timeweb-mcp-server (webkoth/mcp-timeweb) is an MCP server listed on the M8ven Trust Index. It scores 54 out of 100, grade D. It declares 97 tools. No publisher has claimed this listing.

Caution

54/100

timeweb-mcp-server

Item: timeweb-mcp-server
Rating: 54
Author: M8ven

Enables management of Timeweb Cloud resources including servers, databases, Kubernetes clusters, S3 storage, DNS, SSH keys, and floating IPs through natural language.

→ webkoth/mcp-timeweb · listed on glama

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every push why connect →

Who stands behind it

webkoth

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

Glamanot scored here

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings

⚠️

Known vulnerabilities in dependencies: 16 high

Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 1 credential: TIMEWEB_CLOUD_TOKEN

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// tools this server exposes97 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

timeweb_get_account_status

Get current account status including company info, verification status, and restrictions

timeweb_get_finances

Get account finances including balance, discount, hourly cost, and payment history

timeweb_get_service_prices

Get pricing for all available services

timeweb_list_apps

List all PaaS applications in the account

timeweb_get_app

Get detailed information about a specific PaaS application

timeweb_create_app

Create a new PaaS application from GitHub repository

timeweb_update_app

Update a PaaS application settings

timeweb_delete_app

Delete a PaaS application permanently

timeweb_app_action

Perform an action on a PaaS application (start, stop, restart)

timeweb_get_app_logs

Get logs from a PaaS application

timeweb_get_app_statistics

Get resource usage statistics for a PaaS application

timeweb_deploy_app

Trigger a new deployment for a PaaS application

timeweb_list_app_deploys

List deployment history for a PaaS application

timeweb_get_deploy_logs

Get logs for a specific deployment

timeweb_stop_deploy

Stop a running deployment

timeweb_list_balancers

List all load balancers in the account

timeweb_get_balancer

Get detailed information about a specific load balancer

timeweb_create_balancer

Create a new load balancer

timeweb_update_balancer

Update an existing load balancer

timeweb_delete_balancer

Delete a load balancer permanently

timeweb_list_balancer_rules

List all rules for a load balancer

timeweb_create_balancer_rule

Create a new rule for a load balancer

timeweb_list_balancer_presets

List available load balancer configuration presets

timeweb_list_databases

List all database clusters in the account

timeweb_get_database

Get detailed information about a specific database cluster

timeweb_create_database

Create a new database cluster

timeweb_delete_database

Delete a database cluster permanently

timeweb_list_database_presets

List available database configuration presets

timeweb_list_database_backups

List all backups for a database cluster

timeweb_create_database_backup

Create a new backup for a database cluster

timeweb_delete_database_backup

Delete a database backup permanently

timeweb_get_database_auto_backups

Get automatic backup settings for a database cluster

timeweb_list_server_disks

List all disks attached to a server

timeweb_get_server_disk

Get detailed information about a specific server disk

timeweb_create_server_disk

Add a new disk to a server

timeweb_update_server_disk

Update a server disk (resize)

timeweb_delete_server_disk

Delete a disk from a server (cannot delete system disk)

timeweb_list_domains

List all domains in the account

timeweb_get_domain

Get detailed information about a specific domain

timeweb_check_domain

Check if a domain is available for registration

timeweb_list_dns_records

List DNS records for a domain

timeweb_create_dns_record

Create a new DNS record for a domain

timeweb_delete_dns_record

Delete a DNS record

timeweb_list_firewall_groups

List all firewall groups in the account

timeweb_get_firewall_group

Get detailed information about a specific firewall group

timeweb_create_firewall_group

Create a new firewall group

timeweb_update_firewall_group

Update an existing firewall group

timeweb_delete_firewall_group

Delete a firewall group permanently

timeweb_list_firewall_rules

List all rules in a firewall group

timeweb_create_firewall_rule

Create a new firewall rule in a group

timeweb_delete_firewall_rule

Delete a firewall rule from a group

timeweb_list_floating_ips

List all floating IP addresses in the account

timeweb_get_floating_ip

Get detailed information about a specific floating IP

timeweb_create_floating_ip

Create a new floating IP address

timeweb_delete_floating_ip

Delete a floating IP address

timeweb_bind_floating_ip

Bind a floating IP to a server or other resource

timeweb_unbind_floating_ip

Unbind a floating IP from its current resource

timeweb_list_images

List all custom OS images in the account

timeweb_get_image

Get detailed information about a specific custom image

timeweb_create_image

Create a custom OS image from a server disk (snapshot)

