Access (Scottpedia0/access) is an MCP server listed on the M8ven Trust Index. It scores 50 out of 100, grade D. It declares 67 tools. No publisher has claimed this listing.

D
Caution
50/100

Access

Self-hosted credential store and API proxy for AI agents. One Bearer token, all your services. Handles OAuth refresh, encrypted storage, audit logging, and per-agent permissioning.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

Scottpedia0

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
🚨
Secret credentials may flow to a network call
3 flows detected: APOLLO_API_KEY, OURA_PERSONAL_ACCESS_TOKEN. We can’t prove the destination matches the brand the credential belongs to.
⚠️
Known vulnerabilities in dependencies: 8 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 23 credentials: APOLLO_API_KEY, AWS_SECRET_ACCESS_KEY, CAL_API_KEY, CLOUDFLARE_API_TOKEN, CONSUMER_TOKEN_HASH_SECRET, GITHUB_TOKEN, GITLAB_TOKEN, GLOBAL_AGENT_TOKEN, GOOGLE_BROKER_CLIENT_SECRET, GOOGLE_CLIENT_SECRET, HUBSPOT_PRIVATE_APP_TOKEN, JIRA_API_TOKEN, LINEAR_API_KEY, NEXTAUTH_SECRET, NOTION_API_KEY, OURA_PERSONAL_ACCESS_TOKEN, OWNER_LOGIN_PASSWORD, PORKBUN_API_KEY, PORKBUN_SECRET_KEY, SECRET_ENCRYPTION_KEY, SHARED_INTAKE_TOKEN, SLACK_BOT_TOKEN, STRIPE_SECRET_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes67 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

google_profile_all

List all configured Google accounts with their email addresses, display names, and OAuth scope status. Use this first to discover which account aliases are available and verify they have the scopes needed for other tools.

google_admin_login_activity

Query Google Workspace Admin Reports API for activity events such as logins, admin actions, or OAuth token grants. Use this to audit user login history, detect suspicious access, or review admin changes. Defaults to login events.

google_admin_usage_report

Fetch Google Workspace daily usage statistics (storage, app usage, account activity) for a specific user or all users on a given date. Use this for capacity planning or tracking adoption metrics.

gmail_search

Search Gmail messages using Gmail query syntax. Use this to find emails by sender, subject, label, date, or read status. Returns message IDs, subjects, snippets, and thread IDs for use with gmail_thread.

gmail_thread

Retrieve all messages in a Gmail conversation thread. Use this after gmail_search to read the full email chain including all replies. Returns sender, recipients, subject, body, and timestamps for each message.

gmail_send

Send an email from a configured Google account. Supports new messages and replies. Side effect: delivers the email immediately upon success. Returns the sent message ID.

gmail_trash

Move a single Gmail message to trash. The message can be recovered from trash for 30 days. Use gmail_batch_trash for bulk operations.

gmail_batch_trash

Move multiple Gmail messages to trash in a single call (up to 50). Use after gmail_search to bulk-clean spam or old notifications. Returns a count of successfully trashed vs failed messages.

gmail_modify_labels

Add or remove Gmail labels on a message. Use this to mark messages as read (remove 'UNREAD'), star them (add 'STARRED'), archive (remove 'INBOX'), or apply custom labels. Returns the updated label list.

gmail_draft

Create a Gmail draft without sending it. Use this when a message needs review before sending, or to stage a reply. The draft appears in the user's Drafts folder. Returns the draft ID.

calendar_list_events

List upcoming Google Calendar events for a configured account, ordered by start time. Use this to check schedules, find meeting conflicts, or get today's agenda. Returns event titles, times, attendees, and meeting links.

drive_search

Search Google Drive files using the Drive API query syntax. Use this to find documents, spreadsheets, or any file by name, type, or content. Returns file IDs, names, MIME types, and modification dates.

drive_list

List files and subfolders inside a specific Google Drive folder. Defaults to the root folder. Use drive_search to find a folder ID first, then this tool to browse its contents.

drive_read_doc

Export a Google Drive file (Doc, Sheet, Slide, etc.) to a specified format and return its content. Defaults to plain text export. Use this to read document contents without opening the Google editor.

