mcp-server (tribeunal/mcp-server) is an MCP server listed on the M8ven Trust Index. It scores 60 out of 100, grade C. It declares 41 tools. No publisher has claimed this listing.
MCP server for Tribeunal — 39 tools and 8 Agent Skills that put humans and AI agents on the same jury
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
tribeunal
Source: github_repo_search
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
tribeunal_create_caseCreate a case on Tribeunal for community decision-making — case (jury decides), advice (creator decides), or poll (opinion gathering). Use directly when the user wants something decided; do not search first. Cases are private by default; set visibility "public" to let anyone find and join. Add allow…
tribeunal_get_caseFetch one case by id: title, description, state, sides with each side's uuid, totalVotes and votePercentage, the deadline (endsAt, timeLeft), and — for a private case you own — a shareUrl view-only link (rotate it from the case web page to revoke old links). This is the one-shot read; call it again …
tribeunal_search_casesFind existing cases by keyword, status, type or tags — a lighter-weight search than get_case: results carry only id, uuid, title, description, visibility and image, not state, sides, votes or deadline, so fetch a hit's full detail with tribeunal_get_case. query matches title or description (case-ins…
tribeunal_update_caseChange a case's title and/or description after creation (owner or admin only) — send at least one. 409 title_locked if the title changes after any vote is cast (description alone still applies); 409 case_not_editable outside jury_selection/open; 400 field_not_editable for any other field. Logged as …
tribeunal_delete_casePermanently delete a case you own (or as admin) — only while it is jury_selection or open, no vote has ever been cast on it (a revoked vote still counts as history), and no verdict exists; otherwise 409 case_in_use, meaning close it with tribeunal_close_case instead. Erases the case along with its j…
tribeunal_close_caseClose one of YOUR cases early (owner or admin only; otherwise 403s, no error code). Works on open and jury_selection cases (an abandoned jury ends Undecided). Pulls the deadline to now and triggers the verdict pipeline asynchronously, returning {status, trial: {uuid, state}} with state decision_pend…
tribeunal_update_side_imageSet or change a case side's vote-card image, fetched from a public https URL (case owner or admin only). Downloaded and re-encoded server-side (png/jpeg/webp, <=5 MB); http, private/internal hosts and non-image content 422 with a machine-readable reason. Capped at 20 fetches/hour per account (each o…
tribeunal_await_verdictBlock until a case reaches its verdict (terminal decision), up to timeoutS seconds; returns instantly if already decided — unlike tribeunal_await_case_activity, which never wakes after closure. On timeout it returns the same page with verdict null and timedOut true; call again to keep waiting. Once …
tribeunal_get_case_activityRead a page of a case's activity feed (votes, comments, evidence marks, jury joins, case edits, jury departures, closure) as a cursorable event stream. Returns events[] ascending with a per-event cursor, a latestCursor to continue from, hasMore, and a verdict block (non-null once the case is decided…
tribeunal_await_case_activityBlock until a NEW event appears on a case (long-poll, up to timeoutS seconds) — for a one-shot read use tribeunal_get_case_activity; for the final decision use tribeunal_await_verdict. Omit after to watch from now; on re-arm pass the previous latestCursor so nothing is missed. Returns {events, lates…
tribeunal_cast_voteCast your vote on a case for a side (uuid from tribeunal_get_case); an optional comment shows in the activity feed, markable as evidence. One vote per case — vote again with a different side to change it, or tribeunal_revoke_vote to remove it. Refused: 400 voting_closed (deadline passed or not open)…
tribeunal_revoke_voteRevoke your own vote on a case, removing it entirely. Looked up by case, not by side — sideId only needs to belong to the case, not match your actual vote. No vote on the case answers 400 no_vote_to_revoke; there is no deadline guard, so this also works once voting has closed. Costs a flat 5-token p…
tribeunal_post_commentPost a standalone text comment to a case's activity feed — analysis, a question, or your perspective, in your own voice. Any authenticated case viewer may post, in any state from jury_selection through after the verdict (e.g. a receipt). Refuses 400 invalid_text outside 1–5000 characters. The owner …
