8th Wall MCP Server (superdwayne/8thwallmcp) is an MCP server listed on the M8ven Trust Index. It scores 22 out of 100, grade F. It declares 62 tools. No publisher has claimed this listing.

Warning

22/100

8th Wall MCP Server

Item: 8th Wall MCP Server
Rating: 22
Author: M8ven

Enables building WebAR experiences using natural language through tools for Three.js scene creation, project management, and asset integration within 8th Wall Desktop. It supports advanced features like face tracking, image targets, and automated 3D model management.

→ superdwayne/8thwallmcp · listed on glama

Warning. Serious findings were identified. Review the full report before connecting. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every push why connect →

Who stands behind it

superdwayne

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

Glamanot scored here

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings

⚠️

Tool descriptions don’t match what handlers do

2 tools describe read intent but their handlers mutate — desktop_read_json (line 90: fs.mkdir(path.join(root, "src"), { recursive: true })); project_list_files (line 26: fs.mkdir(p, { recursive: true }))

⚠️

Known vulnerabilities in dependencies: 3 high

Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

// tools this server exposes62 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

app_list

List 8th Wall apps (mock unless API configured)

app_get

Get a single app by ID (mock unless API configured)

health_ping

Simple health check

devserver_start

Start a static file server for PROJECT_ROOT

devserver_stop

Stop the static file server

search_ar_assets

Search for AR assets across multiple sources (PolyHaven, local assets, Poly Pizza). Returns ranked results.

get_asset_download_info

Get detailed download information for a specific asset from PolyHaven

assets_status

Report availability of PolyHaven integration

assets_search_polyhaven

Search PolyHaven assets (hdris/textures/models) by keyword

assets_polyhaven_categories

List PolyHaven categories for an asset type (hdris/textures/models/all)

assets_polyhaven_files

Get PolyHaven file metadata for a specific asset id

assets_download_url

Download a file by URL into project/assets/

assets_unzip

Unzip a .zip file into project assets directory

generate_custom_javascript

⚠️ WEB PROJECTS ONLY - NOT FOR DESKTOP! Generate A-Frame components for web-based projects. For Desktop (.expanse.json), use desktop_add_threejs_script instead!

list_code_templates

List all available pre-built code templates

validate_javascript

Validate JavaScript code for common errors and security issues

desktop_guess_scene

Heuristically find scene/config JSON files used by 8th Wall Desktop

desktop_read_json

Read .expanse.json with optional JSON Pointer path

desktop_write_json

Write entire .expanse.json (replaces file)

desktop_patch_json

Patch .expanse.json using JSON Pointer (set/remove/push operations)

desktop_add_shape

Add a 3D shape to .expanse.json with proper 8th Wall validation

desktop_add_model

Add a 3D model (GLB/GLTF) from assets to the scene

desktop_enable_face_tracking

Enable face tracking in .expanse.json with optional debug mesh

desktop_add_rotation_animation

⚠️ BROKEN - DO NOT USE! Adds unregistered attributes causing 'No attribute registered' errors. Use desktop_add_threejs_script to create custom Three.js animations instead!

desktop_add_scale_animation

⚠️ BROKEN - DO NOT USE! Adds unregistered attributes causing 'No attribute registered' errors. Use desktop_add_threejs_script to create custom Three.js animations instead!

desktop_add_image_target

Add an image target container for AR image tracking

desktop_add_video

Add a video plane with custom JavaScript for video texture

desktop_set_model_animation

Set animation clip playback for a GLB/GLTF model

desktop_add_custom_component

⚠️ WEB PROJECTS ONLY - NOT FOR DESKTOP! Add a custom A-Frame component for web-based 8th Wall projects (requires index.html with A-Frame). Desktop projects (.expanse.json) use Three.js directly - use desktop_add_threejs_script instead!

desktop_add_custom_script

Add a custom JavaScript file to your project (for utilities, helpers, initialization code, etc.)

desktop_list_components

List all custom components in the project

desktop_remove_component

Remove a custom component from the project

create_ar_experience

Create a complete AR experience from a natural language description. This tool automatically chains other tools to build complex AR scenes.

