ethora-mcp-serverSAFE
Remote and local MCP server for Ethora: let Claude, ChatGPT, Cursor and agents create chat apps, rooms, users and RAG-powered AI agents.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://www.npmjs.com/package/@ethora/mcp-server) [](#) [](./LICENSE) [](https://glama.ai/mcp/servers/dappros/ethora-mcp-server) [](https://wellknown.network/agents/ethora-mcp-cli)
Add the hosted server in one click. You sign in through your browser; there is nothing to install and no key to paste.
[](https://cursor.com/en/install-mcp?name=ethora&config=eyJ1cmwiOiJodHRwczovL21jcC5jaGF0LmV0aG9yYS5jb20vbWNwL29hdXRoIn0%3D) [](https://insiders.vscode.dev/redirect?url=vscode%3Amcp%2Finstall%3F%257B%2522name%2522%253A%2522ethora%2522%252C%2522type%2522%253A%2522http%2522%252C%2522url%2522%253A%2522https%253A%252F%252Fmcp.chat.ethora.com%252Fmcp%252Foauth%2522%257D) [](https://insiders.vscode.dev/redirect?url=vscode-insiders%3Amcp%2Finstall%3F%257B%2522name%2522%253A%2522ethora%2522%252C%2522type%2522%253A%2522http%2522%252C%2522url%2522%253A%2522https%253A%252F%252Fmcp.chat.ethora.com%252Fmcp%252Foauth%2522%257D)
For Claude.ai, ChatGPT, Claude Desktop, LM Studio and anything else that takes a connector URL, add https://mcp.chat.ethora.com/mcp/oauth and sign in. Running it yourself instead? See Using with stdio clients.
The MCP server for Ethora, an open-source chat and messaging platform with a
c61f59048601OBSERVED · 2026-10-10Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mcp-server --env ETHORA_APP_JWT=${ETHORA_APP_JWT} --env ETHORA_B2B_TOKEN=${ETHORA_B2B_TOKEN} -- npx -y @ethora/[email protected]Exposed tools (105)
59 read · 36 write · 10 destructive. Blast radius: 10 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
ethora-agent-activate | read | |
ethora-agent-clone | read | |
ethora-agent-create | write | |
ethora-agent-delete | destructive | |
ethora-agent-export | read | |
ethora-agent-get | read | |
ethora-agent-import | write | |
ethora-agent-invite | read | |
ethora-agent-knowledge-get | read | |
ethora-agent-knowledge-rebuild | read | |
ethora-agent-list | read | |
ethora-agent-select | read | |
ethora-agent-soul-append | read | |
ethora-agent-soul-set | write | |
ethora-agent-try | read | |
ethora-agent-update | write | |
ethora-agent-visibility-set | write | |
ethora-api-key-create | write | |
ethora-api-key-list | read | |
ethora-api-key-revoke | destructive | |
ethora-app-create | write | |
ethora-app-credentials-reveal | read | |
ethora-app-delete | destructive | |
ethora-app-export | read | |
ethora-app-import | write | |
ethora-app-list | read | |
ethora-app-rooms-list | read | |
ethora-app-select | read | |
ethora-app-token-create | write | |
ethora-app-token-list | read | |
ethora-app-token-revoke | destructive | |
ethora-app-token-rotate | read | |
ethora-app-update | write | |
ethora-auth-mode-set | write | |
ethora-b2b-app-bootstrap-ai | read | |
ethora-b2b-app-create | write | |
ethora-b2b-app-provision | read | |
ethora-b2b-runbook-generate | read | |
ethora-bot-disable | write | |
ethora-bot-enable | write | |
ethora-bot-enable-b2b | write | |
ethora-bot-get | read | |
ethora-bot-history | read | |
ethora-bot-instance-diagnose | read | |
ethora-bot-instance-leave | read | |
ethora-bot-instance-list | read | |
ethora-bot-instance-status-set | write | |
ethora-bot-instance-test | read | |
ethora-bot-message-send | write | |
ethora-bot-update | write | |
ethora-bot-widget-get | read | |
ethora-broadcast-job-start | write | |
ethora-broadcast-job-wait | read | |
ethora-broadcast-send | write | |
ethora-chat-component-app-generate | read | |
ethora-chat-create | write | |
ethora-chat-delete | destructive | |
ethora-chat-history | read | |
ethora-chat-unread-counts | read | |
ethora-doctor | read | |
ethora-env-examples-generate | read | |
ethora-feedback-submit | write | |
ethora-file-delete | destructive | |
ethora-file-get | read | |
ethora-file-upload | write | |
ethora-help | read | |
ethora-message-context | read | |
ethora-message-search | read | |
ethora-message-send | write | |
ethora-recipe-run | write | |
ethora-session-configure | read | |
