MCP server · Org-owned · Audited from source
monitor MCP server
by betterdb-inc/monitorNOASSERTION licenceAudited 20 Oct 2026 · source 555e3ebc734f
npm @app/entitlement 1.14.4stdio★ 1,309
Is it safe? No — BLOCK, grade F (35/100). It exposes 79 tools: 70 read, 8 write and 1 destructive. The audit recorded 72 findings (2 critical, 5 high, 21 medium, 42 low). Maintainer's description: Real-time monitoring, slowlog analysis, and audit trails for Valkey and Redis
Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
Cite
Cite this page
ModelsAtlas. “monitor MCP server (BetterDB-inc/monitor)”. Retrieved 20 Oct 2026. https://modelsatlas.com/mcp/betterdb-inc/monitor
Why this is BLOCK. The audit found 2 critical and 5 high findings; the most severe is Hard-coded secrets at proprietary/entitlement/.env.example:22. Each finding is listed below with its file and line.
Why this page is still public. People search for this server by name. Hiding it would leave them with the README's word alone; here they see what the code does. We list it so you can decide, and we do not show connect commands for BLOCK servers.
Trust audit
Audit 0.4.1 · full source read 20 Oct 2026
Trust score35/100✕BLOCK F
2 critical5 high21 medium42 low2 info
72 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.
What the source does
- FilesystemDeclared11 observations
- NetworkDeclared8 observations
- ShellDeclared5 observations
- DependenciesNot pinnedSome ranges float
- SecretsFoundSee the findings
Findings (72)
Sorted by severity · the 25 most severe of 72 are listed
CRITICALHard-coded secretssecret.private_key · proprietary/entitlement/.env.example:22
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
CRITICALHard-coded secretssecret.private_key · proprietary/entitlement/.env.example:29
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
HIGHInventory / provenanceinv.suspicious_name · apps/api/src/webhooks/webhook-payload-formatter.ts
F-13 Inventory / provenanceCWE-1104Layer L0
webhook-payload-formatter.ts
- Why
- member named after an attack tool
- Fix
- remove or justify
HIGHCode injectioncode.eval_exec · apps/api/src/auth/better-auth-esm.ts:25
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
return new Function('specifier', 'return import(specifier)') as EsmImport;- Why
- evaluates text as code
- Fix
- remove; use a parser or a dispatch table
HIGHCode injectioncode.eval_exec · packages/cli/scripts/build.mjs:74
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
exec(
- Why
- evaluates text as code
- Fix
- remove; use a parser or a dispatch table
HIGHCode injectioncode.eval_exec · packages/cli/scripts/build.mjs:101
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
exec(`npx esbuild src/index.ts --bundle --platform=node --target=node20 --outfile=dist/index.js --external:@inquirer/prompts --external:commander --external:picocolors --define:__CLI_VERSION__='"${cli- Why
- evaluates text as code
- Fix
- remove; use a parser or a dispatch table
HIGHFilesystem / pathfs.credential_store · apps/web/src/components/ConnectionSelector.tsx:877
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
placeholder="id_ed25519"
- Why
- touches a credential store
- Fix
- —
MEDIUMInventory / provenanceinv.symlink · proprietary/node_modules
F-13 Inventory / provenanceCWE-1104Layer L0
proprietary/node_modules
- Why
- link not followed
- Fix
- —
MEDIUMInformation disclosuredisclose.log_secret · apps/api/src/workspace/personal-token.service.ts:141
F-12 Information disclosureCWE-209 · CWE-532Layer L1
this.logger.warn(`Failed to update lastUsedAt for token ${token.id}: ${String(error)}`);- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMInformation disclosuredisclose.log_secret · packages/agent/src/agent.ts:128
F-12 Information disclosureCWE-209 · CWE-532Layer L1
console.log(`[Agent] Rebuilding Valkey client with fresh IAM token (attempt ${this.reconnectAttempt}, delay ${delayMs}ms)`);- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMInformation disclosuredisclose.log_secret · proprietary/entitlement/src/entitlement/entitlement.service.ts:198
F-12 Information disclosureCWE-209 · CWE-532Layer L1
this.logger.error(`Failed to sign entitlement token for ${license.id}: ${(error as Error).message}`);- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMInformation disclosuredisclose.log_secret · proprietary/entitlement/src/provisioning/provisioning.service.ts:594
F-12 Information disclosureCWE-209 · CWE-532Layer L1
this.logger.warn(`Error deleting secret ${params.secretName}: ${error.message}`);- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMInformation disclosuredisclose.log_secret · proprietary/entitlement/src/provisioning/provisioning.service.ts:679
F-12 Information disclosureCWE-209 · CWE-532Layer L1
this.logger.warn(`Secret ${secretName} already exists in ${namespace}, continuing...`);- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMNetwork egressnet.raw_ip · Dockerfile:239
F-04 Network egressCWE-200 · CWE-319Layer L1
