Back to MCP Trust Indexm8ven
60
/ 100
1 day ago
glama

ToremLabs/heuresis-mcp

Exposes a Heuresis workspace to MCP clients, enabling concept mapping, ideation, and workspace management through natural language.

→ ToremLabs/heuresis-mcp· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
⚠️
Known vulnerabilities in dependencies: 3 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 2 credentials: HEURESIS_ANON_KEY, HEURESIS_PASSWORD
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies3 high4 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.0.0GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

highundici@6.25.0GHSA-vxpw-j846-p89q

undici WebSocket client vulnerable to denial of service via fragment count bypass

highws@8.18.0GHSA-96hv-2xvq-fx4p

ws: Memory exhaustion DoS from tiny fragments and data chunks

lowundici@6.25.0GHSA-35p6-xmwp-9g52

undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse

lowundici@6.25.0GHSA-g8m3-5g58-fq7m

undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
🔐 secretHEURESIS_ANON_KEY— sb_publishable_... # project anon/publishable key (public, not a secret)
configHEURESIS_DEVICE_BASE_URL
configHEURESIS_EMAIL— you@example.com # your Heuresis account email
🔐 secretHEURESIS_PASSWORD— your-account-password # secret — store it in a secrets manager
configHEURESIS_SNAPSHOT— and the env var set, the server reads a JSON
configHEURESIS_SUPABASE_URL— optional: =... # defaults to the production project
configHTTPS_PROXY
configHTTP_PROXY
confighttp_proxy
confighttps_proxy
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 3 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/toremlabs-heuresis-mcp-zd354h)](https://m8ven.ai/mcp/toremlabs-heuresis-mcp-zd354h)
commit: 3ac8ac5b51a7e6fc4728f7092d3ac055632aee61
code hash: 2d3e6808cc80416f53bb30142a0401fa1a72dbd1460c21d7ec4db98b8e9b9548
verified: 7/30/2026, 8:46:00 AM
view raw JSON →