sheets_read

Read cell values from a Google Sheets spreadsheet using A1 notation. Returns a 2D array of values. Use this to inspect data, headers, or specific ranges before appending.

sheets_append

Append one or more rows to the bottom of a Google Sheets spreadsheet. New rows are added after the last row with data. Side effect: modifies the spreadsheet immediately.

docs_read

Read the full text content of a Google Doc. Returns the document body as plain text. Use this for quick content extraction without formatting.

contacts_search

Search Google Contacts by name, email address, or phone number. Returns matching contacts with their full names, emails, phone numbers, and organizations.

cal_list_bookings

List Cal.com bookings filtered by status. Use this to see scheduled meetings, check past calls, or find cancelled bookings. Returns booking details including attendee info, event type, and timestamps.

cal_get_booking

Retrieve full details of a single Cal.com booking including attendees, notes, responses, and meeting link. Use after cal_list_bookings to get complete info on a specific booking.

cal_cancel_booking

Cancel a Cal.com booking and notify the attendee. Side effect: sends a cancellation email to all participants. This action cannot be undone.

cal_event_types

List all Cal.com event types with their slugs, durations, and scheduling URLs. Use this to see which booking pages are available and their configuration.

porkbun_domains

List all domains registered in the Porkbun account with their expiration dates and auto-renew status. Use this to audit domain ownership or find a specific domain.

porkbun_dns

List all DNS records (A, AAAA, CNAME, MX, TXT, NS) for a domain managed in Porkbun. Use this to audit DNS configuration or find existing records before creating new ones.

porkbun_check_domain

Check domain name availability and registration price on Porkbun. Returns whether the domain is available and the cost to register it.

porkbun_create_dns

Create a new DNS record on a Porkbun-managed domain. Side effect: the record is live immediately after creation. Use porkbun_dns first to check for conflicts.

gtm_accounts

List all Google Tag Manager accounts accessible by the specified Google account. Use this first to get account IDs needed by gtm_containers and gtm_tags.

gtm_containers

List all GTM containers within a specific Tag Manager account. Returns container IDs, names, and website URLs. Use after gtm_accounts to drill down.

gtm_tags

List all tags configured in a GTM container workspace, including their type, firing triggers, and status. Use this to audit tracking pixels, conversion tags, or analytics configuration.

vercel_projects

List all Vercel projects in the account with their names, frameworks, and latest deployment status. Use this to get project IDs needed by vercel_deployments and vercel_env.

vercel_deployments

List recent Vercel deployments with their status, URL, branch, and creation time. Optionally filter by project. Use this to check deployment status or find a deployment ID for vercel_build_logs.

vercel_build_logs

Retrieve build output logs for a specific Vercel deployment. Use this to diagnose build failures or verify successful deployments. Returns timestamped log lines.

vercel_env

List all environment variables configured for a Vercel project, grouped by target environment (production, preview, development). Returns variable names and targets but redacts secret values.

vercel_domains

List all custom domains configured across Vercel projects, including their DNS verification status and associated project. Use this to audit domain assignments or check configuration.

cf_accounts

List all Cloudflare accounts accessible with the configured API token. Use this first to get account IDs needed by cf_tunnels, cf_tunnel_config, and cf_workers.

cf_zones

List all Cloudflare zones (domains) with their IDs, status, and name servers. Use this to get zone IDs needed by cf_dns and cf_create_dns.

cf_dns

List all DNS records for a Cloudflare zone including type, name, content, TTL, and proxy status. Use this to audit DNS configuration or check for existing records before creating new ones.

cf_create_dns

Create a new DNS record in a Cloudflare zone. Side effect: the record goes live immediately and can affect traffic routing. Use cf_dns first to check for conflicts.

cf_tunnels

List all Cloudflare Tunnels in an account with their IDs, names, and connection status. Use this to find tunnel IDs for cf_tunnel_config.

cf_tunnel_config

Retrieve the ingress routing configuration for a specific Cloudflare Tunnel, showing which hostnames map to which local services. Use this to debug tunnel routing or verify configuration.

cf_workers

List all Cloudflare Workers scripts deployed in an account, including their names and last-modified timestamps. Use this to audit deployed serverless functions.

