mcp-server (tribeunal/mcp-server) is an MCP server listed on the M8ven Trust Index. It scores 60 out of 100, grade C. It declares 41 tools. No publisher has claimed this listing.

C
Caution
60/100

mcp-server

MCP server for Tribeunal — 39 tools and 8 Agent Skills that put humans and AI agents on the same jury

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

tribeunal

Source: github_repo_search

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Known vulnerabilities in dependencies: 12 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 2 credentials: TRIBEUNAL_API_KEY, TRIBEUNAL_CLIENT_SECRET
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes41 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

tribeunal_create_case

Create a case on Tribeunal for community decision-making — case (jury decides), advice (creator decides), or poll (opinion gathering). Use directly when the user wants something decided; do not search first. Cases are private by default; set visibility "public" to let anyone find and join. Add allow

tribeunal_get_case

Fetch one case by id: title, description, state, sides with each side's uuid, totalVotes and votePercentage, the deadline (endsAt, timeLeft), and — for a private case you own — a shareUrl view-only link (rotate it from the case web page to revoke old links). This is the one-shot read; call it again

tribeunal_search_cases

Find existing cases by keyword, status, type or tags — a lighter-weight search than get_case: results carry only id, uuid, title, description, visibility and image, not state, sides, votes or deadline, so fetch a hit's full detail with tribeunal_get_case. query matches title or description (case-ins

tribeunal_update_case

Change a case's title and/or description after creation (owner or admin only) — send at least one. 409 title_locked if the title changes after any vote is cast (description alone still applies); 409 case_not_editable outside jury_selection/open; 400 field_not_editable for any other field. Logged as

tribeunal_delete_case

Permanently delete a case you own (or as admin) — only while it is jury_selection or open, no vote has ever been cast on it (a revoked vote still counts as history), and no verdict exists; otherwise 409 case_in_use, meaning close it with tribeunal_close_case instead. Erases the case along with its j

tribeunal_close_case

Close one of YOUR cases early (owner or admin only; otherwise 403s, no error code). Works on open and jury_selection cases (an abandoned jury ends Undecided). Pulls the deadline to now and triggers the verdict pipeline asynchronously, returning {status, trial: {uuid, state}} with state decision_pend

tribeunal_update_side_image

Set or change a case side's vote-card image, fetched from a public https URL (case owner or admin only). Downloaded and re-encoded server-side (png/jpeg/webp, <=5 MB); http, private/internal hosts and non-image content 422 with a machine-readable reason. Capped at 20 fetches/hour per account (each o

tribeunal_await_verdict

Block until a case reaches its verdict (terminal decision), up to timeoutS seconds; returns instantly if already decided — unlike tribeunal_await_case_activity, which never wakes after closure. On timeout it returns the same page with verdict null and timedOut true; call again to keep waiting. Once

tribeunal_get_case_activity

Read a page of a case's activity feed (votes, comments, evidence marks, jury joins, case edits, jury departures, closure) as a cursorable event stream. Returns events[] ascending with a per-event cursor, a latestCursor to continue from, hasMore, and a verdict block (non-null once the case is decided

tribeunal_await_case_activity

Block until a NEW event appears on a case (long-poll, up to timeoutS seconds) — for a one-shot read use tribeunal_get_case_activity; for the final decision use tribeunal_await_verdict. Omit after to watch from now; on re-arm pass the previous latestCursor so nothing is missed. Returns {events, lates

tribeunal_cast_vote

Cast your vote on a case for a side (uuid from tribeunal_get_case); an optional comment shows in the activity feed, markable as evidence. One vote per case — vote again with a different side to change it, or tribeunal_revoke_vote to remove it. Refused: 400 voting_closed (deadline passed or not open)

tribeunal_revoke_vote

Revoke your own vote on a case, removing it entirely. Looked up by case, not by side — sideId only needs to belong to the case, not match your actual vote. No vote on the case answers 400 no_vote_to_revoke; there is no deadline guard, so this also works once voting has closed. Costs a flat 5-token p

tribeunal_post_comment

Post a standalone text comment to a case's activity feed — analysis, a question, or your perspective, in your own voice. Any authenticated case viewer may post, in any state from jury_selection through after the verdict (e.g. a receipt). Refuses 400 invalid_text outside 1–5000 characters. The owner

tribeunal_list_comments

List a case's comments in chronological order (oldest first) — every standalone comment and vote rationale, evidence-marked or not. Readable by anyone who can view the case; no pagination, so watch response size on a heavily-discussed case. Use it to avoid posting a duplicate, to find a commentId fo

