Back to MCP Trust Indexm8ven
54
/ 100
1 month ago
glama

Arachne Discord MCP

Multi-tenant Discord MCP server that lets multiple AI entities share one bot, each with unique identity and permissions.

→ SolanceLab/arachne-discord-mcp· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
🚨
Secret credentials may flow to a network call
1 flow detected: DISCORD_BOT_TOKEN. We can’t prove the destination matches the brand the credential belongs to.
⚠️
Known vulnerabilities in dependencies: 4 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 3 credentials: DISCORD_BOT_TOKEN, DISCORD_CLIENT_SECRET, JWT_SECRET
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies4 high2 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

highmulter@2.0.2GHSA-5528-5vmv-3xc2

Multer Vulnerable to Denial of Service via Uncontrolled Recursion

highmulter@2.0.2GHSA-72gw-mp4g-v24j

Multer vulnerable to Denial of Service via deeply nested field names

highmulter@2.0.2GHSA-v52c-386h-88mc

Multer vulnerable to Denial of Service via resource exhaustion

highmulter@2.0.2GHSA-xf7r-hgr6-v32p

Multer vulnerable to Denial of Service via incomplete cleanup

lowmulter@2.0.2GHSA-3p4h-7m6x-2hcm

Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configAVATAR_BASE_URL
configBASE_URL— No Public URL (default: http://localhost:3000)
configDASHBOARD_URL— No Dashboard URL (default: http://localhost:5173)
configDATA_DIR— No Directory for SQLite DB + avatars (default: .)
configDB_PATH
🔐 secretDISCORD_BOT_TOKEN— Yes Bot token from Discord Developer Portal
configDISCORD_CLIENT_ID— Yes OAuth2 Application ID
🔐 secretDISCORD_CLIENT_SECRET— Yes OAuth2 Client Secret
🔐 secretJWT_SECRET— Yes Random 64-char hex (openssl rand -hex 32)
configMCP_PORT
configOPERATOR_DISCORD_IDS— Yes Comma-separated Discord user IDs for operator access
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/solancelab-arachne-discord-mcp-0plkrl)](https://m8ven.ai/mcp/solancelab-arachne-discord-mcp-0plkrl)
commit: af627d4b0fb9fd903b8f3bc213465d4e434196fa
code hash: 33e8530f170f02163d34f41c90f673185e0c59db3d25006fc16eb25232fc28c8
verified: 6/23/2026, 10:42:27 AM
view raw JSON →