votel-mcp (votelai/votel-mcp) is an MCP server listed on the M8ven Trust Index. It scores 58 out of 100, grade D. It declares 45 tools. No publisher has claimed this listing.

D
Caution
58/100

votel-mcp

An MCP server that lets AI assistants manage and publish websites via Votel, including creating sites, adding domains, purging cache, and retrieving analytics.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

votelai

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Known vulnerabilities in dependencies: 3 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 2 credentials: API_KEY, VOTEL_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes45 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

list_websites

List all websites for your account. Returns name, CDN hostname, status, and domain count for each site. Example: 'List my websites' or 'Show active websites'.

create_website

Create a new website with CDN hosting. Provisions storage and pull zone automatically. Example: 'Create a website called My Business'.

get_website

Get detailed information about a website including domains, CDN config, and status. Example: 'Show me details for website <id>'.

delete_website

Permanently delete a website and all its resources (storage, CDN, files). Cannot be undone. Example: 'Delete the website called Test Site'.

add_domain

Add a custom domain to a website. Returns DNS records you need to configure. Example: 'Add example.com to my website'.

remove_domain

Remove a custom domain from a website. Example: 'Remove example.com from my website'.

verify_domain

Check DNS propagation and SSL status for a custom domain. Example: 'Check if example.com is verified'.

purge_cache

Clear CDN cache for a website. Purge everything or specific URLs. Example: 'Purge cache for my website'.

get_analytics

Get traffic analytics for a website — requests, bandwidth, and cache hit ratio. Example: 'Show analytics for my website'.

get_storage_credentials

Get storage credentials for direct file uploads to a website. Example: 'Get upload credentials for my website'.

list_files

List files and folders in a website's storage. Use path '/' for root directory. Example: 'Show files in my website'.

upload_file

Upload a file to a website's storage. Content must be base64-encoded. File is immediately available via CDN. Example: 'Upload index.html to my website'.

delete_file

Delete a file from a website's storage. Example: 'Delete old-page.html from my website'.

create_folder

Create a new folder in a website's storage. Example: 'Create an images folder'.

publish_site

Deploy multiple files to a website in one call. Pass a map of file paths to content. CDN cache is purged automatically. This is the best way to publish or update a website. Example: 'Build a landing page and publish it'.

list_contacts

List contacts in your CRM with optional search and filtering. Returns name, email, phone, and lifecycle stage. Example: 'Show my contacts' or 'Find contacts named John'.

get_contact

Get detailed information about a specific contact including all fields, tags, and notes. Example: 'Show me details for contact <id>'.

create_contact

Create a new contact in your CRM. Provide at least a name, email, or phone. Example: 'Add a contact named John Smith with email john@example.com'.

update_contact

Update fields on an existing contact. Only the fields you provide are changed. Example: 'Update John's phone to 555-1234'.

delete_contact

Delete a contact from your CRM (soft delete). Example: 'Delete contact <id>'.

list_pipelines

List all sales pipelines with their stages. Shows pipeline name, stage names, and lead counts. Example: 'Show my pipelines' or 'What stages does my sales pipeline have?'.

get_pipeline_leads

Get contacts/leads in a specific pipeline, optionally filtered by stage. Example: 'Show leads in my Sales pipeline' or 'Who is in the Negotiation stage?'.

move_lead_stage

Move a contact to a different pipeline stage. Example: 'Move John to the Closed Won stage'.

list_tasks

List tasks with optional filtering by completion, priority, type, assignee, or search term. Example: 'Show my tasks', 'Show high priority open tasks', 'Tasks assigned to Alice'.

create_task

Create a new task. Supports the full task field set: assignee, priority, type, status, project, tags, due date with time/timezone, duration, subtask parent, and contact link. Use list_users / list_projects / list_task_statuses / list_task_types to discover valid IDs. Example: 'Create a high priority

update_task

Update fields on an existing task. Use is_completed (boolean) to toggle completion — there is no flat 'status' enum on the backend; for custom statuses use status_id with values from list_task_statuses. Example: 'Set task <id> priority to urgent and assign to Alice'.

