Access (Scottpedia0/access) is an MCP server listed on the M8ven Trust Index. It scores 50 out of 100, grade D. It declares 67 tools. No publisher has claimed this listing.
Self-hosted credential store and API proxy for AI agents. One Bearer token, all your services. Handles OAuth refresh, encrypted storage, audit logging, and per-agent permissioning.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
Scottpedia0
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
google_profile_allList all configured Google accounts with their email addresses, display names, and OAuth scope status. Use this first to discover which account aliases are available and verify they have the scopes needed for other tools.
google_admin_login_activityQuery Google Workspace Admin Reports API for activity events such as logins, admin actions, or OAuth token grants. Use this to audit user login history, detect suspicious access, or review admin changes. Defaults to login events.
google_admin_usage_reportFetch Google Workspace daily usage statistics (storage, app usage, account activity) for a specific user or all users on a given date. Use this for capacity planning or tracking adoption metrics.
gmail_searchSearch Gmail messages using Gmail query syntax. Use this to find emails by sender, subject, label, date, or read status. Returns message IDs, subjects, snippets, and thread IDs for use with gmail_thread.
gmail_threadRetrieve all messages in a Gmail conversation thread. Use this after gmail_search to read the full email chain including all replies. Returns sender, recipients, subject, body, and timestamps for each message.
gmail_sendSend an email from a configured Google account. Supports new messages and replies. Side effect: delivers the email immediately upon success. Returns the sent message ID.
gmail_trashMove a single Gmail message to trash. The message can be recovered from trash for 30 days. Use gmail_batch_trash for bulk operations.
gmail_batch_trashMove multiple Gmail messages to trash in a single call (up to 50). Use after gmail_search to bulk-clean spam or old notifications. Returns a count of successfully trashed vs failed messages.
gmail_modify_labelsAdd or remove Gmail labels on a message. Use this to mark messages as read (remove 'UNREAD'), star them (add 'STARRED'), archive (remove 'INBOX'), or apply custom labels. Returns the updated label list.
gmail_draftCreate a Gmail draft without sending it. Use this when a message needs review before sending, or to stage a reply. The draft appears in the user's Drafts folder. Returns the draft ID.
calendar_list_eventsList upcoming Google Calendar events for a configured account, ordered by start time. Use this to check schedules, find meeting conflicts, or get today's agenda. Returns event titles, times, attendees, and meeting links.
drive_searchSearch Google Drive files using the Drive API query syntax. Use this to find documents, spreadsheets, or any file by name, type, or content. Returns file IDs, names, MIME types, and modification dates.
drive_listList files and subfolders inside a specific Google Drive folder. Defaults to the root folder. Use drive_search to find a folder ID first, then this tool to browse its contents.
drive_read_docExport a Google Drive file (Doc, Sheet, Slide, etc.) to a specified format and return its content. Defaults to plain text export. Use this to read document contents without opening the Google editor.
sheets_readRead cell values from a Google Sheets spreadsheet using A1 notation. Returns a 2D array of values. Use this to inspect data, headers, or specific ranges before appending.
sheets_appendAppend one or more rows to the bottom of a Google Sheets spreadsheet. New rows are added after the last row with data. Side effect: modifies the spreadsheet immediately.
docs_readRead the full text content of a Google Doc. Returns the document body as plain text. Use this for quick content extraction without formatting.
contacts_searchSearch Google Contacts by name, email address, or phone number. Returns matching contacts with their full names, emails, phone numbers, and organizations.
cal_list_bookingsList Cal.com bookings filtered by status. Use this to see scheduled meetings, check past calls, or find cancelled bookings. Returns booking details including attendee info, event type, and timestamps.
cal_get_bookingRetrieve full details of a single Cal.com booking including attendees, notes, responses, and meeting link. Use after cal_list_bookings to get complete info on a specific booking.
cal_cancel_bookingCancel a Cal.com booking and notify the attendee. Side effect: sends a cancellation email to all participants. This action cannot be undone.
cal_event_typesList all Cal.com event types with their slugs, durations, and scheduling URLs. Use this to see which booking pages are available and their configuration.
porkbun_domainsList all domains registered in the Porkbun account with their expiration dates and auto-renew status. Use this to audit domain ownership or find a specific domain.
porkbun_dnsList all DNS records (A, AAAA, CNAME, MX, TXT, NS) for a domain managed in Porkbun. Use this to audit DNS configuration or find existing records before creating new ones.
porkbun_check_domainCheck domain name availability and registration price on Porkbun. Returns whether the domain is available and the cost to register it.
porkbun_create_dnsCreate a new DNS record on a Porkbun-managed domain. Side effect: the record is live immediately after creation. Use porkbun_dns first to check for conflicts.
