Open Mind (theippenguin/open-mind) is an MCP server listed on the M8ven Trust Index. It scores 74 out of 100, grade C. It declares 38 tools. No publisher has claimed this listing.

C
Caution
74/100

Open Mind

Self-hosted personal knowledge base with semantic search, enabling AI agents to capture, search, and manage thoughts using PostgreSQL with pgvector.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

theippenguin

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
🚨
Secret credentials may flow to a network call
1 flow detected: SLACK_BOT_TOKEN. We can’t prove the destination matches the brand the credential belongs to.
⚠️
Known vulnerabilities in dependencies: 1 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 6 credentials: API_KEY, OPENAI_API_KEY, OPENAI_CLIENT_SECRET, OPENROUTER_API_KEY, SLACK_BOT_TOKEN, SLACK_SIGNING_SECRET
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes38 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

add_calendar_event

Add an event to the family calendar.

list_calendar_events

List calendar events within a date range, optionally filtered by category.

update_calendar_event

Update fields on an existing calendar event.

delete_calendar_event

Delete a calendar event by ID.

add_maintenance_task

Add a home maintenance task (HVAC filter, gutter cleaning, etc.) with optional recurrence schedule.

list_maintenance_tasks

List home maintenance tasks with optional filters for status, category, and due date range.

complete_maintenance_task

Mark a maintenance task as completed, log it to history, and auto-advance the next due date if recurring.

get_due_maintenance

Get maintenance tasks due within the next N days.

add_household_item

Add an item to your household knowledge base (appliances, furniture, documents, supplies, etc.)

search_household_items

Search household items by name, category, or location using text matching.

get_household_item

Get a specific household item by its ID.

update_household_item

Update fields on an existing household item.

delete_household_item

Delete a household item by ID.

add_job_application

Add a new job application to your pipeline.

list_applications

List job applications, optionally filtered by stage.

update_application_stage

Update the stage of a job application and optionally add notes.

add_interview

Schedule an interview for a job application.

update_interview

Update an interview with post-interview notes and outcome.

get_pipeline_summary

Get a summary of your job hunt pipeline with counts by stage and upcoming interviews.

add_recipe

Add a recipe to your collection.

search_recipes

Search recipes by name, tags, or ingredients.

plan_meal

Assign a recipe or custom meal to a specific date and meal type.

get_meal_plan

Get the meal plan for a date range, including linked recipe names.

add_grocery_item

Add an item to the grocery shopping list.

get_grocery_list

Get the current grocery list (unpurchased items), grouped by category.

mark_purchased

Mark a grocery item as purchased.

add_contact

Add a professional contact to your CRM.

search_contacts

Search professional contacts by name, company, or tags.

log_interaction

Log an interaction with a professional contact (meeting, email, call, coffee, etc.).

get_contact_history

Get a contact and all their interaction history.

create_opportunity

Create a deal or business opportunity linked to a contact.

get_follow_ups_due

Get contacts that need follow-up, either past due or coming up soon.

link_thought_to_contact

Link a captured thought to a contact interaction, creating a connection between your knowledge base and CRM.

capture_thought

Save a thought, idea, or piece of information to your personal knowledge base. Automatically generates embeddings for semantic search and extracts metadata (topics, people, action items).

list_agents

List all agents that have stored memories, with thought counts and last activity. Use this to see which agents are active and what they have been working on.

list_thoughts

Browse your recent thoughts chronologically. Filter by type, source, or date range.

search_thoughts

Semantic search across your knowledge base. Finds thoughts by meaning, not just keywords. Use this to recall information, find related ideas, or search for topics.

thought_stats

Get statistics about your knowledge base: total thoughts, breakdown by type/source, top topics, and more.

// known CVEs in dependencies1 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

highdrizzle-orm@0.45.1GHSA-gpj5-g38j-94v9

Drizzle ORM has SQL injection via improperly escaped SQL identifiers

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
🔐 secretAPI_KEYPaste the output into .env as the value
configEMBEDDING_PROVIDER${EMBEDDING_PROVIDER:-ollama}
configENABLED_EXTENSIONS${ENABLED_EXTENSIONS:-household-knowledge,home-maintenance,family-calendar,meal-planning,professional-crm,job-hunt-pipeline}
configMETADATA_LLM_MODEL${METADATA_LLM_MODEL:-llama3.2}
configMETADATA_LLM_PROVIDER${METADATA_LLM_PROVIDER:-ollama}
configOLLAMA_BASE_URL${OLLAMA_BASE_URL:-http://192.168.1.100:11434}
configOLLAMA_EMBEDDING_MODELnomic-embed-text
🔐 secretOPENAI_API_KEY${OPENAI_API_KEY:-}
configOPENAI_CLIENT_ID${OPENAI_CLIENT_ID:-}
🔐 secretOPENAI_CLIENT_SECRET${OPENAI_CLIENT_SECRET:-}
configOPENAI_REDIRECT_URI${OPENAI_REDIRECT_URI:-http://localhost:3100/auth/openai/callback}
🔐 secretOPENROUTER_API_KEY${OPENROUTER_API_KEY:-}
🔐 secretSLACK_BOT_TOKEN
configSLACK_REPLY_ENABLED
🔐 secretSLACK_SIGNING_SECRET
Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.
deployDATABASE_URL
deployPORT
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

38/38 tools missing one or more hints — add_calendar_event (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); list_calendar_events (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); update_calendar_event (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +35 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool inputs are validated

34/38 tool handlers declare input schemas (89%)

Declare an inputSchema with zod/joi/yup on every tool definition.

Tool handlers catch errors

Only 1/38 tool handlers wrap calls in try/catch (3%)

Wrap each tool handler body in try/catch and return a structured error response.

License file

No license file

Add a LICENSE file (MIT, Apache-2.0, etc.).

Tests exist

No test files found

Add tests that exercise each declared tool.

Production dependencies are patched

0 critical, 1 high severity in production deps — drizzle-orm@0.45.1 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/theippenguin/open-mind?variant=verified)](https://m8ven.ai/mcp/theippenguin/open-mind)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 345a359bd99c4dde925d9fce9725bc15760239b7
code hash: 21b075d26dbd3287aef39ceeb85403168c5cdf44faf22ac6a3d5c20ff3503b09
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client