wayforth-mcp (WayforthOfficial/wayforth) is an MCP server listed on the M8ven Trust Index. It scores 74 out of 100, grade C. It declares 19 tools. No publisher has claimed this listing.

Back to MCP Trust IndexM8ven
C
Emerging
74/100
8 days ago

wayforth-mcp

Provides AI agents with a unified runtime to discover, use, and pay for thousands of services with automatic failover and per-run credit ceilings.

→ WayforthOfficial/wayforth· listed on glama

Emerging. No concerning findings. Grades remain capped until the project builds reputation through adoption. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

WayforthOfficial

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
🚨
Secret credentials may flow to a network call
13 flows detected: WAYFORTH_API_KEY, RANK_SERVICE_KEY, JINA_API_KEY. We can’t prove the destination matches the brand the credential belongs to.
🔐
You'll be asked for 17 credentials: WAYFORTH_API_KEY, ADMIN_KEY, STRIPE_SECRET_KEY, X402_RELAYER_PRIVATE_KEY, RESEND_API_KEY, WAYFORTH_TEST_API_KEY, RANK_SERVICE_KEY, AGENT_SECRET_KEY, ENCRYPTION_KEY, RUN_TOKEN_SIGNING_SECRET, CDP_API_KEY_PRIVATE_KEY, GROQ_API_KEY, E2B_API_KEY, UPTIMEROBOT_API_KEY, UPTIMEROBOT_READ_ONLY_KEY, JINA_API_KEY, STRIPE_WEBHOOK_SECRET
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configNOTIFY_EMAIL
🔐 secretWAYFORTH_API_KEY
configMCP_TRANSPORT
🔐 secretADMIN_KEY
configENVIRONMENT
configLOG_LEVEL
🔐 secretSTRIPE_SECRET_KEY
configPROBE_EMAIL_FROM
configPROBE_EMAIL_TO
configREPLICA_COUNT
configCPU_CORES
configWAYFORTH_DB_POOL_MIN
configWAYFORTH_DB_POOL_MAX
configBASE_CHAIN_ID
configWAYFORTH_API_URL
configHOST
🔐 secretX402_RELAYER_PRIVATE_KEY
🔐 secretRESEND_API_KEY
configRANK_SERVICE_URL
configDATABASE_PUBLIC_URL
configCONSECUTIVE_FAILURE_THRESHOLD
configTIER2_UPTIME_WINDOW_DAYS
configTIER2_UPTIME_THRESHOLD
🔐 secretWAYFORTH_TEST_API_KEY
configWAYFORTH_BASE_URL
🔐 secretRANK_SERVICE_KEY
configWAYFORTH_ADMIN_KEY_ENABLED
🔐 secretAGENT_SECRET_KEY
🔐 secretENCRYPTION_KEY
configSTRIPE_PRICE_STARTER
configSTRIPE_PRICE_BUILDER
configSTRIPE_PRICE_PRO
configSTRIPE_PRICE_GROWTH
configWAYFORTH_BASE_WALLET
configWAYFORTH_TRUSTED_PROXY_HOPS
🔐 secretRUN_TOKEN_SIGNING_SECRET
configRUN_TOKEN_SIGNING_SECRET_PREV
configWAYFORTH_FAILOVER_MAX_DEPTH
configWAYFORTH_FAILOVER_RETRY_PRIMARY
configWAYFORTH_FAILOVER_POST_SEND
configWAYFORTH_FAILOVER_POST_SEND_MAX_COST
configWAYFORTH_GATEWAY_BASE
configAGENT_RUN_TOKENS_ENABLED
configAGENT_VERSIONED_DISPATCH_ENABLED
configAGENT_MIRROR_URL
configAGENT_MIRROR_HOST
configCDP_API_KEY_NAME
🔐 secretCDP_API_KEY_PRIVATE_KEY
configWAYFORTH_GATEWAY_URL
configSTRIPE_MOCK
🔐 secretGROQ_API_KEY
configDEPS_MIRROR_URL
configDEPS_MIRROR_HOSTS
configWAYFORTH_GATEWAY_HOST
configDEPS_LIVE_PROOF
🔐 secretE2B_API_KEY
configGROQ_API_BASE
configAGENT_GATEWAY_EGRESS_ENABLED
configAGENT_BASE_IMAGE
configX_WAYFORTH_AGENT_ID
configSEARCH_QUERY
configNUM_RESULTS
configTRANSLATE_TEXT
configTARGET_LANG
configFROM_EMAIL
configDATA_SOURCE
configSYMBOL
configTOPIC
configMODEL
configWORD_COUNT
configTONE
configPAGE_URL
configEXTRACT_FOCUS
configSTOCK_SYMBOL
configNEWS_TOPIC
configURL
configSUMMARY_STYLE
configCOMPANY_NAME
configCOMPANY_URL
configIMAGE_PROMPT
configQUALITY
configASPECT_RATIO
configENHANCE_PROMPT
configWAYFORTH_PARAMS
configPROMPT
configQUERY
🔐 secretUPTIMEROBOT_API_KEY
🔐 secretUPTIMEROBOT_READ_ONLY_KEY
configUPTIMEROBOT_MONITOR_ID
configUSDC_EIP712_NAME
configUSDC_EIP712_VERSION
configBASE_RPC
🔐 secretJINA_API_KEY
configSTRIPE_PRICE_STARTER_ANNUAL
configSTRIPE_PRICE_BUILDER_ANNUAL
configSTRIPE_PRICE_PRO_ANNUAL
configSTRIPE_PRICE_GROWTH_ANNUAL
🔐 secretSTRIPE_WEBHOOK_SECRET
configWAYFORTH_USDC_ENABLED
configBASE_RPC_URL
configUSDC_ADDRESS
Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.
deploySENTRY_DSN
deployDATABASE_URL
deployPORT
deployREDIS_URL
deployRUN_BUDGET_PROOF_DSN
// quality suggestions

Tool annotations

18/19 tools have annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

19/19 tools missing one or more hints — wayforth_compare (missing: idempotentHint, openWorldHint); wayforth_similar (missing: idempotentHint, openWorldHint); wayforth_execute (missing: idempotentHint, openWorldHint), +16 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool test coverage

Only 1/19 tools referenced in tests (5%)

Write tests that reference each tool by name so every tool has at least one test.

Secrets not logged

19 secret values sent to log/logger.error/logger.warning/print

Redact or omit secret values from log output.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/wayforthofficial/wayforth)](https://m8ven.ai/mcp/wayforthofficial/wayforth)
Shows your grade and updates automatically. Prefer no grade? Append ?variant=verified to the badge URL.
commit: 97b87df784f43de30caeb3dcd02aac11d3dcf4c0
code hash: ffcbf2822ec734af6b69556e189c4145e131eb867273f8188665f255263b4f15
verified: 9/2/2026, 2:32:22 AM
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client