CMD wget -T 2 -q --spider "http://127.0.0.1:${PORT:-3001}/api/health" || exit 1- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMNetwork egressnet.raw_ip · Dockerfile.aiven:215
F-04 Network egressCWE-200 · CWE-319Layer L1
CMD wget -T 2 -q --spider "http://127.0.0.1:${PORT:-3001}/api/health" || exit 1- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMObfuscation / stealthobf.homoglyph · apps/web/src/components/cluster/ClusterSlowlog.tsx:51
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
if (microseconds < MICROSECONDS_TO_MS) return `${microseconds}μs`;- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.db_uri · README.md:194
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.db_uri · apps/api/src/storage/adapters/__tests__/invitation-storage.spec.ts:18
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.db_uri · apps/api/src/storage/adapters/__tests__/otel-spans.spec.ts:12
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.db_uri · apps/api/test/agent-token-storage-postgres.e2e-spec.ts:9
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.db_uri · apps/api/test/anomaly-detector-config-postgres.e2e-spec.ts:8
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.generic · apps/api/scripts/seed-demo-data.ts:999
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.generic · proprietary/cloud-auth/cloud-actor-resolver.spec.ts:5
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.generic · proprietary/cloud-auth/cloud-auth.guard.health.spec.ts:5
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.generic · proprietary/cloud-auth/cloud-auth.guard.spec.ts:5
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
Tools it exposes
79 declared in source · 1 destructive
70 read8 write1 destructive
1 tool can delete or overwrite. An agent that can be talked into calling a tool can be talked into calling this one, so give it a token scoped to what you need.
| Tool | What it does | Risk |
|---|---|---|
remove_connection | Remove a connection from BetterDB. | destructive |
add_connection | Add a new Valkey/Redis connection to BetterDB. Optionally set it as the active default. | write |
cache_edit_and_approve_proposal | Edit an existing pending proposal and approve it in one step. Provide exactly one edit field matching the proposal type: new_threshold for threshold_adjust, new_ttl_seconds for tool_ttl_adjust. Invalidate proposals are not editable. | write |
id | Connection ID to set as default | write |
run_latency_diagnosis | Run latency diagnostic analysis | write |
run_memory_diagnosis | Run memory diagnostic analysis | write |
set_default_connection | Set a connection as the active default for BetterDB. | write |
start_monitor | Start the BetterDB monitor as a persistent background process. If already running, returns the existing URL. The monitor persists across MCP sessions and must be stopped explicitly with stop_monitor. | write |
stop_monitor | Stop a persistent BetterDB monitor process that was previously started with start_monitor or --autostart --persist. | write |
ai_instance_history | Get the stored metrics time-series for one AI component instance (hits, misses, hit rate, cost saved, evictions, item count, index size, threshold). Use ai_list_instances first to find the instance field identifier. Use this to see trends: hit-rate degradation, growth, threshold drift. | read |
ai_list_instances | No description in the source | read |
cache_approve_proposal | Approve a pending proposal. Synchronously applies the change to Valkey and returns the terminal status (applied|failed). Idempotent: a second call on an already-applied proposal returns the cached result. | read |
cache_get_proposal | Fetch a single cache proposal by id, including its audit trail. | read |
cache_health | Detailed health for a single cache. Response branches by type: semantic_cache reports category_breakdown + uncertain_hit_rate; agent_cache reports tool_breakdown. | read |
cache_list | List all caches (semantic_cache and agent_cache) registered for the active instance, with hit rate and total ops. | read |
cache_list_pending_proposals | List pending cache proposals for the active instance, newest first. Optionally filter by cache_name. | read |
cache_propose_invalidate | Propose a cache invalidation for review. Filter shape depends on cache type: semantic_cache requires filter_kind=valkey_search + filter_expression; agent_cache requires filter_kind in (tool|key_prefix|session) + filter_value. Warns when estimated_affected exceeds 10000. | read |
cache_propose_threshold_adjust | Propose a semantic-cache similarity-threshold change for review. Creates a pending proposal that requires human approval before any change is applied. Reasoning must be at least 20 characters. | read |
cache_propose_tool_ttl_adjust | Propose an agent-cache per-tool TTL change for review. Creates a pending proposal that requires human approval. Reasoning must be at least 20 characters. | read |
cache_recent_changes | Recent proposals for a single cache (any status), so agents can avoid re-proposing pending or recently-applied changes. Newest first. | read |
