call, publish_agent); --transport http + serve over HTTP instead of stdio.
configRYMI_MCP_READONLYOptions: =1 hides every mutating tool (including create_call, batch_call, publish_agent); --transport http + RYMI_MCP_PORT serve over HTTP instead of stdio.
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

56/56 tools missing one or more hints — list_agents (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_agent (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); list_llm_options (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +53 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool inputs are validated

33/40 tool handlers declare input schemas (83%)

Declare an inputSchema with zod/joi/yup on every tool definition.

Tool handlers catch errors

Only 3/40 tool handlers wrap calls in try/catch (8%)

Wrap each tool handler body in try/catch and return a structured error response.

Tool test coverage

Only 14/56 tools referenced in tests (25%)

Write tests that reference each tool by name so every tool has at least one test.

Production dependencies are patched

0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.11.1 (high), @modelcontextprotocol/sdk@1.11.1 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Dev dependencies

2 critical/high in dev-only deps (does not ship to users)

Upgrade dev dependencies when convenient.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/rymi-live/rymi-mcp?variant=verified)](https://m8ven.ai/mcp/rymi-live/rymi-mcp)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 68a85dc4440cc8fb6d4d18511884edbf8d15a17b
code hash: fb6f97d3330da3542d08de12d5dc60a7a1596166da221953995648178a9d93f3
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client