Logseq MCP Server (software-park/logseq-mcp) is an MCP server listed on the M8ven Trust Index. It scores 50 out of 100, grade D. It declares 21 tools. No publisher has claimed this listing.

Back to MCP Trust IndexM8ven
D
Caution
50/100

Logseq MCP Server

A NestJS-based server that enables AI agents to interact with Logseq graphs through its HTTP API for managing notes, journals, and blocks. It features specialized tools for project development tracking, including progress logs, technical decisions, and workflow prompts.

→ software-park/logseq-mcp· listed on glama

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

software-park

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

Glamanot scored here

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Known vulnerabilities in dependencies: 11 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
🔐
You'll be asked for 1 credential: LOGSEQ_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes21 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

block-get

Block의 내용을 조회합니다. UUID로 특정 Block을 확인할 때 사용하세요.

block-add

특정 Page에 새로운 Block을 추가합니다. 내용을 기록할 때 사용하세요. 내용은 자동으로 Logseq 아웃라이너 포맷으로 변환됩니다.

block-insert-child

기존 Block 아래에 자식 Block을 추가합니다. 계층적 구조를 만들 때 사용하세요.

block-update

Block의 내용을 수정합니다.

block-delete

Block을 삭제합니다. ⚠️ 자식 Block도 함께 삭제됩니다.

block-add-reference

기존 Block에 다른 Page나 Block에 대한 참조를 추가합니다. 아이디어를 연결할 때 사용하세요.

dev-log-progress

개발 진행 상황을 기록합니다. 구현 완료, 변경 사항, 리팩토링 등을 기록할 때 사용하세요.

dev-decision

기술적 결정 사항(ADR)을 기록합니다. 아키텍처, 라이브러리 선택, 설계 결정 등을 문서화할 때 사용하세요.

dev-todo

개발 TODO 항목을 추가합니다. 구현할 기능, 수정할 버그, 개선 사항 등을 기록합니다.

dev-idea

개발 아이디어를 기록합니다. 향후 구현할 기능, 개선 아이디어 등을 빠르게 기록할 때 사용하세요.

dev-get-project-logs

프로젝트의 개발 로그를 조회합니다. 최근 기록된 진행 상황, 결정 사항, TODO 등을 확인합니다.

journal-add-entry

오늘의 Journal(일지)에 새로운 내용을 기록합니다. 미팅 내용, 할 일, 생각 등을 기록할 때 사용하세요.

journal-get-today

오늘의 Journal 내용을 조회합니다. 오늘 기록한 내용, 할 일 등을 확인할 수 있습니다.

journal-get-date

특정 날짜의 Journal 내용을 조회합니다.

page-create

새로운 Page를 생성합니다. 프로젝트, 주제, 개념 등을 정리할 새 페이지를 만들 때 사용하세요. 내용은 자동으로 Logseq 아웃라이너 포맷으로 변환됩니다.

page-get

Page의 내용을 조회합니다. 특정 주제에 대해 기록한 내용을 확인할 때 사용하세요.

page-list

Graph 내 모든 Page 목록을 조회합니다. 어떤 페이지가 있는지 확인할 때 사용하세요.

page-delete

Page를 삭제합니다. ⚠️ 주의: 삭제된 페이지는 복구할 수 없습니다.

page-get-references

특정 Page를 참조하는 모든 곳(Backlinks)을 조회합니다. 연결된 내용을 탐색할 때 사용하세요.

search-query

Graph 내에서 키워드로 검색합니다. 특정 주제에 대한 기록을 찾을 때 사용하세요.

graph-info

현재 열린 Graph의 정보를 조회합니다. 어떤 Graph가 활성화되어 있는지 확인할 때 사용하세요.

// known CVEs in dependencies11 high6 medium13 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

highaxios@1.13.2GHSA-35jp-ww65-95wh

axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

highaxios@1.13.2GHSA-3g43-6gmg-66jw

axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

highaxios@1.13.2GHSA-43fc-jf86-j433

Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig

highaxios@1.13.2GHSA-6chq-wfr3-2hj9

Axios: Header Injection via Prototype Pollution

highaxios@1.13.2GHSA-777c-7fjr-54vf

Allocation of Resources Without Limits or Throttling in Axios

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configDOCS_PATH./docs # 개념 설계 문서 경로
configLOGSEQ_HOST"": "127.0.0.1",
configLOGSEQ_PORT"": "12315",
configLOGSEQ_TIMEOUT
🔐 secretLOGSEQ_TOKENyour-api-token
configMCP_CORS_ORIGINS
configMCP_HOST
configMCP_PORT
configMCP_TRANSPORT
configPROJECT_NAMEmy-project # 개발 기록이 연결될 Logseq 페이지 이름
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

21/21 tools missing one or more hints — block-get (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); block-add (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); block-insert-child (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +18 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

License file

No license file

Add a LICENSE file (MIT, Apache-2.0, etc.).

Tool test coverage

Only 0/21 tools referenced in tests (0%)

Write tests that reference each tool by name so every tool has at least one test.

Production dependencies are patched

0 critical, 11 high severity in production deps — axios@1.13.2 (high), axios@1.13.2 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Dependency freshness

1/9 production deps stale: reflect-metadata@2024-03-29 (2.4y)

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/software-park/logseq-mcp?variant=verified)](https://m8ven.ai/mcp/software-park/logseq-mcp)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 992376a942c97374793b0e629ccb614787130804
code hash: e2aee5cbfbf080917fe2081eb22f05a24cded31d962f0d226731ace6ee563e4e
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client