MCP, MCP server
Node804 Freshservice Mcp
A configurable MCP server for the Freshservice REST API with permission-based tool gating.
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
SECRETS_PATH_DOTENV SECRETS_ENV_READ
Why this grade
- SECRETS_PATH_DOTENV Low
Mentions a .env file.
README.md, line 106
**Using a `.env` file instead of inline env values:** - SECRETS_ENV_READ Note
Reads an environment variable whose name contains KEY, SECRET, TOKEN, PASSWORD or CREDENTIAL.
src/node804_freshservice_mcp/client.py, line 21
FRESHSERVICE_APIKEY = os.getenv("FRESHSERVICE_APIKEY")
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Pass
No shell or command execution found, and no extra permission was declared.
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Pass
No network call found.
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
src/node804_freshservice_mcp/client.py, line 21
FRESHSERVICE_APIKEY = os.getenv("FRESHSERVICE_APIKEY")
.gitignore, line 130
# Environments
README.md, line 106
**Using a `.env` file instead of inline env values:**
Show more
README.md, line 108
If you'd rather keep credentials out of `claude_desktop_config.json`, create a `.env` file in the repo root (see `.env.example`) and use `cwd` to point the server at it:
README.md, line 111
cp .env.example .env # edit with your credentials
README.md, line 126
The server calls `load_dotenv()` on startup, which reads `.env` from the working directory. The `cwd` field tells Claude Desktop to start the server in the repo root where that fil
README.md, line 282
| `RuntimeError: FRESHSERVICE_APIKEY environment variable is required` | Missing or empty `FRESHSERVICE_APIKEY` | Same - check the `env` block, or your `.env` file if running from
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 003b76ec5a4b. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: 003b76ec5a4bc48315a875e0a27ae64d4b07efb6
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.