timeweb_update_image

Update a custom image name or description

timeweb_delete_image

Delete a custom OS image permanently

timeweb_list_k8s_clusters

List all Kubernetes clusters in the account

timeweb_get_k8s_cluster

Get detailed information about a specific Kubernetes cluster

timeweb_create_k8s_cluster

Create a new Kubernetes cluster

timeweb_delete_k8s_cluster

Delete a Kubernetes cluster permanently

timeweb_get_kubeconfig

Get kubeconfig file for a Kubernetes cluster

timeweb_list_k8s_versions

List available Kubernetes versions

timeweb_list_locations

List all available datacenter locations for provisioning resources

timeweb_list_projects

List all projects in the account for organizing resources

timeweb_get_project

Get detailed information about a specific project

timeweb_create_project

Create a new project for organizing resources

timeweb_delete_project

Delete a project (resources must be moved or deleted first)

timeweb_list_servers

List all cloud servers in the account with pagination support

timeweb_get_server

Get detailed information about a specific server

timeweb_create_server

Create a new cloud server with specified configuration

timeweb_server_action

Perform an action on a server (start, stop, reboot, reinstall, clone, etc.)

timeweb_delete_server

Delete a cloud server permanently

timeweb_list_os

List available operating system images for server creation

timeweb_list_server_presets

List available server configuration presets

timeweb_get_server_logs

Get logs from a cloud server

timeweb_get_server_statistics

Get resource usage statistics for a cloud server (CPU, RAM, Disk, Network)

timeweb_list_ssh_keys

List all SSH keys in the account

timeweb_get_ssh_key

Get detailed information about a specific SSH key

timeweb_create_ssh_key

Create a new SSH key

timeweb_delete_ssh_key

Delete an SSH key

timeweb_add_ssh_key_to_server

Add an SSH key to a server for authentication

timeweb_list_s3_storages

List all S3-compatible object storages in the account

timeweb_create_s3_storage

Create a new S3-compatible object storage bucket

timeweb_delete_s3_storage

Delete an S3 storage bucket permanently

timeweb_list_s3_presets

List available S3 storage configuration presets

timeweb_list_vpcs

List all Virtual Private Clouds (VPCs) in the account

timeweb_get_vpc

Get detailed information about a specific VPC

timeweb_create_vpc

Create a new Virtual Private Cloud (VPC)

timeweb_update_vpc

Update an existing VPC

timeweb_delete_vpc

Delete a VPC permanently (must not have any attached services)

timeweb_list_vpc_services

List all services (servers, databases, etc.) attached to a VPC

// known CVEs in dependencies16 high12 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.6.1GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.6.1GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

highaxios@1.7.9GHSA-35jp-ww65-95wh

axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

highaxios@1.7.9GHSA-3g43-6gmg-66jw

axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

highaxios@1.7.9GHSA-43fc-jf86-j433

Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig

Depend on this server? Get alerted when its CVEs change.Watch this server free →

// environment variables

To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.

🔐 secretTIMEWEB_CLOUD_TOKENAPI token from Timeweb Cloud panel Yes

// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

97/97 tools missing one or more hints — timeweb_get_account_status (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); timeweb_get_finances (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); timeweb_get_service_prices (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +94 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool inputs are validated

Only 33/97 tool handlers declare input schemas (34%)

Declare an inputSchema with zod/joi/yup on every tool definition.

Tool handlers catch errors

Only 0/97 tool handlers wrap calls in try/catch (0%)

Wrap each tool handler body in try/catch and return a structured error response.

Tests exist

No test files found

Add tests that exercise each declared tool.

Production dependencies are patched

0 critical, 16 high severity in production deps — @modelcontextprotocol/sdk@1.6.1 (high), @modelcontextprotocol/sdk@1.6.1 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail

The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.

// improvement guidance — verified publishers only

We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Verified](https://m8ven.ai/badge/mcp/webkoth/mcp-timeweb?variant=verified)](https://m8ven.ai/mcp/webkoth/mcp-timeweb)

Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.

commit: 6ee423491d4e815b291b2f50754baa9f25839f1e

code hash: e4ba3f9c9303d82ad573d7e22d21b935fc95ff197842b7300f78a24b93c4cc58

view raw JSON →

Check MCPs from inside your assistant

Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check

check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern

How to add it →Free · no account needed · works in any MCP client