Back to MCP Trust Indexm8ven
52
/ 100
1 month ago
glama

mcp-coordinator

Prevents AI coding agents from conflicting by coordinating file claims and resolving conflicts in real-time across multiple sessions.

→ swoofer/mcp-coordinator· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
⚠️
Known vulnerabilities in dependencies: 9 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 8 credentials: COORDINATOR_ADMIN_SECRET, COORDINATOR_ADMIN_TOKEN, COORDINATOR_ENCRYPTION_KEY, COORDINATOR_GITHUB_CLIENT_SECRET, COORDINATOR_JWT_PREV_SECRET, COORDINATOR_JWT_SECRET, COORDINATOR_MQTT_PASSWORD, COORDINATOR_REGISTRATION_SECRET
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies9 high1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.12.0GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.12.0GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.12.0GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

hightar@7.4.3GHSA-34x7-hfp2-rc4v

node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

hightar@7.4.3GHSA-83g3-92jg-28cx

Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
🔐 secretCOORDINATOR_ADMIN_SECRET
🔐 secretCOORDINATOR_ADMIN_TOKEN
configCOORDINATOR_ALLOW_KEY_ROTATION
configCOORDINATOR_ALLOW_TOKEN_LOSS
configCOORDINATOR_AUTH_ENABLED— Authentication Phase 1 JWT () OR Phase 2 OAuth (COORDINATOR_OAUTH_ENABLED) — see [Authentication](#authentication)
configCOORDINATOR_DATA_DIR— ~/.mcp-coordinator/data Directory for the SQLite database
🔐 secretCOORDINATOR_ENCRYPTION_KEY
configCOORDINATOR_GITHUB_CLIENT_ID
🔐 secretCOORDINATOR_GITHUB_CLIENT_SECRET
configCOORDINATOR_INSECURE_COOKIES
configCOORDINATOR_JWT_EXPIRY
🔐 secretCOORDINATOR_JWT_PREV_SECRET
🔐 secretCOORDINATOR_JWT_SECRET
configCOORDINATOR_LAYER4_MAX_COMMITS
configCOORDINATOR_LAYER4_REFRESH_INTERVAL_MS
configCOORDINATOR_LAYER4_RETRY_MS
configCOORDINATOR_LAYER4_SINCE_DAYS
configCOORDINATOR_MAX_BODY_BYTES
configCOORDINATOR_MAX_SSE_CLIENTS
🔐 secretCOORDINATOR_MQTT_PASSWORD
configCOORDINATOR_MQTT_TCP_PORT— 1883 TCP port for the embedded broker
configCOORDINATOR_MQTT_URL
configCOORDINATOR_MQTT_USER
configCOORDINATOR_MQTT_WS_PATH
configCOORDINATOR_OAUTH_ENABLED— Authentication Phase 1 JWT (COORDINATOR_AUTH_ENABLED) OR Phase 2 OAuth () — see [Authentication](#authentication)
configCOORDINATOR_ORG
configCOORDINATOR_PUBLIC_URL
🔐 secretCOORDINATOR_REGISTRATION_SECRET
configCOORDINATOR_REPO_ROOT— 4 Git co-change history (opt-in) 40-60 Files historically modified together — requires + git on PATH
configCOORDINATOR_SSE_HEARTBEAT_MS
configCOORDINATOR_TOKEN_LOSS_CONFIRM
configCOORDINATOR_WORKING_FILES_SWEEP_INTERVAL_MS
configCOORDINATOR_WORKING_FILES_TTL_MIN
configLOG_LEVEL— info debug / info / warn / error
configMCP_COORDINATOR_PROFILE
configPORT— 3100 HTTP port (also serves MQTT-over-WebSocket on /mqtt)
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/swoofer-mcp-coordinator-gkqxc9)](https://m8ven.ai/mcp/swoofer-mcp-coordinator-gkqxc9)
commit: 94cd92d0f73801f4c24491c58108eb196b4bffbb
code hash: 796942f4b07c882c33dc9e8bd2ca2b8319a04e7360855ba300a75809be408664
verified: 6/15/2026, 1:49:35 PM
view raw JSON →