zhuylanz/lapage-strapi-mcp

MCP server for Strapi CMS content and media management.

→ zhuylanz/lapage-strapi-mcp · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 3 credentials: STRAPI_ADMIN_TOKEN, STRAPI_API_TOKEN, STRAPI_TOKEN

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// known CVEs in dependencies3 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

lowqs@6.14.0GHSA-6rw7-vpxm-498p

qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion

lowqs@6.14.0GHSA-q8mj-m7cp-5q26

qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set

lowqs@6.14.0GHSA-w7fw-mjwx-w883

qs's arrayLimit bypass in comma parsing allows denial of service

Depend on this server? Get alerted when its CVEs change.Watch this server free →

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

🔐 secretSTRAPI_ADMIN_TOKEN— Optional Token for content-manager/admin schema discovery. Falls back to STRAPI_API_TOKEN.

🔐 secretSTRAPI_API_TOKEN— Yes Strapi API token for REST content and media operations.

configSTRAPI_API_URL— is also accepted as an alias for STRAPI_URL.

🔐 secretSTRAPI_TOKEN— is also accepted as an alias for STRAPI_API_TOKEN.

configSTRAPI_URL— Yes Strapi base URL, for example https://cms.example.com.

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/zhuylanz-lapage-strapi-mcp-hunnz9)](https://m8ven.ai/mcp/zhuylanz-lapage-strapi-mcp-hunnz9)

commit: 0c023d9f8661bbe9ec55966a99f7ce311405e42a

code hash: ce2402a3466286bd091eeabdb97808099b7e0a9c23bd3d418f7f546ca0a97058

verified: 6/13/2026, 9:44:52 AM

view raw JSON →