/ 100

25 days ago

glama

swarm-mcp

MCP server that lets multiple coding-agent sessions on the same machine discover each other and collaborate through a shared SQLite database.

→ Volpestyle/swarm-mcp · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

⚠️

Known vulnerabilities in dependencies: 2 high

Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

// known CVEs in dependencies2 high1 medium1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.25.2GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

highesbuild@0.24.2GHSA-gv7w-rqvm-qjhr

esbuild: Missing binary integrity verification in Deno module enables remote code execution via NPM_CONFIG_REGISTRY

mediumajv@8.17.1GHSA-2g4f-4pwh-qvx6

ajv has ReDoS when using `$data` option

lowesbuild@0.24.2GHSA-67mh-4wv8-2f99

esbuild enables any website to send any requests to the development server and read the response

Depend on this server? Get alerted when its CVEs change.Watch this server free →

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configAGENT_IDENTITY

configHERDR_FAKE_COMMAND

configHERDR_FAKE_LOG

configHERDR_FAKE_RUN_PANE

configHERDR_PANE

configHERDR_PANE_ID

configHERMES_HOST_HOME

configHERMES_PROFILE_HOME

configMERMAID_BACKGROUND

configMERMAID_SCALE

configMERMAID_WIDTH

configSWARM_CC_AGENT_ROLE

configSWARM_CC_IDENTITY

configSWARM_CODEX_AGENT_ROLE

configSWARM_CODEX_IDENTITY

configSWARM_DB_PATH

configSWARM_DISPATCH_HARNESS

configSWARM_DISPATCH_SPAWNER

configSWARM_HARNESS_CLAUDE

configSWARM_HARNESS_CODEX

configSWARM_HARNESS_HERMES

configSWARM_HARNESS_OPENCODE

configSWARM_HERDR_BIN

configSWARM_HERDR_MAX_PANES_PER_TAB

configSWARM_HERDR_PARENT_PANE

configSWARM_HERDR_SPLIT_DIRECTION

configSWARM_HERMES_IDENTITY

configSWARM_HERMES_ROLE

configSWARM_IDENTITY

configSWARM_MCP_ALLOW_CROSS_IDENTITY

configSWARM_MCP_ALLOW_UNLABELED

configSWARM_MCP_BIN— Launcher-managed sessions may set to a real command such as

configSWARM_MCP_DEFAULT_ROOTS

configSWARM_MCP_DIRECTORY

configSWARM_MCP_FILE_ROOT

configSWARM_MCP_INSTANCE_ID— Writes (require identity — pass --as <uuid prefix unique-label-substring> or set ; falls back to the sole live instance in scope):

configSWARM_MCP_LABEL

configSWARM_MCP_LAUNCH_DIR

configSWARM_MCP_PERSONAL_ROOTS

configSWARM_MCP_PROFILE_DIR

configSWARM_MCP_SCOPE— const scope = process.env.;

configSWARM_OPENCODE_AGENT_ROLE

configSWARM_PROTOCOL_STATE_RS

configSWARM_SPAWNER

configSWARM_WORKER_HARNESS

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/volpestyle-swarm-mcp-12vhyt)](https://m8ven.ai/mcp/volpestyle-swarm-mcp-12vhyt)

commit: b95f607c7692fc931cf398ccc09374bfc6b56b88

code hash: c6fbfde16cf0a81f4423dcb179e8f37c7eab8393648161c0a48a01cb9d299fd0

verified: 6/15/2026, 1:02:52 PM

view raw JSON →