embedded-mcp-toolkit (smk-h/embedded-mcp-toolkit) is an MCP server listed on the M8ven Trust Index. It scores 74 out of 100, grade C. No publisher has claimed this listing.

Back to MCP Trust IndexM8ven
C
Caution
74/100

embedded-mcp-toolkit

基于MCP协议的嵌入式板卡远程管理工具，提供串口、SSH和本地PowerShell的交互能力，支持会话管理、一键登录等功能。

→ smk-h/embedded-mcp-toolkit· listed on glama

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

smk-h

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

Glamanot scored here

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Known vulnerabilities in dependencies: 1 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 1 credential: BOARD_PASSWORD
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies1 high1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

highjs-yaml@4.3.1GHSA-2883-xcg3-v3hh

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

lowadm-zip@0.6.0GHSA-vwc7-r8mq-g2x9

adm-zip extraction follows destination symlinks, allowing arbitrary file overwrite

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configBOARD_CONFIG_PATH：主配置文件 config.yaml 的路径，相对于 MCP server 进程的工作目录（即启动 Claude 时的 cwd）。注意：devices/ 目录的查找位置始终是 config.yaml 的同级目录，因此 BOARD_CONFIG_PATH 同时决定了 config.yaml 和 devices/ 的位置
configBOARD_HOST
🔐 secretBOARD_PASSWORD
configBOARD_PORT
configBOARD_USERNAME
configCHALLENGE_FILE
configDEVICE这个是MCP的配置文件。env 字段中定义的环境变量会在 Claude 启动 MCP server 时，注入到 MCP server 子进程 的 process.env 中。也就是说，这些变量只在 [src/mcp.ts](src/mcp.ts:102-107) 进程中通过 process.env. 等方式读取，不会 影响 Claude 自身的 shell 环境变量。
configEMBEDDED_DATA_DIR环境变量可整体覆盖数据目录根（非标准部署时的逃生口，默认 cwd/.embedded）。传输相关的三条链路都收敛到同一落点后，典型流转是：Linux 端 scp 推到 .embedded/tmp/ → 经 serial_upload / ssh_sftp_upload 上载到设备；或反向下载后从该目录 scp 拉走。
configKEY_FILE
configKEY_PROVIDER
configLOGNAME
configLOG_DIRPowerShell 执行 ipconfig / 用 ps 运行 xxx
configLOG_SAVE：是否开启业务日志写入文件（"1" 表示开启），记录工具调用信息（工具名称、调用参数、会话生命周期等）。需配合 LOG_DIR 使用
configPSH_CHALLENGE_PATTERN
configPSH_ERROR_PROMPT
configPSH_LOCKED_PROMPT
configPSH_PROFILE
configPSH_READY_PROMPT
configPSH_UNLOCKING_PROMPT
configPSH_UNLOCK_SEQUENCE
configSAVE2FILE_PATH：原始数据日志的存储目录，记录串口、SSH、ADB 等 transport 接收到的原始字节流（每行附到达时间戳，每个会话单独一个文件）。设为 "none" 或留空则关闭。与 LOG_SAVE / LOG_DIR 相互独立
configSERIAL_BAUDRATE
configSERIAL_PORT
configSSH_CLIENT
configSSH_CONNECTION
configSSH_TTY
// quality suggestions

Shell command execution

4 calls in production code run through a shell (bin/embedded-mcp-toolkit-cli.js:15, src/sdk/transports/adb.ts:101, src/sdk/transports/powershell.ts:61)

Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.

Production dependencies are patched

0 critical, 1 high severity in production deps — js-yaml@4.3.1 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Dependency freshness

1/9 production deps stale: zmodem.js@2022-06-29 (4.2y)

Domain consistency

npm scope @smai-kit doesn't match GitHub owner smk-h

Use the same org name across GitHub, npm, and your homepage so users can verify the publisher.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 3 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/smk-h/embedded-mcp-toolkit?variant=verified)](https://m8ven.ai/mcp/smk-h/embedded-mcp-toolkit)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 0e7bfdda3376c78fa417a6ceda2e8c78886f3323
code hash: d407dfb428ba40b18fed5ca67278f73d61127132bc4da7117cfc3077f5b3d281
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client