52
/ 100
2 days ago
glama

zkshare-mcp

An MCP server that provides tools for privacy-oriented context API including encrypted fact storage, commitment-based proofs, and semantic search, enabling users, AI agents, and back-office systems to securely manage and prove personal facts without exposing raw data.

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
⚠️
Known vulnerabilities in dependencies: 13 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 12 credentials: NEXT_PUBLIC_SUPABASE_ANON_KEY, OPENAI_API_KEY, OPENROUTER_API_KEY, STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET, SUPABASE_SERVICE_ROLE_KEY, UPSTASH_REDIS_REST_TOKEN, ZKSHARE_API_KEY, ZKSHARE_ENCLAVE_JWT_SECRET, ZKSHARE_ENCRYPTION_SECRET, ZKSHARE_PROOF_SECRET, ZKSHARE_TEST_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies13 high5 medium7 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

highnext@16.2.4GHSA-267c-6grr-h53f

Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes

highnext@16.2.4GHSA-26hh-7cqf-hhc6

Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up

highnext@16.2.4GHSA-36qx-fr4f-26g5

Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n

highnext@16.2.4GHSA-492v-c6pp-mqqv

Next.js has a Middleware / Proxy bypass through dynamic route parameter injection

highnext@16.2.4GHSA-6gpp-xcg3-4w24

Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configBASE_URL
configNEXT_PUBLIC_SITE_URL
🔐 secretNEXT_PUBLIC_SUPABASE_ANON_KEY
configNEXT_PUBLIC_SUPABASE_URL
🔐 secretOPENAI_API_KEY
configOPENAI_CHAT_MODEL
configOPENAI_EMBEDDING_MODEL
🔐 secretOPENROUTER_API_KEY
configOPENROUTER_APP_TITLE
configOPENROUTER_CHAT_MODEL
configOPENROUTER_EMBEDDING_MODEL
configOPENROUTER_HTTP_REFERER
configSTRIPE_PRICE_ENTERPRISE
configSTRIPE_PRICE_PRO
configSTRIPE_PRICE_STARTER
🔐 secretSTRIPE_SECRET_KEY
🔐 secretSTRIPE_WEBHOOK_SECRET
🔐 secretSUPABASE_SERVICE_ROLE_KEY
configTEST_BASE_URL
🔐 secretUPSTASH_REDIS_REST_TOKENUpstash Redis is configured (UPSTASH_REDIS_REST_URL + ); the in-process rate-limit fallback is for local development only.
configUPSTASH_REDIS_REST_URLUpstash Redis is configured ( + UPSTASH_REDIS_REST_TOKEN); the in-process rate-limit fallback is for local development only.
🔐 secretZKSHARE_API_KEY"": "zk_live_…",
configZKSHARE_API_URL"": "https://zkshare.io"
configZKSHARE_CORS_ORIGINis an explicit comma-separated allow list of origins. is for unauthenticated demos only.
configZKSHARE_DISABLE_EXTERNAL_LLM
🔐 secretZKSHARE_ENCLAVE_JWT_SECRETHS256 secret for sandbox attestations (minimum 32 characters).
configZKSHARE_ENCLAVE_PUBLIC_KEY_STUB
🔐 secretZKSHARE_ENCRYPTION_SECRETserver-side AES-256-GCM master secret (scrypt-derived; minimum
configZKSHARE_OPENROUTER_DENY_DATA_COLLECTION
🔐 secretZKSHARE_PROOF_SECRETHMAC secret for commitments and proof envelopes (minimum 16
🔐 secretZKSHARE_TEST_API_KEY
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/sp0oby-zkshare-fyv8nd)](https://m8ven.ai/mcp/sp0oby-zkshare-fyv8nd)
commit: db2f6267f7d90dba0cf2948ed19e0dc08ef94c0d
code hash: e30878d4438397e7fa137cf39e3b6dd3ebe9453e2d925ed7b610e798d9091c49
verified: 7/29/2026, 9:25:42 AM
view raw JSON →