vcon-mcp (vcon-dev/vcon-mcp) is an MCP server listed on the M8ven Trust Index. It scores 50 out of 100, grade D. It declares 65 tools. No publisher has claimed this listing.
MCP server for storing, managing, and analyzing IETF vCon (Virtual Conversation) data with AI assistants.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
vcon-dev
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
ai_analyze_vconRun AI analysis (sentiment, summary, topics) on a specific vCon by UUID. Useful for re-analyzing or analyzing vCons that were created before the AI sidecar was available.
ai_analyzer_statusGet AI analyzer status: sidecar connection, analysis count, model info.
ai_queryAsk a natural language question about conversations. Provide context chunks from vCon transcripts for RAG-style Q&A.
jsonld_get_enrichmentGet the full JSON-LD-ex semantic enrichment for a vCon, including provenance annotations, confidence scores, integrity hash, and agent capabilities.
jsonld_verify_integrityVerify the cryptographic integrity of a vCon enrichment. Returns whether the document has been tampered with since signing.
jsonld_confidence_queryQuery confidence scores for a vCon. Returns per-party and per-analysis confidence with Subjective Logic opinions. Supports temporal decay calculation.
jsonld_provenance_chainTrace the full provenance chain for a vCon: who created it, what models analyzed it, confidence scores, integrity verification, and data lineage.
jsonld_trust_propagationCompute trust propagation through an analysis chain using Subjective Logic. For example: transcript confidence → sentiment confidence → summary confidence.
neo4j_queryRun a read-only Cypher query against the vCon knowledge graph. Use for finding repeat callers, topic clusters, contact networks, and escalation patterns.
neo4j_insightsGet pre-built graph insights: repeat_callers, topic_clusters, escalation_paths, contact_network, or graph_stats.
siprec_ingest_fileManually trigger ingestion of a SIPREC XML or JSON file from the watch folder. Useful for testing or re-processing.
siprec_statusGet SIPREC adapter status: watch folder path, pending files, processed count.
teams_import_fileImport a Teams call record JSON file and create a vCon. File must follow MS Graph callRecord schema.
teams_import_folderImport all Teams call record JSON files from a folder. Defaults to the sample-data directory.
teams_statusGet Teams adapter status: watch folder, stats, connection info.
whatsapp_import_fileImport a WhatsApp exported chat .txt file and create a vCon.
whatsapp_import_folderImport all WhatsApp .txt files from a folder. Defaults to sample-data directory.
whatsapp_parse_previewParse a WhatsApp chat export and return a preview without creating a vCon.
whatsapp_statusGet WhatsApp adapter status.
get_database_analyticsget_monthly_growth_analyticsget_attachment_analyticsget_tag_analyticsget_content_analyticsget_database_health_metricsget_database_size_infoget_smart_search_limitsget_database_shapeget_database_statsanalyze_queryget_schemaGet vCon schema definition in the requested format (json_schema or typescript).
get_examplesGet example vCons (minimal, phone_call, chat, email, video, full_featured) as JSON or YAML.
manage_tagget_tagsRetrieve tags from a vCon. Provide a specific key to get one tag value, or omit key to get all tags as an object.
remove_all_tagsRemove all tags from a vCon.
search_by_tagsSearch for vCons that have specific tag values. All specified tags must match (AND logic). REQUIRED: You must provide the tags parameter as an object with at least one key-value pair.
get_unique_tagscreate_vcon_from_templateCreate a new vCon from a predefined template (phone_call, chat_conversation, email_thread, video_meeting, custom).
vcon_fetchvcon_taxonomyvcon_capabilitiesvcon_graph_shapevcon_searchvcon_aggregatedescribe_response_shapecreate_vconget_vconsearch_vconssearch_vcons_contentsearch_vcons_semanticsearch_vcons_hybridadd_analysisadd_dialogAdd a dialog (conversation segment) to an existing vCon. Dialog can be a recording, text, transfer, or incomplete.
add_attachmentAdd an attachment to an existing vCon. Attachments can be files, documents, or other data related to the conversation.
delete_vconDelete a vCon and all its related data (parties, dialog, analysis, attachments). This operation cannot be undone.
update_vconUpdate top-level vCon metadata (subject, extensions, must_support). For dialog, analysis, attachments use their specific tools.
update_dialogReplace the dialog at the given index (PUT semantics: omitted fields are cleared). Index is the dialog's position in the vCon's dialog array.
remove_dialogRemove the dialog at the given index. Per IETF core-02 §4.1.8 the slot is preserved as a content-stripped placeholder (keeps "type") so positional references in analysis/attachments do not shift.
update_analysisReplace the analysis at the given index (PUT semantics: omitted fields are cleared). vendor is REQUIRED per IETF spec.