analyze_ar_description

Analyze a natural language description to determine the type of AR experience and extract key entities

project_get_root

Return the current PROJECT_ROOT used by tools

project_set_root

Set PROJECT_ROOT at runtime to target another folder (e.g., 8th Wall Desktop project)

desktop_list_projects

List candidate 8th Wall Desktop project folders under ~/Documents/8th-Wall (or 8th Wall)

desktop_set_project

Set PROJECT_ROOT to ~/Documents/8th-Wall/<name> (or EIGHTHWALL_DESKTOP_ROOT/<name>; also supports '8th Wall')

project_get_info

Summarize project structure (files and folders) under PROJECT_ROOT

project_list_files

List files under a subdirectory of PROJECT_ROOT

project_read_file

Read a text file under PROJECT_ROOT

project_write_file

Write text to a file under PROJECT_ROOT (creates dirs if needed)

project_delete_file

Delete a file under PROJECT_ROOT

project_move_file

Move/rename a file within PROJECT_ROOT

project_scaffold

Create a minimal web XR app structure (index.html, main.js, styles.css)

project_export_zip

Export the project directory to a zip archive in the workspace

prompts_asset_strategy

Guidance for choosing and importing assets/textures/HDRIs for web XR apps

scene_detect_engine

Detect whether the project uses A-Frame or Three.js

scene_add_gltf_model

Add a GLTF/GLB model to the scene (A-Frame or Three.js)

scene_set_background_color

Set scene background color

scene_add_primitive

Add a primitive shape to the scene

scene_add_light

Add a light to the scene

scene_set_environment_hdr

Set environment using an HDR/EXR URL

scene_add_animation

Add a simple spin animation to meshes (Three) or an A-Frame animation entity

scene_add_textured_plane

Add a textured plane (e.g., for backgrounds/posters)

scene_add_orbit_controls

Add OrbitControls to Three.js scene

scene_add_grid_helper

Add a GridHelper to the scene (Three.js)

scene_add_floor

Add a simple floor plane (Three.js)

desktop_add_threejs_script

Add a working Three.js script with proper XR8 pipeline setup for 8th Wall Desktop

apply_experience_template

Apply a pre-configured AR experience template. This automatically sets up components, code, and configurations.

list_templates

List all available AR experience templates with descriptions

get_template_info

Get detailed information about a specific template

// known CVEs in dependencies3 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.18.1GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.18.1GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.18.1GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

Depend on this server? Get alerted when its CVEs change.Watch this server free →

// environment variables

To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.

configEIGHTHWALL_DESKTOP_ROOT

configHTTP_HOST

configHTTP_PORT

configMODE

configPROJECT_ROOT

// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

62/62 tools missing one or more hints — app_list (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); app_get (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); health_ping (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +59 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Destructive tools are labelled

2 tools perform destructive updates without destructiveHint — desktop_remove_component deletes at line 296 (fs.unlink(filePath)); project_delete_file deletes at line 292 (fs.rm(full, { force: true }))

Add destructiveHint:true to any tool whose handler calls .delete(), .upsert(), .update(), unlink, rm, DELETE, DROP, REPLACE INTO, or any operation that overwrites existing data.

Descriptions match behaviour

Rename the tool, rewrite the description, or move the side-effect into a separate clearly-named tool.

Tool inputs are validated

51/62 tool handlers declare input schemas (82%)

Declare an inputSchema with zod/joi/yup on every tool definition.

Tests exist

No test files found

Add tests that exercise each declared tool.

Production dependencies are patched

0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.18.1 (high), @modelcontextprotocol/sdk@1.18.1 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Tool description accuracy

desktop_read_json: description implies read-only but handler writes/deletes/executes; project_list_files: description implies read-only but handler writes/deletes/executes

Update tool descriptions to accurately reflect all capabilities — especially write, delete, or execute operations.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail

The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.

// improvement guidance — verified publishers only

We have 8 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Verified](https://m8ven.ai/badge/mcp/superdwayne/8thwallmcp?variant=verified)](https://m8ven.ai/mcp/superdwayne/8thwallmcp)

Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.

commit: 0c17706a5be634b7101abc8973366f364b81387d

code hash: 412d8e482e22dbf9407bafce1227d11aa337a7adb186262ad9a3adc96f8bfb2f

view raw JSON →

Check MCPs from inside your assistant

Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check

check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern

How to add it →Free · no account needed · works in any MCP client