/ 100

17 days ago

glama

spanlens-mcp

Item: spanlens-mcp
Rating: 35
Author: M8ven

MCP-native LLM observability. Query your Spanlens traces, stats, cost anomalies, and savings from Cursor, Claude Desktop, or any MCP client. Open source (MIT).

→ spanlens/Spanlens · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

🚨

Secret credentials may flow to a network call

9 flows detected: SPANLENS_API_KEY, GITGUARDIAN_API_KEY, SPANLENS_INTERNAL_API_KEY. We can’t prove the destination matches the brand the credential belongs to.

🔐

You'll be asked for 10 credentials: CLICKHOUSE_PASSWORD, CRON_SECRET, ENCRYPTION_KEY, GITGUARDIAN_API_KEY, KV_REST_API_TOKEN, RESEND_API_KEY, SPANLENS_API_KEY, SPANLENS_INTERNAL_API_KEY, SUPABASE_ANON_KEY, SUPABASE_SERVICE_ROLE_KEY

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configCLICKHOUSE_DB

🔐 secretCLICKHOUSE_PASSWORD— choose a strong password>

configCLICKHOUSE_URL

configCLICKHOUSE_USER

🔐 secretCRON_SECRET— random string>

🔐 secretENCRYPTION_KEY— 32-byte base64>

configEVAL_GENERATION_CONCURRENCY

configEVAL_JUDGE_CONCURRENCY

configEVAL_MAX_RETRIES

configEVENTS_BACKFILL_COMPLETE

🔐 secretGITGUARDIAN_API_KEY

🔐 secretKV_REST_API_TOKEN

configKV_REST_API_URL

configMOCK_OPENAI_PORT

configNO_COLOR

configPADDLE_ENVIRONMENT— =sandbox # or production

configPADDLE_PRICE_ENTERPRISE

configPADDLE_PRICE_STARTER

configPADDLE_PRICE_TEAM

configPORT

configPROXY_URL

🔐 secretRESEND_API_KEY— Email invitations have a 7-day expiry with sha256-hashed tokens. Sent via [Resend](https://resend.com) when is set; falls back to console-logging the accept URL for local dev.

configSENTRY_DSN

configSKIP_ANTHROPIC

configSKIP_GEMINI

configSKIP_OPENAI

configSPANLENS_ADMIN_EMAILS

🔐 secretSPANLENS_API_KEY— 2. Writes to .env.local

🔐 secretSPANLENS_INTERNAL_API_KEY

configSPANLENS_INTERNAL_BASE_URL

🔐 secretSUPABASE_ANON_KEY

🔐 secretSUPABASE_SERVICE_ROLE_KEY

configSUPABASE_URL

configTERM

configUSE_EVENTS_FOR_REQUESTS

configUSE_EVENTS_FOR_STATS

configUSE_EVENTS_FOR_TRACES

configWEB_URL— =https://your-domain.com

configFORCE_COLOR

configSPANLENS_API_BASE

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 3 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/spanlens-spanlens-1q9os6)](https://m8ven.ai/mcp/spanlens-spanlens-1q9os6)

commit: 9c48c49f74a393921316e8088fb7044ddc08a873

code hash: 4af9be5beeaae06ecdb2948da5f44c0134fceed23e0ffa72c50394f5cdd76969

verified: 7/14/2026, 8:35:17 AM

view raw JSON →