mcp_arena (SatyamSingh8306/mcp_arena) is an MCP server listed on the M8ven Trust Index. It scores 39 out of 100, grade F. It declares 395 tools. No publisher has claimed this listing.

Warning

39/100

mcp_arena

Item: mcp_arena
Rating: 39
Author: M8ven

A production-ready Python library for building MCP servers with agent orchestration and domain-specific presets for platforms like GitHub, Slack, and Notion.

→ SatyamSingh8306/mcp_arena · listed on glama

Warning. Serious findings were identified. Review the full report before connecting. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every push why connect →

Who stands behind it

SatyamSingh8306

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

Glamanot scored here

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings

⚠️

Tool descriptions don’t match what handlers do

1 tool describes read intent but its handler mutates — get_ffmpeg_info (line 285: result = subprocess.run()

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 14 credentials: BITBUCKET_APP_PASSWORD, BITBUCKET_OAUTH_KEY, BITBUCKET_OAUTH_SECRET, AWS_SECRET_ACCESS_KEY, CONFLUENCE_PASSWORD, GITHUB_TOKEN, GITLAB_PRIVATE_TOKEN, GITLAB_OAUTH_TOKEN, JIRA_PASSWORD, TWILIO_AUTH_TOKEN, SLACK_BOT_TOKEN, NOTION_TOKEN, SLACK_TOKEN, OPENAI_API_KEY

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// tools this server exposes356 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

get_audio_info

Get detailed information about an audio file.

analyze_audio

Analyze audio characteristics using librosa.

convert_audio

Convert audio to a different format.

batch_convert

Convert multiple audio files.

trim_audio

Trim audio to specified time range.

concatenate_audio

Concatenate multiple audio files.

split_audio

Split audio into segments.

change_volume

Change audio volume (dB).

normalize_audio

Normalize audio to target dBFS.

add_fade

Add fade in/out effects to audio.

change_speed

Change audio playback speed.

add_echo

Add echo effect to audio.

reverse_audio

Reverse audio playback.

detect_beats

Detect beats in audio.

extract_mfcc

Extract MFCC features from audio.

get_spectrogram

Generate spectrogram data for audio.

list_buckets

List all S3 buckets

list_objects

List objects in an S3 bucket

list_workspaces

List Bitbucket workspaces.

get_workspace

Get information about a specific workspace.

list_repositories

List Bitbucket repositories. Args: workspace_slug: Workspace slug (required for Bitbucket Cloud) search: Search repositories by name

get_repository

Get detailed information about a repository.

create_repository

Create a new repository. Args: workspace_slug: Workspace slug name: Repository name description: Repository description is_private: Make repository private fork_policy: Fork policy (allow_forks, no_public_forks, no_forks) project_key: Project key to associate with

list_pull_requests

List pull requests for a repository. Args: workspace_slug: Workspace slug repository_slug: Repository slug state: Pull request state (OPEN, MERGED, DECLINED, SUPERSEDED) author: Filter by author username

create_pull_request

Create a new pull request. Args: workspace_slug: Workspace slug repository_slug: Repository slug title: Pull request title source_branch: Source branch name destination_branch: Destination branch name description: Pull request description reviewers: List of reviewer usernames close_source_branch: Cl…

merge_pull_request

Merge a pull request.

list_commits

List commits for a repository. Args: workspace_slug: Workspace slug repository_slug: Repository slug branch: Branch name limit: Maximum number of commits to return

get_commit

Get detailed information about a specific commit.

list_branches

List branches for a repository.

create_branch

Create a new branch. Args: workspace_slug: Workspace slug repository_slug: Repository slug branch_name: New branch name from_branch: Source branch name

list_pipelines

List CI/CD pipelines for a repository.

trigger_pipeline

Trigger a new pipeline.

create_browser_session

Create a new browser session.

list_browser_sessions

List all active browser sessions.

switch_session

Switch the active browser session.

close_browser_session

Close a browser session.

close_all_sessions

Close all browser sessions.

navigate

Navigate to a URL.

go_back

Go back in browser history.

go_forward

Go forward in browser history.

refresh

Reload the current page.

get_current_url

Return current page URL and title.

click

Click an element.

double_click

Double-click an element.

hover

Hover over an element.

type_text

Type text into an input field.

fill_input

Fill an input field instantly (faster than type_text).

press_key

Press a key or key combination.

select_option

Select a dropdown option by value, label, or index.

check_checkbox

Check a checkbox or radio button.

uncheck_checkbox

Uncheck a checkbox.

upload_file

Upload a file via a file input element.

scroll

Scroll the page or a specific element.

fill_form

Fill multiple form fields at once.

analyze_form

Inspect a form and return its field definitions.

get_form_data

Extract current values from all form fields.

get_text

Get the text content of an element.

get_attribute

Get an attribute value from an element.

get_inner_html

Get the inner HTML of an element.

query_selector_all

Query all matching elements and return info about each.

extract_table

Extract data from an HTML table.

get_page_content

Return the full page HTML (capped at 50 000 chars).

execute_javascript

Execute JavaScript in the page context.

take_screenshot

Capture a screenshot.

generate_pdf

Generate a PDF from the current page (Chromium only).

wait_for_selector

Wait until an element reaches the given state.

wait_for_load

Wait for the page to finish loading.

get_cookies

Get browser cookies.

set_cookies

Set browser cookies.

