grade D

3 days ago

glama

mcp-services

Multi-tool MCP server for AI agents with 29 tools across web scraping, SEO analysis, screenshot and PDF generation, domain intelligence, content extraction, multi-chain EVM blockchain queries, and security toolkit. Free tier available with no auth required.

→ san-npm/mcp-services · listed on glama

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

⚠️

Known vulnerabilities in dependencies: 3 high

Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 5 credentials: ABUSEIPDB_API_KEY, ADMIN_SECRET, ETHERSCAN_API_KEY, STRIPE_WEBHOOK_SECRET, VT_API_KEY

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

🔐 secretABUSEIPDB_API_KEY— Security tools degrade gracefully without API keys (heuristics-only mode). Optional keys: VT_API_KEY, , ETHERSCAN_API_KEY.

🔐 secretADMIN_SECRET— Secret for admin endpoints

configALLOW_APIKEY_QUERY— For migration only, query-string API keys (?apikey=) can be temporarily re-enabled with =true. This mode is deprecated; prefer X-Api-Key.

configAPI_KEYS— Comma-separated valid API keys

configCHECKOUT_LIMIT_PER_HOUR— 5 Per-IP Stripe checkout creation limit

configCHROMIUM_PATH— /usr/bin/chromium-browser Path to Chromium

configDOMAIN

🔐 secretETHERSCAN_API_KEY— Security tools degrade gracefully without API keys (heuristics-only mode). Optional keys: VT_API_KEY, ABUSEIPDB_API_KEY, .

configFREE_DAILY_LIMIT— 10 Free tier request limit

configFREE_WINDOW_MS— 86400000 Free-tier rate-limit window in ms

configKEYS_FILE— Persist , MEMORY_DB_PATH, and X402_TX_CACHE_FILE on durable storage

configMAX_BROWSERS— 3 Max concurrent browser instances

configMAX_SSE_PER_IP— 5 Max concurrent SSE sessions per client IP

configMAX_SSE_SESSIONS— 50 Max MCP SSE sessions

configMEMORY_DB_PATH— ./data/memory.db SQLite memory database path

configPORT— 3100 Server port

configREDIS_URL— Optional Redis backend for shared/distributed rate-limits

configSSE_CONNECT_MAX_PER_WINDOW— 30 Max SSE connection attempts per IP per window

configSSE_CONNECT_WINDOW_MS— 60000 SSE connect rate-limit window in ms

configSTRIPE_SK— Stripe API key for Pro subscriptions

configSTRIPE_WEBHOOK_IP_ALLOWLIST— Optional CSV allowlist for webhook source IPs

🔐 secretSTRIPE_WEBHOOK_SECRET— Stripe webhook signing secret

configTRUST_PROXY— false Express trust proxy setting (false, true, hop count like 1, or subnet names/CIDRs like loopback/10.0.0.0/8)

🔐 secretVT_API_KEY— Security tools degrade gracefully without API keys (heuristics-only mode). Optional keys: , ABUSEIPDB_API_KEY, ETHERSCAN_API_KEY.

configX402_MAX_TX_AGE_SECONDS— 86400 Maximum accepted payment tx age in seconds (stale txs are rejected)

configX402_PRICE_USD— 0.005 x402 price per call

configX402_RECEIVER— x402 payment receiver address

configX402_TEST_MODE— 0 Set to 1 only for local/offline testing; ignored in production

configX402_TX_CACHE_FILE— ./data/x402-tx-cache.json Persistent replay-protection cache for used x402 tx hashes

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/san-npm-mcp-services-734ph4)](https://m8ven.ai/mcp/san-npm-mcp-services-734ph4)

commit: 49069264b541fa8ccceede03fd55c040018af82c

code hash: 4d46b19f8fd78cbce384449d2ffb30d3546d81764f0da6cf4504363e6d93c3af

verified: 4/18/2026, 3:47:54 PM

view raw JSON →