Stellify MCP Server (Stellify-Software-Ltd/stellify-mcp) is an MCP server listed on the M8ven Trust Index. It scores 52 out of 100, grade D. It declares 68 tools. No publisher has claimed this listing.

D
Caution
52/100

Stellify MCP Server

Enables AI assistants to incrementally build Laravel and Vue.js applications by creating file structures, methods, and code through natural conversation.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

Stellify-Software-Ltd

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Known vulnerabilities in dependencies: 14 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
🔐
You'll be asked for 1 credential: STELLIFY_API_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes68 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

load_tools

Enable a group of situational tools that are kept OUT of the default set to save context (they cost tokens on every turn). Call this ONCE with the group(s) you need and those tools become available to call. Groups: "editing" (surgical statement-level edits + granular inspection: save_/create_method/

get_stellify_framework_api

Get Stellify Framework API reference with full type signatures. Import from "stellify-framework". Returns composables (useForm, useAuth, etc.) with options/returns, utilities (Http, Collection, etc.) with methods/staticMethods, and validation rules. Each item includes summary, type signatures, and

get_project

Get active project. Returns uuid, name, branches, and directories array.

create_file

Create an empty file shell in a Stellify project. Returns file UUID. For PHP: type='class', 'model', 'controller', or 'middleware'. CONSTRAINT: API controllers must `return response()->json(...)` — a bare array/string leaves the response null and the API route 404s. For Vue: type='js', extension='v

create_method

Create a method in a file. Pass 'body' to include implementation. Async auto-detected from `await`. For significant methods, include context fields.

add_method_body

APPEND code to the end of an existing method that already has statements. (For a NEW method use create_method with its 'body' param. To REPLACE / CHANGE what a method does, use replace_method_body — do NOT delete and recreate the method.) Nested code is handled: the parser tracks brace/bracket/paren

replace_method_body

Replace what an existing method does — IN PLACE. Clears the method's current statements and re-parses your new code into fresh ones, KEEPING the method's UUID, name and parameters, so file.data, routes and click handlers stay wired. This is the surgical, cheap way to CHANGE a method: do NOT delete_m

rename_variable

Rename EVERY occurrence of a variable within one method, atomically. This is the safe way to rename: editing a single variable clause only changes that ONE occurrence (occurrences are independent references, like retyping one occurrence in a text editor), which leaves the others behind and breaks th

save_method

Update a method's properties. Use add_method_body to append code. For significant changes, include context fields: summary, rationale, references, decisions.

search_methods

Search for methods in the project by name or within a specific file

search_attributes

Find available PHP 8 attributes in Laravel (name, namespace, target, expected args) before adding them to files/methods. Three modes: no params → list categories (eloquent, queue, routing, …); category only → all attributes in it (e.g. eloquent → Fillable, Hidden, …); query → search names (e.g. "fil

analyze_attributes

Audit PHP 8 attribute usage across a project. Three modes: usage (default) → all attributes used + counts (optional file_type filter); missing → files of a file_type lacking a required attribute (e.g. FormRequests missing FailOnUnknownFields); search → files where an attribute contains a value (e.g.

delete_method

Delete a method from a file by UUID. This permanently removes the method and all its code. Requires both the file UUID and method UUID.

get_method

Get a method by UUID. Returns the method data including its parameters and body.

search_files

Search for files in the project by name or type

create_route

Create a route/page. For API routes, you MUST pass BOTH controller AND controller_method UUIDs to wire execution. IMPORTANT: Both 'controller' (file UUID) and 'controller_method' (method UUID) are required together for API routes to execute code. Without both, the route won't run any code. Route p

get_route

Get a route/page by UUID. Returns route details including name, path, and attached elements. Use this to look up a route you created or to find existing routes in the project.

save_route

Update a route/page. Wire to controller with both controller and controller_method UUIDs. For significant routes, include context fields.

delete_route

Delete a route/page from the project by UUID. This permanently removes the route. WARNING: This is destructive and cannot be undone. Any elements attached to this route will be deleted also.

