Gluecron MCP Server
https://gluecron.com/mcp
Remote
v1.0
Published by gluecron.com — no publish provenance and no public repository, so the publisher could not be verified and the source cannot be independently located.
AI-native git hosting — repos, PRs, issues, CI gates, and AI code review over MCP (60 tools).
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 6.3 = 94. What the published surface and source actually contain:
| Points | What was found | Category |
|---|---|---|
| −6.3 | Annotation contradicts behavior on "gluecron_write_file" MTC-CAP-003 | permissions |
2. Client adoption risk — 94 − 6 = 88. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −6 | capability blast radius (high) — client exposure if the model is manipulated |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 8
critical Completed toxic-flow trifecta across toolsMTC-FLOW-002
This server (without client built-ins) exposes a complete data-exfiltration chain: gluecron_get_commit → gluecron_read_file ⇒ gluecron_create_issue. Untrusted input is ingested, private data is read, and it can be sent to an external sink — and at least one leg is a direct schema wire (⇒), where a producer's output drops straight into a free-text parameter of the next tool, so the chain needs little agent cooperation. Static analysis proves the primitive exists, not that a specific run will occur.
Fix: Remove one leg of the trifecta: isolate untrusted-input tools from secret-reading tools and from egress tools, or require human approval between them.
Location: flow gluecron_get_commit → gluecron_read_file → gluecron_create_issue
medium Tool "gluecron_write_file" can modify the filesystemMTC-CAP-002
Tool "gluecron_write_file" can write, overwrite or delete files (keyword "write_file" in tool name). Verify it is scoped to a safe directory.
Fix: Constrain file operations to an explicit, non-sensitive root; reject path traversal.
Location: tool gluecron_write_file
medium Tool "gluecron_delete_file" can modify the filesystemMTC-CAP-002
Tool "gluecron_delete_file" can write, overwrite or delete files (keyword "delete_file" in tool name). Verify it is scoped to a safe directory.
Fix: Constrain file operations to an explicit, non-sensitive root; reject path traversal.
Location: tool gluecron_delete_file
medium Annotation contradicts behavior on "gluecron_write_file"MTC-CAP-003
Tool "gluecron_write_file" advertises destructiveHint=false but its derived capabilities include state-modifying actions (file-write). Tool annotations are attacker-controllable and must never be trusted; a mismatch like this is exactly how a hostile server hides a destructive tool.
Fix: Ignore server-provided annotations for security decisions; gate destructive tools on explicit user consent.
Location: tool gluecron_write_file
low Unconstrained path parameter "path" on "gluecron_repo_read_file"MTC-CAP-008
Tool "gluecron_repo_read_file" takes a path parameter "path" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.
Fix: Resolve and verify the path stays within an allowed root; reject traversal sequences.
Location: tool gluecron_repo_read_file · inputSchema.properties.path
low Unconstrained path parameter "path" on "gluecron_read_file"MTC-CAP-008
Tool "gluecron_read_file" takes a path parameter "path" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.
Fix: Resolve and verify the path stays within an allowed root; reject traversal sequences.
Location: tool gluecron_read_file · inputSchema.properties.path
low Unconstrained path parameter "path" on "gluecron_write_file"MTC-CAP-008
Tool "gluecron_write_file" takes a path parameter "path" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.
Fix: Resolve and verify the path stays within an allowed root; reject traversal sequences.
Location: tool gluecron_write_file · inputSchema.properties.path
low Unconstrained path parameter "path" on "gluecron_delete_file"MTC-CAP-008
Tool "gluecron_delete_file" takes a path parameter "path" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.
Fix: Resolve and verify the path stays within an allowed root; reject traversal sequences.
