56
/ 100
21 days ago
glama

kb-graph

Provides a self-tending knowledge base for AI agents, automatically harvesting session transcripts into facts and state notes, and injecting relevant context into new sessions via MCP hooks.

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
🚨
Known vulnerabilities in dependencies: 1 critical, 16 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 2 credentials: BETTER_AUTH_SECRET, KB_PASSWORD
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies1 critical16 high2 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

criticalbetter-auth@1.5.5GHSA-pw9m-5jxm-xr6h

Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins

high@modelcontextprotocol/sdk@1.0.0GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.0.0GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

highbetter-auth@1.5.5GHSA-392p-2q2v-4372

Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption

highbetter-auth@1.5.5GHSA-7w99-5wm4-3g79

@better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitive

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
🔐 secretBETTER_AUTH_SECRET/ BETTER_AUTH_URL No — OAuth for remote access
configBETTER_AUTH_URLBETTER_AUTH_SECRET / No — OAuth for remote access
configCLASSIFY_MODELNo claude-haiku-4-5-20251001 Model for write-time AI work
configCLAUDE_BUS_ROLE
configCLAUDE_PATHNo claude on PATH Claude CLI binary, used by harvest/classification
configKB_API_KEY_CLAUDE/ _OPENAI / _GEMINI No — API keys for remote REST access
configKB_API_KEY_GEMINI
configKB_API_KEY_OPENAI
configKB_BUS_DB_PATH
configKB_BUS_HOME
configKB_BUS_SENDER
configKB_CORS_ORIGINS
configKB_DIR
🔐 secretKB_PASSWORDyourpassword kb start # dashboard + REST API on :3838
configKB_PORTNo 3838 HTTP server port
configKB_TICKET_REGEXNo pf-(\d+) Workstream autobind: regex that recognizes ticket ids in directory/branch names. Full match (lowercased) becomes the bus channel name
configOBSIDIAN_VAULT_PATHNo — Vault path (any markdown directory)
configSTATE_MODEL
configSYNTHESIS_MODEL
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 2 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/uttambharadwaj-kb-graph-ol2he2)](https://m8ven.ai/mcp/uttambharadwaj-kb-graph-ol2he2)
commit: f063e728523ced022447685ebc65a97c9ecedef1
code hash: 73f7029319d5ff4a17f1be676757d56340229c3b7b30ac29695d4a2538dea6c2
verified: 7/10/2026, 10:03:50 AM
view raw JSON →