gtm_accountsList all Google Tag Manager accounts accessible by the specified Google account. Use this first to get account IDs needed by gtm_containers and gtm_tags.
gtm_containersList all GTM containers within a specific Tag Manager account. Returns container IDs, names, and website URLs. Use after gtm_accounts to drill down.
gtm_tagsList all tags configured in a GTM container workspace, including their type, firing triggers, and status. Use this to audit tracking pixels, conversion tags, or analytics configuration.
vercel_projectsList all Vercel projects in the account with their names, frameworks, and latest deployment status. Use this to get project IDs needed by vercel_deployments and vercel_env.
vercel_deploymentsList recent Vercel deployments with their status, URL, branch, and creation time. Optionally filter by project. Use this to check deployment status or find a deployment ID for vercel_build_logs.
vercel_build_logsRetrieve build output logs for a specific Vercel deployment. Use this to diagnose build failures or verify successful deployments. Returns timestamped log lines.
vercel_envList all environment variables configured for a Vercel project, grouped by target environment (production, preview, development). Returns variable names and targets but redacts secret values.
vercel_domainsList all custom domains configured across Vercel projects, including their DNS verification status and associated project. Use this to audit domain assignments or check configuration.
cf_accountsList all Cloudflare accounts accessible with the configured API token. Use this first to get account IDs needed by cf_tunnels, cf_tunnel_config, and cf_workers.
cf_zonesList all Cloudflare zones (domains) with their IDs, status, and name servers. Use this to get zone IDs needed by cf_dns and cf_create_dns.
cf_dnsList all DNS records for a Cloudflare zone including type, name, content, TTL, and proxy status. Use this to audit DNS configuration or check for existing records before creating new ones.
cf_create_dnsCreate a new DNS record in a Cloudflare zone. Side effect: the record goes live immediately and can affect traffic routing. Use cf_dns first to check for conflicts.
cf_tunnelsList all Cloudflare Tunnels in an account with their IDs, names, and connection status. Use this to find tunnel IDs for cf_tunnel_config.
cf_tunnel_configRetrieve the ingress routing configuration for a specific Cloudflare Tunnel, showing which hostnames map to which local services. Use this to debug tunnel routing or verify configuration.
cf_workersList all Cloudflare Workers scripts deployed in an account, including their names and last-modified timestamps. Use this to audit deployed serverless functions.
slack_list_channelsList all Slack channels (public and private) in the workspace with their IDs, names, topics, and member counts. Use this to find channel IDs needed by slack_channel_history and slack_send.
slack_channel_historyRead recent messages from a Slack channel in reverse chronological order. Returns message text, author, timestamp, and thread metadata. Use slack_thread to read replies.
slack_threadRead all replies in a Slack thread including the parent message. Use this after slack_channel_history when a message has thread replies you need to read.
slack_list_dmsList all direct message and group DM conversations visible to the bot. Returns channel IDs and participant info. Use this to find DM channel IDs for slack_dm_history.
slack_dm_historyRead recent messages from a Slack direct message or group DM conversation. Returns message text, author, and timestamps in reverse chronological order.
slack_searchSearch Slack messages across all channels and DMs using Slack search syntax. Use this to find specific conversations, mentions, or topics. Returns matching messages with channel context and timestamps.
slack_sendSend a Slack message to a channel, DM, or thread. Side effect: delivers the message immediately and it is visible to all channel members. Supports Slack mrkdwn formatting.
slack_usersList all members of the Slack workspace with their user IDs, display names, emails, and online status. Use this to look up user IDs or find team members.
slack_find_userLook up a Slack user by their email address. Returns user ID, display name, and profile info. Use this when you have an email but need the Slack user ID for sending messages.
hubspot_search_contactsSearch HubSpot CRM contacts by name, email, or company. Returns contact IDs, names, emails, and company associations. Use this to find contacts before viewing full details with hubspot_get_contact.
hubspot_get_contactRetrieve all properties and associations for a single HubSpot contact. Returns full profile data including custom properties, lifecycle stage, and associated deals/companies.
hubspot_create_contactCreate a new contact in HubSpot CRM. Side effect: the contact is immediately created and may trigger workflows. Email is required; all other fields are optional.
hubspot_update_contactUpdate one or more properties on an existing HubSpot contact. Side effect: changes are saved immediately and may trigger workflows. Only provided properties are changed; others are left untouched.
hubspot_search_dealsSearch HubSpot CRM deals by name, stage, or pipeline. Returns deal IDs, names, amounts, stages, and close dates. Use this to find deals before creating notes or logging calls.
hubspot_create_dealCreate a new deal in HubSpot CRM. Side effect: the deal is immediately created in the specified pipeline. Use hubspot_pipelines first to get valid pipeline and stage IDs.
