claude-ts-mcps (ukkz/claude-ts-mcps) is an MCP server listed on the M8ven Trust Index. It scores 56 out of 100, grade D. It declares 142 tools. No publisher has claimed this listing.

D
Caution
56/100

claude-ts-mcps

A collection of Model Context Protocol servers that enable Claude Desktop to provide development assistance capabilities with filesystem, Git, shell command, and web search functionality without incurring API usage costs.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

ukkz

Source: ModelScope

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
🚨
Secret credentials may flow to a network call
4 flows detected: BRAVE_API_KEY. We can’t prove the destination matches the brand the credential belongs to.
⚠️
Known vulnerabilities in dependencies: 5 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 3 credentials: BRAVE_API_KEY, GITHUB_PERSONAL_ACCESS_TOKEN, PERPLEXITY_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes84 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

puppeteer_navigate

Navigate to a URL

puppeteer_screenshot

Take a screenshot of the current page or a specific element

puppeteer_click

Click an element on the page

puppeteer_fill

Fill out an input field

puppeteer_select

Select an option from a select element

puppeteer_hover

Hover over an element on the page

puppeteer_evaluate

Execute JavaScript in the browser console

puppeteer_wait_for_selector

Wait for an element to appear on the page

puppeteer_wait_for_timeout

Wait for a specified amount of time

puppeteer_wait_for_function

Wait for a JavaScript function to return true

puppeteer_wait_for_navigation

Wait for page navigation to complete

puppeteer_keyboard_press

Press a specific key or key combination

puppeteer_keyboard_type

Type text with fine-grained control over typing speed

puppeteer_set_viewport

Set the viewport size of the page

puppeteer_go_back

Navigate back in browser history

puppeteer_go_forward

Navigate forward in browser history

puppeteer_reload

Reload the current page

puppeteer_pdf

Generate PDF from the current page

puppeteer_emulate_device

Emulate a specific device

puppeteer_set_cookies

Set cookies for the current page

puppeteer_get_cookies

Get all cookies for the current page

puppeteer_authenticate

Set HTTP authentication credentials

puppeteer_get_title

Get the page title

puppeteer_get_url

Get the current page URL

puppeteer_get_content

Get the full HTML content of the page

puppeteer_get_text

Get the text content of an element

puppeteer_get_element_info

Get detailed information about an element

puppeteer_get_frames

Get information about all frames on the page

puppeteer_switch_to_frame

Switch context to a specific frame

puppeteer_switch_to_main_frame

Switch context back to the main frame

puppeteer_evaluate_in_frame

Execute JavaScript in a specific frame

puppeteer_search_across_frames

Search for elements across all frames

puppeteer_add_script_tag

Add a script tag to the page

puppeteer_clear_input

Clear an input field

create_or_update_file

Create or update a single file in a GitHub repository

search_repositories

Search for GitHub repositories

create_repository

Create a new GitHub repository

get_file_contents

Get the contents of a file or directory from a GitHub repository

push_files

Push multiple files to a GitHub repository in a single commit

create_branch

Create a new branch in a GitHub repository

create_issue

Create a new issue in a GitHub repository

get_issue

Get details of a specific issue in a GitHub repository

list_issues

List issues in a GitHub repository with filtering options

update_issue

Update an existing issue in a GitHub repository

add_issue_comment

Add a comment to an existing issue

create_pull_request

Create a new pull request in a GitHub repository

get_pull_request

Get details of a specific pull request

list_pull_requests

List and filter repository pull requests

merge_pull_request

Merge a pull request

search_code

Search for code across GitHub repositories

search_issues

Search for issues and pull requests across GitHub repositories

search_users

Search for users on GitHub

create_release

Create a new release for a repository

get_release

Get a specific release by ID

get_latest_release

Get the latest release for a repository

list_releases

List releases for a repository

update_release

Update an existing release

delete_release

Delete a release

brave_web_search

Keyword-based web search returning a list of search results. Each result includes title, description, and URL. Best for quickly scanning multiple web pages or when you need to see diverse sources. Returns up to 20 search results as a list, not synthesized answers.

brave_local_search

Search local businesses, services, and places. Returns real-time data including address, phone, ratings, hours. Use for location-based queries.

fetch

Fetch content from a specific URL. Use when you have an exact URL and need its full content. Extracts text as markdown by default, or returns raw HTML if requested. Best for reading specific pages, not for searching.

read_file

Read file contents with proper encoding. Supports partial reading by byte range or line range. Encoding options: utf-8, base64, hex. Only works within allowed directories.

read_multiple_files

Read multiple files simultaneously. More efficient than reading one by one. Returns each file's content with its path. Failed reads don't stop the operation. Only works within allowed directories.

