subspace-api

Item: subspace-api
Rating: 74
Author: M8ven

An express-based RESTful API and Model Context Protocol (MCP) server for services used by subtype.space. Please note the GitHub repository is a downstream mirror, and updates may be late.

→ subtype-space/subspace-api · listed on mcp_so

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

mcp.so Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

🔐

You'll be asked for 3 credentials: AERODATABOX_API_KEY, TRMNL_FLIGHTS_CLIENT_SECRET, WMATA_PRIMARY_KEY

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configACTIVE_VERSION— v1 API version prefix (not fully implemented)

🔐 secretAERODATABOX_API_KEY— For flight plugin RapidAPI key for AeroDataBox (live flight status data)

configAERODATABOX_PROVIDER

configLOG_LEVEL— info Logging verbosity (debug, info, warn, error)

configPORT— 9595 Port the server listens on

configTRMNL_DB_PATH— No Path to SQLite database file (default: ./trmnl.sqlite)

configTRMNL_FLIGHTS_CLIENT_ID— For flight plugin OAuth 2.0 client ID for the TRMNL flight tracker plugin

🔐 secretTRMNL_FLIGHTS_CLIENT_SECRET— For flight plugin OAuth 2.0 client secret paired with TRMNL_FLIGHTS_CLIENT_ID

configTRMNL_IP_ALLOW_PRIVATE— No Set to true to bypass TRMNL worker IP allowlist check (useful for local dev)

🔐 secretWMATA_PRIMARY_KEY— For metro plugin WMATA API key for DC Metro arrival predictions and incidents

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/subtype-space-subspace-api-13sunk)](https://m8ven.ai/mcp/subtype-space-subspace-api-13sunk)

commit: beb8a4aa9fbf0ec5e68f584eda524cecfacc9047

code hash: 275631ccf38a6da584deebb94e0c2c96a536129403e3373bed10b438f044123c

verified: 6/13/2026, 9:37:26 AM

view raw JSON →