alethia-mcp

Item: alethia-mcp
Rating: 41
Author: M8ven

MCP bridge that lets any MCP client drive the Alethia runtime for agent-native E2E testing. It provides a per-step policy gate that blocks destructive actions with a cryptographic audit trail.

→ vitron-ai/alethia-mcp · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configALETHIA_BOOTSTRAPPED

configALETHIA_BRIDGE_SRI— (unset) Require any auto-downloaded bridge tarball to match this sha512-<base64> integrity string. Rejects everything else. For high-assurance deployments.

configALETHIA_BRIDGE_VERSION— (unset) Pin the bridge itself to a specific version (e.g. 0.8.0). Skips the npm auto-update check. For reproducible CI or deliberate stay-behind.

configALETHIA_DEBUG— (unset) Set to 1 for debug logging on stderr

configALETHIA_HEADLESS— (unset) Set to 1 to hide the cockpit window. Default is visible. CI environments (CI=1, GITHUB_ACTIONS, etc.) auto-hide.

configALETHIA_HIGHLIGHTS

configALETHIA_HOST— 127.0.0.1 Host of the Alethia runtime

configALETHIA_PORT— 47432 Port of the Alethia runtime

configALETHIA_QUIET

configALETHIA_RUNTIME_DIR— ~/.alethia/runtime Where the auto-installed runtime lives. Override for sandboxing or to stash multiple installs.

configALETHIA_RUNTIME_VERSION— "env": { "": "0.4.0" }

configALETHIA_SKIP_AUTO_UPDATE— (unset) Set to 1 to disable the bridge's npm registry check entirely. The bridge runs as-installed, no background fetches.

configALETHIA_TIMEOUT_MS— 60000 Per-request timeout in milliseconds

configALETHIA_VISIBLE— (unset) Deprecated — set to 0 as a legacy alias for ALETHIA_HEADLESS=1. Removed in a future release.

configBUILDKITE— CIRCLECI, ) and the cockpit window stays hidden. Pin a

configGITHUB_ACTIONS— CI environments are auto-detected (CI, , GITLAB_CI,

configGITLAB_CI— CI environments are auto-detected (CI, GITHUB_ACTIONS, ,

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 2 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/vitron-ai-alethia-mcp-f3xnh0)](https://m8ven.ai/mcp/vitron-ai-alethia-mcp-f3xnh0)

commit: faf2b3d64688ca9dd9880aa9f84dbaea260709dc

code hash: 20fc8e0da6f9a0706e076473c932a0874be0a40f768ed16b9fca5e51ce30311a

verified: 6/11/2026, 12:23:40 PM

view raw JSON →