mitra-seruni (serunimumbul2010-mitra/mitra-seruni) is an MCP server listed on the M8ven Trust Index. It scores 52 out of 100, grade D. It declares 60 tools. No publisher has claimed this listing.

Caution

52/100

mitra-seruni

Item: mitra-seruni
Rating: 52
Author: M8ven

Management Informasi dan Transaksi Data Desa

→ serunimumbul2010-mitra/mitra-seruni · listed on github_code

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every push why connect →

Who stands behind it

serunimumbul2010-mitra

Source: github_code

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

GitHub

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings

🚨

Secret credentials may flow to a network call

1 flow detected: FONNTE_TOKEN. We can’t prove the destination matches the brand the credential belongs to.

⚠️

Known vulnerabilities in dependencies: 4 high

Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.

🔐

You'll be asked for 4 credentials: ENCRYPTION_KEY, FONNTE_TOKEN, JWT_SECRET, WORKER_SECRET

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// tools this server exposes60 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

document_generate

Generasi PDF dari template + data (Internal Worker)

document_get_url

Dapatkan URL download dokumen

auth_forgot_password

Ganti password user jika lupa

auth_login

auth_refresh

Refresh access token menggunakan refresh token

auth_register

Daftarkan akun baru menggunakan NIK

news_list

Ambil daftar berita/kabar desa

news_get

Ambil detail berita berdasarkan slug

gallery_list

Ambil daftar galeri desa

finance_summary

Ambil ringkasan APBDes per tahun

apparatus_list

Ambil daftar perangkat desa

cms_laporan_submit

Kirim laporan atau keluhan warga dari landing page

cms_laporan_list

Dapatkan daftar laporan warga

get_tenant_by_domain

Ambil tenant ID berdasarkan domain

get_profil_desa

Ambil profil desa

update_profil_desa

Update profil desa

penduduk_get_by_nik

Mencari data penduduk berdasarkan NIK

penduduk_register

Mendaftarkan warga baru ke sistem desa

core_health_check

Cek status kesehatan sistem dan sumber daya (CPU, RAM, Uptime)

db_wilayah_list

Ambil daftar wilayah (Dusun, RW, RT) milik tenant

db_pekerjaan_list

Ambil daftar referensi pekerjaan

db_apbdes_recap

Ambil rekapitulasi APBDes (Anggaran vs Realisasi)

penduduk_create

Tambah data penduduk baru

penduduk_delete

Soft delete penduduk (tidak bisa dihapus jika ada surat aktif)

penduduk_export_csv

Download seluruh data penduduk aktif dalam format CSV

penduduk_get

Ambil detail 1 penduduk by ID

penduduk_import_bulk

Import data penduduk massal dengan Smart Fuzzy Normalisasi.

penduduk_list

Ambil daftar penduduk dengan pagination dan search

penduduk_public_check

Cek ketersediaan NIK di database warga dan ambil profil dasar untuk autofill

penduduk_stats

Ambil statistik ringkasan penduduk desa

penduduk_truncate

Hapus SELURUH data penduduk secara permanen (Hard Delete). Membutuhkan konfirmasi ekstrem.

penduduk_update

Update data penduduk (NIK tidak dapat diubah unless explicitly supplied)

surat_approve

Menyetujui surat yang sudah diverifikasi (SELESAI)

surat_delete

Hapus data draft surat

surat_draft_create

Buat draf surat baru

surat_export_csv

Export tabel data surat (berdasarkan status) ke format CSV

surat_get

Dapatkan detail surat berdasarkan ID

surat_import_bulk

Import data surat massal dari CSV JSON array

surat_list

Melihat daftar pengajuan surat

surat_public_verify

Verifikasi publik untuk keabsahan surat digital

surat_submit

Ajukan surat yang telah dibuat (DRAFT -> VERIFIKASI)

surat_template_list

Ambil semua template surat aktif milik tenant

surat_template_create

Buat jenis surat (template) baru

surat_template_update

Update data jenis surat (template)

surat_template_delete

Hapus atau nonaktifkan jenis surat (template)

surat_template_export_csv

Export seluruh daftar jenis surat ke format CSV

surat_template_import_bulk

Import massal jenis surat dari daftar record

surat_update

Ubah data detail / catatan surat

surat_verify

Melakukan verifikasi surat (pilih Approve atau Reject)

infra_audit_list

Daftar log aktivitas sistem (Audit Log)

market_status

Cek status operasional pasar desa

notification_send

Kirim notifikasi WhatsApp ke satu nomor via Fonnte (ADMIN/SUPER_ADMIN only)

notification_send_bulk

Kirim notifikasi ke banyak nomor sekaligus (ADMIN/SUPER_ADMIN only)

notification_status

Cek status pengiriman notifikasi untuk submission tertentu

pipeline_status

Cek status antrean data pipeline

queue_check_status

Cek status ketersediaan Redis/Queue server

admin_user_create

Buat akun admin/operator baru (SUPER_ADMIN only)

admin_user_deactivate

Nonaktifkan akun user (SUPER_ADMIN only)

admin_user_list

Daftar semua user dalam tenant (SUPER_ADMIN only)

admin_user_update_role

Update role user (SUPER_ADMIN only)

// known CVEs in dependencies4 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.0.0GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

highdrizzle-orm@0.30.0GHSA-gpj5-g38j-94v9

Drizzle ORM has SQL injection via improperly escaped SQL identifiers

highxlsx@0.18.5GHSA-4r6h-8v6p-xvw6

Prototype Pollution in sheetJS

highxlsx@0.18.5GHSA-5pgg-2g8v-p4x9

SheetJS Regular Expression Denial of Service (ReDoS)

Depend on this server? Get alerted when its CVEs change.Watch this server free →

// environment variables

To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.

configCORS_ORIGINS

🔐 secretENCRYPTION_KEY

🔐 secretFONNTE_TOKEN

configFRONTEND_URL

configJSON_BODY_LIMIT

configJWT_ACCESS_EXPIRES

configJWT_REFRESH_EXPIRES

🔐 secretJWT_SECRET

configSTORAGE_PATH

🔐 secretWORKER_SECRET

Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.

deployDATABASE_URL

deployPORT

deployREDIS_URL

// quality suggestions

Dependencies

21 runtime dependencies (9 dev), 1 flagged: puppeteer

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

60/60 tools missing one or more hints — document_generate (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); document_get_url (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); auth_forgot_password (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +57 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

README present

No README found

Add a README.md describing the server and its tools.

License file

No license file

Add a LICENSE file (MIT, Apache-2.0, etc.).

Tests exist

No test files found

Add tests that exercise each declared tool.

Production dependencies are patched

0 critical, 4 high severity in production deps — @modelcontextprotocol/sdk@1.0.0 (high), drizzle-orm@0.30.0 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Domain consistency

npm scope @mitradesa doesn't match GitHub owner serunimumbul2010-mitra

Use the same org name across GitHub, npm, and your homepage so users can verify the publisher.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail

The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.

// improvement guidance — verified publishers only

We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Verified](https://m8ven.ai/badge/mcp/serunimumbul2010-mitra/mitra-seruni?variant=verified)](https://m8ven.ai/mcp/serunimumbul2010-mitra/mitra-seruni)

Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.

commit: 1e248d45c8461c06d8ee16bda2954894444a98d2

code hash: dd9fb824fe7a2a820f2c3e3820506d7ea0ba8f1a9eb6dc76852627100bd20d06

view raw JSON →

Check MCPs from inside your assistant

Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check

check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern

How to add it →Free · no account needed · works in any MCP client