/ 100

27 days ago

glama

Trusty Squire

Item: Trusty Squire
Rating: 43
Author: M8ven

Signs up to SaaS platforms and vaults the credential so you can focus on coding

→ Trusty-Squire/trusty-squire · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

🚨

Known vulnerabilities in dependencies: 2 critical

Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.

🔐

You'll be asked for 12 credentials: ADAPTER_SIGNING_PRIVATE_KEY, FUNNEL_METRICS_TOKEN, GMAIL_APP_PASSWORD, LOCAL_KMS_KEY, OPERATOR_IMAP_PASSWORD, REGISTRY_ADMIN_BEARER, RESEND_API_KEY, SESSION_JWT_SECRET, SKILL_VERIFY_PUBLIC_KEY, TWOCAPTCHA_API_KEY, UNIVERSAL_BOT_API_KEY, WORKSPACE_IMAP_PASSWORD

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// known CVEs in dependencies2 critical

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

criticalvitest@1.2.0GHSA-5xrq-8626-4rwp

When Vitest UI server is listening, arbitrary file can be read and executed

criticalvitest@1.2.0GHSA-9crc-q9x8-hgqq

Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening

Depend on this server? Get alerted when its CVEs change.Watch this server free →

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configADAPTER_REGISTRY_URL

🔐 secretADAPTER_SIGNING_PRIVATE_KEY

configAPI_ACCOUNT_HOURLY_LIMIT

configAPI_PORT

configAPP_BASE_URL

configAUTH_DATABASE_URL

configBILLING_ENABLED

configBOT_BLOCK_RESOURCES

configBOT_CDP_ENDPOINT

configBOT_CDP_HARDENED

configBOT_NOVNC_H

configBOT_NOVNC_W

configBOT_SELF_LAUNCH

configCORPUS_DIR

configDATABASE_URL

configDISPLAY

configEDITOR

configEGRESS_503_RETRY_AFTER_SECONDS

configEGRESS_CRED_CACHE_TTL_MS

configEGRESS_DEFAULT_RATE_PER_HOUR

configFUNNEL_EXCLUDE_ACCOUNT_IDS

🔐 secretFUNNEL_METRICS_TOKEN

🔐 secretGMAIL_APP_PASSWORD

configGMAIL_USER

configHOUSEKEEPER_CONCURRENCY

configINSTALL_IP_HOURLY_LIMIT

🔐 secretLOCAL_KMS_KEY

configLOG_LEVEL

configMAINTENANCE_MESSAGE

configMETRICS_PORT

configOAUTH_CALLBACK_BASE_URL

configOAUTH_DEBUG_TS

🔐 secretOPERATOR_IMAP_PASSWORD

configOPERATOR_IMAP_USER

configPAIRING_TOKEN_RETENTION_HOURS

configPWA_BASE_URL

🔐 secretREGISTRY_ADMIN_BEARER

configREGISTRY_API_PORT

configREGISTRY_DATABASE_URL

🔐 secretRESEND_API_KEY

configRESEND_FROM_ADDRESS

configRESEND_FROM_NAME

🔐 secretSESSION_JWT_SECRET

🔐 secretSKILL_VERIFY_PUBLIC_KEY

configSSH_CONNECTION

configSSH_TTY

configTRUSTY_SQUIRE_ACCOUNT_ID

configTRUSTY_SQUIRE_AGENT_IDENTITY

configTRUSTY_SQUIRE_API_BASE

configTRUSTY_SQUIRE_DEMOTION_WEBHOOK_URL

configTRUSTY_SQUIRE_FORCE_DISPLAY

configTRUSTY_SQUIRE_FORCE_HEADLESS

configTRUSTY_SQUIRE_ONBOARDING_CAPTURE

configTRUSTY_SQUIRE_OPERATOR_RECIPE_DIR

configTRUSTY_SQUIRE_PROFILE_DIR

configTRUSTY_SQUIRE_REGISTRY_URL

configTRUSTY_SQUIRE_SESSION_FILE

configTRUSTY_SQUIRE_SOURCE_COMMIT

configTS_LOGIN_LOCAL_PORT

configTS_LOGIN_PUBLIC_HOSTNAME

🔐 secretTWOCAPTCHA_API_KEY

🔐 secretUNIVERSAL_BOT_API_KEY

configUNIVERSAL_BOT_CAPTCHA_TRACE

configUNIVERSAL_BOT_CHANNEL

configUNIVERSAL_BOT_CHROME_BINARY

configUNIVERSAL_BOT_HEADLESS

configUNIVERSAL_BOT_OAUTH_DEBUG

configUNIVERSAL_BOT_PROXY_ALWAYS

configUNIVERSAL_BOT_PROXY_URL

configUNIVERSAL_BOT_XVFB_DISPLAY

configVAULT_AUDIT_RETENTION_DAYS

configVAULT_ROTATION_STALE_DAYS

configVAULT_USE_MAX_RESPONSE_BYTES

configVISUAL

configVITEST

🔐 secretWORKSPACE_IMAP_PASSWORD

configWORKSPACE_IMAP_USER

configXDG_CONFIG_HOME

configXDG_SESSION_TYPE

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 2 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/trusty-squire-trusty-squire-1vdos4)](https://m8ven.ai/mcp/trusty-squire-trusty-squire-1vdos4)

commit: 1105decd2b90f0e10a2a27e1f4e244f816001aa9

code hash: c749c5a6591fb0d56818e221c37e5a9effadb35a61dc08f1524a81fca83d3534

verified: 7/4/2026, 9:10:22 AM

view raw JSON →