hubspot_create_noteCreate a note engagement on a HubSpot contact or deal. Side effect: the note is immediately visible on the contact/deal timeline. Provide at least one of contactId or dealId.
hubspot_log_callLog a completed phone call as an engagement on a HubSpot contact. Side effect: the call record appears on the contact's activity timeline with notes and duration.
hubspot_ownersList all HubSpot owners (team members) with their IDs, names, and email addresses. Use this to get owner IDs needed by hubspot_create_note and hubspot_log_call.
hubspot_pipelinesList all HubSpot deal pipelines with their stages, stage IDs, and display order. Use this to get valid pipeline and stage IDs before creating deals with hubspot_create_deal.
search_console_sitesList all verified Google Search Console properties (websites) for a Google account. Returns site URLs needed by search_console_query and search_console_sitemaps.
search_console_queryQuery Google Search Console performance data including clicks, impressions, CTR, and average position. Use this for SEO analysis, tracking keyword rankings, or identifying top-performing pages.
search_console_sitemapsList all submitted sitemaps for a Google Search Console property, including their status and error counts. Use this to verify sitemap indexing health.
search_console_submit_sitemapSubmit a sitemap URL to Google Search Console for crawling and indexing. Side effect: Google will begin processing the sitemap, which may take hours to days.
analytics_propertiesList all Google Analytics 4 properties accessible by a Google account. Returns property IDs and names needed by analytics_report and analytics_realtime.
analytics_reportRun a Google Analytics 4 report for a date range with configurable metrics and dimensions. Use this for traffic analysis, conversion tracking, or page performance. Returns tabular data rows.
analytics_realtimeGet real-time active user data from Google Analytics 4. Shows currently active users on the site, optionally broken down by country, device, or page. Data reflects the last 30 minutes.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes
Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up
Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n
Next.js has a Middleware / Proxy bypass through dynamic route parameter injection
Next.js Vulnerable to Denial of Service with Server Components
ACCESS_BASE_URLCopy the "For agents USING Access" section into your agent's instruction file and set and ACCESS_TOKEN in your environment.AGENT_ENV_PATHAPOLLO_API_KEYAPP_NAMEAWS_ACCESS_KEY_IDAWS_REGIONAWS_SECRET_ACCESS_KEYCAL_API_KEYCLOUDFLARE_API_TOKENCONSUMER_TOKEN_HASH_SECRETopenssl rand -base64 32 # ->EMAIL_FROMEMAIL_SERVERGITHUB_REPO_URLGITHUB_TOKENGITLAB_BASE_URLGITLAB_TOKENGLOBAL_AGENT_TOKEN"": "your-token-here"GOOGLE_ACCOUNTSGOOGLE_BROKER_CLIENT_IDGOOGLE_BROKER_CLIENT_SECRETGOOGLE_CLIENT_IDGOOGLE_CLIENT_SECRETHUBSPOT_PRIVATE_APP_TOKENJIRA_API_TOKENJIRA_BASE_URLJIRA_EMAILLINEAR_API_KEYNEXTAUTH_SECRETopenssl rand -base64 32 # ->NEXTAUTH_URL4. Set to your production URLNOTION_API_KEYOURA_PERSONAL_ACCESS_TOKENOWNER_EMAILS(comma-separated list of emails allowed to log in)OWNER_LOGIN_PASSWORDPORKBUN_API_KEYPORKBUN_SECRET_KEYRATE_LIMIT_ENABLEDSECRET_ENCRYPTION_KEYopenssl rand -base64 32 # ->SECRET_ENCRYPTION_KEY_PREVIOUS"<old key>"SHARED_INTAKE_TOKENSLACK_BOT_TOKENSTRIPE_SECRET_KEYDATABASE_URLNEXT_PUBLIC_GA_MEASUREMENT_IDSENTRY_AUTH_TOKENSENTRY_ORGTool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
67/67 tools missing one or more hints — google_profile_all (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); google_admin_login_activity (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); google_admin_usage_report (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +64 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tool inputs are validated
55/67 tool handlers declare input schemas (82%)
Declare an inputSchema with zod/joi/yup on every tool definition.
Tool handlers catch errors
Only 0/67 tool handlers wrap calls in try/catch (0%)
Wrap each tool handler body in try/catch and return a structured error response.
Tests exist
No test files found
Add tests that exercise each declared tool.
No arbitrary install scripts
Has postinstall/preinstall script — runs arbitrary code on npm install
Remove postinstall/preinstall hooks unless they’re essential.
Production dependencies are patched
0 critical, 8 high severity in production deps — next@16.2.0 (high), next@16.2.0 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/scottpedia0/access)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check