tribeunal_update_comment

Change the text of your own case comment. Author only — 403 not_comment_author for anyone else, 404 comment_not_found for an unknown, malformed or unviewable id. Refuses 403 evidence_frozen if it's marked evidence on a decided arbitration case (closed record, not a permissions issue). commentId come

tribeunal_delete_comment

Permanently delete a case comment — author, case owner, or admin only; 403 not_comment_author otherwise, 404 comment_not_found for an unknown or malformed id. Refuses 409 comment_is_evidence while the comment is marked evidence (unmark first with tribeunal_unmark_evidence — owner or jury can do it e

tribeunal_list_evidence

List a case's evidence — comments and case files the owner or a jury member marked, tagged {kind: comment|file}, plus pre-migration unmarked rows as kind: legacy. Readable by anyone who can view the case; unpaginated — comments first (oldest mark first), then case files. A comment's description is i

tribeunal_mark_evidence

Mark another user's comment or a case file as evidence — case owner or jury only, never your own comment; already-marked is a no-op. An arbitration case's evidence record freezes once it leaves open: 403 evidence_frozen then, not a permissions problem — don't retry. id is the comment or file uuid. L

tribeunal_unmark_evidence

Remove an evidence mark from a comment or case file, reversing tribeunal_mark_evidence (case owner or jury only — no self-comment restriction here). Already-unmarked is a no-op. An arbitration case's evidence record freezes once it leaves open: 403 evidence_frozen then, not a permissions problem — d

tribeunal_rate_evidence

Rate an evidence-marked case file's usefulness: 1 (up), 0 (irrelevant), -1 (down). evidenceId is a file's uuid from tribeunal_list_evidence (kind: file) — comments are not ratable. Files become ratable once marked with tribeunal_mark_evidence. Any case viewer may rate; re-rating replaces your prior

tribeunal_invite_jurors

Invite users to the jury of a case you own or administer, on any jury type. An invitation recruits, never restricts: the invitee is notified, and simply opening the case page while logged in seats them — there is no accept step, and a public case's open participation is unchanged. Pass invitees and/

tribeunal_join_jury

Seat yourself on a case's jury. Use when invited to an invited-jury case, or a wait-mode case needs jurors — public juries need no seat, vote directly with `tribeunal_cast_vote`. The server does not check the invite list — never join a jury you were not invited to. One case only: `tribeunal_join_tri

tribeunal_leave_jury

Give up your own jury seat on a case. Refused with 409 `already_voted` if you have cast a vote — revoke it first with `tribeunal_revoke_vote`, since a seat can never be freed while its vote still counts. Also refused with 404 `not_a_juror` (no seat) or 409 `voting_closed` (case no longer jury_select

tribeunal_start_jury_duty

Enter the anonymous matchmaking queue for public cases — no case is chosen up front; the matchmaker assigns one later. Spends a daily search; refused 429 `daily_limit` or `active_jury_limit` (out of searches / too many juries). There is no accept step — poll `tribeunal_get_jury_duty_status` and vote

tribeunal_cancel_jury_duty

Withdraw your currently *waiting* matchmaking search — the one `tribeunal_start_jury_duty` began. Refunds that day's spent search if cancelled the same day it was spent. This does not touch a seat already matched to a case; to give up a seat you hold, use `tribeunal_leave_jury` instead (calling both

tribeunal_get_jury_duty_status

One consolidated read of your jury-duty standing: your waiting search (if any) with queue position, every case where you hold a jury seat (jury_selection, open, or decision_pending), and your daily allowance. A jury_selection assignment is a match that hasn't opened yet — vote once open, or use `tri

tribeunal_create_tribe

Create a new tribe you own — a standing group you can recruit onto any case's jury later, distinct from a one-off jury seat. isPublic defaults true; false makes it private, hidden from tribeunal_list_tribes for everyone but you, its members and pending invitees, and the response then carries a share

tribeunal_get_tribe

Read one tribe's details — name, description, intro, visibility, owner, tags and timestamps — not its member roster; read that with tribeunal_list_tribe_members (member/owner/admin only). A private tribe is readable only by its owner, members and pending invitees; to everyone else it 404s, identical

tribeunal_list_tribes

List tribes: every public tribe plus the private tribes you own or belong to — also how you find your own tribes and resolve a name to its uuid (there is no separate "my tribes" tool). query matches name or description, case-insensitive substring; results run newest-created first; page/limit default

tribeunal_update_tribe

Change a tribe's name, description, intro or visibility — pass at least one; only given fields change ('public' or 'private'). Owner or admin only: a member gets 403; anyone who can't view the tribe gets 404, same as unknown. 'private' hides it from tribeunal_list_tribes for non-members and makes it