search_routes

Search for routes/pages in the project by name. Use this to find existing routes before creating new ones. Returns paginated results with route details including UUID, name, path, and type. Use the returned UUID with html_to_elements (page parameter) or get_route for full details.

create_element

Create a UI element. Provide page (route UUID) for root elements, or parent (element UUID) for children. **s-slot elements (for layouts):** Use type='s-slot' to create a slot placeholder in a layout. When a page uses the layout via `<x-layout-name>`, the page's children are injected where the s-slo

update_element

Update a UI element. Data object: tag, classes, text, event handlers (method UUIDs), classBindings. Set 'name' on root elements to create Blade views (e.g. name="notes.index" → view('notes.index')). Slots: set 'name' on an s-slot to define a slot (name="default" is the default); set 'slot' on an el

get_element

Get a single element by UUID. Returns the element data with all its attributes.

get_element_tree

Get an element with all its descendants (children, grandchildren, etc.) as a hierarchical tree structure.

delete_element

Delete an element and all its children (CASCADE). Returns the count of deleted elements.

search_elements

Search for elements in the project. Useful for finding elements by name, type, or content. Note: To reorder elements, use update_element to modify the parent element's 'data' array with the new order of child UUIDs.

html_to_elements

Convert HTML to Stellify elements. SILENT GOTCHA: non-ASCII text is mangled by DOMDocument (£→£, em-dash→â) — use ASCII, prefer SVG over emoji, or set such text afterwards with update_element. (@event handlers like @click/@keyup.enter ARE captured on creation — you do NOT need to re-set them; pass

get_statement

Get a statement by UUID. Returns the statement data including its clauses (code tokens).

create_statement

Create empty statement (step 1 of 2). Call add_statement_code next. Prefer create_statement_with_code for single call.

create_statement_with_code

Create a statement with code in one call. Preferred over two-step create_statement + add_statement_code. Pass 'types' to specify TypeScript types for variables. The assembler infers the full type from code structure: - `ref([])` + type "Todo" → outputs `const todos: Ref<Todo[]>` - `ref(0)` + type "

add_statement_code

Add code to an existing statement. This is step 2 of 2 - call this AFTER create_statement. **ALTERNATIVE:** Use create_statement_with_code for a single-call approach that combines both steps. The statement must already exist (created via create_statement). This parses and stores the code. Example

delete_statement

Delete a statement from a file by UUID. This permanently removes the statement (import, variable, ref, etc.).

save_statement

Update an existing statement. Use this to modify statement properties after creation. Always pass the containing method (and file, if known): when the statement lives in reused-by-reference code, this lets the platform fork just the edited statement into your project and leave the shared original un

save_file

Finalize a file. Full replacement - call get_file first to update existing files. Required: uuid, name, type. For significant changes, include context fields: summary, rationale, references, decisions.

get_file

Get a file by UUID with all its metadata, methods, and statements.

delete_file

Delete a file from the project by UUID. This permanently removes the file and all its methods/statements. WARNING: This is destructive and cannot be undone. Make sure the file is not referenced elsewhere before deleting.

get_directory

Get a directory by UUID to see its contents. Use this to inspect directories returned by get_project. The project's data array contains directory UUIDs. Returns the directory name and list of files/subdirectories inside it.

create_directory

Create a new directory for organizing files. Common directories: - 'js' for JavaScript/Vue files - 'css' for stylesheets - 'components' for reusable components IMPORTANT: Check existing directories first using get_project and get_directory before creating new ones.

save_directory

Update an existing directory. Use this to rename or modify directory properties.

broadcast_element_command

Push real-time UI updates via WebSocket. Use for SHOW/DISPLAY/DEMONSTRATE requests. Actions: update (modify element), create (ephemeral element), batch (multiple updates), delete. Changes are EPHEMERAL (not saved). For persistent changes, use update_element or html_to_elements.

