SassyMCP (sassyconsultingllc/SassyMCP) is an MCP server listed on the M8ven Trust Index. It scores 16 out of 100, grade F. It declares 272 tools. No publisher has claimed this listing.

Warning

16/100

SassyMCP

Item: SassyMCP
Rating: 16
Author: M8ven

One MCP server, 270 tools, replaces 75+ — files, shell, GitHub, Android, desktop vision, security & forensics, persistent memory. Smart context-saving tool loading, safe-delete guardrails, and an orphan-proof self-healing process supervisor. Works with Claude Desktop, Cursor, Windsurf, and any MCP client.

→ sassyconsultingllc/SassyMCP · listed on glama

Warning. Serious findings were identified. Review the full report before connecting. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every push why connect →

Who stands behind it

sassyconsultingllc

Source: Glama · also listed on github_repo_search

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

Glamanot scored here GitHub

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings

🚨

Secret credentials may flow to a network call

5 flows detected: INCEPTION_API_KEY, LLM_API_KEY, GITHUB_TOKEN. We can’t prove the destination matches the brand the credential belongs to.

🚨

Reads files from sensitive locations

Touches: /Library/Keychains

⚠️

Tool descriptions don’t match what handlers do

1 tool describes read intent but its handler mutates — sassy_edit_block (line 157: p.write_text(new_content, encoding="utf-8"))

🔐

You'll be asked for 12 credentials: SASSYMCP_AUTH_TOKEN, INCEPTION_API_KEY, LEMONSQUEEZY_API_KEY, SSH_KEY, SSH_PASS, LLM_API_KEY, OPENROUTER_API_KEY, SASSYMCP_PANEL_TOKEN, SASSYMCP_LICENSE_SECRET, GITHUB_TOKEN, GITHUB_PERSONAL_ACCESS_TOKEN, SASSYMCP_CROSSLINK_TOKEN

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// tools this server exposes271 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

sassy_setup_tools

Manage external tool dependencies (tesseract, adb, nmap, plink, scrcpy, cloudflared).

sassy_adb_devices

List connected Android devices.

sassy_adb_shell

Run shell command on Android device.

sassy_adb_packages

List installed packages.

sassy_adb_pull

Pull file from Android to local.

sassy_adb_push

Push file from local to Android.

sassy_adb_install

Install APK on Android device.

sassy_adb_logcat

Get Android logcat output.

sassy_adb_screencap

Capture Android screen to local PNG.

sassy_adb_app_info

Get detailed info about an installed Android app.

sassy_adb_wifi_connect

Connect to Android device over WiFi.

sassy_launch_app

Launch an application by name.

sassy_launch_exe

Launch an executable directly by path.

sassy_focus_window

Bring a window to the foreground by title substring.

sassy_close_window

Close a window by title. Graceful unless force=True (kills the process).

sassy_resize_window

Move and/or resize a window by title.

sassy_snap_window

Snap a window to a screen edge (like Win+Arrow).

sassy_audit_log

Read recent audit log entries.

sassy_audit_search

Search audit log for a keyword.

sassy_audit_false_positives

Show recent shell-interceptor pattern matches (blocks + bypasses).

sassy_audit_clear

Rotate the audit log to a timestamped archive.

sassy_bt_devices

List paired Bluetooth devices.

sassy_bt_scan

List all Bluetooth devices.

sassy_bt_android

List Bluetooth devices from Android.

sassy_clipboard_get

Get the system clipboard text.

sassy_clipboard_set

Set the system clipboard text.

sassy_clipboard_to_android

Send the host clipboard to Android via base64 encoding.

sassy_clipboard_from_android

Get Android clipboard to the host.

sassy_combo_pr_review

Fetch PR metadata, diff, comments, and CI check status in one call.

sassy_combo_phone_observe

Phone state + UI tree + (optional) low-res screenshot in one call.

sassy_combo_codebase_grep

Ranked codebase search with context windows — one call replaces sassy_search_files + N x sassy_read_file.

sassy_peer_announce

Announce/refresh this agent as a live peer in the coordination mesh.

sassy_peer_list

List peers in the coordination mesh, newest heartbeat first.

sassy_peer_delegate

Hand a specific task to ONE peer (targeted handoff).

sassy_coordination_board

One-call coordination snapshot for the Sassy Brain cockpit view.

sassy_crosslink_start

Start the Crosslink HTTP API for LAN-accessible cross-device messaging.

