votel-mcp (votelai/votel-mcp) is an MCP server listed on the M8ven Trust Index. It scores 58 out of 100, grade D. It declares 45 tools. No publisher has claimed this listing.
An MCP server that lets AI assistants manage and publish websites via Votel, including creating sites, adding domains, purging cache, and retrieving analytics.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
votelai
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
list_websitesList all websites for your account. Returns name, CDN hostname, status, and domain count for each site. Example: 'List my websites' or 'Show active websites'.
create_websiteCreate a new website with CDN hosting. Provisions storage and pull zone automatically. Example: 'Create a website called My Business'.
get_websiteGet detailed information about a website including domains, CDN config, and status. Example: 'Show me details for website <id>'.
delete_websitePermanently delete a website and all its resources (storage, CDN, files). Cannot be undone. Example: 'Delete the website called Test Site'.
add_domainAdd a custom domain to a website. Returns DNS records you need to configure. Example: 'Add example.com to my website'.
remove_domainRemove a custom domain from a website. Example: 'Remove example.com from my website'.
verify_domainCheck DNS propagation and SSL status for a custom domain. Example: 'Check if example.com is verified'.
purge_cacheClear CDN cache for a website. Purge everything or specific URLs. Example: 'Purge cache for my website'.
get_analyticsGet traffic analytics for a website — requests, bandwidth, and cache hit ratio. Example: 'Show analytics for my website'.
get_storage_credentialsGet storage credentials for direct file uploads to a website. Example: 'Get upload credentials for my website'.
list_filesList files and folders in a website's storage. Use path '/' for root directory. Example: 'Show files in my website'.
upload_fileUpload a file to a website's storage. Content must be base64-encoded. File is immediately available via CDN. Example: 'Upload index.html to my website'.
delete_fileDelete a file from a website's storage. Example: 'Delete old-page.html from my website'.
create_folderCreate a new folder in a website's storage. Example: 'Create an images folder'.
publish_siteDeploy multiple files to a website in one call. Pass a map of file paths to content. CDN cache is purged automatically. This is the best way to publish or update a website. Example: 'Build a landing page and publish it'.
list_contactsList contacts in your CRM with optional search and filtering. Returns name, email, phone, and lifecycle stage. Example: 'Show my contacts' or 'Find contacts named John'.
get_contactGet detailed information about a specific contact including all fields, tags, and notes. Example: 'Show me details for contact <id>'.
create_contactCreate a new contact in your CRM. Provide at least a name, email, or phone. Example: 'Add a contact named John Smith with email john@example.com'.
update_contactUpdate fields on an existing contact. Only the fields you provide are changed. Example: 'Update John's phone to 555-1234'.
delete_contactDelete a contact from your CRM (soft delete). Example: 'Delete contact <id>'.
list_pipelinesList all sales pipelines with their stages. Shows pipeline name, stage names, and lead counts. Example: 'Show my pipelines' or 'What stages does my sales pipeline have?'.
get_pipeline_leadsGet contacts/leads in a specific pipeline, optionally filtered by stage. Example: 'Show leads in my Sales pipeline' or 'Who is in the Negotiation stage?'.
move_lead_stageMove a contact to a different pipeline stage. Example: 'Move John to the Closed Won stage'.
list_tasksList tasks with optional filtering by completion, priority, type, assignee, or search term. Example: 'Show my tasks', 'Show high priority open tasks', 'Tasks assigned to Alice'.
create_taskCreate a new task. Supports the full task field set: assignee, priority, type, status, project, tags, due date with time/timezone, duration, subtask parent, and contact link. Use list_users / list_projects / list_task_statuses / list_task_types to discover valid IDs. Example: 'Create a high priority…
update_taskUpdate fields on an existing task. Use is_completed (boolean) to toggle completion — there is no flat 'status' enum on the backend; for custom statuses use status_id with values from list_task_statuses. Example: 'Set task <id> priority to urgent and assign to Alice'.
delete_taskSoft-delete a task. Example: 'Delete task <id>'.
get_taskGet full detail for a single task — fields, comments, attachments, subtask count. Example: 'Show me task <id>'.
complete_taskMark a task as completed (or reopen with is_completed=false). Example: 'Mark task <id> as done'.
snooze_taskSnooze a task until a future datetime. Example: 'Snooze task <id> until tomorrow 9am'.
list_subtasksList all subtasks of a parent task. To create a subtask, call create_task with parent_task_id. Example: 'Show subtasks of task <id>'.
add_task_commentAdd a comment to a task's activity timeline. The comment is appended to the task's recent_comments array; auto-generated activity entries (field changes) are preserved. Example: 'Comment on task <id>: spoke with client, will reschedule'.
add_task_attachmentAttach a file to a task. Provide either a local file_path (uploaded to Votel storage) or a pre-hosted url. Example: 'Attach /tmp/proposal.pdf to task <id>'.
remove_task_attachmentRemove an attachment from a task by its display name. Does not delete the underlying file from storage. Example: 'Remove proposal.pdf from task <id>'.
list_usersList users in the workspace — use to discover assigned_to_id values for tasks. Example: 'Who can I assign tasks to?'.
list_projectsList task projects/pipelines for the workspace. Each project has its own status set and task-type set. Example: 'Show me my projects'.
list_task_statusesList the custom statuses available for a project (or for the project that contains a given task). Statuses are scoped per-project, NOT per task_type. Example: 'What statuses can I set on task <id>?'.
list_task_typesList the task types available for a project (or for the project that contains a given task). Each type has a 'key' (used as task_type on a task) and a display 'label'. Example: 'What task types can I use in project <id>?'.
list_task_tagsAutocomplete task tag suggestions. Example: 'What tags exist for tasks?' or 'Tags starting with foll'.
get_task_statsSummary task statistics for the workspace — counts by status, priority, etc. Optional filter by assignee. Example: 'Give me task stats' or 'Show task stats for Alice'.
get_contact_activityGet recent activity for a contact — calls, emails, SMS, notes, and system events. Example: 'Show recent activity for John' or 'What happened with contact <id>?'.
send_smsSend an SMS text message to a contact. The contact must have a phone number on file. Example: 'Send John a text saying: Your appointment is confirmed for tomorrow at 2pm'.
list_contact_fieldsList all contact fields (built-in and custom) with their types and visibility. Useful for understanding what data you can store on contacts. Example: 'What fields are available for contacts?' or 'Show custom fields'.
create_custom_fieldCreate a new custom field for contacts. Supports text, email, phone, dropdown, date, number, and textarea types. Example: 'Create a dropdown field called Industry with options: Tech, Healthcare, Finance'.
list_variablesList all global variables with their current values. These are used in templates, workflows, and agent prompts. Example: 'Show my global variables' or 'What variables are set?'.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
API_KEYAPI_URLVOTEL_API_KEYe =sk_your_api_key_here \VOTEL_API_URLNo https://app.votel.ai Backend URLTool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
45/45 tools missing one or more hints — list_websites (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); create_website (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_website (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +42 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tool inputs are validated
41/45 tool handlers declare input schemas (91%)
Declare an inputSchema with zod/joi/yup on every tool definition.
Tool handlers catch errors
Only 0/45 tool handlers wrap calls in try/catch (0%)
Wrap each tool handler body in try/catch and return a structured error response.
Tests exist
No test files found
Add tests that exercise each declared tool.
Production dependencies are patched
0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.12.1 (high), @modelcontextprotocol/sdk@1.12.1 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/votelai/votel-mcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check