69
/ 100
18 days ago
glama

Research MCP

Provides a private set of high-level tools for web research, focused URL investigation, read-only GitHub research, and persistent semantic memory via a Streamable HTTP MCP gateway.

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
🔐
You'll be asked for 4 credentials: RESEARCH_API_TOKEN, GITHUB_TOKEN, PLANNER_API_KEY, CRAWL4AI_API_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configRESEARCH_API_MAX_REQUEST_BYTES
🔐 secretRESEARCH_API_TOKENUvicorn, set and send the same bearer token from the
configARTIFACT_DIR/<job_id>/result-<lease-prefix>.json; source snapshots may be
configRESEARCH_BROWSER_TOTAL_TIMEOUT_SECONDS
configWEB_RUNNER_MAX_RESPONSE_BYTES
configRESEARCH_BROWSER_SANDBOX_MODEauto first launches Chromium with its native
configRESEARCH_BROWSER_PROXY
configWEB_RUNNER_SOCKET
configCRAWL4AI_EGRESS_SOCKS_HOST
configCRAWL4AI_EGRESS_SOCKS_PORT
configCRAWL4AI_EGRESS_CONNECT_TIMEOUT_SECONDS
configSAFE_EGRESS_ALLOWED_PORTSapplies to both direct fetches and browser traffic.
configSAFE_EGRESS_DENY_CIDRSKeep it limited to required web ports. Use to block
configSAFE_EGRESS_DNS_TIMEOUT_SECONDS
configDIRECT_MAX_RESPONSE_BYTES
configCRAWL4AI_MAX_RESPONSE_BYTES
configDIRECT_TOTAL_TIMEOUT_SECONDS
configDIRECT_EXTRACTION_TIMEOUT_SECONDS
configCRAWL4AI_TOTAL_TIMEOUT_SECONDS
configDIRECT_FIRST_HEDGE_SECONDShead start. Results must pass the conservative
configDIRECT_FIRST_MIN_CONTENT_CHARSquality gate; thin, blocked, or dynamic pages
configPDF_MAX_RESPONSE_BYTES
configPDF_MAX_PAGES
configPDF_MAX_EXTRACTED_CHARS
configPDF_SANDBOX_MEMORY_BYTES
configPDF_SANDBOX_CPU_SECONDS
configPDF_SANDBOX_OUTPUT_BYTES
configPDF_RUNNER_SOCKET
configCRAWL4AI_NETWORK_ISOLATED
configRESEARCH_REQUIRE_WEB_ISOLATION
configSYSTEMROOT
configRESEARCH_REQUIRE_PDF_ISOLATION
configGITHUB_API_URLonly to a trusted GitHub Enterprise API because the configured
🔐 secretGITHUB_TOKENURL. Anonymous access is rate-limited. Set a least-privilege for
configGITHUB_API_VERSION
configGITHUB_MAX_FILE_CHARSauthentication. bounds returned file content, while
configGITHUB_MAX_RESPONSE_BYTES
configGITHUB_TIMEOUT_SECONDS
configGITHUB_ALLOW_INSECURE_HTTP
configGITHUB_REDACT_SECRETS
configREDIS_URL
configRESEARCH_QUEUE
configMCP_TRANSPORT
configJOB_BACKENDstart_research Queue durable research_web work and return a job ID immediately. Use this for clients with short tool-call timeouts. It requires =redis, which Compose configures.
configMCP_SYNC_JOB_WAIT_SECONDSfor up to (60 seconds by default) before returning a
configMCP_JOB_POLL_SECONDS
configMCP_JOB_LONG_POLL_SECONDS
configMCP_MAX_QUERY_CHARS
configMCP_MAX_INGEST_CHARS
configGITHUB_ALLOWED_REPOSITORIESWhen GITHUB_TOKEN is configured, is mandatory
configMCP_HOST
configMCP_PORT
configMCP_PATH
configMCP_EXTERNAL_BIND_ADDRESS
configMCP_ALLOW_UNAUTHENTICATED_REMOTE
configRESEARCH_PDF_NETWORK_ISOLATED
configLOG_LEVEL
configRESEARCH_SOURCE_CONCURRENCYEach worker processes up to sources concurrently.
configPLANNER_BASE_URL
configPLANNER_MODEL
🔐 secretPLANNER_API_KEY; it is excluded from the container build context.
configPLANNER_TIMEOUT_SECONDS
configPLANNER_MAX_RESPONSE_BYTES
configPLANNER_ALLOW_INSECURE_HTTP
configPLANNER_ENABLE_SYNTHESISmodel, credentials, and =true are configured.
configSAFE_EGRESS_HOST
configSAFE_EGRESS_PORT
configSAFE_EGRESS_CONNECT_TIMEOUT_SECONDS
configSAFE_EGRESS_HANDSHAKE_TIMEOUT_SECONDS
configSAFE_EGRESS_IDLE_TIMEOUT_SECONDS
configSAFE_EGRESS_MAX_CONNECTION_SECONDS
configSAFE_EGRESS_MAX_CONNECTIONS
configSAFE_EGRESS_QUEUE_TIMEOUT_SECONDS
configSAFE_EGRESS_MAX_BYTES_PER_DIRECTION
configSEARXNG_MAX_RESPONSE_BYTES
configSEARXNG_TIMEOUT_SECONDS
configSEARXNG_URL
configCRAWL4AI_URL
configRERANKER_URL
configQDRANT_URL
configRESEARCH_API_URL, RESEARCH_API_TOKEN, and bounded request, metadata, ingest,
configRESEARCH_API_MAX_RESPONSE_BYTES
configRESEARCH_API_TOTAL_TIMEOUT_SECONDSand response limits. bounds the entire
configRAG_MAX_INGEST_CHARS
configRAG_MAX_METADATA_BYTES
configRERANKER_MAX_RESPONSE_BYTES
configRERANKER_TIMEOUT_SECONDS
configRERANKER_TOTAL_TIMEOUT_SECONDS
configUSE_RESEARCH_API_RAGdevelopment service. Consumers set =true,
configQDRANT_COLLECTION
configEMBEDDING_MODELVECTOR_SIZE must match the selected .
configMODEL_CACHE_DIR
configDEFAULT_RESEARCH_NAMESPACE
configRESEARCH_TIMEZONESet to the primary user's IANA timezone, such as
configCHUNK_SIZE
configCHUNK_OVERLAP
configVECTOR_SIZEmust match the selected EMBEDDING_MODEL.
configQDRANT_INIT_RETRIES
configQDRANT_INIT_DELAY_SECONDS
configQDRANT_HISTORY_RETENTION_SECONDShistory after (default 30 days; 0 disables
configWEB_RUNNER_MAX_REQUEST_BYTES
🔐 secretCRAWL4AI_API_TOKENecho "=$(openssl rand -hex 32)"
configARTIFACT_RETENTION_SECONDSpruned when their newest file is older than
configARTIFACT_CLEANUP_INTERVAL_SECONDS(default 30 days), with scans every (default
configQDRANT_LIFECYCLE_REPAIR_INTERVAL_SECONDS(default one hour), resumes bounded
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/zdost-research-mcp-1ssxf9)](https://m8ven.ai/mcp/zdost-research-mcp-1ssxf9)
commit: 1cbf86b30927da1bbe2bd644fdd3813726bec9da
code hash: fccb2bd204cc4490db6028484ca45cd317f41a73304ded871296e997b7f981b9
verified: 7/13/2026, 9:55:24 AM
view raw JSON →