sassy_crosslink_stop

Stop the Crosslink HTTP API server.

sassy_crosslink_send

Send a message to the crosslink queue.

sassy_crosslink_recv

Read messages from the crosslink queue. Marks them as read for this session.

sassy_crosslink_status

Check crosslink status: server running, sessions, message counts, channels.

sassy_crosslink_register

sassy_crosslink_broadcast

Broadcast a message to ALL known channels.

sassy_edit_block

Surgical file edit: find old_text and replace with new_text.

sassy_edit_multi

Apply multiple edits to a file in one call.

sassy_eventlog

Read the system log. Windows: log_name = System/Application/Security (Get-WinEvent). macOS: unified log (`log show`). Linux: journald (`journalctl`). level: error/warning/information. source: provider / process / subsystem name. log_name is Windows-only; ignored elsewhere.

sassy_eventlog_search

Search the system log for a keyword across hosts (Get-WinEvent / `log show` predicate / `journalctl -g`).

sassy_android_logcat

Read Android logcat.

sassy_safe_delete

Move a file or directory to a _DELETE_ staging folder for review.

sassy_read_file

Read file contents with line-based pagination.

sassy_read_multiple

Read multiple files at once. paths = JSON array of file paths.

sassy_write_file

Write or append to a file. mode: rewrite | append.

sassy_list_dir

List directory contents. [FILE]/[DIR] prefixes. depth controls recursion.

sassy_search_files

Search for files by name or content.

sassy_move

Move or rename a file/directory.

sassy_copy

Copy a file or directory tree.

sassy_file_info

Get detailed file/directory metadata.

sassy_mkdir

Create a directory (and any missing parents).

sassy_gh_get_me

Get the authenticated GitHub user's profile.

sassy_gh_get_teams

List teams for an organization.

sassy_gh_get_team_members

List members of a team.

sassy_gh_search_repos

Search GitHub repositories.

sassy_gh_get_file_contents

Get file or directory contents. Returns decoded content + SHA.

sassy_gh_create_file

Create a NEW file. Use push_files or update_file for existing files.

sassy_gh_update_file

Update EXISTING file. Auto-fetches blob SHA if not provided.

sassy_gh_delete_file

Delete a file from a repository.

sassy_gh_push_files

Push multiple files atomically via Git Data API. PREFERRED for all ops. files: JSON array of {"path": "...", "content": "..."} objects.

sassy_gh_create_repo

Create a new GitHub repository.

sassy_gh_fork_repo

Fork a repository.

sassy_gh_update_repo

Update repo settings. settings: JSON e.g. {"visibility":"public"}

sassy_gh_get_commit

Get details for a specific commit.

sassy_gh_list_commits

List commits on a branch.

sassy_gh_list_branches

List branches in a repository.

sassy_gh_create_branch

Create a new branch.

sassy_gh_list_tags

List tags in a repository.

sassy_gh_get_tag

Get details for a specific tag.

sassy_gh_list_releases

List releases.

sassy_gh_get_latest_release

Get latest release.

sassy_gh_get_release_by_tag

Get release by tag name.

sassy_gh_list_starred

List starred repos. Empty username = authenticated user.

sassy_gh_star_repo

Star a repository.

sassy_gh_unstar_repo

Unstar a repository.

sassy_gh_get_tree

Get a Git tree. recursive=True for full listing.

sassy_gh_get_issue

Get issue details.

sassy_gh_list_issues

List issues.

sassy_gh_create_issue

Create issue. labels/assignees: comma-separated.

sassy_gh_update_issue

Update an issue.

sassy_gh_add_issue_comment

Add a comment to an issue.

sassy_gh_search_issues

Search issues and PRs across GitHub.

sassy_gh_get_pr

Get PR details.

sassy_gh_list_prs

List pull requests.

sassy_gh_create_pr

Create a pull request.

sassy_gh_update_pr

Update a PR.

sassy_gh_merge_pr

Merge a PR. merge_method: merge, squash, rebase.

sassy_gh_pr_files

Get files changed in a PR.

sassy_gh_pr_reviews

Get reviews on a PR.

sassy_gh_pr_review_comments

Get review comments on a PR.

sassy_gh_create_pr_review

Create PR review. event: APPROVE, REQUEST_CHANGES, COMMENT.

sassy_gh_update_pr_branch

Update PR branch with latest from base.

sassy_gh_pr_status

Get combined status checks for a PR.

sassy_gh_search_code

Search code across GitHub.