cache_reject_proposal | Reject a pending proposal. Optionally records a reason in the audit trail. | read |
cache_similarity_distribution | Histogram of recent similarity scores (20 buckets, width 0.1) for a semantic_cache. Errors on agent_cache. | read |
cache_threshold_recommendation | Threshold-tuning recommendation for a semantic_cache, based on the rolling similarity-score window. Errors with INVALID_CACHE_TYPE on agent_cache. | read |
cache_tool_effectiveness | Per-tool hit rate, cost saved, and TTL recommendation for an agent_cache. Errors with INVALID_CACHE_TYPE on semantic_cache. | read |
calculate | Math helper | read |
capability | Runtime capability key (e.g. canSlowLog, canCommandLog, canLatency) | read |
correlate_ai_trace | No description in the source | read |
deliveryId | Delivery ID | read |
eventName | Name of the latency event | read |
get_acl_audit | Get persisted ACL audit log entries from storage. Filter by username, reason (auth, command, key, channel), or time range. Use this to investigate why a connection is failing or audit access patterns. | read |
get_acl_failures | Get ACL/authentication failures from audit log | read |
get_ai_trace | Get the full span waterfall for one AI trace: every span with timing, parent relationships, and attributes (model, cache hit/miss, similarity scores). Use list_ai_traces to find trace IDs. | read |
get_anomalies | Get anomaly detection events from persisted storage. BetterDB continuously runs Z-score analysis on memory, hit rate, CPU, and other metrics — this returns the detected anomalies. Use to investigate what triggered an alert or correlate with an incident. | read |
get_client_activity | Get time-bucketed client activity from persisted snapshots. Shows connection counts, command distribution, and buffer usage over time. Use startTime/endTime to focus on a specific incident window. | read |
get_client_analytics | Get client connection analytics and trends | read |
get_client_list | Get list of connected clients grouped by name | read |
get_clients | Get the active client list with connection details. | read |
get_cluster_node_stats | Get per-node performance stats: memory usage, ops/sec, connected clients, replication offset, and CPU. Use this to identify hot nodes, lagging replicas, or uneven load distribution. | read |
get_cluster_nodes | Discover all nodes in the Valkey cluster — role (master/replica), address, health status, and slot ranges. Returns an error message if this instance is not running in cluster mode. | read |
get_cluster_slowlog | Get the aggregated slowlog across ALL nodes in the cluster. This is the primary tool for finding slow commands in cluster mode — per-node slowlogs are incomplete. Returns an error message if not in cluster mode. | read |
get_commandlog | Get the most recent entries from COMMANDLOG (Valkey 8+ only, superset of slowlog). | read |
get_commandlog_history | Get persisted COMMANDLOG entries from storage (Valkey 8+ only). Supports time range filtering to investigate specific incidents. Returns empty with a note if COMMANDLOG is not supported on this instance. | read |
get_commandlog_patterns | Get analyzed COMMANDLOG patterns from persisted storage (Valkey 8+ only). Like get_slowlog_patterns but includes large-request and large-reply patterns in addition to slow commands. | read |
get_connected_clients | Get number of connected and blocked clients | read |
get_forecast | Get a capacity forecast for one metric: current trajectory and projected time until the resource ceiling is hit. Metric kinds: opsPerSec, usedMemory, cpuTotal, memFragmentation. Use for capacity planning ( | read |
get_health | No description in the source | read |
get_hot_keys | No description in the source | read |
get_inference_latency | No description in the source | read |
get_info | Get INFO stats for the active instance. Contains all health data: memory, clients, replication, keyspace, stats (hit rate, ops/sec), and server info. Optionally filter to a section: server|clients|memory|stats|replication|keyspace. | read |
get_key_count | Get total number of keys in the database | read |
get_largest_keys | No description in the source | read |
get_latency | Get latency event history for the active instance. | read |
get_latency_history | Get the full latency history for a named event (e.g. | read |
get_latency_regressions | Get detected latency regressions (sustained p99 command-latency degradations vs baseline) from persisted storage. Companion to get_anomalies: same event store, pre-filtered to latency regressions. Use when investigating | read |
get_memory | Get memory diagnostics: MEMORY DOCTOR assessment and MEMORY STATS breakdown. | read |
get_memory_usage | Get memory usage statistics | read |
get_server_status | Get current server status: connected clients, memory usage, ops/sec, total keys, uptime | read |
get_slot_stats | Get per-slot key counts and CPU usage (Valkey 8.0+ only). Use orderBy= | read |