create_resources

Scaffold a CRUD resource in ONE call: Model + Migration (+ Controller, + optional Service, + optional route files) from fields + relationships. MANDATORY: you MUST call search_code BEFORE this tool, every time — even for a small, fully-specified feature on an empty project ("it's quick to just build

search_code

Search the reusable-code library for an existing, proven unit that matches a requirement, ranked by fit. This is the RETRIEVE-don't-regenerate path: before scaffolding a feature from scratch with create_resources/create_file, search here first — a matching unit can be cloned in one call with reuse_c

reuse_code

REFERENCE a reusable unit into your ACTIVE project — the canonical code is linked in place, never copied. Each reused file becomes a thin local shell whose methods resolve to the canonical originals at assembly time, so the code you get is byte-identical to the proven source and costs nothing to car

list_forks

List the curated FORK VARIANTS of a canonical unit — approved forks that descend from it, ranked by adoption. When a search_code candidate reports variants > 0, call this with its uuid to see the alternatives: each carries a summary, the submitter's NOTE (their case for why this take is useful), and

variant_counts

BULK check which of a set of units have curated fork alternatives — the cheap "badge" query. Pass the uuids you're working with (file/method) and get back a compact { uuid: count } map with only the non-zero entries. This is uuid→int, NO fork data — use it to decide which units are worth a list_fork

get_contributions

Report the user's OWN contribution stats — how their shared code is being reused across the library. Use when they ask "has my code been reused?", "what have I earned?", or "how are my contributions doing?". Returns { total_reuses (times a stranger's project referenced your units), projects (distinc

see_divergences

See how PEERS changed the canonical code your project references — the reasoned divergences other projects made from units you reference ("someone on this code changed it, here's why"). Use it when adapting reused code: before you re-implement a change to a referenced unit, check whether another pro

explain_divergence

Explain a divergence you just made — attach the WHY to a referenced unit your project forked. When you edit code that was referenced (not authored) here, copy-on-write forks a private copy; call this right after so other projects on the same canonical unit can see why you changed it (and, later, ado

adopt_divergence

Adopt a peer's divergence — take their change to a unit you reference. Re-points your project's reference from the canonical unit to the peer's forked version, a granular swap that leaves the rest of the file untouched; the diverger earns on adoption. Use after see_divergences when a peer's reasoned

submit_code

Offer a file or method the user OWNS into the shared reusable-code library for curator review. Use this when the user has built something reusable and wants to contribute it (e.g. "submit this", "share this with the library", "offer this for reuse"). REFERENCE MODEL: the user keeps ownership — appro

run_code

Execute a method in sandboxed environment. Requires file and method UUIDs. Returns output, success, error, and optional benchmark data. CONSTRAINT: the sandbox blocks literal http://|https:// strings (exfiltration guard) — build any URL (success_url, redirects, webhooks) with the url('/path') helper

run_migration

Apply a migration against the project's tenant database (creates/updates tables). Migrations need elevated Schema/DDL privileges that run_code forbids, so they have a dedicated runner. Pass the migration file UUID (returned by create_resources). Run this after create_resources to actually create the

run_tests

Run every test in a studio test file (type 'test') and return per-test results: pass/fail, failure message, location, duration. Use this to prove code you've built or reused actually works. Runs are wrapped in a database transaction and rolled back — tests never permanently mutate project data. AUTH

publish

Bundle a Vue component tree into an ESM loader served at /esm and attach its import-map to a page route, so the component renders in the browser without the editor. Pass the entry file UUID (the app.js mount file) and the route UUID of the page that hosts it. Run this after building a Vue component

request_capability

Log a missing framework-level capability. Creates a ticket in the Stellify backlog.

