Baasix MCP Server (tspvivek/baasix-mcp) is an MCP server listed on the M8ven Trust Index. It scores 54 out of 100, grade D. It declares 57 tools. No publisher has claimed this listing.
Enables to interact with Baasix Backend-as-a-Service operations including schema management, CRUD, filtering, authentication, and realtime subscriptions through MCP tools.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
tspvivek
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
baasix_list_schemasGet all available collections/schemas in Baasix with optional search and pagination
baasix_get_schemaGet detailed schema information for a specific collection
baasix_create_schemaCreate a new collection schema in Baasix. FIELD TYPES: - String: VARCHAR with values.length (e.g., 255) - Text: Unlimited text - Integer, BigInt: Whole numbers - Decimal: values.precision & values.scale - Float, Real, Double: Floating point - Boolean: true/false - Date, DateTime, Time: Date/time - …
baasix_update_schemaUpdate an existing collection schema
baasix_delete_schemaDelete a collection schema
baasix_add_indexAdd an index to a collection schema
baasix_remove_indexRemove an index from a collection schema
baasix_create_relationshipCreate a relationship between collections. RELATIONSHIP TYPES: - M2O (Many-to-One): Creates foreign key with auto-index. products.category → categories - O2M (One-to-Many): Virtual reverse of M2O. categories.products → products - O2O (One-to-One): Creates foreign key with auto-index. user.profile →…
baasix_update_relationshipUpdate an existing relationship
baasix_delete_relationshipDelete a relationship
baasix_export_schemasExport all schemas as JSON
baasix_import_schemasImport schemas from JSON data
baasix_list_itemsQuery items from a collection with powerful filtering, sorting, pagination, relations, and aggregation. FILTER OPERATORS (50+): - Comparison: eq, neq, gt, gte, lt, lte - String: contains, icontains, startswith, endswith, like, ilike, regex - Null: isNull (true/false), empty (true/false) - List: in,…
baasix_get_itemGet a specific item by ID from a collection, optionally including related data
baasix_create_itemCreate a new item in a collection
baasix_update_itemUpdate an existing item in a collection
baasix_delete_itemDelete an item from a collection
baasix_list_filesList files with metadata and optional filtering
baasix_get_file_infoGet detailed information about a specific file
baasix_delete_fileDelete a file
baasix_auth_statusCheck the current authentication status and token validity
baasix_refresh_authForce refresh the authentication token (only works for email/password auth)
baasix_generate_reportGenerate reports with grouping and aggregation for a collection
baasix_collection_statsGet collection statistics and analytics
baasix_list_notificationsList notifications for the authenticated user
baasix_send_notificationSend a notification to specified users
baasix_mark_notification_seenMark a notification as seen
baasix_get_settingsGet application settings
baasix_update_settingsUpdate application settings
baasix_list_templatesList all email templates with optional filtering
baasix_get_templateGet a specific email template by ID
baasix_update_templateUpdate an email template's subject, description, or body content. TEMPLATE TYPES: - magic_link: Magic link authentication emails - invite: User invitation emails - password_reset: Password reset emails - welcome: Welcome emails - verification: Email verification emails AVAILABLE VARIABLES: - User:…
baasix_list_rolesList all available roles
baasix_list_permissionsList all permissions with optional filtering
baasix_get_permissionGet a specific permission by ID
baasix_get_permissionsGet permissions for a specific role
baasix_create_permissionCreate a new permission for role-based access control. ACTIONS: create, read, update, delete FIELDS: - ["*"] for all fields - ["name", "price"] for specific fields CONDITIONS (Row-level security): - Uses same filter operators as queries - {"published": {"eq": true}} - only published records - {"a…
baasix_update_permissionUpdate an existing permission
baasix_delete_permissionDelete a permission
baasix_reload_permissionsReload the permission cache
baasix_update_permissionsUpdate permissions for a role
baasix_realtime_statusGet the status of the realtime service including WAL configuration. Returns information about: - Whether realtime is initialized and consuming WAL - PostgreSQL replication configuration (wal_level, max_replication_slots) - Publication and replication slot status - Collections with realtime enabled
baasix_realtime_configCheck PostgreSQL replication configuration for WAL-based realtime. Returns: - walLevel: Should be 'logical' for realtime to work - maxReplicationSlots: Number of available replication slots - maxWalSenders: Number of WAL sender processes - replicationSlotExists: Whether the baasix slot exists - pub…
baasix_realtime_collectionsGet list of collections with realtime enabled and their action configurations
baasix_realtime_enableEnable realtime for a collection. Changes will be broadcast via WebSocket when data is modified. The realtime config is stored in the schema definition and can include specific actions to broadcast.
baasix_realtime_disableDisable realtime for a collection
baasix_server_infoGet Baasix server information and health status
baasix_sort_itemsSort items within a collection (move item before/after another)
baasix_register_userRegister a new user
baasix_loginLogin user with email and password
baasix_send_inviteSend an invitation to a user
baasix_verify_inviteVerify an invitation token
baasix_send_magic_linkSend magic link or code for authentication
baasix_get_user_tenantsGet available tenants for the current user
baasix_switch_tenantSwitch to a different tenant context
baasix_logoutLogout the current user
baasix_get_current_userGet current user information with role and permissions
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
MCP Inspector proxy server lacks authentication between the Inspector client and proxy
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig
Tool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
57/57 tools missing one or more hints — baasix_list_schemas (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); baasix_get_schema (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); baasix_create_schema (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +54 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
License file
No license file
Add a LICENSE file (MIT, Apache-2.0, etc.).
Tests exist
No test files found
Add tests that exercise each declared tool.
Production dependencies are patched
0 critical, 12 high severity in production deps — @modelcontextprotocol/sdk@0.5.0 (high), axios@1.12.2 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Dev dependencies
2 critical/high in dev-only deps (does not ship to users)
Upgrade dev dependencies when convenient.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/tspvivek/baasix-mcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check