46
/ 100
1 month ago
github_topic

openrouter-deep-research-mcp

A multi-agent research MCP server + mini client adapter - orchestrates a net of async agents or streaming swarm to conduct ensemble consensus-backed research. Each task builds its own indexed pglite database on the fly in web assembly. Includes semantic + hybrid search, SQL execution, semaphores, prompts/resources and more

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
⚠️
Known vulnerabilities in dependencies: 16 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 12 credentials: ALLOW_NO_API_KEY, API_KEY, BING_API_KEY, BRAVE_API_KEY, ENTERPRISE_CLIENT_SECRET, GOOGLE_API_KEY, OPENROUTER_API_KEY, SERPER_API_KEY, SERVER_API_KEY, SUPABASE_ANON_KEY, SUPABASE_JWT_SECRET, TAVILY_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies16 high14 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

highaxios@1.6.2GHSA-35jp-ww65-95wh

axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

highaxios@1.6.2GHSA-3g43-6gmg-66jw

axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

highaxios@1.6.2GHSA-43fc-jf86-j433

Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig

highaxios@1.6.2GHSA-4hjh-wcwx-xvwj

Axios is vulnerable to DoS attack through lack of data size check

highaxios@1.6.2GHSA-6chq-wfr3-2hj9

Axios: Header Injection via Prototype Pollution

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
🔐 secretALLOW_NO_API_KEY
configALLOW_START_WITHOUT_DB
🔐 secretAPI_KEY
configAPPIMAGE
configAUTH_EXPECTED_AUD
configAUTH_JWKS_URL
configBATCH_MAX_DELAY_MS
configBATCH_MAX_SIZE
🔐 secretBING_API_KEY
configBLOOM_FALSE_POSITIVE_RATE
🔐 secretBRAVE_API_KEY
configCACHE_SIMILARITY_THRESHOLD
configCACHE_TTL_SECONDS
configCHAT_TIMEOUT_MS
configCLASSIFICATION_MODEL
configCONSENSUS_MIN_AGREEMENT
configCORE_HANDLERS_ENABLED
configCORE_HANDLER_DOMAINS
configCRYSTAL_NEGATIVE_WEIGHT
configCRYSTAL_POSITIVE_WEIGHT
configCUBE_MAX_DIMENSIONS
configDB_AUTO_CLOSE
configDB_AUTO_HEAL
configDB_BLOOM_ENABLED
configDB_CUBE_ENABLED
configDB_EAGER_INIT
configDB_SEG_ENABLED
configDB_TCN_ENABLED
configDB_TEMPORAL_ENABLED
configDRY_RUN
configENSEMBLE_SIZE
configENTERPRISE_CLIENT_ID
🔐 secretENTERPRISE_CLIENT_SECRET
configENTERPRISE_EXPECTED_AUD
configENTERPRISE_IDP_ISSUER
configENTERPRISE_IDP_URL
🔐 secretGOOGLE_API_KEY
configGOOGLE_SEARCH_ENGINE_ID
configHIGH_COST_MODELS
configHVM_CHECK_INTERVAL_MS
configHVM_CRYSTALLIZATION_THRESHOLD
configHVM_DEBUG
configHVM_ENABLED
configHVM_INTERPRETER
configHVM_MAX_REDUCTIONS
configHVM_MAX_WORKERS
configHVM_PARALLEL
configHVM_PARALLEL_STRATEGY
configHVM_VISUALIZE
configHYPER_MODE
configINDEXER_AUTO_INDEX_FETCHED
configINDEXER_AUTO_INDEX_REPORTS
configINDEXER_BM25_B
configINDEXER_BM25_K1
configINDEXER_EMBED_DOCS
configINDEXER_ENABLEDtrue Enable knowledge indexing
configINDEXER_MAX_DOC_LENGTH
configINDEXER_RERANK_ENABLED
configINDEXER_RERANK_MODEL
configINDEXER_STOPWORDS
configINDEXER_WEIGHT_BM25
configINDEXER_WEIGHT_VECTOR
configJOBS_CONCURRENCY
configJOB_BATCH_EVENT_LIMIT
configJOB_HEARTBEAT_MS
configJOB_LEASE_TIMEOUT_MS
configJOB_SSE_POLLING_MS
configLOG_FORMAT
configLOG_JSON
configLOG_LEVEL
configLOG_OUTPUT
configLOW_COST_MODELS
configMANIFOLD_CURVATURE_THRESHOLD
configMANIFOLD_ENABLED
configMANIFOLD_NEIGHBORHOOD_SIZE
configMANIFOLD_PRECOMPUTE
configMAX_RESEARCH_ITERATIONS
configMAX_TOOL_DEPTH
configMCP_CIMD_ALLOW_HTTP
configMCP_ENABLE_PROMPTS
configMCP_ENABLE_RESOURCES
