/ 100

1 month ago

glama

SidClaw GovernanceMCPServer

Item: SidClaw GovernanceMCPServer
Rating: 47
Author: M8ven

Governance proxy for MCP servers. Wraps any MCP server with policy evaluation, human approval workflows, and hash-chain audit trails. Supports stdio and Streamable HTTP transports.

→ sidclawhq/platform · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 10 credentials: EMAIL_API_KEY, GITHUB_APP_PRIVATE_KEY, GITHUB_APP_WEBHOOK_SECRET, GITHUB_CLIENT_SECRET, GOOGLE_CLIENT_SECRET, OIDC_CLIENT_SECRET, SESSION_SECRET, STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET, SUPER_ADMIN_KEY

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// known CVEs in dependencies1 medium1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

mediumturbo@2GHSA-hcf7-66rw-9f5r

Trubo: Login callback CSRF/session fixation

lowturbo@2GHSA-3qcw-2rhx-2726

Turbo: Unexpected local code execution during Yarn Berry detection

Depend on this server? Get alerted when its CVEs change.Watch this server free →

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configALLOWED_ORIGINS

configAPI_BASE_URL

configAPI_PUBLIC_URL

configCOOKIE_DOMAIN

configDASHBOARD_URL

configDATABASE_URL

🔐 secretEMAIL_API_KEY

configEMAIL_FROM

configGITHUB_APP_ID

🔐 secretGITHUB_APP_PRIVATE_KEY

🔐 secretGITHUB_APP_WEBHOOK_SECRET

configGITHUB_CLIENT_ID

🔐 secretGITHUB_CLIENT_SECRET

configGITHUB_REDIRECT_URI

configGOOGLE_CLIENT_ID

🔐 secretGOOGLE_CLIENT_SECRET

configGOOGLE_REDIRECT_URI

configHOST

configNEXT_PUBLIC_API_URL— Vercel can only host the dashboard (Next.js). The API is Fastify — deploy it to Railway, Fly, Render, or run via Docker. Set on the dashboard project to point at it.

configOIDC_CLIENT_ID

🔐 secretOIDC_CLIENT_SECRET

configOIDC_ISSUER

configOIDC_REDIRECT_URI

configPORT

configPUBLIC_API_URL

configRATE_LIMIT_ENABLED

configSECURE_COOKIES

🔐 secretSESSION_SECRET

configSESSION_TTL_SECONDS

configSTRIPE_BUSINESS_PRICE_ID

🔐 secretSTRIPE_SECRET_KEY

configSTRIPE_STARTER_PRICE_ID

🔐 secretSTRIPE_WEBHOOK_SECRET

🔐 secretSUPER_ADMIN_KEY

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 1 concrete improvement we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/sidclawhq-platform-12wuqc)](https://m8ven.ai/mcp/sidclawhq-platform-12wuqc)

commit: 3a794232a10fee826061b52959655f1d7b7d146a

code hash: 6859350858abf37aacc964061057aec5c7852ab35e557e198e339960e2537c14

verified: 6/11/2026, 11:38:06 AM

view raw JSON →