Skylight MCP Server (samabenie1/skylight-mcp-fork) is an MCP server listed on the M8ven Trust Index. It scores 62 out of 100, grade C. It declares 40 tools. No publisher has claimed this listing.

C
Caution
62/100

Skylight MCP Server

Enables AI assistants to interact with the Skylight family calendar API, allowing management of calendars, chores, lists, tasks, family members, and rewards through natural language.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

samabenie1

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
🚨
Known vulnerabilities in dependencies: 1 critical, 2 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 2 credentials: SKYLIGHT_PASSWORD, SKYLIGHT_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes40 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

get_calendar_events

Get calendar events from Skylight. Use this to answer questions like: - "What's on my calendar today?" - "What do we have scheduled this weekend?" - "Are there any events on Friday?" Returns a list of events with their titles, times, and details.

get_source_calendars

Get connected calendar sources synced to Skylight. Use this to answer: - "Which calendars are synced to Skylight?" - "What calendar accounts are connected?" Returns a list of connected calendar sources (Google, iCloud, etc.).

create_calendar_event

Create a new calendar event in Skylight. Use this when: - Scheduling a new event: "Add a dentist appointment on Friday at 2pm" - Creating family activities: "Schedule soccer practice every Saturday at 10am" - Adding reminders: "Put Mom's birthday on the calendar" Parameters: - summary (required):

update_calendar_event

Update an existing calendar event. Use this when: - Changing event time: "Move the dentist appointment to 3pm" - Updating event details: "Add location to the meeting" - Renaming an event: "Change 'Doctor' to 'Dr. Smith checkup'" Parameters: - eventId (required): ID of the event to update (from get

delete_calendar_event

Delete a calendar event from Skylight. Use this when: - Canceling an event: "Remove the dentist appointment" - Deleting old events: "Delete the meeting from yesterday" Parameters: - eventId (required): ID of the event to delete (from get_calendar_events) Note: This permanently removes the event.

get_chores

Get chores from Skylight. Use this to answer: - "What chores do I need to do today?" - "Show me this week's chores" - "What's on the chore chart?" - "What chores does [name] have?" Returns chores with their IDs (needed for update_chore/delete_chore), assignees, due dates, and completion status.

create_chore

Add a new chore to Skylight. Use this when the user wants to: - Add a new task like "empty the dishwasher" - Assign chores to family members - Create recurring chores The chore will appear on the Skylight display. An assignee is required — this account's Skylight API version rejects unassigned ("u

update_chore

Update an existing chore in Skylight. Use this when: - Marking a chore as complete: "Mark 'dishes' as done" - Changing chore assignment: "Reassign the trash to Dad" - Updating chore details: "Change the time for the homework chore" - Changing a recurring chore's name/reward/assignee/recurrence for

delete_chore

Delete a chore from Skylight. Use this when: - Removing an old or irrelevant chore - Deleting a chore that was added by mistake - Removing a recurring chore series, or ending it from a given date onward Parameters: - choreId (required): ID of the chore to delete (from get_chores) - applyTo: Requir

get_family_members

Get family members/profiles from Skylight. Shows who can be assigned chores and their profile details. Use this to answer: - "Who's in our family on Skylight?" - "What family members are set up?" - "Who can I assign chores to?"

get_frame_info

Get Skylight household/frame information. Useful for setup verification and debugging. Use this to answer: - "Show Skylight household info" - "What's my frame ID?"

get_devices

List Skylight devices in the household. Use this to answer: - "What Skylight devices do we have?" - "How many Skylight frames are connected?"

get_lists

Get all lists from Skylight (grocery lists, to-do lists, etc.). Use this to see what lists are available before adding items. Returns list names, types (shopping/to_do), and item counts.

get_list_items

Get items from a specific Skylight list. Use this to answer: - "What's on the grocery list?" - "Show me my to-do list" - "What items are on [list name]?" Returns items organized by section with their completion status.