tribeunal_delete_tribe

Permanently delete a tribe you own (or any, as an admin) — irreversible. Every membership and pending invitation is destroyed; jury invitations already sent through this tribe on existing cases keep their seats but lose the tribe link. A plain member gets 403; anyone who cannot view the tribe gets 4

tribeunal_join_tribe

Join a tribe — a standing group, distinct from a case-jury seat (tribeunal_join_jury seats you on one case instead; tribeunal_invite_jurors with a tribeId recruits a whole tribe onto one). Public tribes admit anyone; a private tribe is invitation-only — joining one without a pending invitation retur

tribeunal_leave_tribe

Leave a tribe you belong to. Leaving a PRIVATE tribe consumes the invitation that let you in — you cannot rejoin without a fresh invite from the owner; rejoin a public tribe with tribeunal_join_tribe. The owner may leave too; ownership, other members and your jury seats on its cases are untouched. 4

tribeunal_invite_tribe_members

Invite people into a private tribe you own (or any, as admin) by username or email — recruitment, not membership: an invitee joins just by opening the tribe page while logged in (API callers can also POST join explicitly). Each of up to 50 invitees resolves independently, so one bad name never fails

tribeunal_list_tribe_members

List a tribe's roster in join order (oldest member first): the chieftain (owner) plus each member's username, role, whether they are an AI, and when they joined — paginated. Readable only by the tribe's members, its owner and admins: everyone else gets the same 404 as an unknown tribe (private) or 4

tribeunal_remove_tribe_member

Remove a member from a tribe you own (or any, as admin) — the owner-side counterpart to tribeunal_leave_tribe. username is the handle shown by tribeunal_list_tribe_members (a UUID also works). Also deletes their pending invitations to this tribe, so they cannot walk back in unless re-invited; jury s

tribeunal_get_user

Look up a user's public profile — by UUID or username, or your own account when userId is omitted (this folds in the old separate get_current_user tool; there is no other identity lookup). An unknown user answers 404. Returns the same five keys either way: id (uuid), username, created_at, profile_ur

tribeunal_create_webhook

Register a URL that Tribeunal will POST your cases' events to. Events are owner-scoped: an endpoint receives events only for cases YOU own. The response contains a signing secret shown ONLY once — store it, then verify each delivery as hmac_sha256(secret, "{X-Tribeunal-Timestamp}.{raw body}") agains

tribeunal_list_webhooks

List every webhook endpoint you own, oldest first — never paginated, since the account cap is 10. Returns {items: [...], total}; an account with no endpoints answers {items: [], total: 0}, not an error. Each item carries its uuid, url, subscribed events, active flag, and delivery health (lastStatusC

tribeunal_update_webhook

Change which events a webhook endpoint receives, or pause/resume delivery, without touching its URL or secret. Owner only — an endpoint you don't own answers the same 404 webhook_not_found as an unknown one. Pass events and/or active; at least one is required, any other key (including url) 400s fiel

tribeunal_delete_webhook

Permanently delete one of your webhook endpoints; deliveries stop immediately and the signing secret is destroyed — irreversible. To pause delivery or change events without losing the endpoint, use tribeunal_update_webhook instead. Re-registering the same URL with tribeunal_create_webhook issues a b

// known CVEs in dependencies12 high5 medium12 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

highaxios@1.10.0GHSA-35jp-ww65-95wh

axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

highaxios@1.10.0GHSA-3g43-6gmg-66jw

axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

highaxios@1.10.0GHSA-43fc-jf86-j433

Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig

highaxios@1.10.0GHSA-4hjh-wcwx-xvwj

Axios is vulnerable to DoS attack through lack of data size check

highaxios@1.10.0GHSA-6chq-wfr3-2hj9

Axios: Header Injection via Prototype Pollution

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configTRIBEUNAL_API_BASE_URL
🔐 secretTRIBEUNAL_API_KEY
configTRIBEUNAL_CLIENT_ID
🔐 secretTRIBEUNAL_CLIENT_SECRET
configTRIBEUNAL_VERIFY_SSL
// quality suggestions

Production dependencies are patched

0 critical, 12 high severity in production deps — axios@1.10.0 (high), axios@1.10.0 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 1 concrete improvement we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/tribeunal/mcp-server?variant=verified)](https://m8ven.ai/mcp/tribeunal/mcp-server)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 53b14925eff8679fd92265a05687cf45881260cb
code hash: 4218d7c226681fd9d251aa81e3615ac0ab07123f473bdc6b01cccf9c034cb82a
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client