trb-mcp-server-api
MCP Server exposing Trimble Connect for Browser APIs documentation — for AI-assisted extension development
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
SimonTrim
Source: Glama · also listed on github_repo_search
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
search_trimble_connect_docsSearch across all Trimble Connect for Browser API documentation. Returns matching sections with code examples.
get_api_referenceGet the complete reference documentation for a specific Trimble Connect API category.
get_extension_starterGet a complete starter template for a Trimble Connect extension.
get_viewer_api_guideGet a comprehensive guide for a specific Viewer 3D API topic.
list_available_docsList all available documentation categories and sections in this Trimble Connect MCP server.
tc_api_callExecute any Trimble Connect REST API call. Use the documentation tools first to find the right endpoint, then use this tool to execute it. Supports Core API and BCF API.
tc_get_regionsGet all available Trimble Connect regions and their API base URLs. Call this first to determine which region a project is in.
tc_get_current_userGet the current authenticated user's profile information.
tc_list_projectsList all projects the authenticated user has access to in a given region.
tc_get_projectGet details of a specific project.
tc_create_projectCreate a new project in Trimble Connect.
tc_list_project_usersList all members of a project.
tc_search_filesSearch for files in a project.
tc_get_folder_contentsList the contents (files and subfolders) of a folder.
tc_get_fileGet details of a specific file including versions and download URL.
tc_list_todosList all todos/notes in a project.
tc_create_todoCreate a new todo/note in a project.
tc_update_todoUpdate an existing todo/note.
tc_list_viewsList all 3D views saved in a project.
tc_list_clashsetsList all clash sets in a project.
tc_list_activitiesList recent activities in a project (audit trail).
tc_bcf_list_topicsList BCF topics (issues) in a project.
tc_bcf_dashboard_appShow an interactive MCP App dashboard for Trimble Connect BCF topics. Use this when the user asks for a BCF dashboard, visual BCF summary, filters, charts, or an interactive table of BCF issues.
tc_bcf_create_topicCreate a new BCF topic (issue) in a project.
tc_bcf_create_appShow an interactive MCP App form to create a Trimble Connect BCF topic. Use this when the user wants to create/open/fill a BCF, an issue, or a topic via a form. Optional fields prefill the form. The form can optionally attach the current 3D viewpoint (camera + snapshot) by delegating creation to the…
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
PORTTool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
25/25 tools missing one or more hints — search_trimble_connect_docs (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_api_reference (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_extension_starter (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +22 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tool inputs are validated
22/25 tool handlers declare input schemas (88%)
Declare an inputSchema with zod/joi/yup on every tool definition.
Tool handlers catch errors
Only 1/25 tool handlers wrap calls in try/catch (4%)
Wrap each tool handler body in try/catch and return a structured error response.
License file
No license file
Add a LICENSE file (MIT, Apache-2.0, etc.).
Tests exist
No test files found
Add tests that exercise each declared tool.
Production dependencies are patched
0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.12.1 (high), @modelcontextprotocol/sdk@1.12.1 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/simontrim/trb-mcp-server-api)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check