create_list

Create a new list in Skylight. Use this when: - Creating a new shopping/grocery list - Creating a new to-do list Parameters: - label (required): Name of the list (e.g., "Vacation Packing", "Weekly Groceries") - kind (required): "shopping" for grocery/shopping lists, "to_do" for task lists - color:

update_list

Update an existing list's name or settings. Use this when: - Renaming a list - Changing a list's type or color Parameters: - listId: ID of the list to update (use get_lists to find IDs) - listName: Name of the list to update (alternative to listId) - label: New name for the list - kind: New type (

delete_list

Delete a list from Skylight. Use this when: - Removing an old or unused list - Deleting a temporary list Parameters: - listId: ID of the list to delete (use get_lists to find IDs) - listName: Name of the list to delete (alternative to listId) Note: This permanently deletes the list and all its it

create_list_item

Add an item to a Skylight list. Use this when: - Adding something to the grocery list: "Add milk to the shopping list" - Creating a to-do item: "Put 'call doctor' on my to-do list" - Adding items to any list Parameters: - label (required): The item text (e.g., "Milk", "Call doctor") - listId: ID o

update_list_item

Update a list item (mark complete, rename, move to section). Use this when: - Marking an item as complete: "Check off milk from the list" - Renaming an item: "Change 'milk' to '2% milk'" - Moving an item to a different section Parameters: - itemId (required): ID of the item to update - listId (req

delete_list_item

Remove an item from a list. Use this when: - Removing an item that was added by mistake - Deleting an item instead of marking it complete Parameters: - itemId (required): ID of the item to delete - listId (required): ID of the list containing the item Note: This permanently removes the item. Use

get_meal_categories

Get meal categories (Breakfast, Lunch, Dinner, etc.) - Plus subscription required. Use this when: - Finding category IDs for scheduling meals - Seeing what meal times are available Returns: List of meal categories with IDs.

get_recipes

Get all saved recipes - Plus subscription required. Use this when: - Browsing available recipes - Finding a recipe ID for meal planning Returns: List of recipes with their details.

get_recipe

Get details for a specific recipe - Plus subscription required. Parameters: - recipeId (required): ID of the recipe Returns: Recipe details including description.

create_recipe

Create a new recipe - Plus subscription required. Use this when: - Adding a new family recipe - Saving a meal for meal planning Parameters: - summary (required): Recipe name - description: Recipe details or instructions - mealCategoryId: Category ID (use get_meal_categories) Returns: The created

update_recipe

Update an existing recipe - Plus subscription required. Parameters: - recipeId (required): ID of the recipe - summary: New name - description: New description Returns: The updated recipe.

delete_recipe

Delete a recipe - Plus subscription required. Parameters: - recipeId (required): ID of the recipe to delete Note: This permanently removes the recipe.

add_recipe_to_grocery_list

Add a recipe's ingredients to the grocery list - Plus subscription required. Use this when: - Planning to make a recipe and need to buy ingredients - Adding meal ingredients to shopping list Parameters: - recipeId (required): ID of the recipe Returns: Confirmation that ingredients were added.

get_meal_sittings

Get scheduled meals for a date range - Plus subscription required. Use this when: - Viewing the meal plan for the week - Checking what's scheduled for dinner Parameters: - date: Start date (defaults to today) - dateEnd: End date (defaults to 7 days from start) Returns: List of scheduled meals.

create_meal_sitting

Schedule a meal for a specific date - Plus subscription required. Use this when: - Planning meals for the week - Scheduling a recipe for dinner - Marking a night as takeout, leftovers, or BYO with no recipe Parameters: - date (required): Date for the meal (YYYY-MM-DD) - mealCategoryId (required):

get_avatars

Get available avatar options for Skylight profiles. Use this when: - Setting up a new family member profile - Changing someone's profile picture - Exploring available avatar options Returns: List of available avatars with their IDs and details.

get_colors

Get available color options for Skylight profiles and lists. Use this when: - Choosing a color for a family member profile - Setting a list color - Exploring available color options Returns: List of available colors with their IDs and hex values.

get_albums

Get photo albums from Skylight - Plus subscription required. Use this when: - Viewing available photo albums - Getting album IDs for photo management Returns: List of photo albums with their IDs.