configMCP_LEGACY_SSE_ENABLED
configMCP_PROMPTS_ENABLED
configMCP_RESOURCES_ENABLED
configMIN_MAX_TOKENS
configMODEALL AGENT, MANUAL, or ALL
configMODEL_CACHE_MAX_ENTRIES
configMODEL_CACHE_TTL
configMODEL_CACHING_ENABLED
configNEXT_PUBLIC_SUPABASE_URL
🔐 secretOPENROUTER_API_KEYSet in your environment, then configure via .env or .mcp.json:
configOPENROUTER_API_KEYS(optional) Comma-separated OpenRouter keys for rotation
configOPENROUTER_KEY_COOLDOWN_MS5000 Base cooldown per key after failures
configOPENROUTER_RETRIES
configOPENROUTER_RETRY_DELAY_MS
configOPENROUTER_TIMEOUT_MS
configPADIC_CACHE
configPADIC_CACHE_TTL
configPADIC_ENABLED
configPADIC_PRIME
configPARALLELISM
configPAYLOAD_COMPRESSION
configPAYLOAD_COMPRESSION_FORMAT
configPAYLOAD_COMPRESSION_THRESHOLD
configPAYLOAD_REFERENCE_THRESHOLD
configPGLITE_ALLOW_IN_MEMORY_FALLBACK
configPGLITE_DATABASE_URL
configPGLITE_DATA_DIR
configPGLITE_INIT_TIMEOUT_MS
configPGLITE_MAX_RETRY_ATTEMPTS
configPGLITE_RELAXED_DURABILITY
configPGLITE_RETRY_DELAY_BASE_MS
configPGLITE_RETRY_ON_FAILURE
configPLANNING_CANDIDATES
configPLANNING_MAX_TOKENS
configPLANNING_MIN_TOKENS
configPLANNING_MODEL
configPORT
configPROMPTS_COMPACT
configPROMPTS_CONFIDENCE
configPROMPTS_REQUIRE_URLS
configPROVIDER_TELEMETRY_MODELS
configPUBLIC_URL
configQUADRATURE_ENABLED
configQUADRATURE_PHASE_LOCK_THRESHOLD
configQUADRATURE_REFERENCE_MODEL
configRAIL_CACHE
configRAIL_CACHE_THRESHOLD
configRAIL_CACHE_TTL
configRAIL_CIRCUIT_BREAKERtrue Enable circuit breaker
configRAIL_CIRCUIT_RESET_MS120000 Recovery timeout (ms)
configRAIL_CIRCUIT_THRESHOLD5 Failures before tripping
configRAIL_CONSENSUS
configRAIL_CONSENSUS_MIN
configRAIL_CONSENSUS_TIMEOUT_MS
configRAIL_CONSENSUS_UPDATE_MS
configRAIL_COST_PREFERENCE
configRAIL_DEBUG
configRAIL_DEBUG_RAILS
configRAIL_ENABLED
configRAIL_RATE_LIMIT
configRAIL_RATE_LIMIT_RPM
configRAIL_ROUTING_STRATEGY
configRAIL_TOKEN_BUDGET
configRAIL_TOKEN_BUDGET_LIMIT
configRAIL_TOKEN_COUNT
configRAIL_TUNNELS
configRAIL_TUNNEL_REQUIRE_ACK
configRAIL_TUNNEL_TTL_MS
configREPORT_OUTPUT_PATH
configREQUIRE_HTTPS
configRESEARCH_MAX_TOKENS
configRESEARCH_MIN_TOKENS
configRESULT_CACHE_MAX_ENTRIES
configRESULT_CACHE_TTL
configRESULT_CACHING_ENABLED
configREWARDS_CRYSTALLIZATION_WEIGHT
configREWARDS_ENABLED
configREWARDS_PERSIST_TRACE
configREWARDS_TRACE_BONUS
configREWARDS_UNCERTAINTY_PENALTY
configROLESHIFT_ENABLED
configROLESHIFT_TIMEOUT_MS
configSEARXNG_URL
🔐 secretSERPER_API_KEY
🔐 secretSERVER_API_KEY
configSERVER_PORT3002 HTTP server port
configSIGNAL_MAX_HISTORY
configSIGNAL_PROTOCOL_ENABLED
configSIMPLE_TOOLS
configSTARTUP_TIMEOUT_MS
configSTREAM_TIMEOUT_MS
configSTRICT_SCHEMA_VALIDATION
🔐 secretSUPABASE_ANON_KEY
🔐 secretSUPABASE_JWT_SECRET
configSUPABASE_URL
configSYNTHESIS_MAX_TOKENS
configSYNTHESIS_MIN_TOKENS
configSYNTHESIS_MODEL
🔐 secretTAVILY_API_KEY
configTOKENS_PER_DOC
configTOKENS_PER_SUBQUERY
configUSE_DYNAMIC_CATALOG
configVERY_LOW_COST_MODELS
configWEB_GROUNDING_ENABLED
configWEB_GROUNDING_MAX_RESULTS
configXDG_DATA_HOME
configZERO_CLI_MODE
configZERO_DB_PATH
configZERO_SOCKET
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/wheattoast11-openrouter-deep-research-mcp-53ue6n)](https://m8ven.ai/mcp/wheattoast11-openrouter-deep-research-mcp-53ue6n)
commit: 1506d9f5a77736eed306c7f47065cfefbf85b5ed
code hash: 0c13f2d9ceb960a16680edfe11ba761c75bed92a888a53b4bb3712bfa1dba868
verified: 6/15/2026, 1:05:32 PM
view raw JSON →