C
com.brianbooms/quiet-menders
cline
Privacy clinic + pay-per-call data APIs for AI agents via x402. Never pays or touches keys.
1 open CVE
MIT license
Maintained
Last commit 44d ago
Works with most clients
Transport: http
3 tools · ~83 tok
Grade A · 0.0% of 200K ctx
MCPpedia last refreshed this data
com.brianbooms/quiet-menders is an MCP server that privacy clinic + pay-per-call data APIs for AI agents via x402. Never pays or touches keys. Its tool list has not been published yet over http, requires no API key, and scores 85/100 on MCPpedia's security, maintenance and efficiency rubric.
Step 1
Install in your client
Config is the same across clients - only the file and path differ.
CD
Supported in Claude Desktophttp · Node 18+
Paste into ~/Library/Application Support/Claude/claude_desktop_config.json
{
"mcpServers": {
"quiet-menders": {
"transport": {
"url": "https://quiet-menders-mcp.brianbooms.workers.dev/mcp",
"type": "streamableHttp"
}
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
Embed in your READMEAbout badges →
[](https://mcppedia.org/s/com-brianbooms-quiet-menders)
Read me
What com.brianbooms/quiet-menders does
Privacy clinic + pay-per-call data APIs for AI agents via x402. Never pays or touches keys.
Test This Server
This server supports HTTP transport. Be the first to test it - help the community know if it works.
Loading README…
Scored, not listed
Why this score
Five weighted categories - click any category to see the underlying evidence.
Score breakdown
85/100across 5 weighted dimensions
0255075100
28
12
20
15
10
−15
Security
Maintenance
Efficiency
Documentation
Compatibility
Categoriesclick a row to see evidence
Security
OSV.dev1 open3 fixed
CVE-2026-59723high · fixedCVSS 8.8
Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)
### Summary The Cline Hub dashboard server (`@cline/cline-hub`), launched via the `cline dashboard` CLI command, accepts WebSocket connections on the `/browser` endpoint without validating the HTTP `Origin` header. When `ROOM_SECRET` is not set—the default for local (`127.0.0.1`) binds—`isAuthorizedBrowserRequest()` returns `true` unconditionally, allowing any website a developer visits to open a cross-origin WebSocket to `ws://127.0.0.1:8787/browser`. An attacker-controlled page can then send
CVE-2026-44211criticalCVSS 9.6
Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability
## Summary The `kanban` npm package (used by the `cline` CLI) starts a WebSocket server on `127.0.0.1:3484` with no Origin header validation. Any website a developer visits can silently connect to the kanban server via WebSocket and: 1. Leak sensitive data in real-time: workspace filesystem paths, task titles/descriptions, git branch info, AI agent chat messages 2. Hijack running AI agent terminals by injecting arbitrary prompts into the agent's input, leading to remote code execution 3. Kill
Affected:
>= 0source →GHSA-9ppg-jx86-fqw7low · fixed
Unauthorized npm publish of cline@2.3.0 with modified postinstall script
### Description On February 17, 2026 at 3:26 AM PT, an unauthorized party used a compromised npm publish token to publish an update to Cline CLI on the NPM registry: cline@2.3.0. The published package contains a modified package.json with an added postinstall script: `"postinstall": "npm install -g openclaw@latest"` This causes openclaw (an unrelated, non-malicious open source package) to be globally installed when cline@2.3.0 is installed. No other files were modified -- the CLI binary (dist/cl
MAL-2026-1380info · fixed
Malicious code in cline (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (38d7531f4d4af07fee607e1d2985d0ea5b41dbf28cca5bc16c8457934e372f86) The package cline was found to contain malicious code. ## Source: ghsa-malware (3c16746b2d863d4c24bbc2297611c642a02942b47d12b675c4a3120911c72eec) ### Description On February 17, 2026 at 3:26 AM PT, an unauthorized party used a compromised npm publish token to publish an update to Cline CLI on the NPM registry: cline@2.3.0. The published pac
Inventory
Tools (3)
Click any tool to inspect its schema.
~83 tokens total
Community
Reviews
Be the first to review
Have you used this server?
Share your experience - it helps other developers decide.
How easy was setup?Did it work reliably?How was the documentation?
Sign in to write a review.
Frequently Asked Questions
- Is com.brianbooms/quiet-menders safe to use?
- com.brianbooms/quiet-menders has 1 known CVE tracked by MCPpedia. You can verify these on OSV.dev by searching for "cline". Review the Security section above for details before installing.
- How do I install com.brianbooms/quiet-menders?
- com.brianbooms/quiet-menders supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
- What can com.brianbooms/quiet-menders do?
- com.brianbooms/quiet-menders provides 3 tools: Tools, Use, License. See the full tools list on the server page for descriptions and parameters.
- What AI clients work with com.brianbooms/quiet-menders?
- com.brianbooms/quiet-menders is compatible with claude-desktop, cursor, claude-code. It uses http transport.
- Is com.brianbooms/quiet-menders actively maintained?
- com.brianbooms/quiet-menders is recently maintained - last commit was 44 days ago.
Related
Similar servers
Others in ai-ml / analytics
Vibe Assistant95A cross-platform desktop application for managing AI Agents and MCP Servers. 一款用于管理AI智能体与MCP服务器的跨平台桌面应用程序。
169 3
Codebase Memory Mcp95Codebase knowledge graph for AI agents — 162 languages, sub-ms queries, 99% fewer tokens.
48.6k 6
Gemini Cli95An open-source AI agent that brings the power of Gemini directly into your terminal.
108.8k 8
Bla95🛡️ BLA (Blind LLM Agents) — Adversarial defense shield that protects binaries, Electron apps, JS bundles, Python, and WebAssembly against AI reverse-engineering agents like REA. Poison -> Exhaust -> Hallucinate.
5.5k 1
MCP Security Weekly
Get CVE alerts and security updates for com.brianbooms/quiet-menders and similar servers.
Community
Discussion
Start a conversation
Ask a question, share a tip, or report an issue.
Has anyone used this with Cursor?How do you handle auth?Any alternatives?
Sign in to join the discussion.