urantia-papers (urantia-hub/urantia-dev-api) is an MCP server listed on the M8ven Trust Index. It scores 72 out of 100, grade C. It declares 19 tools. No publisher has claimed this listing.

C
Caution
72/100

urantia-papers

Free, open MCP server for The Urantia Papers — full-text and semantic search across 197 papers, 14,500+ paragraphs, and 4,400+ named entities.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

urantia-hub

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Known vulnerabilities in dependencies: 2 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 4 credentials: APP_JWT_SECRET, BETTERSTACK_SOURCE_TOKEN, CF_ANALYTICS_API_TOKEN, OPENAI_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes19 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

toc.get

Get the full table of contents of the Urantia Book. Returns all 4 parts and 197 papers with their titles. This is the best starting point to understand the book structure.

papers.list

List all 197 papers in the Urantia Book with their metadata (id, title, partId, labels). Use toc.get for a hierarchical view instead.

papers.get

Get a single paper with all its paragraphs. Paper IDs range from 0 (Foreword) to 196. Optionally include entity mentions.

papers.sections

Get all sections within a paper, ordered by section number. Useful for understanding paper structure before reading specific sections.

paragraphs.random

Get a random paragraph from the Urantia Book. Great for daily quotes, exploration, or discovering new passages.

paragraphs.get

Look up a specific paragraph by reference. Supports three formats: globalId ("1:2.0.1"), standardReferenceId ("2:0.1"), or paperSectionParagraphId ("2.0.1"). The format is auto-detected.

paragraphs.context

Get a paragraph with surrounding context (N paragraphs before and after within the same paper). Useful for understanding passages in context.

search.fulltext

Full-text search across all Urantia Book paragraphs. Supports three modes: "and" (all words must appear, default), "or" (any word), "phrase" (exact phrase). Results ranked by relevance.

search.semantic

Search the Urantia Book using semantic similarity (vector embeddings). Returns conceptually related results even without exact keyword matches. Requires OPENAI_API_KEY.

entities.list

Browse the entity catalog: beings, places, orders, races, religions, and concepts mentioned in the Urantia Book. Supports filtering by type and searching by name.

entities.get

Get detailed information about a specific entity by its slug ID. Returns name, type, aliases, description, related entities, and citation count.

entities.paragraphs

Get all paragraphs that mention a specific entity, ordered by position in the text. Useful for studying everything said about a particular being, place, or concept.

audio.get

Get the audio file URL for a specific paragraph. Accepts any paragraph reference format (globalId "1:2.0.1", standardReferenceId "2:0.1", or paperSectionParagraphId "2.0.1").

bible.books

List all 81 books of the World English Bible (eng-web): 39 Old Testament + 15 deuterocanonical + 27 New Testament. Each entry includes OSIS book code, full name, abbreviation, canonical order, canon, and chapter/verse counts.

bible.book

Get metadata for a single Bible book including chapter and verse counts. Accepts OSIS codes ("Gen"), USFM codes ("GEN"), full names ("Genesis"), and aliases ("genesis", "1-maccabees") — case-insensitive, hyphens/underscores tolerated.

bible.chapter

Get every verse in a Bible chapter, ordered by verse number. Accepts OSIS, USFM, full name, or alias for `book_code`.

bible.verse

Get a single verse from the World English Bible (eng-web). Accepts OSIS, USFM, full name, or alias for `book_code`.

bible.verse.urantia_parallels

Returns the top 10 Urantia paragraphs whose embeddings are nearest to the Bible chunk that contains this verse — the reverse of `include_bible_parallels` on the UB side. Pre-computed at seed time with text-embedding-3-large (3072-d) cosine similarity. Each result carries a similarity score (0..1) an

bible.search.semantic

Free-form natural-language search across all Bible chunks, ranked by cosine similarity. Each result includes the top-N pre-computed Urantia paragraphs related to that chunk via `bible_parallels` (direction=bible_to_ub). One query surfaces both Bible matches and the relevant UB content. Optional filt

// known CVEs in dependencies2 high1 medium25 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

highdrizzle-orm@0.45.1GHSA-gpj5-g38j-94v9

Drizzle ORM has SQL injection via improperly escaped SQL identifiers

highhono@4.12.8GHSA-88fw-hqm2-52qc

hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard

mediumhono@4.12.8GHSA-xf4j-xp2r-rqqx

Hono: Path traversal in toSSG() allows writing files outside the output directory

lowhono@4.12.8GHSA-26pp-8wgv-hjvm

Hono missing validation of cookie name on write path in setCookie()

lowhono@4.12.8GHSA-2gcr-mfcq-wcc3

Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
🔐 secretAPP_JWT_SECRETnpx wrangler secret put
🔐 secretBETTERSTACK_SOURCE_TOKEN
🔐 secretCF_ANALYTICS_API_TOKEN
configCF_ZONE_TAG
🔐 secretOPENAI_API_KEY
configSUPABASE_URL
Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.
deployDATABASE_URL
deployPORT
// quality suggestions

All four hints declared on every tool

19/19 tools missing one or more hints — toc.get (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); papers.list (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); papers.get (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +16 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool inputs are validated

16/19 tool handlers declare input schemas (84%)

Declare an inputSchema with zod/joi/yup on every tool definition.

Secrets not logged

15 secret values sent to console.log

Redact or omit secret values from log output.

Production dependencies are patched

0 critical, 2 high severity in production deps — drizzle-orm@0.45.1 (high), hono@4.12.8 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/urantia-hub/urantia-dev-api?variant=verified)](https://m8ven.ai/mcp/urantia-hub/urantia-dev-api)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 7dc9eeebbbba0f1ef583e6552036c159888fc176
code hash: bd9d63154c5cb71193bcf8c437dee7c12af55f0f1ef7908b89ffe215d7010e99
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client