get_slowlog | Get the most recent slow commands from the slowlog. | read |
get_slowlog_patterns | Get analyzed slowlog patterns from persisted storage. Groups slow commands by normalized pattern, showing frequency, average duration, and example commands. Survives slowlog buffer rotation — data goes back as far as BetterDB has been running. | read |
get_vector_indexes | Get health details for every vector search index on the instance: document count, memory usage, indexing failures, and percent indexed. Requires the Search module (valkey-search / RediSearch) on the connection — errors clearly if absent. Use to diagnose incomplete indexing or index memory growth. | read |
get_weather | Get current weather for a city | read |
list_ai_traces | List recent AI application traces ingested via OpenTelemetry (LLM calls, cache lookups, memory recalls, retrieval spans). Not tied to a Valkey instance — traces come from instrumented AI apps. Use get_ai_trace for a full span waterfall and correlate_ai_trace to join a trace with live Valkey state. | read |
list_instances | List all Valkey/Redis instances registered in BetterDB. Shows connection status and capabilities. | read |
memory_approve_forget | Approve a pending forget proposal, applying the deletion against the live store. | read |
memory_forget | Propose forgetting memories (by id, or by scope/tags). Creates a pending proposal that a human must approve before anything is deleted. | read |
memory_get | Fetch a single memory by ID from a store. | read |
memory_list | List memories in a store, newest first, with optional scope and tag filters. | read |
memory_list_pending_forgets | List pending forget proposals awaiting approval on an instance. | read |
memory_recall | Recall memories from a store by a precomputed query vector (the caller supplies the embedding). | read |
memory_reject_forget | Reject a pending forget proposal without deleting anything. | read |
memory_stats | Get item count, eviction count, and live config for a memory store. | read |
memory_stores | List agent-memory stores discovered on an instance (name, capabilities, stats key). | read |
nodeId | Node ID | read |
parameter | Configuration parameter name | read |
redis.memory.used | bytes | read |
search | Search web | read |
select_instance | Select which instance subsequent tool calls operate on. | read |
test_connection | Test a Valkey/Redis connection without persisting it. Use before add_connection to validate credentials. | read |
Safer alternatives
All logs & monitoring servers →Prometheus✓SAFE
idanfishman/prometheus-mcp
A Model Context Protocol (MCP) server implementation that provides AI agents with programmatic access to Prometheus metrics via a unified interface.
2 writeGrade B
Dynatrace✓SAFE
dynatrace-oss/dynatrace-mcp
MCP server for Dynatrace Observability
Grade B
Prometheus✓SAFE
pab1it0/prometheus-mcp-server
A Model Context Protocol (MCP) server that enables AI agents and LLMs to query and analyze Prometheus metrics through standardized interfaces.
Grade B
Audit history
- ✕BLOCK F 35 / 100
First audit ·
555e3ebc734f
README badge
Badges show the current verdict, BLOCK included
A badge cannot be hidden by the maintainer while the verdict is BLOCK. Fix the findings, push, and the re-audit updates it.
Questions about monitor MCP server
What is the monitor MCP server?
Real-time monitoring, slowlog analysis, and audit trails for Valkey and Redis
What tools does monitor expose?
79 in total: 70 read-only, 8 that write, and 1 that can delete or overwrite (remove_connection). Every one is listed on this page with its risk.
Is monitor safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (35/100) and found 7 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does monitor need?
It reads ADMIN_API_TOKEN, AGENT_AUTH_MODE, AGENT_TOKEN_POSTGRES_TEST_DSN, AUTH_BROKER_KEY_ID, AUTH_BROKER_PUBLIC_KEY, AUTH_PRIVATE_KEY, AUTH_PUBLIC_KEY, AUTH_PUBLIC_URL, AUTH_SECRET, BETTERDB_LICENSE_KEY, BETTERDB_TOKEN and BROKER_API_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does monitor run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as @app/entitlement at 1.14.4.
How current is this page?
The grade is for one exact copy of the source (555e3ebc734f), read on 2026-10-20. The repository is watched and re-audited when it changes.
I already installed monitor. What should I do?
Remove it from your client's MCP configuration, then rotate any API keys and tokens that were in your environment while it ran.
Can the verdict change?
Yes. The repository is watched and re-audited when its source changes. If the findings are removed the verdict updates, and the history on this page shows it.
Sources
- BetterDB-inc/monitor on GitHub — the source we read, its licence, stars and activityObserved · 20 Oct 2026
- ModelsAtlas trust audit — BLOCK verdict for commit 555e3ebc734fObserved · 20 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What is the monitor MCP server?
- What tools does monitor expose?
- Is monitor safe to connect to an agent?