brilliant-directories-mcpBLOCK
Official MCP server for Brilliant Directories — manage members, posts, leads, reviews, pages, and more from any AI agent. OpenAPI 3.1 spec included.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://www.npmjs.com/package/brilliant-directories-mcp) [](LICENSE) [](https://modelcontextprotocol.io)
Universal AI integration for your BD site. Give any AI agent full access to your Brilliant Directories site with one API key.
Manage members, posts (single-image and multi-image), leads, reviews, top and sub categories, email templates, pages (homepage, landing pages), 301 redirects, smart lists, widgets, menus, forms, tags, membership plans, and more — across every resource BD exposes via its REST API.
This guide walks you through connecting your AI of choice (Claude, Cursor, etc.) to your BD site. Pick your AI app below, paste two things, restart. Most setups take under 5 minutes.
⚠️ REQUIREMENTS — Before you start
- Your BD site URL. Use the full canonical URL exactly as it loads in a browser — include
https://(orhttp://if your site has no SSL), includewww.if your site uses it, no trailing slash. - ✅
https://www.mysite.com(most BD sites) - ✅
https://mysite.com(only if your site has nowww.) - ✅
http://mysite.com(HTTP-only sites — protocol respected) - ❌
mysite.com(missing protocol) - ❌
https://mysite.com/(trailing slash) - ❌
https://mysite.comif the site actually serves atwww.mysite.com— use the form your site canonically responds at - Your BD API key.
BD Admin → Developer Hub → Generate API Key → copy it.
Full walkthrough: How to Create an API Key.
- Node.js — only for the Advanced path (see below). Not needed for the E
d71960f93daaOBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add brilliant-directories-mcp --env BD_API_KEY=${BD_API_KEY} -- npx -y [email protected]Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (5 observation(s))
- Shell
- declared (5 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (18)
text = eval(code);
const original = eval(code);
bd-skill-content.zip
console.log(` claude mcp add ${serverName} -- npx -y brilliant-directories-mcp --api-key ${apiKey} --url ${apiUrl}`);if (/[\s--]/.test(slug)) {@modelcontextprotocol/sdk
Every other resource (web pages, forms, menus, tags, email templates, reviews, leads, categories, post types, widgets, etc.) lives behind an **"Advanced Endpoints"** toggle and returns `403 API Key do
-d "[email protected]&password=secret123&subscription_id=1&first_name=Jane&last_name=Doe" \
Every other resource (web pages, forms, menus, tags, email templates, reviews, leads, categories, post types, widgets, etc.) lives behind an **"Advanced Endpoints"** toggle and returns `403 API Key do
-d "[email protected]&password=secret123&subscription_id=1&first_name=Jane&last_name=Doe" \
**Code-field trust level:** widget-equivalent - arbitrary HTML, CSS, JS, iframes, and PHP are all accepted and evaluated server-side at render. BD text-label tokens (`%%%text_label%%%`) and PHP variab
CHANGELOG.md
Universal AI integration for your BD site. Give any AI agent full access to your Brilliant Directories site with one API key.
Universal AI integration for your BD site. Give any AI agent full access to your Brilliant Directories site with one API key.
4. **API Key / Access token:** your 32-char BD API key.
4. **API Key / Access token:** your 32-char BD API key.
Sensitive fields present in read responses: user records include `password` (bcrypt hash), `token` (member auth token), and `cookie` (session value) - redact before logging responses. There are TWO on
Gates applied: no_behavioural_pass.
d71960f93daafull audit observations/trust-audit/mcp-server/brilliantdirectories__brilliant-directories-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | d71960f93daa | BLOCK | D | 69 | first audit |
Questions
What is the brilliant-directories-mcp MCP server?
Official MCP server for Brilliant Directories — manage members, posts, leads, reviews, pages, and more from any AI agent. OpenAPI 3.1 spec included.
Is brilliant-directories-mcp safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does brilliant-directories-mcp need?
It reads BD_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does brilliant-directories-mcp run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as brilliant-directories-mcp at 6.58.611.
How current is this page?
The grade is for one exact copy of the source (d71960f93daa), read on 2026-10-12. The repository is watched and re-audited when it changes.