slack_list_channels

List all Slack channels (public and private) in the workspace with their IDs, names, topics, and member counts. Use this to find channel IDs needed by slack_channel_history and slack_send.

slack_channel_history

Read recent messages from a Slack channel in reverse chronological order. Returns message text, author, timestamp, and thread metadata. Use slack_thread to read replies.

slack_thread

Read all replies in a Slack thread including the parent message. Use this after slack_channel_history when a message has thread replies you need to read.

slack_list_dms

List all direct message and group DM conversations visible to the bot. Returns channel IDs and participant info. Use this to find DM channel IDs for slack_dm_history.

slack_dm_history

Read recent messages from a Slack direct message or group DM conversation. Returns message text, author, and timestamps in reverse chronological order.

slack_search

Search Slack messages across all channels and DMs using Slack search syntax. Use this to find specific conversations, mentions, or topics. Returns matching messages with channel context and timestamps.

slack_send

Send a Slack message to a channel, DM, or thread. Side effect: delivers the message immediately and it is visible to all channel members. Supports Slack mrkdwn formatting.

slack_users

List all members of the Slack workspace with their user IDs, display names, emails, and online status. Use this to look up user IDs or find team members.

slack_find_user

Look up a Slack user by their email address. Returns user ID, display name, and profile info. Use this when you have an email but need the Slack user ID for sending messages.

hubspot_search_contacts

Search HubSpot CRM contacts by name, email, or company. Returns contact IDs, names, emails, and company associations. Use this to find contacts before viewing full details with hubspot_get_contact.

hubspot_get_contact

Retrieve all properties and associations for a single HubSpot contact. Returns full profile data including custom properties, lifecycle stage, and associated deals/companies.

hubspot_create_contact

Create a new contact in HubSpot CRM. Side effect: the contact is immediately created and may trigger workflows. Email is required; all other fields are optional.

hubspot_update_contact

Update one or more properties on an existing HubSpot contact. Side effect: changes are saved immediately and may trigger workflows. Only provided properties are changed; others are left untouched.

hubspot_search_deals

Search HubSpot CRM deals by name, stage, or pipeline. Returns deal IDs, names, amounts, stages, and close dates. Use this to find deals before creating notes or logging calls.

hubspot_create_deal

Create a new deal in HubSpot CRM. Side effect: the deal is immediately created in the specified pipeline. Use hubspot_pipelines first to get valid pipeline and stage IDs.

hubspot_create_note

Create a note engagement on a HubSpot contact or deal. Side effect: the note is immediately visible on the contact/deal timeline. Provide at least one of contactId or dealId.

hubspot_log_call

Log a completed phone call as an engagement on a HubSpot contact. Side effect: the call record appears on the contact's activity timeline with notes and duration.

hubspot_owners

List all HubSpot owners (team members) with their IDs, names, and email addresses. Use this to get owner IDs needed by hubspot_create_note and hubspot_log_call.

hubspot_pipelines

List all HubSpot deal pipelines with their stages, stage IDs, and display order. Use this to get valid pipeline and stage IDs before creating deals with hubspot_create_deal.

search_console_sites

List all verified Google Search Console properties (websites) for a Google account. Returns site URLs needed by search_console_query and search_console_sitemaps.

search_console_query

Query Google Search Console performance data including clicks, impressions, CTR, and average position. Use this for SEO analysis, tracking keyword rankings, or identifying top-performing pages.

search_console_sitemaps

List all submitted sitemaps for a Google Search Console property, including their status and error counts. Use this to verify sitemap indexing health.

search_console_submit_sitemap

Submit a sitemap URL to Google Search Console for crawling and indexing. Side effect: Google will begin processing the sitemap, which may take hours to days.

analytics_properties

List all Google Analytics 4 properties accessible by a Google account. Returns property IDs and names needed by analytics_report and analytics_realtime.

analytics_report

Run a Google Analytics 4 report for a date range with configurable metrics and dimensions. Use this for traffic analysis, conversion tracking, or page performance. Returns tabular data rows.

analytics_realtime

Get real-time active user data from Google Analytics 4. Shows currently active users on the site, optionally broken down by country, device, or page. Data reflects the last 30 minutes.