clear_cookies

Clear all browser cookies.

get_local_storage

Get all localStorage key/value pairs.

set_local_storage

Set localStorage key/value pairs.

intercept_requests

Intercept matching network requests.

mock_api_response

Mock responses for requests matching url_pattern.

handle_dialog

emulate_device

Emulate a mobile/tablet device by name (e.g. 'iPhone 13').

set_geolocation

Override geolocation for the active context.

set_viewport_size

Resize the viewport.

drag_and_drop

Drag an element and drop it onto another.

new_tab

Open a new browser tab.

switch_tab

Switch active tab by index.

close_tab

Close a tab by index (defaults to last tab).

download_file

Click a download link and wait for the file to arrive.

listen_console

Start capturing browser console messages.

get_console_logs

Return captured console messages.

s3_list_buckets

List all S3 buckets.

s3_list_objects

List objects in an S3 bucket.

s3_upload_file

Upload a file to S3.

s3_download_file

Download a file from S3.

gcs_list_buckets

List all GCS buckets.

gcs_upload_file

Upload a file to GCS.

get_provider_info

Get configured cloud provider information.

list_spaces

List Confluence spaces. Args: space_type: Space type (global, personal) status: Space status (current, archived) limit: Maximum number of spaces to return

get_space

Get detailed information about a space.

create_space

Create a new Confluence space. Args: space_key: Space key (unique identifier) name: Space name description: Space description

list_pages

List pages in a space. Args: space_key: Space key start: Start index for pagination limit: Maximum number of pages to return status: Page status (current, draft, archived)

get_page

Get detailed information about a page. Args: page_id: Page ID include_content: Include page content in response

create_page

Create a new page in Confluence. Args: space_key: Space key title: Page title body: Page content (HTML format) parent_id: Parent page ID (for nested pages) editor: Editor format (storage, editor2, view)

update_page

Update an existing page. Args: page_id: Page ID title: New page title (optional) body: New page content (optional) version: Current page version (required for conflict resolution) editor: Editor format (storage, editor2, view)

delete_page

Delete a page.

256 further tools are not listed here. The complete surface is in the source.

// environment variables

To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.

configBITBUCKET_USERNAME

🔐 secretBITBUCKET_APP_PASSWORD

🔐 secretBITBUCKET_OAUTH_KEY

🔐 secretBITBUCKET_OAUTH_SECRET

configAWS_ACCESS_KEY_ID

🔐 secretAWS_SECRET_ACCESS_KEY

configS3_BUCKET_NAME

configGCS_PROJECT_ID

configGCS_BUCKET_NAME

configGOOGLE_APPLICATION_CREDENTIALS

configCONFLUENCE_USERNAME

🔐 secretCONFLUENCE_PASSWORD

🔐 secretGITHUB_TOKEN

🔐 secretGITLAB_PRIVATE_TOKEN

🔐 secretGITLAB_OAUTH_TOKEN

configJIRA_USERNAME

🔐 secretJIRA_PASSWORD

configGMAIL_CREDENTIALS_PATH

configTWILIO_ACCOUNT_SID

🔐 secretTWILIO_AUTH_TOKEN

configTWILIO_PHONE_NUMBER

🔐 secretSLACK_BOT_TOKEN

🔐 secretNOTION_TOKEN

🔐 secretSLACK_TOKEN

🔐 secretOPENAI_API_KEY

configTWILIO_WHATSAPP_NUMBER

Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.

deployMONGODB_CONNECTION_STRING

deploySMTP_HOST

deploySMTP_USERNAME

deploySMTP_PASSWORD

deployPOSTGRES_CONNECTION_STRING

// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

395/395 tools missing one or more hints — get_audio_info (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); analyze_audio (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); convert_audio (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +392 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Destructive tools are labelled

1 tool perform destructive updates without destructiveHint — delete_file deletes at line 756 (path.unlink())

Add destructiveHint:true to any tool whose handler calls .delete(), .upsert(), .update(), unlink, rm, DELETE, DROP, REPLACE INTO, or any operation that overwrites existing data.

Descriptions match behaviour

1 tool describes read intent but its handler mutates — get_ffmpeg_info (line 285: result = subprocess.run()

Rename the tool, rewrite the description, or move the side-effect into a separate clearly-named tool.

Tool inputs are validated

360/395 tool handlers declare input schemas (91%)

Declare an inputSchema with zod/joi/yup on every tool definition.

Tool handlers catch errors

370/395 tool handlers wrap calls in try/catch (94%)

Wrap each tool handler body in try/catch and return a structured error response.

Tests exist

No test files found

Add tests that exercise each declared tool.

Tool description accuracy

get_ffmpeg_info: description implies read-only but handler writes/deletes/executes

Update tool descriptions to accurately reflect all capabilities — especially write, delete, or execute operations.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail

The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.

// improvement guidance — verified publishers only

We have 8 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Verified](https://m8ven.ai/badge/mcp/satyamsingh8306/mcp_arena?variant=verified)](https://m8ven.ai/mcp/satyamsingh8306/mcp_arena)

Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.

commit: 6213ea3186871a17e8e3d3ffca86033e7724f824

code hash: e4da689cefd21ddf63561e35b2a7f6ba5b40f4f8f1e6d04612763939555e017c

view raw JSON →

Check MCPs from inside your assistant

Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check

check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern

How to add it →Free · no account needed · works in any MCP client