UMBRAXON/kya-hub (UMBRAXON/kya-hub) is an MCP server listed on the M8ven Trust Index. M8ven has not graded it: we have no way to read this server ourselves. No publisher has claimed this listing.
Read-only MCP server bridging the public UMBRAXON KYA-Hub HTTP API. Exposes tools to fetch tiers/health, certificates, reputation, CRL metadata, and to verify certificate/delegation-pass payloads.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
UMBRAXON
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
ws: Uninitialized memory disclosure
ADMIN_API_KEYALBY_HUB_URLALBY_NWC_URIALBY_NWC_URI_FILEALBY_UNLOCK_PASSWORDALBY_UNLOCK_PASSWORD_FILEANCHOR_FALLBACK_FEERATE_SAT_VBANCHOR_FEE_TARGET_BLOCKSANCHOR_FUNDING_BACKENDANCHOR_MAX_FEERATE_SAT_VBANCHOR_REQUIRE_CONFIRMATIONSANCHOR_WALLET_AUTOPAUSE_ENABLEDANCHOR_WALLET_AUTOPAUSE_SATSANCHOR_WALLET_CRITICAL_SATSANCHOR_WALLET_MONITOR_INTERVAL_MSANCHOR_WALLET_WARN_SATSANCHOR_WORKER_BACKOFF_MSANCHOR_WORKER_BATCHANCHOR_WORKER_BROADCAST_ENABLEDANCHOR_WORKER_CONFIRM_INTERVAL_MSANCHOR_WORKER_INTERVAL_MSANCHOR_WORKER_MAX_ATTEMPTSANCHOR_WORKER_PM2_NAMEANOMALY_AUTO_SLASHANOMALY_TARGET_SPAMAPPEAL_SLA_HOURSAUTH_CHALLENGE_403_SPIKE_THRESHOLDAUTH_CHALLENGE_403_SPIKE_TTL_MULTIPLIERAUTH_CHALLENGE_403_SPIKE_WINDOW_MINAUTH_CHALLENGE_EXTEND_OPEN_ON_SPIKEB2_APP_KEYB2_BUCKETB2_KEY_IDB2_S3_ENDPOINTBACKUP_LOCAL_DIRBACKUP_PASSPHRASEBACKUP_S3_ACCESS_KEY_IDBACKUP_S3_BUCKETBACKUP_S3_ENDPOINTBACKUP_S3_PREFIXBACKUP_S3_REGIONBACKUP_S3_SECRET_ACCESS_KEYBAD_SIG_AUTO_SLASHBAD_SIG_PER_HOURBAN_DAYS_BASICBAN_DAYS_ELITEBAN_REPUTATION_DROPBITCOIND_ANCHOR_ADDRESSBITCOIND_ANCHOR_WALLETBITCOIND_RPC_COOKIE_PATHBITCOIND_RPC_DOCKER_CONTAINERBITCOIND_RPC_DOCKER_COOKIEBITCOIND_RPC_PASSWORDBITCOIND_RPC_TIMEOUT_MSBITCOIND_RPC_URLBITCOIND_RPC_USERBLOCKSTREAM_API_URLBTCPAY_API_KEYBTCPAY_SECRETBTCPAY_STORE_IDBTCPAY_TIMEOUT_MSBTCPAY_URLCB_FAILURE_THRESHOLDCB_OPEN_DURATION_MSCB_SUCCESS_THRESHOLDCERT_BREAKER_AUTO_RESET_AFTER_MSCERT_BREAKER_HALT_PCTCERT_BREAKER_MIN_SAMPLESCERT_BREAKER_WARN_PCTCERT_BREAKER_WINDOW_MSCERT_DISCLAIMERCERT_ELITE_MULTISIGCERT_ELITE_MULTISIG_OPTIONALCERT_ELITE_MULTISIG_ROLESCERT_ELITE_MULTISIG_THRESHOLDCERT_TERMS_URLCOINGECKO_BASE_URLCORS_ALLOWED_ORIGINSCRL_PUBLIC_BASE_URLCRL_PUBLIC_DIRCRL_WORKER_BACKOFF_MSCRL_WORKER_BATCH_MAXCRL_WORKER_BROADCAST_ENABLEDCRL_WORKER_CONFIRM_INTERVAL_MSCRL_WORKER_INTERVAL_MSCRL_WORKER_MAX_ATTEMPTSCRL_WORKER_MIN_LEAVESDAC8_EXPORT_DIRDAC8_RATE_CACHE_DIRDATA_EXPORT_DIRDATA_EXPORT_MAX_PER_DAYDATA_EXPORT_PUBLIC_BASE_URLDATA_EXPORT_TTL_SECONDSDB_HOSTDB_NAMEDB_PASSWORDDB_PORTDB_USERDECAY_INTERVAL_MSDEVKEY_RATE_ENTERPRISE_PER_MINDEVKEY_RATE_FREE_PER_MINDEVKEY_RATE_PRO_PER_MINDEV_WEBHOOK_BATCH_SIZEDEV_WEBHOOK_MAX_ATTEMPTSDEV_WEBHOOK_POST_TIMEOUT_MSDEV_WEBHOOK_QUEUE_ENABLEDDISCORD_WEBHOOK_URLDRY_RUNELITE_LISTING_GRACE_DAYSELITE_LISTING_HEARTBEAT_DAYSELITE_LISTING_HEARTBEAT_SATSELITE_LISTING_REACTIVATION_SATSESG_FALLBACK_WATTSEU_GRID_GCO2_PER_KWHFILE_PERM_AUTOFIXFILE_PERM_STRICTFORK_DETECTOR_AUTOPAUSEFORK_DETECTOR_DEPTHFORK_DETECTOR_HTTP_TIMEOUT_MSFORK_DETECTOR_UAGITHUB_ISSUE_WATCH_MAX_NOTIFYGITHUB_ISSUE_WATCH_NUMBERGITHUB_ISSUE_WATCH_REPOGITHUB_ISSUE_WATCH_STATE_PATHHUB_ED25519_PRIVKEY_HEXHUB_ED25519_PUBKEY_HEXHUB_KEY_PASSPHRASEHUB_NAMEHUB_PUBLIC_URLHUB_URLHUB_VERSIONINTEGRATOR_KEY_REQUEST_NOTIFYINTEGRATOR_KEY_REQ_MAX_PER_IP_DAYINTEGRATOR_LSAT_DAY_PASS_SATSINTEGRATOR_LSAT_RATE_PER_MININTEGRATOR_LSAT_TTL_HOURSINTEGRATOR_METRICS_ENABLEDINTEGRATOR_READ_CACHE_MSINTEGRATOR_SANDBOX_ON_PRODUCTIONINVOICE_BTC_RATE_EURINVOICE_CURRENCYINVOICE_DOC_TITLEINVOICE_FX_PROVIDERINVOICE_LEGAL_NOTEINVOICE_LOCAL_DIRINVOICE_NUMBER_PREFIXINVOICE_PUSH_TO_R2INVOICE_SELLER_ADDRESSINVOICE_SELLER_EMAILINVOICE_SELLER_IBANINVOICE_SELLER_LOGO_PATHINVOICE_SELLER_NAMEINVOICE_SELLER_TAX_IDINVOICE_SELLER_VAT_IDINVOICE_SELLER_WEBSITEINVOICE_VERIFIER_BASEIP_BAN_DURATION_HOURSIP_BAN_GROSS_10MINIP_BAN_TOTAL_10MINIP_BAN_WHITELISTKYAHUB_APP_PASSWORDKYAHUB_BASE_URLKYA_HUB_BASE_URLKYA_HUB_LIVE_TESTKYA_HUB_REQUEST_TIMEOUT_MSKYA_HUB_USER_AGENTKYA_INTEGRATOR_API_KEYLIQUIDITY_CRITICAL_SATSLIQUIDITY_HTTP_TIMEOUT_MSLIQUIDITY_INBOUND_RATIO_PCTLIQUIDITY_LSP_BUY_SATSLIQUIDITY_LSP_FEE_SATSLIQUIDITY_MIN_INBOUND_SATSLIQUIDITY_WARN_SATSLOG_LEVELLOG_REDACT_MAX_DEPTHLOG_REDACT_MIN_LENMASTODON_ACCESS_TOKENMASTODON_BASE_URLMASTODON_MAX_PER_RUNMASTODON_POSTS_DIRMASTODON_STATE_PATHMASTODON_TOKEN_FILEMEMPOOL_API_URLMETRICS_PREFIXMETRICS_REFRESH_TTL_MSMFR_ATTEST_RATE_BRONZE_PER_HRMFR_ATTEST_RATE_DEFAULT_PER_HRMFR_ATTEST_RATE_GOLD_PER_HRMFR_ATTEST_RATE_SILVER_PER_HRMFR_BONUS_BRONZEMFR_BONUS_GOLDMFR_BONUS_SILVERMFR_MAX_MANIFEST_META_BYTESMFR_MAX_METADATA_BYTESNETDATA_URLNOTIF_DEDUPE_MSNOTIF_ENABLEDNOTIF_TIMEOUT_MSNWC_PAY_URINWC_PAY_URI_FILEOPERATOR_DAILY_REPORT_ENABLEDOPERATOR_REPORT_ALLOW_KYA_IDSOPERATOR_REPORT_HOURSPM2_BINPOW_DEFAULT_DIFFICULTYPOW_ENABLEDPOW_REGISTER_DIFFICULTYPOW_REGISTER_ELITE_DIFFICULTYPOW_REGISTER_MIN_DIFFICULTYPOW_REQUIRED_FORPOW_SOLVE_MAX_ITERATIONSPOW_TTL_SECPRICING_POLL_MSPROTOCOL_VIOLATION_SECOND_DELTAPROTOCOL_VIOLATION_THIRD_PLUS_DELTAPROTOCOL_VIOLATION_WINDOW_HOURSPUBLIC_HUB_URLRATE_V1_REGISTER_PER_MINREGISTRATION_IDREGISTRATION_MAX_INTENTS_PER_IP_PER_DAYREREG_MULTIPLIER_BASEREREG_MULTIPLIER_CAP_EXPRETENTION_ACTION_LOG_DAYSRETENTION_ACTION_LOG_HARDDEL_DAYSRETENTION_ANOMALY_FRACRETENTION_ANOMALY_MIN_ROWSRETENTION_AUTH_CHALLENGES_DAYSRETENTION_BATCH_SIZERETENTION_CERTSIGN_DAYSRETENTION_CERTSIGN_HARDDEL_DAYSRETENTION_DATA_EXPORTS_DAYSRETENTION_HEARTBEAT_DAYSRETENTION_INTERVAL_MSRETENTION_IP_BANS_DAYSRETENTION_POW_CHALLENGES_DAYSRETENTION_REG_INTENTS_DAYSRETENTION_REJREQ_DAYSRETENTION_REJREQ_HARDDEL_DAYSRETENTION_REPEVENT_DAYSRETENTION_REPEVENT_HARDDEL_DAYSRETENTION_REPORTS_DAYSRETENTION_REPORTS_HARDDEL_DAYSRETENTION_SIGFAIL_DAYSRETENTION_VACUUMRETENTION_VOLUMETRIC_DAYSRETENTION_WEBHOOK_DAYSRETENTION_WEBHOOK_HARDDEL_DAYSRETENTION_WORKERSPONSOR_AGENT_ALLOWLISTSPONSOR_AGENT_INVITES_PER_MONTHSPONSOR_AGENT_MIN_REPUTATIONSPONSOR_INVITE_ENABLEDSPONSOR_INVITE_SUSPEND_DAYSSPONSOR_INVITE_TTL_HOURS_DEFAULTSPONSOR_INVITE_TTL_HOURS_MAXSPONSOR_MAX_VIOLATIONS_PER_30DSPONSOR_MFR_ALLOWLISTSPONSOR_MFR_INVITES_BRONZE_PER_MONTHSPONSOR_MFR_INVITES_GOLD_PER_MONTHSPONSOR_MFR_INVITES_SILVER_PER_MONTHSPONSOR_PENALTY_REPUTATIONSYBIL_CIRCLE_LOOKBACK_DAYSSYBIL_CIRCLE_MIN_PAIRSSYBIL_CIRCLE_PENALTYSYBIL_MFR_BONUSSYBIL_MIN_ABS_DELTASYBIL_RESISTANCESYBIL_TIER_WEIGHT_BASICSYBIL_TIER_WEIGHT_ELITETELEGRAM_BOT_TOKENTELEGRAM_CHAT_IDTIER_BASIC_DURATION_MONTHSTIER_BASIC_GRADETIER_BASIC_SATSTIER_ELITE_GRADETIER_ELITE_REQUIRES_ANCHORTIER_ELITE_SATSVOLUMETRIC_LIMITS_CACHE_TTL_MSWEB_UPTIME_FAIL_THRESHOLDWEB_UPTIME_STATE_PATHWEB_UPTIME_TIMEOUT_MSWEB_UPTIME_URLNEXT_PUBLIC_HUB_URLNEXT_PUBLIC_OPERATOR_GITHUBNEXT_PUBLIC_OPERATOR_NAMENEXT_PUBLIC_OPERATOR_TELEGRAMNEXT_PUBLIC_OPERATOR_X_URLNEXT_PUBLIC_SITE_URLPORTSENTRY_DSNSENTRY_ENVIRONMENTSENTRY_RELEASESENTRY_TRACES_SAMPLE_RATETool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
20/20 tools missing one or more hints — kya_health (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); kya_tiers (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); kya_hub_pubkey (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +17 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tool handlers catch errors
Only 1/20 tool handlers wrap calls in try/catch (5%)
Wrap each tool handler body in try/catch and return a structured error response.
Tool test coverage
Only 0/20 tools referenced in tests (0%)
Write tests that reference each tool by name so every tool has at least one test.
Tests pass
npm test failed — tests do not pass
Make sure npm test runs cleanly. Common cause: missing build step or missing env vars.
Shell command execution
2 child_process calls — runs shell commands
Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.
Secrets stay with their owner
11 secret/sensitive values flow into network calls (ADMIN_API_KEY → dynamic, ADMIN_API_KEY → dynamic)
Audit where credentials are sent. A NOTION_TOKEN should only reach api.notion.com — never a third-party host.
Secrets not logged
3 secret values sent to console.log
Redact or omit secret values from log output.
Dependency freshness
1/25 production deps stale: ajv-formats@2024-03-30 (2.2y)
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/umbraxon-kya-hub-1q5yhd)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check