aden-hive (SinShine5/aden-hive) is an MCP server listed on the M8ven Trust Index. It scores 74 out of 100, grade C. It declares 45 tools. No publisher has claimed this listing.

Caution

74/100

aden-hive

Item: aden-hive
Rating: 74
Author: M8ven

→ SinShine5/aden-hive · listed on github_code

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every push why connect →

Who stands behind it

SinShine5

Source: github_code

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

GitHub

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings

🚨

Secret credentials may flow to a network call

1 flow detected: BRAVE_SEARCH_API_KEY. We can’t prove the destination matches the brand the credential belongs to.

🔐

You'll be asked for 3 credentials: BRAVE_SEARCH_API_KEY, ANTHROPIC_API_KEY, CEREBRAS_API_KEY

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// tools this server exposes45 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

create_session

Create a new agent building session. Call this first before building an agent.

list_sessions

List all saved agent building sessions.

load_session_by_id

Load a previously saved agent building session by its ID.

delete_session

Delete a saved agent building session.

set_goal

Define the goal for the agent. Goals are the source of truth - they define what success looks like.

add_node

Add a node to the agent graph. Nodes are units of work that process inputs and produce outputs.

add_edge

Connect two nodes with an edge. Edges define how execution flows between nodes.

update_node

Update an existing node in the agent graph. Only provided fields will be updated.

delete_node

Delete a node from the agent graph. Also removes all edges connected to this node.

delete_edge

Delete an edge from the agent graph.

validate_graph

Validate the complete graph. Checks for unreachable nodes, missing connections, and context flow.

export_graph

Export the validated graph as a GraphSpec for GraphExecutor.

get_session_status

Get the current status of the build session.

add_mcp_server

list_mcp_servers

List all registered MCP servers for this agent.

list_mcp_tools

List tools available from registered MCP servers.

remove_mcp_server

Remove a registered MCP server.

test_node

Test a single node with sample inputs. Use this during HITL approval to show humans what the node actually does before they approve it.

test_graph

Test the complete agent graph with sample inputs. Use this during final approval to show humans the full execution flow before they approve the agent.

add_evaluation_rule

Add an evaluation rule for the HybridJudge.

list_evaluation_rules

List all configured evaluation rules for the HybridJudge.

remove_evaluation_rule

Remove an evaluation rule.

create_plan

Create a plan for flexible execution.

validate_plan

Validate a plan structure before execution.

simulate_plan_execution

Simulate plan execution without actually running it.

generate_constraint_tests

Get constraint test guidelines for a goal.

generate_success_tests

Get success criteria test guidelines for a goal.

run_tests

Run pytest on agent test files.

debug_test

Run a specific test with verbose output for debugging.

list_tests

List tests for an agent by scanning Python test files.

load_exported_plan

Validate and load an exported plan, returning its structure.

gtm_fetch_lead

Fetch lead from GTM table

dynamic_tool_100

dynamic_tool_340

pdf_read

Read and extract text content from a PDF file.

web_scrape

Scrape and extract text content from a webpage.

web_search

Search the web for information using Brave Search API.

apply_diff

Purpose Apply a structured diff to update a file while preserving context.

apply_patch

Purpose Apply a scoped, line-level modification to an existing file.

execute_command_tool

Purpose Execute a shell command within the session sandbox.

grep_search

Search for a pattern in a file or directory within the session sandbox.

list_dir

Purpose List the contents of a directory within the session sandbox.

replace_file_content

Purpose Replace all occurrences of a target string with replacement text in a file.

view_file

Purpose Read the content of a file within the session sandbox.

write_to_file

Purpose Create a new file or append content to an existing file.

// known CVEs in dependencies1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

lowyaml@2.8.2GHSA-48c2-rrv3-qjmp

yaml is vulnerable to Stack Overflow via deeply nested YAML collections

Depend on this server? Get alerted when its CVEs change.Watch this server free →

// environment variables

To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.

configMCP_PORT

🔐 secretBRAVE_SEARCH_API_KEY

🔐 secretANTHROPIC_API_KEY

🔐 secretCEREBRAS_API_KEY

configEDITOR

configMOCK_MODE

// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

45/45 tools missing one or more hints — create_session (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); list_sessions (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); load_session_by_id (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +42 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Destructive tools are labelled

1 tool perform destructive updates without destructiveHint — delete_session deletes at line 278 (session_file.unlink())

Add destructiveHint:true to any tool whose handler calls .delete(), .upsert(), .update(), unlink, rm, DELETE, DROP, REPLACE INTO, or any operation that overwrites existing data.

Tool test coverage

17/45 tools referenced in tests (38%)

Write tests that reference each tool by name so every tool has at least one test.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail

The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.

// improvement guidance — verified publishers only

We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Verified](https://m8ven.ai/badge/mcp/sinshine5/aden-hive?variant=verified)](https://m8ven.ai/mcp/sinshine5/aden-hive)

Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.

commit: ab8fb3f8c9657cc889e0ffaaf57b923549a4b8b1

code hash: 29c609b0712aebe6a1e5362d215b1437ef9bdef64d66f5c3e4709a33097331a2

view raw JSON →

Check MCPs from inside your assistant

Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check

check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern

How to add it →Free · no account needed · works in any MCP client