ethora-source-doc-delete | destructive | |
ethora-source-doc-delete-legacy | destructive | |
ethora-source-doc-list | read | |
ethora-source-doc-tags-update | write | |
ethora-source-doc-upload | write | |
ethora-source-doc-upload-legacy | write | |
ethora-source-site-crawl | read | |
ethora-source-site-crawl-cancel | read | |
ethora-source-site-crawl-wait | read | |
ethora-source-site-list | read | |
ethora-source-site-reindex | read | |
ethora-source-site-reindex-wait | read | |
ethora-source-site-tags-update | write | |
ethora-source-site-url-delete | destructive | |
ethora-source-site-url-delete-batch | destructive | |
ethora-status | read | |
ethora-tools-enable | write | |
ethora-user-batch-create | write | |
ethora-user-batch-job-start | write | |
ethora-user-batch-job-wait | read | |
ethora-user-login | read | |
ethora-user-register | read | |
ethora-wallet-balance-get | read | |
ethora-wallet-erc20-transfer | write | |
ethora-widget-appearance-get | read | |
ethora-widget-appearance-set | write | |
ethora-widget-snippet-get | read | |
ethora.b2b.app.bootstrap-ai | read | |
ethora.b2b.app.create | write | |
ethora.b2b.auth.use | read | |
ethora.b2b.bot.enable | write | |
ethora.b2b.broadcast.wait | read | |
fetch | read | |
search | read |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (3 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (8)
ethora-agent-delete, ethora-api-key-revoke, ethora-app-delete, ethora-app-token-revoke, ethora-chat-delete, ethora-file-delete, ethora-source-doc-delete, ethora-source-doc-delete-legacy, ethora-source
@modelcontextprotocol/sdk, axios, cors, express, zod, @types/cors, @types/express, @types/node
- `ethora-feedback-submit`: send feedback (bug / unexpected / feature / docs) to the Ethora team from inside a session. The session's last few tool failures - tool name, error code, API request id - a
**Autonomous agents with no account yet.** Connect to `https://mcp.chat.ethora.com/mcp` with no credentials and call `ethora-user-register` with an email, first and last name. It creates the account,
| `/mcp` (add `?tools=all` to list every tool up front) | Nobody at connect time. Call `ethora-user-login` or `ethora-user-register` inside the session, or send `Authorization: Bearer <token>` on ever
| `/mcp/oauth` | An OAuth 2.1 access token obtained through the Ethora authorization server (dynamic client registration, PKCE, access scopes `read`, `write`, `admin`, plus the identity scopes `openid
- A key acts as the user. Treat the personal URL like a password: do not share screenshots of it, revoke it if it leaks. The server never logs request URLs, and the monoserver nginx template logs meth
- validates each token against the API once per session (cached five minutes) and enforces the token's `scope` per tool: read-only tools need `read`; deleting, revoking and rotating (and revealing a c
Gates applied: no_behavioural_pass.
c61f59048601full audit observations/trust-audit/mcp-server/dappros__ethora-mcp-server.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-10 | c61f59048601 | SAFE | B | 89 | first audit |
Questions
What is the ethora-mcp-server MCP server?
Remote and local MCP server for Ethora: let Claude, ChatGPT, Cursor and agents create chat apps, rooms, users and RAG-powered AI agents.
What tools does ethora-mcp-server expose?
105 in total: 59 read-only, 36 that write, and 10 that can delete or overwrite (ethora-agent-delete, ethora-api-key-revoke, ethora-app-delete, ethora-app-token-revoke, ethora-chat-delete). Every one is listed on this page with its risk.
Is ethora-mcp-server safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B. Separately from the audit: 10 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does ethora-mcp-server need?
It reads ETHORA_APP_JWT, ETHORA_APP_TOKEN, ETHORA_B2B_TOKEN and ETHORA_MCP_AUTH_ISSUER from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does ethora-mcp-server run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @ethora/mcp-server at 26.10.0.
How current is this page?
The grade is for one exact copy of the source (c61f59048601), read on 2026-10-10. The repository is watched and re-audited when it changes.