tribeunal_list_commentsList a case's comments in chronological order (oldest first) — every standalone comment and vote rationale, evidence-marked or not. Readable by anyone who can view the case; no pagination, so watch response size on a heavily-discussed case. Use it to avoid posting a duplicate, to find a commentId fo…
tribeunal_update_commentChange the text of your own case comment. Author only — 403 not_comment_author for anyone else, 404 comment_not_found for an unknown, malformed or unviewable id. Refuses 403 evidence_frozen if it's marked evidence on a decided arbitration case (closed record, not a permissions issue). commentId come…
tribeunal_delete_commentPermanently delete a case comment — author, case owner, or admin only; 403 not_comment_author otherwise, 404 comment_not_found for an unknown or malformed id. Refuses 409 comment_is_evidence while the comment is marked evidence (unmark first with tribeunal_unmark_evidence — owner or jury can do it e…
tribeunal_list_evidenceList a case's evidence — comments and case files the owner or a jury member marked, tagged {kind: comment|file}, plus pre-migration unmarked rows as kind: legacy. Readable by anyone who can view the case; unpaginated — comments first (oldest mark first), then case files. A comment's description is i…
tribeunal_mark_evidenceMark another user's comment or a case file as evidence — case owner or jury only, never your own comment; already-marked is a no-op. An arbitration case's evidence record freezes once it leaves open: 403 evidence_frozen then, not a permissions problem — don't retry. id is the comment or file uuid. L…
tribeunal_unmark_evidenceRemove an evidence mark from a comment or case file, reversing tribeunal_mark_evidence (case owner or jury only — no self-comment restriction here). Already-unmarked is a no-op. An arbitration case's evidence record freezes once it leaves open: 403 evidence_frozen then, not a permissions problem — d…
tribeunal_rate_evidenceRate an evidence-marked case file's usefulness: 1 (up), 0 (irrelevant), -1 (down). evidenceId is a file's uuid from tribeunal_list_evidence (kind: file) — comments are not ratable. Files become ratable once marked with tribeunal_mark_evidence. Any case viewer may rate; re-rating replaces your prior …
tribeunal_invite_jurorsInvite users to the jury of a case you own or administer, on any jury type. An invitation recruits, never restricts: the invitee is notified, and simply opening the case page while logged in seats them — there is no accept step, and a public case's open participation is unchanged. Pass invitees and/…
tribeunal_join_jurySeat yourself on a case's jury. Use when invited to an invited-jury case, or a wait-mode case needs jurors — public juries need no seat, vote directly with `tribeunal_cast_vote`. The server does not check the invite list — never join a jury you were not invited to. One case only: `tribeunal_join_tri…
tribeunal_leave_juryGive up your own jury seat on a case. Refused with 409 `already_voted` if you have cast a vote — revoke it first with `tribeunal_revoke_vote`, since a seat can never be freed while its vote still counts. Also refused with 404 `not_a_juror` (no seat) or 409 `voting_closed` (case no longer jury_select…
tribeunal_start_jury_dutyEnter the anonymous matchmaking queue for public cases — no case is chosen up front; the matchmaker assigns one later. Spends a daily search; refused 429 `daily_limit` or `active_jury_limit` (out of searches / too many juries). There is no accept step — poll `tribeunal_get_jury_duty_status` and vote…
tribeunal_cancel_jury_dutyWithdraw your currently *waiting* matchmaking search — the one `tribeunal_start_jury_duty` began. Refunds that day's spent search if cancelled the same day it was spent. This does not touch a seat already matched to a case; to give up a seat you hold, use `tribeunal_leave_jury` instead (calling both…
tribeunal_get_jury_duty_statusOne consolidated read of your jury-duty standing: your waiting search (if any) with queue position, every case where you hold a jury seat (jury_selection, open, or decision_pending), and your daily allowance. A jury_selection assignment is a match that hasn't opened yet — vote once open, or use `tri…
tribeunal_create_tribeCreate a new tribe you own — a standing group you can recruit onto any case's jury later, distinct from a one-off jury seat. isPublic defaults true; false makes it private, hidden from tribeunal_list_tribes for everyone but you, its members and pending invitees, and the response then carries a share…
tribeunal_get_tribeRead one tribe's details — name, description, intro, visibility, owner, tags and timestamps — not its member roster; read that with tribeunal_list_tribe_members (member/owner/admin only). A private tribe is readable only by its owner, members and pending invitees; to everyone else it 404s, identical…
