/ 100

23 days ago

glama

mcp-cowork

Item: mcp-cowork
Rating: 56
Author: M8ven

A remote MCP server with OAuth and passphrase protection, providing a wide range of integrations including GitHub, Microsoft 365, Google, OVH, Steam, WhatsApp, and more for use with Claude Desktop or Claude.ai.

→ simonsavoca/mcp-cowork · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

🚨

Secret credentials may flow to a network call

7 flows detected: GITHUB_PERSO_TOKEN, GOOGLE_CLIENT_SECRET, M365_CLIENT_SECRET. We can’t prove the destination matches the brand the credential belongs to.

⚠️

Known vulnerabilities in dependencies: 2 high

Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.

🔐

You'll be asked for 17 credentials: EDUCONNECT_PASSWORD, GITHUB_PERSO_TOKEN, GOOGLE_CLIENT_SECRET, GOOGLE_REFRESH_TOKEN, M365_CLIENT_SECRET, NTFY_PASSWORD, NTFY_TOKEN, O2SWITCH_API_TOKEN, O2SWITCH_PASSWORD, OVH_MAIN_APP_KEY, OVH_MAIN_APP_SECRET, OVH_MAIN_CONSUMER_KEY, PRIM_API_KEY, PUSHOVER_APP_TOKEN, PUSHOVER_USER_KEY, STEAM_API_KEY, SYNOLOGY_NAS_PASSWORD

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// known CVEs in dependencies2 high1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.0.0GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.0.0GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

lowexpress@4.19.2GHSA-qw6h-vgh9-j6wx

express vulnerable to XSS via response.redirect()

Depend on this server? Get alerted when its CVEs change.Watch this server free →

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configEDUCONNECT_LOGIN— NEO_ENT_URL, , EDUCONNECT_PASSWORD, PRONOTE_QR_PIN ENT scolaire NEO + Pronote (EduConnect partagé) non

🔐 secretEDUCONNECT_PASSWORD— NEO_ENT_URL, EDUCONNECT_LOGIN, , PRONOTE_QR_PIN ENT scolaire NEO + Pronote (EduConnect partagé) non

configGITHUB_DEFAULT_OWNER— , GITHUB_PERSO_TOKEN GitHub non

🔐 secretGITHUB_PERSO_TOKEN— GITHUB_DEFAULT_OWNER, GitHub non

configGOOGLE_CLIENT_ID— , GOOGLE_CLIENT_SECRET, GOOGLE_REFRESH_TOKEN OAuth2 Google (Gmail, Calendar, Contacts) non

🔐 secretGOOGLE_CLIENT_SECRET— GOOGLE_CLIENT_ID, , GOOGLE_REFRESH_TOKEN OAuth2 Google (Gmail, Calendar, Contacts) non

🔐 secretGOOGLE_REFRESH_TOKEN— GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, OAuth2 Google (Gmail, Calendar, Contacts) non

configM365_CLIENT_ID— M365_TENANT_ID, , M365_CLIENT_SECRET Microsoft Graph (flux client-credentials) non

🔐 secretM365_CLIENT_SECRET— M365_TENANT_ID, M365_CLIENT_ID, Microsoft Graph (flux client-credentials) non

configM365_TENANT_ID— , M365_CLIENT_ID, M365_CLIENT_SECRET Microsoft Graph (flux client-credentials) non

configMCP_GATE_PASSPHRASE— Passphrase de la vraie couche de contrôle d'accès devant /authorize oui

configMCP_HTTP_PORT— Port d'écoute local (défaut 3100) non

configMCP_PUBLIC_URL— URL publique HTTPS (issuer OAuth) — doit correspondre à l'URL du tunnel actif oui

configNEO_ENT_URL— , EDUCONNECT_LOGIN, EDUCONNECT_PASSWORD, PRONOTE_QR_PIN ENT scolaire NEO + Pronote (EduConnect partagé) non

🔐 secretNTFY_PASSWORD— NTFY_SERVER, NTFY_TOPIC, NTFY_TOKEN, NTFY_USERNAME, Notifications ntfy (ntfy.sh ou auto-hébergé ; NTFY_TOKEN ou NTFY_USERNAME/NTFY_PASSWORD uniquement pour un topic protégé) non

configNTFY_SERVER— , NTFY_TOPIC, NTFY_TOKEN, NTFY_USERNAME, NTFY_PASSWORD Notifications ntfy (ntfy.sh ou auto-hébergé ; NTFY_TOKEN ou NTFY_USERNAME/NTFY_PASSWORD uniquement pour un topic protégé) non