171 further tools are not listed here. The complete surface is in the source.

// environment variables

To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.

configSASSYMCP_HOMECrash-survivable control. A pidfile + on-disk registry under $ mean supervise status/stop work even when the bridge is down, so an operator or agent can recover a wedged system.

configSASSYMCP_NO_AUTH

🔐 secretSASSYMCP_AUTH_TOKENRun the server in HTTP mode (sassymcp.exe --http, default 127.0.0.1:21001) and point your client at http://127.0.0.1:21001/mcp/. Set if the bind is non-loopback.

configSASSYMCP_ALLOWED_HOSTS

configSASSYMCP_LOAD_ALLLoad every tool group

configSASSYMCP_GROUPSLoad specific groups

configSASSYMCP_DEVEnable live reload (dev mode)

configSASSYMCP_NO_UPDATE_CHECKDisable the startup update check (no GitHub API call)

configSASSYMCP_PANELpanel.enabled / =1 to launch it at boot), then open the

🔐 secretINCEPTION_API_KEY

configSASSYMCP_REPOOverride the auto-detected repo root in tools/mercury_audit_sassymcp.py (dev tool only)

configLEMONSQUEEZY_API_BASE

🔐 secretLEMONSQUEEZY_API_KEY

configSSH_HOSTRemote Linux hostname/IP

configSSH_USERRemote Linux username

🔐 secretSSH_KEY

🔐 secretSSH_PASSRemote Linux password

configJOINT_CHANNEL

configHERMES_MODEL

configOLLAMA_URL

configMAX_TURNS

configPOLL_SECONDS

configHERMES_AUTORUN

configHERMES_TOOLS

configHERMES_TOOL_HOPS

🔐 secretLLM_API_KEY

🔐 secretOPENROUTER_API_KEY

configNO_COLOR

configTERM

configSASSYMCP_BILLING_BASE

configSASSYMCP_LS_BASE

configSASSYMCP_LS_VARIANT_MAP

configSASSYMCP_NET_PROBE_TIMEOUT

configSASSYMCP_OFFLINE_GATE

configSASSYMCP_ADB

configSHELL

configSASSYMCP_RESOURCE_URL

configSASSYMCP_OAUTH_ISSUER

🔐 secretSASSYMCP_PANEL_TOKEN

configXDG_CONFIG_HOME

🔐 secretSASSYMCP_LICENSE_SECRET

configSASSYMCP_TUNNEL_NAME

🔐 secretGITHUB_TOKENValidates an existing GITHUB_TOKEN, or opens [github.com/settings/tokens](https://github.com/settings/tokens?type=beta), walks you through scope selection, then saves and re-validates.

🔐 secretGITHUB_PERSONAL_ACCESS_TOKEN

🔐 secretSASSYMCP_CROSSLINK_TOKEN

configSSH_SESSION

configSSH_AUTH_SOCK

configPLINK_PATH

configSSH_CLIENT_PATH

configHERMES_NODE_PATH

// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

272/272 tools missing one or more hints — sassy_setup_tools (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); sassy_adb_devices (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); sassy_adb_shell (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +269 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Descriptions match behaviour

1 tool describes read intent but its handler mutates — sassy_edit_block (line 157: p.write_text(new_content, encoding="utf-8"))

Rename the tool, rewrite the description, or move the side-effect into a separate clearly-named tool.

Tool test coverage

Only 50/272 tools referenced in tests (18%)

Write tests that reference each tool by name so every tool has at least one test.

No access to sensitive paths

Reads sensitive paths: /Library/Keychains

Remove reads of sensitive system paths. If you genuinely need them, document why in the README.

Secrets not logged

2 secret values sent to print/logger.info

Redact or omit secret values from log output.

Tool description accuracy

sassy_edit_block: description implies read-only but handler writes/deletes/executes

Update tool descriptions to accurately reflect all capabilities — especially write, delete, or execute operations.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail

The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.

// improvement guidance — verified publishers only

We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Verified](https://m8ven.ai/badge/mcp/sassyconsultingllc/sassymcp?variant=verified)](https://m8ven.ai/mcp/sassyconsultingllc/sassymcp)

Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.

commit: f2ad9c7503142e21d50ea8e3a3712d01945aa6b4

code hash: c5815138656875bf91cc1a78aa397eb2800f835934545de9533dc8ae43d3ed68

view raw JSON →

Check MCPs from inside your assistant

Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check

check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern

How to add it →Free · no account needed · works in any MCP client