basecamp-mcp (stefanoverna/basecamp-mcp) is an MCP server listed on the M8ven Trust Index. It scores 20 out of 100, grade F. It declares 47 tools. No publisher has claimed this listing.
Warning. Serious findings were identified. Review the full report before connecting. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
stefanoverna
Source: ModelScope
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
basecamp_list_recordingsBrowse recent activity across Basecamp by listing recordings. Recordings represent all content in Basecamp: todos, messages, documents, comments, uploads, and more. Use this tool to: - See what's been happening across all projects or specific projects - Find recent activity by one or more people - …
basecamp_loginbasecamp_logoutRemove stored Basecamp credentials.
basecamp_whoamiCheck login state: show whether you're authenticated and, if so, the basic Basecamp user + account id. For your full profile (id, title, attachable_sgid) use basecamp_get_me.
basecamp_list_campfire_messagesBrowse chat messages from Basecamp Campfires. Campfires are real-time chat rooms within projects. Use this tool to: - See recent chat activity across all campfires or specific ones - Find messages from specific people - Search message content for keywords - Review chat history since a specific date…
basecamp_get_questionnaireGet the questionnaire (check-ins container) for a project. Returns the number of questions and their URL.
basecamp_list_questionsList all automatic check-in questions in a questionnaire. Returns each question's title, schedule, paused status, and answer count.
basecamp_get_questionGet a single automatic check-in question with its schedule and metadata.
basecamp_list_answersList answers to a specific check-in question. Returns each answer's content, author, and check-in date.
basecamp_get_answerGet a single check-in answer by its ID.
basecamp_create_answerCreate a new answer for a check-in question. Content must be HTML.
basecamp_list_commentsList comments on any Basecamp resource (message, todo, card, etc.). Works universally on all recording types.
basecamp_create_commentAdd a comment to any Basecamp resource (message, todo, card, etc.).
basecamp_update_commentbasecamp_list_vaultsList sub-vaults (folders) under a parent vault in the Docs & Files section.
basecamp_get_vaultGet details of a vault (folder) including document/upload/sub-vault counts.
basecamp_create_vaultCreate a new vault (folder) under a parent vault.
basecamp_update_vaultUpdate the title of a vault (folder).
basecamp_list_documentsList documents in a vault.
basecamp_get_documentRetrieve a single document with its full content.
basecamp_create_documentbasecamp_update_documentbasecamp_list_uploadsList files uploaded to a vault in the Docs & Files section.
basecamp_get_uploadGet a file uploaded to a vault. For images, returns the image content that the LLM can see directly. For text-based files (plain text, CSV, JSON, XML, etc.), returns the file content as text. For other binary formats, returns metadata only.
basecamp_download_blobDownload an inline attachment from a <bc-attachment> tag found in document/message/comment HTML content. Extract the blob_id and filename from the href attribute (format: https://storage.3.basecamp.com/{accountId}/blobs/{blobId}/download/{filename}). For images, returns the image content that the LL…
basecamp_list_kanban_columnsList all columns in a kanban board.
basecamp_list_kanban_cardsList cards in a kanban column.
basecamp_get_kanban_cardGet all details of a specific kanban card.
basecamp_create_kanban_cardbasecamp_update_kanban_cardbasecamp_move_kanban_cardMove a kanban card to a different column and/or position within that column.
basecamp_get_messageRetrieve a single message from a Basecamp message board.
basecamp_list_messagesList messages in a Basecamp message board (a single project). For cross-project or time-based browsing across content types, use basecamp_list_recordings instead.
basecamp_list_message_typesList available message types/categories for a Basecamp project
basecamp_create_messageCreate a new message in a Basecamp message board.
basecamp_update_messagebasecamp_get_meGet your full profile for the authenticated user (id, name, email, title, attachable_sgid). To simply check whether you're logged in, use basecamp_whoami.
basecamp_list_peopleList all people in the Basecamp account.
basecamp_get_personGet details about a specific person.
basecamp_list_projectsList all projects visible to the authenticated user in a Basecamp account. This tool returns active projects with their IDs, names, descriptions, and metadata. Use this to discover project/bucket IDs needed for accessing messages, todos, and other resources.
basecamp_get_projectFetch detailed information about a specific Basecamp project. This tool retrieves complete project details including name, description, dock configuration, and metadata. Examples: - Use when: "Get details for project 12345" - Use when: Need full project information including dock configuration
basecamp_get_todosetGet todo set container for a project. Returns todo lists and groups.
basecamp_list_todosList todos in a todo list. Filter by status: 'active' or 'archived'.
basecamp_create_todobasecamp_complete_todoMark a todo as completed.
basecamp_uncomplete_todoMark a todo as incomplete (undo completion).
basecamp_update_todoDisclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
ANTHROPIC_API_KEYBASECAMP_CLIENT_IDYour Basecamp OAuth client IDBASECAMP_CLIENT_SECRETYour Basecamp OAuth client secretTool annotations match behaviour
2 read-only tools perform write/delete/exec — basecamp_get_upload (line 32: mkdirSync(DOWNLOAD_DIR, { recursive: true })); basecamp_download_blob (line 32: mkdirSync(DOWNLOAD_DIR, { recursive: true }))
Either remove the readOnlyHint:true annotation, or remove the write/delete call from the tool handler.
Descriptions match behaviour
1 tool describes read intent but its handler mutates — basecamp_get_upload (line 32: mkdirSync(DOWNLOAD_DIR, { recursive: true }))
Rename the tool, rewrite the description, or move the side-effect into a separate clearly-named tool.
Tool inputs are validated
44/47 tool handlers declare input schemas (94%)
Declare an inputSchema with zod/joi/yup on every tool definition.
License file
No license file
Add a LICENSE file (MIT, Apache-2.0, etc.).
Shell command execution
1 call in production code run through a shell (src/utils/oauth.ts:44)
Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.
Secrets not logged
5 secret values sent to log
Redact or omit secret values from log output.
Production dependencies are patched
0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.20.2 (high), @modelcontextprotocol/sdk@1.20.2 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Tool description accuracy
basecamp_get_upload: description implies read-only but handler writes/deletes/executes
Update tool descriptions to accurately reflect all capabilities — especially write, delete, or execute operations.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/stefanoverna/basecamp-mcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check