install_package

Install a foundation package into the current project. Creates routes and other resources defined in the package manifest. Returns success with installed counts, or error with code: - PACKAGE_NOT_FOUND: Package name doesn't exist - PACKAGE_NOT_INSTALLABLE: Package is disabled - ALREADY_INSTALLED: P

list_capabilities

List the capability catalog - libraries and services that can be enabled for the project (e.g. Sanctum, Livewire, Vue, Stripe). Each capability includes: - name, category, description - type: "composer" (PHP) or "npm" (JavaScript) - determines whether it lands in composer.json or package.json - pac

set_capability

Enable or disable a capability (library/service) for the current project. Enabling adds the capability to the project so its packages are emitted into composer.json / package.json at build/export time (and may enable related framework features, e.g. Livewire directives). IMPORTANT: - Use list_capa

analyze_performance

Analyze execution performance from logs. Types: full, slow_methods, high_query_methods, high_memory_methods, failure_rates, trend.

analyze_quality

Analyze Laravel code for quality issues. Types: full, relationships, fillables, casts, routes. Returns actionable suggestions.

get_setting

Get a setting profile by name. Returns key-value pairs accessible via config() in code.

save_setting

Create or update a setting profile. Data is merged with existing values. Access via config('name.key') in code.

save_project_meta

Set the ACTIVE project's App Store card metadata — its display name and description. These are what the Constellation store card renders, so set them whenever a project is built for (or headed to) the store. Owner-only. Does NOT publish the project (listing stays a manual review) and cannot touch is

create_project

Create a fresh, empty project for the user and make it their ACTIVE project. Use when starting work that belongs in its own project (e.g. a new Constellation module) instead of building inside the currently open one. The current project is untouched — the active pointer is simply repointed. Owner-on

set_active_project

Switch the user's ACTIVE project to another project they own or have been assigned to. All other tools operate on the active project, so use this to move between projects (e.g. back to a module project to rename or extend it). Fails with 403 for projects the user has no access to.

save_module

Set a project module's name and/or description. Modules are the named groups files/routes are organised into (created via the 'module' param on create_file/create_route); the description documents what the module provides for anyone browsing or reusing it.

delete_setting

Delete a setting profile from the tenant's settings table. WARNING: This permanently removes the entire setting profile and all its values. This cannot be undone. EXAMPLE: { "name": "vote" } This removes the "vote" setting profile entirely.

get_assembled_code

Get the assembled source code for a file — the full PHP class or Vue SFC as it would render. Returns the WHOLE file, so it is the single biggest source of wasted tokens when overused. HARD RULE: do NOT call this during a build. Call it AT MOST ONCE, at the very end, as a final sanity check. Every c

// known CVEs in dependencies14 high5 medium11 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.0.4GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

highaxios@1.7.9GHSA-35jp-ww65-95wh

axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

highaxios@1.7.9GHSA-3g43-6gmg-66jw

axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

highaxios@1.7.9GHSA-43fc-jf86-j433

Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig

highaxios@1.7.9GHSA-4hjh-wcwx-xvwj

Axios is vulnerable to DoS attack through lack of data size check

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
🔐 secretSTELLIFY_API_TOKEN"": "your-token-here"
configSTELLIFY_API_URL"": "https://api.stellisoft.com/v1",
configSTELLIFY_MCP_TELEMETRY_PATH
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

68/68 tools missing one or more hints — load_tools (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_stellify_framework_api (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_project (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +65 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

License file

No license file

Add a LICENSE file (MIT, Apache-2.0, etc.).

Tests exist

No test files found

Add tests that exercise each declared tool.

Production dependencies are patched

0 critical, 14 high severity in production deps — @modelcontextprotocol/sdk@1.0.4 (high), axios@1.7.9 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Domain consistency

npm scope @stellisoft doesn't match GitHub owner stellify-software-ltd

Use the same org name across GitHub, npm, and your homepage so users can verify the publisher.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/stellify-software-ltd/stellify-mcp?variant=verified)](https://m8ven.ai/mcp/stellify-software-ltd/stellify-mcp)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: fc9e3db8540ed6777ca67734d4ecd8ef03d7f503
code hash: d8e759e21760bd09f67f738b3cf29af34881f489c48fb096ce9dbd2419185bf0
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client