AdvocuCAUTION
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
🎯 Overview
A unified MCP (Model Context Protocol) server that enables both Google Developer Experts (GDEs) and Microsoft MVPs to report their activities through AI-powered conversational interfaces.
Stop the boring manual data entry! Just talk to Claude and submit your activities naturally - whether it's a YouTube video, blog post, conference talk, or mentoring session.
Supported Programs
- ✅ Microsoft MVP - Direct API integration with the MVP portal
- ✅ Google GDE - Integration with Advocu API
- 🔧 Both at once - If you're both an MVP and GDE, use one tool for everything!
🚀 Quick Start
Prerequisites
- Node.js 18+
- Claude Desktop
- At least one access token (MVP or GDE)
Installation
Option 1: Local Development (Recommended)
git clone https://github.com/carlosazaustre/advocu-mcp-server.git cd advocu-mcp-server npm install npm run build
Option 2: Global Install
npm install -g advocu-mcp-server
Configuration
Edit your Claude Desktop config file:
macOS: ~/Library/Application Support/Claude/claude_desktop_config.json Windows: %APPDATA%/Claude/claude_desktop_config.json
For Both MVP + GDE:
{
"mcpServers": {
"activity-reporting": {
"command": "node",
"args": ["/absolute/path/to/advocu-mcp-server/dist/index.js"],
"env": {
"MVP_ACCESS_TOKEN": "your_mvp_bearer_token",
"MVP_USER_PROFILE_ID": "your_mvp_profile_id",
"ADVOCU_ACCESS_TOKEN": "your_gde_token",
"DOCS_DIR": "/absolute/path/to/advocu-mcp-server/docs"
}
}
}
}📚 Important: TheDOCS_DIRenvironment variable is required for documentation tools to work. Set it to the absolute path of thedocsdirectory in your installation.
MVP Only:
{
"mcpServers": {
"activity-reporting": {
"command": "node",
"args": ["/absolute/path/to/dist/index.js"],
"e14c1efcd5eaOBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add advocu-mcp-server --env ADVOCU_ACCESS_TOKEN=${ADVOCU_ACCESS_TOKEN} --env MVP_ACCESS_TOKEN=${MVP_ACCESS_TOKEN} -- npx -y [email protected]{
"mcpServers": {
"advocu-mcp-server": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"ADVOCU_ACCESS_TOKEN": "${ADVOCU_ACCESS_TOKEN}",
"MVP_ACCESS_TOKEN": "${MVP_ACCESS_TOKEN}"
}
}
}
}Exposed tools (13)
2 read · 11 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
get_documentation | read | Get a specific documentation file by name |
list_documentation | read | List all available documentation resources |
submit_content_creation | write | Submit a content creation activity draft |
submit_gde_content_creation | write | Submit a content creation activity to Google GDE program (Advocu) |
submit_googler_interaction | write | Submit an interaction with Googlers activity draft |
submit_mentoring | write | Submit a mentoring activity draft |
submit_mvp_blog | write | Submit a blog post or article activity to Microsoft MVP |
submit_mvp_speaking | write | Submit a speaking engagement/conference activity to Microsoft MVP |
submit_mvp_video | write | Submit a video/webinar/online training/livestream activity to Microsoft MVP |
submit_product_feedback | write | Submit a product feedback activity draft |
submit_public_speaking | write | Submit a public speaking activity draft |
submit_story | write | Submit a story activity draft |
submit_workshop | write | Submit a workshop activity draft |
Trust audit
CAUTIONgrade B · trust 88/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (5 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (6)
console.log(` Length: ${token.length} characters`);console.log(` Preview: ${token.substring(0, 40)}...`);console.log(` Token Length: ${credentials.accessToken.length} characters`);.lintstagedrc.json
.versionrc.json
@modelcontextprotocol/sdk, dotenv, @commitlint/cli, @commitlint/config-conventional, @playwright/test, @types/dotenv, @types/node, husky
Gates applied: no_behavioural_pass.
e14c1efcd5eafull audit observations/trust-audit/mcp-server/carlosazaustre__advocu.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | e14c1efcd5ea | CAUTION | B | 88 | first audit |
Questions
What tools does Advocu expose?
13 in total: 2 read-only, 11 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Advocu safe to connect to an agent?
With care. The audit graded it B (88/100) and found 6 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does Advocu need?
It reads ADVOCU_ACCESS_TOKEN and MVP_ACCESS_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Advocu run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as advocu-mcp-server at 0.1.3.
How current is this page?
The grade is for one exact copy of the source (e14c1efcd5ea), read on 2026-10-08. The repository is watched and re-audited when it changes.