VibeMCP (VibeTensor/vibemcp) is an MCP server listed on the M8ven Trust Index. It scores 58 out of 100, grade D. It declares 51 tools. No publisher has claimed this listing.

Caution

58/100

VibeMCP

Item: VibeMCP
Rating: 58
Author: M8ven

Token-optimized unified MCP server for Gmail and Microsoft 365, enabling email, calendar, and contact management with up to 70% token savings via TOON format.

→ VibeTensor/vibemcp · listed on glama

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every push why connect →

Who stands behind it

VibeTensor

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

Glamanot scored here

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings

⚠️

Known vulnerabilities in dependencies: 3 high

Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

// tools this server exposes51 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

list_accounts

List all connected Google and Microsoft accounts with their auth status.

add_google_account

Add a Google account and start OAuth flow. Opens browser for sign-in. Call complete_google_auth after signing in.

complete_google_auth

Complete Google authentication after user has signed in via the OAuth URL.

add_microsoft_account

Add a Microsoft account using Device Code Flow. Returns a code the user must enter at a URL. Call complete_microsoft_auth after entering the code.

complete_microsoft_auth

Complete Microsoft authentication after user has entered the device code.

remove_account

Remove a connected account.

accounts_status

Check authentication status of all accounts and server configuration.

calendar_list_calendars

List available calendars for an account (Google Calendar or Outlook).

calendar_list_events

List calendar events in a time range. Works with Google Calendar and Outlook Calendar.

calendar_create_event

Create a new calendar event (Google Calendar or Outlook). Supports recurring events via recurrence_rule.

calendar_delete_event

Delete a calendar event (Google Calendar or Outlook).

calendar_update_event

Update an existing calendar event (Google Calendar or Outlook).

calendar_free_busy

Check free/busy availability for calendars or people in a time range.

contact_search

Search contacts by name or email across Google or Microsoft. Uses Google People API search or Microsoft Graph /me/people endpoint.

resolve_contacts

Resolve email addresses to display names using the account contacts. Useful for enriching email threads with sender names.

contact_list

List contacts from a Google or Microsoft account. Returns email, name, and provider-specific metadata.

gmail_list_messages

List Gmail messages with TOON-optimized output. Supports Gmail search operators (e.g., "is:unread from:john@example.com").

gmail_get_message

Get full Gmail message content by ID including body and attachments.

gmail_send_message

Send an email via Gmail with proper RFC 2822 threading support.

gmail_reply_to_message

Reply to an existing Gmail message with automatic threading (In-Reply-To, References headers).

gmail_create_draft

Create a new Gmail draft.

gmail_list_labels

List all Gmail labels.

gmail_list_threads

List email threads with TOON-optimized output.

gmail_get_thread

Get full conversation thread with all messages.

gmail_create_label

Create a new Gmail label.

gmail_update_label

Update an existing Gmail label name or visibility.

gmail_delete_label

Delete a Gmail label by ID. System labels cannot be deleted.

gmail_modify_labels

Add or remove labels from one or more Gmail messages.

gmail_download_attachment

Download an attachment from a Gmail message. Returns base64url-encoded data with metadata.

gmail_batch_modify

Batch modify Gmail messages: archive, mark read/unread, trash, or untrash up to 1000 messages at once.

gmail_get_vacation

Get current Gmail vacation (out-of-office) auto-reply settings.

gmail_set_vacation

Enable or disable Gmail vacation (out-of-office) auto-reply with optional date range.

outlook_list_messages

List Outlook messages with TOON-optimized output. Supports folder filtering.

outlook_get_message

Get full Outlook message by ID.

outlook_send_message

Send an email via Microsoft 365 Outlook.

outlook_reply_to_message

Reply to an Outlook message.

outlook_forward_message

Forward an Outlook message.

outlook_list_folders

List Outlook mail folders.

outlook_move_message

Move an Outlook message to a different folder.

outlook_search

Search Outlook messages using KQL.

outlook_list_categories

List all Outlook mail categories for the account.

outlook_set_categories

Set categories on an Outlook message.

outlook_set_flag

Set a follow-up flag on an Outlook message.

outlook_batch_update

Batch update multiple Outlook messages at once. Supports marking read/unread, archiving, and moving.

outlook_download_attachment

Download a specific attachment from an Outlook message.

outlook_list_attachments

List all attachments on an Outlook message.

outlook_get_auto_reply

Get the current auto-reply (out-of-office) settings for an Outlook account.

outlook_set_auto_reply

Configure auto-reply (out-of-office) settings for an Outlook account.

unified_search

Search across all configured email accounts (Gmail + Outlook) simultaneously. Returns combined results with TOON output.

unified_inbox

Get unread messages across all configured email accounts.

unified_calendar

Get calendar events across all accounts (Google Calendar + Outlook) in a time range.

// known CVEs in dependencies3 high3 medium1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.12.0GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.12.0GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.12.0GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

mediummermaid@11.12.3GHSA-87f9-hvmw-gh4p

Mermaid: Improper sanitization of configuration leads to CSS injection

mediummermaid@11.12.3GHSA-ghcm-xqfw-q4vr

Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection

Depend on this server? Get alerted when its CVEs change.Watch this server free →

// environment variables

To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.

configVIBEMCP_CONFIG_DIR~/.vibemcp/ config directory - Tokens, accounts, and MSAL cache stored in a persistent user directory (~/.vibemcp/), not relative to the package install location. Overridable via env var.

// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

51/51 tools missing one or more hints — list_accounts (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); add_google_account (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); complete_google_auth (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +48 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool inputs are validated

50/51 tool handlers declare input schemas (98%)

Declare an inputSchema with zod/joi/yup on every tool definition.

Tool test coverage

Only 0/51 tools referenced in tests (0%)

Write tests that reference each tool by name so every tool has at least one test.

Production dependencies are patched

0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.12.0 (high), @modelcontextprotocol/sdk@1.12.0 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail

The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.

// improvement guidance — verified publishers only

We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Verified](https://m8ven.ai/badge/mcp/vibetensor/vibemcp?variant=verified)](https://m8ven.ai/mcp/vibetensor/vibemcp)

Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.

commit: aef14b58ccbea1a2ad37765b95f92749efbf3a5e

code hash: d6184c951ecaaaa01ce3aaa9fbaed83d5f8e86da22912fcb7e5a6f7b8b8321c8

view raw JSON →

Check MCPs from inside your assistant

Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check

check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern

How to add it →Free · no account needed · works in any MCP client