write_file

Create or overwrite a file. Caution: overwrites without warning. Handles text encoding. Only works within allowed directories.

edit_file

Make edits to text files. Supports text replacement, line-based operations (replace/insert/delete), and regex replacements. Returns git-style diff. Only works within allowed directories.

create_directory

Create directory or ensure it exists. Creates nested directories. Succeeds silently if already exists. Only works within allowed directories.

list_directory

List files and directories in a path. Distinguished with [FILE] and [DIR] prefixes. Only works within allowed directories.

directory_tree

Get recursive tree view as JSON. Each entry has name, type (file/directory), and children for directories. 2-space indented output. Only works within allowed directories.

move_file

Move or rename files and directories. Fails if destination exists. Both paths must be within allowed directories.

create_file

Create a new file (alias for write_file). Creates or overwrites a file. Only works within allowed directories.

search_files

Recursively search files matching a pattern. Case-insensitive, partial name matching. Returns full paths. Only searches within allowed directories.

get_file_info

Get file/directory metadata: size, creation time, modified time, permissions, type. Only works within allowed directories.

list_allowed_directories

List directories this server can access.

delete_file

Delete a file. This operation cannot be undone. Only works within allowed directories.

copy_file

Copy a file to a new location. Fails if destination exists unless overwrite is true. Both paths must be within allowed directories.

append_file

Append content to the end of a file. Creates the file if it doesn't exist. Only works within allowed directories.

search_content

Search for content within files. Supports plain text and regex search. Returns matching lines with file path and line number. Only searches within allowed directories.

batch_operations

Execute multiple file operations efficiently. Supports transactional mode (rollback on error) and parallel execution for read operations. Each operation result is returned individually.

watch_file

Check for file changes since a specific time. Due to MCP constraints, this is a one-time check, not continuous monitoring. Returns list of changed files.

compress_files

Compress files into an archive. Supports zip, tar, and tar.gz formats. Requires appropriate tools (zip/tar) to be installed on the system.

extract_archive

Extract files from an archive. Supports zip, tar, and tar.gz formats. Creates destination directory if it doesn't exist. Requires appropriate tools (unzip/tar) to be installed.

sonar_search
sonar_multi_search

Performs multiple related searches simultaneously and returns combined results. Ideal for complex research questions that benefit from being broken down into simpler components. IMPORTANT: Each query should be a natural language question as a complete sentence, NOT keyword lists.

sonar_search_with_timeout

Performs a natural language search with a strict timeout to ensure fast responses. IMPORTANT: Ask in natural language as a complete sentence, NOT as keyword lists.

// known CVEs in dependencies5 high1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.7.0GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.7.0GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

highminimatch@10.0.1GHSA-23c5-xmqv-rm74

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

highminimatch@10.0.1GHSA-3ppc-4f35-3m26

minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

highminimatch@10.0.1GHSA-7r86-cg39-jmmj

minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
🔐 secretBRAVE_API_KEY"": "YOUR_BRAVE_API_KEY"
configCUSTOM_USER_AGENT"": "YOUR_CUSTOM_USER_AGENT",
🔐 secretGITHUB_PERSONAL_ACCESS_TOKEN"": "YOUR_DEFAULT_TOKEN",
configIGNORE_ROBOTS_TXT"": "false"
🔐 secretPERPLEXITY_API_KEY"": "YOUR_PERPLEXITY_API_KEY"
configSHELL
// quality suggestions

Dependencies

11 dependencies, 2 flagged: puppeteer, @types/puppeteer

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

142/142 tools missing one or more hints — puppeteer_navigate (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); puppeteer_screenshot (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); puppeteer_click (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +139 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool inputs are validated

3/6 tool handlers declare input schemas (50%)

Declare an inputSchema with zod/joi/yup on every tool definition.

Tests exist

No test files found

Add tests that exercise each declared tool.

Shell command execution

4 child_process/subprocess calls in production code — runs shell commands (test-filesystem.ts:17, test-shell-new.ts:60, src/shell/environment.ts:45)

Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.

Production dependencies are patched

0 critical, 5 high severity in production deps — @modelcontextprotocol/sdk@1.7.0 (high), @modelcontextprotocol/sdk@1.7.0 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/ukkz/claude-ts-mcps?variant=verified)](https://m8ven.ai/mcp/ukkz/claude-ts-mcps)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: bf5b24e50a209d1eaa65d038be314cc49bf3b2a4
code hash: 40ad78e7e57aabe45dc056c685c0047ecf41d0a8ab131a2c04788d65b0bdf45e
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client