delete_task

Soft-delete a task. Example: 'Delete task <id>'.

get_task

Get full detail for a single task — fields, comments, attachments, subtask count. Example: 'Show me task <id>'.

complete_task

Mark a task as completed (or reopen with is_completed=false). Example: 'Mark task <id> as done'.

snooze_task

Snooze a task until a future datetime. Example: 'Snooze task <id> until tomorrow 9am'.

list_subtasks

List all subtasks of a parent task. To create a subtask, call create_task with parent_task_id. Example: 'Show subtasks of task <id>'.

add_task_comment

Add a comment to a task's activity timeline. The comment is appended to the task's recent_comments array; auto-generated activity entries (field changes) are preserved. Example: 'Comment on task <id>: spoke with client, will reschedule'.

add_task_attachment

Attach a file to a task. Provide either a local file_path (uploaded to Votel storage) or a pre-hosted url. Example: 'Attach /tmp/proposal.pdf to task <id>'.

remove_task_attachment

Remove an attachment from a task by its display name. Does not delete the underlying file from storage. Example: 'Remove proposal.pdf from task <id>'.

list_users

List users in the workspace — use to discover assigned_to_id values for tasks. Example: 'Who can I assign tasks to?'.

list_projects

List task projects/pipelines for the workspace. Each project has its own status set and task-type set. Example: 'Show me my projects'.

list_task_statuses

List the custom statuses available for a project (or for the project that contains a given task). Statuses are scoped per-project, NOT per task_type. Example: 'What statuses can I set on task <id>?'.

list_task_types

List the task types available for a project (or for the project that contains a given task). Each type has a 'key' (used as task_type on a task) and a display 'label'. Example: 'What task types can I use in project <id>?'.

list_task_tags

Autocomplete task tag suggestions. Example: 'What tags exist for tasks?' or 'Tags starting with foll'.

get_task_stats

Summary task statistics for the workspace — counts by status, priority, etc. Optional filter by assignee. Example: 'Give me task stats' or 'Show task stats for Alice'.

get_contact_activity

Get recent activity for a contact — calls, emails, SMS, notes, and system events. Example: 'Show recent activity for John' or 'What happened with contact <id>?'.

send_sms

Send an SMS text message to a contact. The contact must have a phone number on file. Example: 'Send John a text saying: Your appointment is confirmed for tomorrow at 2pm'.

list_contact_fields

List all contact fields (built-in and custom) with their types and visibility. Useful for understanding what data you can store on contacts. Example: 'What fields are available for contacts?' or 'Show custom fields'.

create_custom_field

Create a new custom field for contacts. Supports text, email, phone, dropdown, date, number, and textarea types. Example: 'Create a dropdown field called Industry with options: Tech, Healthcare, Finance'.

list_variables

List all global variables with their current values. These are used in templates, workflows, and agent prompts. Example: 'Show my global variables' or 'What variables are set?'.

// known CVEs in dependencies3 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.12.1GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.12.1GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.12.1GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
🔐 secretAPI_KEY
configAPI_URL
🔐 secretVOTEL_API_KEYe =sk_your_api_key_here \
configVOTEL_API_URLNo https://app.votel.ai Backend URL
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

45/45 tools missing one or more hints — list_websites (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); create_website (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_website (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +42 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool inputs are validated

41/45 tool handlers declare input schemas (91%)

Declare an inputSchema with zod/joi/yup on every tool definition.

Tool handlers catch errors

Only 0/45 tool handlers wrap calls in try/catch (0%)

Wrap each tool handler body in try/catch and return a structured error response.

Tests exist

No test files found

Add tests that exercise each declared tool.

Production dependencies are patched

0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.12.1 (high), @modelcontextprotocol/sdk@1.12.1 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/votelai/votel-mcp?variant=verified)](https://m8ven.ai/mcp/votelai/votel-mcp)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: bcf95a732405b8aeca584165fc363f43e24e01ce
code hash: 2ae204ff1b2af49af504de8411c3d1d4428085f2b79130c32299e456f843baa9
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client