get_rewards

Get available rewards that can be redeemed with reward points. For family gamification - shows rewards that family members can earn. Use this to answer: - "What rewards can we redeem?" - "What can the kids earn?" - "Show available rewards"

get_reward_points

Get reward points balance for family members. Shows how many reward points each family member has earned. Use this to answer: - "How many points does [name] have?" - "Show reward points balance" - "Who has the most points?"

create_reward

Create a new reward that can be redeemed with points (Plus subscription required). Use this when: - Adding a new reward: "Create a reward for 30 minutes of screen time" - Setting up family incentives: "Add a pizza night reward worth 100 points" Parameters: - name (required): Reward name (e.g., "30

update_reward

Update an existing reward (Plus subscription required). Use this when: - Changing point value: "Make the screen time reward cost 50 points" - Updating reward details: "Add a description to the pizza reward" Parameters: - rewardId (required): ID of the reward (from get_rewards) - name: New reward n

delete_reward

Delete a reward (Plus subscription required). Use this when: - Removing an old reward - Cleaning up unused rewards Parameters: - rewardId (required): ID of the reward to delete (from get_rewards) Note: This permanently removes the reward.

redeem_reward

Redeem a reward using points (Plus subscription required). Use this when: - A family member wants to cash in points: "Redeem the screen time reward for Johnny" - Claiming an earned reward Parameters: - rewardId (required): ID of the reward to redeem (from get_rewards) - assignee: Family member red

unredeem_reward

Cancel a reward redemption (Plus subscription required). Use this when: - A redemption was made by mistake - Undoing a reward claim Parameters: - rewardId (required): ID of the reward to unredeem Returns: The unredeemed reward details.

create_task

Add a task to the Skylight task box. The task box holds unscheduled tasks that can later be assigned to specific dates. Use this when the user says: - "Add XYZ to my task list" - "Remind me to do ABC" (without a specific date) - "Put 'clean garage' on the task box" The task will appear on the Sky

// known CVEs in dependencies1 critical2 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

criticalvitest@1.6.1GHSA-5xrq-8626-4rwp

When Vitest UI server is listening, arbitrary file can be read and executed

high@modelcontextprotocol/sdk@1.25.1GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.25.1GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configSKYLIGHT_AUTH_TYPEbearer (default) or basic (for manual token)
configSKYLIGHT_EMAILYour Skylight account email
configSKYLIGHT_FRAME_IDYour household frame ID
configSKYLIGHT_HAS_PLUS
🔐 secretSKYLIGHT_PASSWORDYour Skylight account password
configSKYLIGHT_TIMEZONEDefault timezone (default: America/New_York)
🔐 secretSKYLIGHT_TOKENYour API token (if not using email/password)
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

40/40 tools missing one or more hints — get_calendar_events (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_source_calendars (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); create_calendar_event (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +37 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool inputs are validated

36/40 tool handlers declare input schemas (90%)

Declare an inputSchema with zod/joi/yup on every tool definition.

Tool test coverage

Only 0/40 tools referenced in tests (0%)

Write tests that reference each tool by name so every tool has at least one test.

Secrets not logged

1 secret value sent to error

Redact or omit secret values from log output.

Production dependencies are patched

0 critical, 2 high severity in production deps — @modelcontextprotocol/sdk@1.25.1 (high), @modelcontextprotocol/sdk@1.25.1 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Dev dependencies

1 critical/high in dev-only deps (does not ship to users)

Upgrade dev dependencies when convenient.

Domain consistency

npm scope @eaglebyte doesn't match GitHub owner samabenie1

Use the same org name across GitHub, npm, and your homepage so users can verify the publisher.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 8 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/samabenie1/skylight-mcp-fork?variant=verified)](https://m8ven.ai/mcp/samabenie1/skylight-mcp-fork)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 5811f05617930a94ae9777ba5de1cfaee51e2c1b
code hash: 12bbd15855bed8c597b0023e1930154ad7fcdc7e2bc4405787cfb87d6cf07a63
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client