BridgeAI (wranglatang/BridgeAI) is an MCP server listed on the M8ven Trust Index. It scores 68 out of 100, grade C. It declares 55 tools. No publisher has claimed this listing.

Warning

68/100

BridgeAI

Item: BridgeAI
Rating: 68
Author: M8ven

→ wranglatang/BridgeAI · listed on github_code

Warning. Serious findings were identified. Review the full report before connecting. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every push why connect →

Who stands behind it

wranglatang

Source: github_code

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

GitHub

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings

🚨

Code appears obfuscated

1 file are unreadable to a human reviewer. Cannot audit what they do.

// tools this server exposes55 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

read_skill

Read a file from a skill directory in the platform KB.

write_skill

Write or update a file in a skill directory.

read_workflow

Read a workflow body from the platform KB.

write_workflow

Write or update a workflow body.

platform_search

Full-text search across the platform KB (skills + workflows).

knowledge_read

Read a file from the business knowledge base.

knowledge_write

Write or update a file in the business knowledge base.

knowledge_list

List files in the business knowledge base.

create_agent

Create a new persistent worker agent in this environment.

list_tickets

List tickets with optional filters.

get_ticket

Fetch a single ticket by id, with its full event timeline.

create_ticket

Create a new ticket and assign it to a worker by name.

assign_ticket

Reassign an existing ticket to a different agent by name.

set_agent_model

Change an existing agent's MAIN model.

set_agent_role

Change an existing agent's role label.

set_agent_emoji

Set an agent's emoji avatar.

set_agent_background_model

Change an existing agent's BACKGROUND model.

archive_agent

Soft-delete (archive) an agent from this env.

restore_agent

Restore a previously-archived agent. Re-registers their memory-prune job and restarts their Telegram bot if env.yaml still has an entry. Previously-reassigned tickets are NOT reverted — that was a real decision at archive time.

purge_agent

Hard-delete (purge) an agent. THIS IS DESTRUCTIVE AND CANNOT BE UNDONE.

list_team

List every agent in this environment's team.

list_skills

List every skill available in this environment's shared KB.

list_workflows

List every workflow available in this environment's shared KB.

start_skill

Execute a named skill by creating a ticket for the skill's designated agent.

start_workflow

Execute a named workflow by creating tickets for all blocks.

comment_on_ticket

Post a comment to a ticket's audit timeline.

approve_ticket

Approve a ticket that's in_review or needs_approval, moving it to `done`.

request_changes

Reject a ticket that's in_review or needs_approval, sending it back to `todo` with attached feedback for the worker.

cancel_ticket

Cancel a ticket, moving it to the terminal `cancelled` state.

delete_ticket

Hard-delete a terminal ticket and its full descendant subtree.

purge_done_tickets

Bulk-delete terminal tickets older than ``older_than_days``.

list_http_endpoints

List the local HTTP endpoints configured for this env.

http_get

GET from a configured local HTTP endpoint.

http_post

POST to a configured local HTTP endpoint. See http_get for endpoint semantics and response shape.

http_put

PUT to a configured local HTTP endpoint. See http_post.

http_delete

DELETE against a configured local HTTP endpoint. See http_get.

register_http_endpoint

Add a new local HTTP endpoint to this env's config.

remove_http_endpoint

Delete a local HTTP endpoint from env.yaml.

create_routine

Create a new scheduled routine that fires on a cron schedule.

update_routine

Update an existing scheduled routine.

delete_routine

Delete a scheduled routine by name.

list_routines

List all scheduled routines defined in env.yaml.

register_telegram_bot

remove_telegram_bot

Remove a Telegram bot registration for an agent.

send_message

Send a message to another agent and wait for their response.

read_agent_session

Read another agent's conversation transcript.

list_secrets

List the KEY names currently set in this env's .env file.

set_secret

Set or update a secret in this env's .env file.

delete_secret

Remove a secret from this env's .env file.

grant_agent_tool

Add a tool to an existing agent's allowed_tools whitelist.

revoke_agent_tool

Remove a tool from an existing agent's allowed_tools.

append_to_user_md

Append a short, factual stanza to your own USER.md file.

set_my_display_name

Set the UI-facing display name for YOURSELF.

remember

Save a load-bearing fact to your persistent memory.

complete_bootstrap

Mark the first-contact bootstrap as complete.

// environment variables

To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.

configBRIDGE_ALLOW_SELF_MOUNT

// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

55/55 tools missing one or more hints — read_skill (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); write_skill (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); read_workflow (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +52 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Destructive tools are labelled

1 tool perform destructive updates without destructiveHint — complete_bootstrap deletes at line 3112 (bootstrap_path.unlink())

Add destructiveHint:true to any tool whose handler calls .delete(), .upsert(), .update(), unlink, rm, DELETE, DROP, REPLACE INTO, or any operation that overwrites existing data.

License file

No license file

Add a LICENSE file (MIT, Apache-2.0, etc.).

Readable source code

1 file are minified or bundled, which is usually build output rather than concealment

Ship unminified, readable source.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail

The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.

// improvement guidance — verified publishers only

We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Verified](https://m8ven.ai/badge/mcp/wranglatang/bridgeai?variant=verified)](https://m8ven.ai/mcp/wranglatang/bridgeai)

Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.

commit: ce24f34210ccf0176639df89d2c05836a1423554

code hash: b4dd776c73f6d81fc203cdc9f483b688e1584aaa23aaa9042aa9e1dd65ad2dd3

view raw JSON →

Check MCPs from inside your assistant

Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check

check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern

How to add it →Free · no account needed · works in any MCP client