hooks — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited hooks (Hook) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<!-- mycelium-badges:start -->
<p> <a href="https://github.com/adelaidasofia/luma-mcp/blob/main/LICENSE"><img alt="License" src="https://img.shields.io/github/license/adelaidasofia/luma-mcp?color=blue"></a> <a href="https://github.com/adelaidasofia/luma-mcp/stargazers"><img alt="GitHub stars" src="https://img.shields.io/github/stars/adelaidasofia/luma-mcp?color=eab308"></a> <a href="https://github.com/adelaidasofia/luma-mcp/commits/main"><img alt="Last commit" src="https://img.shields.io/github/last-commit/adelaidasofia/luma-mcp"></a> <a href="https://github.com/adelaidasofia/luma-mcp/issues"><img alt="Open issues" src="https://img.shields.io/github/issues/adelaidasofia/luma-mcp"></a> <a href="https://pypi.org/project/adelaidasofia-luma-mcp/"><img alt="PyPI version" src="https://img.shields.io/pypi/v/adelaidasofia-luma-mcp?color=blue&label=pypi"></a> <a href="https://pypi.org/project/adelaidasofia-luma-mcp/"><img alt="PyPI downloads" src="https://img.shields.io/pypi/dm/adelaidasofia-luma-mcp?color=blue&label=downloads"></a> <a href="https://myceliumai.co"><img alt="Built by Mycelium AI" src="https://img.shields.io/badge/built_by-Mycelium_AI-15B89A"></a> </p>
<!-- mycelium-badges:end -->
lu.ma events MCP server. Create events, set ticket prices, issue coupon codes, list RSVPs, and email attendees. All writes go through draft+confirm so nothing posts to Luma until you explicitly approve. Built on the official Luma public API.
Reads (call API directly):
luma_health — auth check + draft store sizeluma_get_event — fetch one event by IDluma_list_events — paginated calendar listingluma_list_event_guests — RSVPs filtered by statusluma_list_coupons — calendar or event-scopedWrites (draft+confirm pairs):
luma_create_event_draft / luma_create_event_confirmluma_update_event_draft / luma_update_event_confirmluma_create_ticket_type_draft / luma_create_ticket_type_confirmluma_create_coupon_draft / luma_create_coupon_confirmluma_send_event_email_draft / luma_send_event_email_confirmPlus:
luma_cancel_draft — cancel an unconfirmed draft (idempotent)14 tools total.
luma-mcp/
├── pyproject.toml
├── README.md
├── SETUP.md
├── LICENSE
├── .env.example
├── luma_mcp/
│ ├── __init__.py
│ ├── server.py FastMCP entry point + .env loader
│ ├── client.py HTTP wrapper around api.lu.ma/public/v1
│ ├── drafts.py Thread-safe draft store with TTL
│ ├── audit.py JSONL audit log with redaction
│ ├── scrubber.py Prompt-injection neutralizer
│ ├── _shared/ Day-1 shared utilities
│ │ ├── normalize.py Timezone alias + datetime helpers
│ │ └── types.py Permissive typed shapes for API responses
│ └── tools/
│ ├── health.py luma_health, luma_cancel_draft
│ ├── events.py create / update / get / list events
│ ├── tickets.py create ticket types
│ ├── coupons.py create / list coupons
│ ├── guests.py list event guests
│ └── emails.py send email to attendees
└── tests/integration/
└── test_full_pipeline.py 10-step bare-runnable verificationdraft_id; nothing hits Luma until the matching confirm tool is called. Drafts expire after 1 hour and can only be confirmed once.ts, tool, action, args (redacted), status, latency_ms. Path: ~/.claude/luma-mcp/audit.log.api_key, token, cookie, secret, are masked before logging.unicodedata.normalize("NFKC"), stripped of zero-width characters, and have role-spoof prefixes / fake fences wrapped in backticks (preserving operator visibility, neutralizing model effect on downstream reads).Open Claude Code, paste:
/plugin marketplace add adelaidasofia/luma-mcp /plugin install luma-mcp@luma-mcp
Two prerequisites for the server to authenticate:
https://lu.ma/settings/api, dropped into ~/.claude/luma-mcp/.env as LUMA_API_KEY=....After both steps, restart Claude Code. Tools appear under mcp__luma__*.
<details> <summary>Legacy install</summary>
See SETUP.md for the manual .mcp.json registration path. The plugin install above replaces it.
</details>
cd ~/.claude/luma-mcp && python3 tests/integration/test_full_pipeline.py
# expected: PASSED — luma-mcp v0.1.0 integration test (10 steps green)Then in a Claude Code session: mcp__luma__luma_health() → {ok: true, user: {...}}.
Luma's public API caps at 200 requests / minute / calendar. The client does not auto-retry on 429; it surfaces the error and lets the operator pace.
Same author, same architecture pattern (FastMCP, draft+confirm on writes, vault auto-export where applicable):
This plugin sends a single anonymous install signal to myceliumai.co the first time it loads in a Claude Code session on a given machine.
What is sent:
slack-mcp)0.1.0)What is NOT sent:
Why: Helps the maintainer know which plugins people actually install, so attention goes to the ones that get used.
Opt out: Set the environment variable MYCELIUM_NO_PING=1 before launching Claude Code. The hook will skip the network call entirely. Already-pinged installs leave a sentinel at ~/.mycelium/onboarded-<plugin> — delete it if you want to reset state.
MIT. See LICENSE.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.