/ 100

1 month ago

glama

yandex-marketing-mcp

Item: yandex-marketing-mcp
Rating: 64
Author: M8ven

MCP server for managing Yandex Direct advertising, Yandex Metrica analytics, Wordstat keyword research, and Yandex Webmaster SEO tools, with self-configuring OAuth; provides 153 tools for complete ad and search workflows from AI assistants.

→ skiddgoddamn/yandex-marketing-mcp · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

⚠️

Known vulnerabilities in dependencies: 3 high

Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 1 credential: YD_OAUTH_TOKEN

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// known CVEs in dependencies3 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.12.0GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.12.0GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.12.0GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

Depend on this server? Get alerted when its CVEs change.Watch this server free →

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configYANDEX_MCP_CONFIG_DIR

configYANDEX_OAUTH_CLIENT_ID— Client ID OAuth-приложения (seed; сохраняется через yd_set_client_id)

configYC_FOLDER_ID— ID каталога Yandex Cloud для Wordstat (seed; сохраняется через yd_set_token)

configYD_ALLOWED_LOGINS— Белый список логинов клиентов через запятую (только для инструментов Директа)

configYD_API_URL

configYD_CONFIRM— true — изменяющие вызовы сначала возвращают превью; для выполнения нужен confirm=true

configYD_LOGIN— Логин клиента по умолчанию (для агентских аккаунтов)

configYD_LOG_BODIES— true — писать тела запросов и ответов в лог

configYD_LOG_FILE— Путь к лог-файлу (пусто — только stderr, файл не создаётся)

configYD_LOG_LEVEL— DEBUG / INFO / WARNING / ERROR (по умолчанию INFO)

🔐 secretYD_OAUTH_TOKEN— OAuth access_token (seed; сохраняется через yd_set_token)

configYD_READONLY— true — блокирует все изменяющие инструменты; только чтение и отчёты

configYD_SANDBOX— true — тестовый режим Директа (sandbox)

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 1 concrete improvement we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/skiddgoddamn-yandex-marketing-mcp-1aeuwf)](https://m8ven.ai/mcp/skiddgoddamn-yandex-marketing-mcp-1aeuwf)

commit: 7f580514d9248d3eff5d5a27820b42f5f31f35a6

code hash: 01ac670f631c5c6e72f7d78f16e2ea83220c82d49f024c9eed0669199dc9a61f

verified: 6/19/2026, 10:47:56 AM

view raw JSON →