remove_analysisRemove the analysis at the given index. Analysis is a referential leaf, so the element is hard-deleted and the remaining analyses are renumbered to stay contiguous.
update_attachmentReplace the attachment at the given index (PUT semantics: omitted fields are cleared).
remove_attachmentRemove the attachment at the given index. Attachments are referential leaves, so the element is hard-deleted and the rest renumbered to stay contiguous. Note: removing a "tags" attachment clears the vCon's tags.
add_partyAppend a party to an existing vCon. Returns the new party index.
update_partyReplace the party at the given index (PUT semantics: omitted fields are cleared).
remove_partyRemove the party at the given index. Per IETF core-02 §4.1.8 the slot is preserved as an empty placeholder Party Object so positional references (dialog.parties, attachment.party, etc.) do not shift. Set anonymize=true to write {name:"anonymous"} instead of an empty object.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
When Vitest UI server is listening, arbitrary file can be read and executed
Prometheus exporter process crash via malformed HTTP request
Prometheus exporter process crash via malformed HTTP request
Koa has Host Header Injection via ctx.hostname
OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation
AI_ANALYZER_VERBOSEAPI_AUTH_REQUIREDAPI_KEYSAPI_KEYS_READONLYAPI_KEY_HEADERAWS_REGIONCORS_ORIGINCURRENT_TENANT_IDDB_TYPEDatabase backend: Defaults to Supabase (=supabase). MongoDB is also supported via DB_TYPE=mongodb — see [docs/mongodb/setup.md](docs/mongodb/setup.md).EMBEDDING_PROVIDERENV_FILEJSONLD_VERBOSELLAMA_SIDECAR_URLLOG_LEVELMCP_DISABLED_CATEGORIESMCP_DISABLED_TOOLSMCP_ENABLED_CATEGORIESMCP_HTTP_ALLOWED_HOSTSMCP_HTTP_ALLOWED_ORIGINSMCP_HTTP_DNS_PROTECTIONMCP_HTTP_HOSTMCP_HTTP_JSON_ONLYMCP_HTTP_PORTMCP_HTTP_STATELESSStateless mode (=true): No session tracking, each request is independentMCP_SERVER_URLMCP_TOOLS_PROFILEMCP_TRANSPORTMONGO_DB_NAMEMONGO_URLMQTT_BROKER_URLMQTT_ORG_IDMQTT_VERBOSENEO4J_DATABASENEO4J_PASSWORDNEO4J_URINEO4J_USERNEO4J_VERBOSEOPENAI_API_KEYOTEL_ENABLEDOTEL_ENDPOINTOTEL_EXPORTER_TYPEOTEL_LOG_LEVELOTEL_SERVICE_NAMEOTEL_SERVICE_VERSIONREST_API_BASE_PATHREST_API_ENABLEDREST_API_URLRLS_ENABLEDSIPREC_FAILED_FOLDERSIPREC_POLL_INTERVALSIPREC_PROCESSED_FOLDERSIPREC_VERBOSESIPREC_WATCH_FOLDERSUPABASE_DB_SCHEMATEAMS_VERBOSETEAMS_WATCH_FOLDERTENANT_ATTACHMENT_TYPETENANT_JSON_PATHVCON_INSTANCE_LABELVCON_LICENSE_KEYVCON_MCP_BUILD_TIMEVCON_MCP_GIT_COMMITVCON_MCP_VERSIONVCON_OFFLINE_MODEVCON_PLUGINS_PATHVCON_REDIS_EXPIRYWHATSAPP_VERBOSEWHATSAPP_WATCH_FOLDERWHISPER_SIDECAR_URLGROQ_API_KEYGROQ_MODELLLAMA_HOSTLLAMA_PORTWHISPER_MODELWHISPER_HOSTWHISPER_PORTREDIS_URLSUPABASE_ANON_KEYSUPABASE_SERVICE_ROLE_KEYSUPABASE_URLTool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
65/65 tools missing one or more hints — ai_analyze_vcon (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); ai_analyzer_status (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); ai_query (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +62 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tool test coverage
46/65 tools referenced in tests (71%)
Write tests that reference each tool by name so every tool has at least one test.
Production dependencies are patched
0 critical, 3 high severity in production deps — @opentelemetry/auto-instrumentations-node@0.48.0 (high), @opentelemetry/sdk-node@0.52.1 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Dev dependencies
1 critical/high in dev-only deps (does not ship to users)
Upgrade dev dependencies when convenient.
Dependency freshness
3/34 production deps abandoned (no release in 2+ years): fast-json-stable-stringify@2023-06-22 (3.2y), koa-bodyparser@2023-07-21 (3.1y), @koa/cors@2023-12-11 (2.7y)
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/vcon-dev/vcon-mcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check