Conductor By Thealxlabs (useconductor/conductor) is an MCP server listed on the M8ven Trust Index. It scores 52 out of 100, grade D. It declares 271 tools. No publisher has claimed this listing.

Caution

52/100

Conductor By Thealxlabs

Item: Conductor By Thealxlabs
Rating: 52
Author: M8ven

Local-first AI agent that unifies 25+ plugins (Spotify, Gmail, GitHub, Notion, Telegram, Vercel, and more) into a single orchestration framework. AES-256-GCM encrypted credentials, zero telemetry, supports Claude, GPT-4o, Gemini, and Ollama.

→ useconductor/conductor · listed on mcp_so

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every push why connect →

Who stands behind it

useconductor

Source: mcp.so

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

mcp.sonot scored here

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings

⚠️

Known vulnerabilities in dependencies: 4 high

Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 2 credentials: CONDUCTOR_GOOGLE_CLIENT_SECRET, GOOGLE_CLIENT_SECRET

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// tools this server exposes271 tools

These names and descriptions are the publisher's own, as the running server reported them. We print them as written. Our assessment is the findings above, not this list.

conductor_status

Get the current status of Conductor

conductor_recent_activity

Get recent activity from Conductor

json_format

Format, validate, and minify JSON

text_stats

Get text statistics — word count, character count, sentence count, reading time

regex_test

Test a regex pattern against text

text_transform

Transform text: uppercase, lowercase, title case, camelCase, snake_case, slug, reverse

url_expand

Expand a shortened URL to its final destination

url_status

Check if a URL is accessible and get response details

url_headers

Get all HTTP response headers for a URL

aws_ec2_list

List EC2 instances

aws_ec2_start

Start an EC2 instance

aws_ec2_stop

Stop an EC2 instance

aws_s3_list

List S3 buckets

aws_s3_put

Upload file to S3

aws_lambda_list

List Lambda functions

aws_lambda_invoke

Invoke a Lambda function

calc_math

Evaluate a math expression. Supports +, -, *, /, **, %, sqrt(), abs(), sin(), cos(), tan(), log(), ceil(), floor(), round(), PI, E

calc_convert

Convert between units. Supports: km/mi/m/ft/in/cm, kg/lb/oz/g, °C/°F/K, L/gal/ml, GB/MB/KB/TB

calc_date

Calculate days between dates, or add/subtract days from a date

color_convert

Convert a color between hex, RGB, and HSL formats

color_contrast

Check WCAG contrast ratio between two colors

color_palette

Generate a color palette (complementary, analogous, triadic, or random)

cron_schedule

cron_list

List all scheduled tasks

cron_cancel

Cancel and delete a scheduled task

cron_pause

Pause or resume a scheduled task without deleting it

cron_history

Get the run history for a scheduled task

cron_run_now

Immediately trigger a scheduled task without waiting for its next run time

crypto_price

Get current price of a cryptocurrency

crypto_trending

Get trending cryptocurrencies

crypto_search

Search for a cryptocurrency by name or symbol

db_postgres_query

Execute a read-only SQL query on PostgreSQL. SELECT only — no writes allowed.

db_mysql_query

Execute a read-only SQL query on MySQL. SELECT only — no writes allowed.

db_mongo_find

Query a MongoDB collection

db_redis_command

Execute a Redis command

db_list_connections

List configured database connections (without exposing credentials)

docker_containers

List Docker containers. Use --all to include stopped containers.

docker_container_logs

Get logs from a Docker container

docker_container_action

Start, stop, restart, pause, unpause, or kill a Docker container

docker_images

List Docker images

docker_pull

Pull a Docker image

docker_run

Run a Docker container. Requires approval for security.