Location: tool gluecron_delete_file · inputSchema.properties.path
Tools 62
Each tool and what it can reach — enumerated from the running server.
gluecron_create_issuenetwork egressgluecron_delete_filewrites filesgluecron_get_commitingests untrusted inputgluecron_get_pringests untrusted inputgluecron_get_workflow_logsingests untrusted inputgluecron_get_workflow_runingests untrusted inputgluecron_merge_prnetwork egressgluecron_read_filereads sensitive datagluecron_repo_read_filereads sensitive datagluecron_write_filewrites files
Show 52 more tools ↓
gluecron_acquire_leaseno sensitive capabilitygluecron_ai_cost_summaryno sensitive capabilitygluecron_assign_issueno sensitive capabilitygluecron_atomic_multi_file_commitno sensitive capabilitygluecron_cancel_workflow_runno sensitive capabilitygluecron_chat_continueno sensitive capabilitygluecron_chat_with_repono sensitive capabilitygluecron_clone_urlno sensitive capabilitygluecron_close_issueno sensitive capabilitygluecron_close_prno sensitive capabilitygluecron_comment_issueno sensitive capabilitygluecron_comment_prno sensitive capabilitygluecron_create_agent_sessionno sensitive capabilitygluecron_create_branchno sensitive capabilitygluecron_create_prno sensitive capabilitygluecron_delete_repono sensitive capabilitygluecron_explain_repono sensitive capabilitygluecron_find_symbolno sensitive capabilitygluecron_fork_repono sensitive capabilitygluecron_generate_commit_messageno sensitive capabilitygluecron_generate_pr_descriptionno sensitive capabilitygluecron_generate_release_notesno sensitive capabilitygluecron_generate_testsno sensitive capabilitygluecron_get_agent_budgetno sensitive capabilitygluecron_get_diffno sensitive capabilitygluecron_get_preview_urlno sensitive capabilitygluecron_label_issueno sensitive capabilitygluecron_list_prsno sensitive capabilitygluecron_list_treeno sensitive capabilitygluecron_open_draft_prno sensitive capabilitygluecron_pr_status_summaryno sensitive capabilitygluecron_propose_doc_updateno sensitive capabilitygluecron_propose_migrationno sensitive capabilitygluecron_provision_pr_sandboxno sensitive capabilitygluecron_refactor_across_reposno sensitive capabilitygluecron_release_leaseno sensitive capabilitygluecron_reopen_issueno sensitive capabilitygluecron_repo_explain_codebaseno sensitive capabilitygluecron_repo_healthno sensitive capabilitygluecron_repo_list_issuesno sensitive capabilitygluecron_repo_searchno sensitive capabilitygluecron_request_changesno sensitive capabilitygluecron_search_issuesno sensitive capabilitygluecron_search_prsno sensitive capabilitygluecron_search_reposno sensitive capabilitygluecron_security_scanno sensitive capabilitygluecron_semantic_searchno sensitive capabilitygluecron_ship_specno sensitive capabilitygluecron_trigger_workflowno sensitive capabilitygluecron_unlabel_issueno sensitive capabilitygluecron_update_repono sensitive capabilitygluecron_voice_to_prno sensitive capability
Toxic flows 1
Cross-tool combinations that form a data-exfiltration primitive (untrusted input → sensitive source → external sink).
Versions 1
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v1.0 latest |
B 88/100 | 8 | 1.13.0 | 2026-09-05 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan https://gluecron.com/mcp --onlineMore in Developer Tools
Hotel booking MCP server — 300K+ properties, real confirmation numbers, loyalty programs. Builders monetize every booking via Stripe Connect. The first MCP server that completes real hotel reservations inside AI conversations.
Manage AdGuard Home through AI assistants
Read-only Azure DevOps for MCP clients using only your existing browser session — no PAT, no Azure CLI. Browse work items, pull requests, comments, attachments and Artifacts feeds across every project, repo and feed you can access.
MCP server for Adobe Experience Manager Assets integration development
Servidor MCP para el tiempo oficial de España (API pública OpenData de AEMET). Predicción, observación y avisos como herramientas MCP tipadas.
A standalone MCP stdio bridge for Affinity by Canva's local MCP SSE server.