// known CVEs in dependencies8 high8 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

highnext@16.2.0GHSA-267c-6grr-h53f

Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes

highnext@16.2.0GHSA-26hh-7cqf-hhc6

Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up

highnext@16.2.0GHSA-36qx-fr4f-26g5

Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n

highnext@16.2.0GHSA-492v-c6pp-mqqv

Next.js has a Middleware / Proxy bypass through dynamic route parameter injection

highnext@16.2.0GHSA-8h8q-6873-q5fj

Next.js Vulnerable to Denial of Service with Server Components

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configACCESS_BASE_URLCopy the "For agents USING Access" section into your agent's instruction file and set and ACCESS_TOKEN in your environment.
configAGENT_ENV_PATH
🔐 secretAPOLLO_API_KEY
configAPP_NAME
configAWS_ACCESS_KEY_ID
configAWS_REGION
🔐 secretAWS_SECRET_ACCESS_KEY
🔐 secretCAL_API_KEY
🔐 secretCLOUDFLARE_API_TOKEN
🔐 secretCONSUMER_TOKEN_HASH_SECRETopenssl rand -base64 32 # ->
configEMAIL_FROM
configEMAIL_SERVER
configGITHUB_REPO_URL
🔐 secretGITHUB_TOKEN
configGITLAB_BASE_URL
🔐 secretGITLAB_TOKEN
🔐 secretGLOBAL_AGENT_TOKEN"": "your-token-here"
configGOOGLE_ACCOUNTS
configGOOGLE_BROKER_CLIENT_ID
🔐 secretGOOGLE_BROKER_CLIENT_SECRET
configGOOGLE_CLIENT_ID
🔐 secretGOOGLE_CLIENT_SECRET
🔐 secretHUBSPOT_PRIVATE_APP_TOKEN
🔐 secretJIRA_API_TOKEN
configJIRA_BASE_URL
configJIRA_EMAIL
🔐 secretLINEAR_API_KEY
🔐 secretNEXTAUTH_SECRETopenssl rand -base64 32 # ->
configNEXTAUTH_URL4. Set to your production URL
🔐 secretNOTION_API_KEY
🔐 secretOURA_PERSONAL_ACCESS_TOKEN
configOWNER_EMAILS(comma-separated list of emails allowed to log in)
🔐 secretOWNER_LOGIN_PASSWORD
🔐 secretPORKBUN_API_KEY
🔐 secretPORKBUN_SECRET_KEY
configRATE_LIMIT_ENABLED
🔐 secretSECRET_ENCRYPTION_KEYopenssl rand -base64 32 # ->
configSECRET_ENCRYPTION_KEY_PREVIOUS"<old key>"
🔐 secretSHARED_INTAKE_TOKEN
🔐 secretSLACK_BOT_TOKEN
🔐 secretSTRIPE_SECRET_KEY
Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.
deployDATABASE_URL
deployNEXT_PUBLIC_GA_MEASUREMENT_ID
deploySENTRY_AUTH_TOKEN
deploySENTRY_ORG
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

67/67 tools missing one or more hints — google_profile_all (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); google_admin_login_activity (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); google_admin_usage_report (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +64 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool inputs are validated

55/67 tool handlers declare input schemas (82%)

Declare an inputSchema with zod/joi/yup on every tool definition.

Tool handlers catch errors

Only 0/67 tool handlers wrap calls in try/catch (0%)

Wrap each tool handler body in try/catch and return a structured error response.

Tests exist

No test files found

Add tests that exercise each declared tool.

No arbitrary install scripts

Has postinstall/preinstall script — runs arbitrary code on npm install

Remove postinstall/preinstall hooks unless they’re essential.

Production dependencies are patched

0 critical, 8 high severity in production deps — next@16.2.0 (high), next@16.2.0 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/scottpedia0/access?variant=verified)](https://m8ven.ai/mcp/scottpedia0/access)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 98633f430f5066156471dee5b259dece3e11534b
code hash: 86a1cf8b6b214e160fba4af307540729cc985125820714c8623096a2c97e4451
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client