docker_volumes

List Docker volumes

docker_networks

List Docker networks

docker_stats

Get resource usage stats for running containers

docker_build

Build a Docker image from a Dockerfile

docker_push

Push a Docker image to a registry

docker_network_ls

List Docker networks

docker_volume_ls

List Docker volumes

docker_compose_up

Start services defined in a docker-compose file

docker_compose_down

Stop and remove services defined in a docker-compose file

docker_exec

Execute a command inside a running container

fun_joke

Get a random joke

fun_cat_fact

Get a random cat fact

fun_trivia

Get a random trivia question

fun_random_number

Generate a random number in a range

fun_quote

Get an inspirational quote

gcal_list_calendars

List all Google Calendars accessible to the user

gcal_list_events

List upcoming calendar events

gcal_get_event

Get full details of a specific calendar event

gcal_create_event

Create a new Google Calendar event

gcal_update_event

Update an existing Google Calendar event

gcal_delete_event

Delete a Google Calendar event

gcp_compute_list

List GCP Compute Engine instances

gcp_compute_start

Start a Compute Engine instance

gcp_compute_stop

Stop a Compute Engine instance

gcp_storage_list

List Cloud Storage buckets

gcp_storage_upload

Upload file to Cloud Storage

gcp_functions_list

List Cloud Functions

gcp_functions_deploy

Deploy a Cloud Function

gdrive_list

List files and folders in Google Drive

gdrive_search

Search Google Drive files by name or content. Supports Drive query syntax e.g. name contains "budget" mimeType="application/vnd.google-apps.spreadsheet"

gdrive_get

Get metadata about a specific Drive file

gdrive_read

gdrive_create_folder

Create a new folder in Google Drive

gdrive_upload_text

Upload a text file to Google Drive

gdrive_delete

Permanently delete a file from Google Drive

gh_my_repos

List the authenticated user's own repositories

gh_workflow_runs

List recent workflow runs for a repository

gh_run_status

Get the status and jobs of a specific workflow run

gh_trigger_workflow

Manually trigger a GitHub Actions workflow (workflow_dispatch)

gh_cancel_run

Cancel a running GitHub Actions workflow run

gh_list_prs

List pull requests for a repository

gh_create_pr

Create a new pull request

gh_merge_pr

Merge a pull request

gh_list_issues

List issues for a repository

gh_create_issue

Create a new GitHub issue

gh_comment

Add a comment to a GitHub issue or pull request

gh_releases

List releases for a repository

gh_create_release

Create a new GitHub release

gh_notifications

Get unread GitHub notifications (mentions, CI failures, reviews needed)

gh_code_search

Search code across GitHub repositories

github_user

Get GitHub user profile info

github_repo

Get repository details

github_repos

List repositories for a user

github_trending

Search trending/popular repositories by query and optional language filter

github_issues

List issues for a repository with optional filters

github_issue

Get a single issue by number

github_create_issue

Create a new issue in a repository

github_close_issue

Close an open issue

171 further tools are not listed here. The complete surface is in the source.

// known CVEs in dependencies4 high1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

highmathjs@15.1.1GHSA-29qv-4j9f-fjw5

Unsafe object property setter in mathjs

highmathjs@15.1.1GHSA-jvff-x2qm-6286

mathjs Allows Improperly Controlled Modification of Dynamically-Determined Object Attributes

highsysteminformation@5.31.5GHSA-5xpp-75jx-m839

systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux

highsysteminformation@5.31.5GHSA-hvx9-hwr7-wjj9

Systeminformation vulnerable to Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name

lowvitest@4.1.2GHSA-82fw-gwwq-j7x9

Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock

Depend on this server? Get alerted when its CVEs change.Watch this server free →

// environment variables

To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.

configCONDUCTOR_GOOGLE_CLIENT_ID

🔐 secretCONDUCTOR_GOOGLE_CLIENT_SECRET

configCONDUCTOR_GOOGLE_REDIRECT_URI

🔐 secretGOOGLE_CLIENT_SECRET

configHOSTNAME

configLOG_LEVEL

// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

271/271 tools missing one or more hints — conductor_status (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); conductor_recent_activity (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); json_format (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +268 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool test coverage

90/271 tools referenced in tests (33%)

Write tests that reference each tool by name so every tool has at least one test.

Shell command execution

4 calls in production code run through a shell (src/dashboard/cli.ts:25, src/security/keychain.ts:57, src/security/keychain.ts:72)

Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.

Production dependencies are patched

0 critical, 4 high severity in production deps — mathjs@15.1.1 (high), mathjs@15.1.1 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Dependency freshness

1/22 production deps stale: spotify-web-api-node@2022-06-26 (4.2y)

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail

The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.

// improvement guidance — verified publishers only

We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Verified](https://m8ven.ai/badge/mcp/useconductor/conductor?variant=verified)](https://m8ven.ai/mcp/useconductor/conductor)

Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.

commit: 1c817c527b15dc7890ff507e8cd9537ffa98ac95

code hash: f6ccd893d5c69e24489f7949ea562cd174076ea3544f2bc48c36bec950fbbc75

view raw JSON →

Check MCPs from inside your assistant

Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check

check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern

How to add it →Free · no account needed · works in any MCP client