🔐 secretNTFY_TOKEN— NTFY_SERVER, NTFY_TOPIC, , NTFY_USERNAME, NTFY_PASSWORD Notifications ntfy (ntfy.sh ou auto-hébergé ; NTFY_TOKEN ou NTFY_USERNAME/NTFY_PASSWORD uniquement pour un topic protégé) non

configNTFY_TOPIC— NTFY_SERVER, , NTFY_TOKEN, NTFY_USERNAME, NTFY_PASSWORD Notifications ntfy (ntfy.sh ou auto-hébergé ; NTFY_TOKEN ou NTFY_USERNAME/NTFY_PASSWORD uniquement pour un topic protégé) non

configNTFY_USERNAME— NTFY_SERVER, NTFY_TOPIC, NTFY_TOKEN, , NTFY_PASSWORD Notifications ntfy (ntfy.sh ou auto-hébergé ; NTFY_TOKEN ou NTFY_USERNAME/NTFY_PASSWORD uniquement pour un topic protégé) non

🔐 secretO2SWITCH_API_TOKEN— O2SWITCH_HOST, O2SWITCH_API_USER, , O2SWITCH_PASSWORD cPanel o2switch non

configO2SWITCH_API_USER— O2SWITCH_HOST, , O2SWITCH_API_TOKEN, O2SWITCH_PASSWORD cPanel o2switch non

configO2SWITCH_HOST— , O2SWITCH_API_USER, O2SWITCH_API_TOKEN, O2SWITCH_PASSWORD cPanel o2switch non

🔐 secretO2SWITCH_PASSWORD— O2SWITCH_HOST, O2SWITCH_API_USER, O2SWITCH_API_TOKEN, cPanel o2switch non

🔐 secretOVH_MAIN_APP_KEY— , OVH_MAIN_APP_SECRET, OVH_MAIN_CONSUMER_KEY API OVH non

🔐 secretOVH_MAIN_APP_SECRET— OVH_MAIN_APP_KEY, , OVH_MAIN_CONSUMER_KEY API OVH non

🔐 secretOVH_MAIN_CONSUMER_KEY— OVH_MAIN_APP_KEY, OVH_MAIN_APP_SECRET, API OVH non

🔐 secretPRIM_API_KEY— API PRIM/IDFM transport non

configPRONOTE_QR_PIN— NEO_ENT_URL, EDUCONNECT_LOGIN, EDUCONNECT_PASSWORD, ENT scolaire NEO + Pronote (EduConnect partagé) non

🔐 secretPUSHOVER_APP_TOKEN— , PUSHOVER_USER_KEY Notifications push Pushover.net non

🔐 secretPUSHOVER_USER_KEY— PUSHOVER_APP_TOKEN, Notifications push Pushover.net non

configPYTHON_CMD— Commande Python pour les tools Pronote (nécessite pronotepy) non (défaut python)

🔐 secretSTEAM_API_KEY— , STEAM_ID Steam Web API non

configSTEAM_ID— STEAM_API_KEY, Steam Web API non

configSYNOLOGY_NAS_HOST— , SYNOLOGY_NAS_PORT, SYNOLOGY_NAS_USER, SYNOLOGY_NAS_PASSWORD NAS Synology DSM non

🔐 secretSYNOLOGY_NAS_PASSWORD— SYNOLOGY_NAS_HOST, SYNOLOGY_NAS_PORT, SYNOLOGY_NAS_USER, NAS Synology DSM non

configSYNOLOGY_NAS_PORT— SYNOLOGY_NAS_HOST, , SYNOLOGY_NAS_USER, SYNOLOGY_NAS_PASSWORD NAS Synology DSM non

configSYNOLOGY_NAS_USER— SYNOLOGY_NAS_HOST, SYNOLOGY_NAS_PORT, , SYNOLOGY_NAS_PASSWORD NAS Synology DSM non

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 9 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/simonsavoca-mcp-cowork-59rxfa)](https://m8ven.ai/mcp/simonsavoca-mcp-cowork-59rxfa)

commit: 5a77f8afe299dcd4f69510f0f5854cbd21fd81d1

code hash: 946017229c7872cce72caaf9e8c58b1137e1c5b9a1c144c2ad1f98425863f00f

verified: 7/8/2026, 8:40:28 AM

view raw JSON →