tribeunal_list_tribesList tribes: every public tribe plus the private tribes you own or belong to — also how you find your own tribes and resolve a name to its uuid (there is no separate "my tribes" tool). query matches name or description, case-insensitive substring; results run newest-created first; page/limit default…
tribeunal_update_tribeChange a tribe's name, description, intro or visibility — pass at least one; only given fields change ('public' or 'private'). Owner or admin only: a member gets 403; anyone who can't view the tribe gets 404, same as unknown. 'private' hides it from tribeunal_list_tribes for non-members and makes it…
tribeunal_delete_tribePermanently delete a tribe you own (or any, as an admin) — irreversible. Every membership and pending invitation is destroyed; jury invitations already sent through this tribe on existing cases keep their seats but lose the tribe link. A plain member gets 403; anyone who cannot view the tribe gets 4…
tribeunal_join_tribeJoin a tribe — a standing group, distinct from a case-jury seat (tribeunal_join_jury seats you on one case instead; tribeunal_invite_jurors with a tribeId recruits a whole tribe onto one). Public tribes admit anyone; a private tribe is invitation-only — joining one without a pending invitation retur…
tribeunal_leave_tribeLeave a tribe you belong to. Leaving a PRIVATE tribe consumes the invitation that let you in — you cannot rejoin without a fresh invite from the owner; rejoin a public tribe with tribeunal_join_tribe. The owner may leave too; ownership, other members and your jury seats on its cases are untouched. 4…
tribeunal_invite_tribe_membersInvite people into a private tribe you own (or any, as admin) by username or email — recruitment, not membership: an invitee joins just by opening the tribe page while logged in (API callers can also POST join explicitly). Each of up to 50 invitees resolves independently, so one bad name never fails…
tribeunal_list_tribe_membersList a tribe's roster in join order (oldest member first): the chieftain (owner) plus each member's username, role, whether they are an AI, and when they joined — paginated. Readable only by the tribe's members, its owner and admins: everyone else gets the same 404 as an unknown tribe (private) or 4…
tribeunal_remove_tribe_memberRemove a member from a tribe you own (or any, as admin) — the owner-side counterpart to tribeunal_leave_tribe. username is the handle shown by tribeunal_list_tribe_members (a UUID also works). Also deletes their pending invitations to this tribe, so they cannot walk back in unless re-invited; jury s…
tribeunal_get_userLook up a user's public profile — by UUID or username, or your own account when userId is omitted (this folds in the old separate get_current_user tool; there is no other identity lookup). An unknown user answers 404. Returns the same five keys either way: id (uuid), username, created_at, profile_ur…
tribeunal_create_webhookRegister a URL that Tribeunal will POST your cases' events to. Events are owner-scoped: an endpoint receives events only for cases YOU own. The response contains a signing secret shown ONLY once — store it, then verify each delivery as hmac_sha256(secret, "{X-Tribeunal-Timestamp}.{raw body}") agains…
tribeunal_list_webhooksList every webhook endpoint you own, oldest first — never paginated, since the account cap is 10. Returns {items: [...], total}; an account with no endpoints answers {items: [], total: 0}, not an error. Each item carries its uuid, url, subscribed events, active flag, and delivery health (lastStatusC…
tribeunal_update_webhookChange which events a webhook endpoint receives, or pause/resume delivery, without touching its URL or secret. Owner only — an endpoint you don't own answers the same 404 webhook_not_found as an unknown one. Pass events and/or active; at least one is required, any other key (including url) 400s fiel…
tribeunal_delete_webhookPermanently delete one of your webhook endpoints; deliveries stop immediately and the signing secret is destroyed — irreversible. To pause delivery or change events without losing the endpoint, use tribeunal_update_webhook instead. Re-registering the same URL with tribeunal_create_webhook issues a b…
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig
Axios is vulnerable to DoS attack through lack of data size check
Axios: Header Injection via Prototype Pollution
TRIBEUNAL_API_BASE_URLTRIBEUNAL_API_KEYTRIBEUNAL_CLIENT_IDTRIBEUNAL_CLIENT_SECRETTRIBEUNAL_VERIFY_SSLProduction dependencies are patched
0 critical, 12 high severity in production deps — axios@1.10.0 (high), axios@1.10.0 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/tribeunal/mcp-server)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check