Provides a self-tending knowledge base for AI agents, automatically harvesting session transcripts into facts and state notes, and injecting relevant context into new sessions via MCP hooks.
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption
@better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitive
process.env. You'll be asked to provide them before it can run.BETTER_AUTH_SECRET— / BETTER_AUTH_URL No — OAuth for remote accessBETTER_AUTH_URL— BETTER_AUTH_SECRET / No — OAuth for remote accessCLASSIFY_MODEL— No claude-haiku-4-5-20251001 Model for write-time AI workCLAUDE_BUS_ROLECLAUDE_PATH— No claude on PATH Claude CLI binary, used by harvest/classificationKB_API_KEY_CLAUDE— / _OPENAI / _GEMINI No — API keys for remote REST accessKB_API_KEY_GEMINIKB_API_KEY_OPENAIKB_BUS_DB_PATHKB_BUS_HOMEKB_BUS_SENDERKB_CORS_ORIGINSKB_DIRKB_PASSWORD— yourpassword kb start # dashboard + REST API on :3838KB_PORT— No 3838 HTTP server portKB_TICKET_REGEX— No pf-(\d+) Workstream autobind: regex that recognizes ticket ids in directory/branch names. Full match (lowercased) becomes the bus channel nameOBSIDIAN_VAULT_PATH— No — Vault path (any markdown directory)STATE_MODELSYNTHESIS_MODEL[](https://m8ven.ai/mcp/uttambharadwaj-kb-graph-ol2he2)