kb-graph (uttambharadwaj/kb-graph) is an MCP server listed on the M8ven Trust Index. It scores 74 out of 100, grade C. No publisher has claimed this listing.

C
Emerging
74/100

kb-graph

Provides a self-tending knowledge base for AI agents, automatically harvesting session transcripts into facts and state notes, and injecting relevant context into new sessions via MCP hooks.

Emerging. No concerning findings. Grades remain capped until the project builds reputation through adoption. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

uttambharadwaj

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 2 credentials: BETTER_AUTH_SECRET, KB_PASSWORD
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
🔐 secretBETTER_AUTH_SECRETOAuth for remote access
configBETTER_AUTH_URLOAuth for remote access
configCLASSIFY_MODELModel for write-time AI work
configCLAUDE_BUS_ROLE
configCLAUDE_PATHClaude CLI binary, used by harvest/classification
configKB_API_KEY_CLAUDEAPI keys for remote REST access
configKB_API_KEY_GEMINI
configKB_API_KEY_OPENAI
configKB_BATCH
configKB_BUS_DB_PATH
configKB_BUS_HOMEpointing it somewhere disposable takes KB_DIR and . KB_DIR
configKB_BUS_SENDER
configKB_CONTROL_SOCKET_PATH
configKB_CORS_ORIGINS
configKB_DIR/trigger-hook-enabled exists. A one-way command can instead be made
configKB_EMBEDDING_CACHE_DIR
configKB_HARVEST_FACTS1/true/yes makes the nightly harvest extract facts as well as lessons. Off because it is the expensive half and writes an open vocabulary unattended. Scheduled jobs inherit no environment, so kb setup copies this into the job definition — set it before setup, or re-run setup after changing it
configKB_HARVEST_SDK_SESSIONS1/true/yes harvests print-mode (SDK) transcripts too. Off because the harvest's own claude -p calls look like sessions — 98% of candidates on a busy install. Turn on if you drive Claude Code headlessly and want that work captured
configKB_HOOK_DAEMON_TIMEOUT_MS
🔐 secretKB_PASSWORDDashboard login password
configKB_PORTHTTP server port
configKB_REPO_ROOTSColon-separated absolute paths searched to verify a verified-tier commit sha or file-path reference. The server's cwd is often a workspace directory sitting one level above every git repo, where nothing ever resolves — set this to that workspace and each immediate subdirectory that is a git repo is searched too
configKB_REVIEW_TIMEOUT_MS
configKB_SHIM_PROBE_TIMEOUT_MS
configKB_SHIM_RECONNECT_DELAY_MS
configKB_SHIM_RECONNECT_MAX_DELAY_MS
configKB_SLOW_HOOK_MS
configKB_TICKET_REGEXWorkstream autobind: regex that recognizes ticket ids in directory/branch names. Full match (lowercased) becomes the bus channel name. The default deliberately accepts any short prefix so autobind works unconfigured; it will also match same-shaped directory names like node-22, so set this to something exact if that bothers you
configMAX_THINKING_TOKENS
configOBSIDIAN_VAULT_PATHVault path (any markdown directory)
configSTATE_MODEL
configSYNTHESIS_MODEL
// quality suggestions

Dependency freshness

1/14 production deps stale: gray-matter@2023-07-12 (3.2y)

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 0 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/uttambharadwaj/kb-graph)](https://m8ven.ai/mcp/uttambharadwaj/kb-graph)
Shows your grade and updates automatically. Prefer no grade? Append ?variant=verified to the badge URL.
commit: a34edef00498c6b6ce733edcdb5d9bda74defa8a
code hash: b1bdf7ed3932d5ac6bebff166d594c4fdd6262aa3e6aa89ef02a6d453259b2fa
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client