Glean Mcp Server — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Glean Mcp Server (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Simple, focused implementation providing:
glean_mcp.cookie_client.GleanClient) — uses browser session cookiesglean_mcp.token_client.TokenBasedGleanClient) — uses API tokens for server-to-server authpython -m glean_mcp.server) — auto-detects authentication method; ready for DockerLinks: Releases · Cookie Guide · Token Auth Guide
pip install -U glean-mcpsrc/
└── glean_mcp/
├── cookie_client.py # Cookie-based authentication client
├── token_client.py # Token-based authentication client
├── server.py # MCP server with auto-detection
└── glean_filter.py # Response filtering utilitiesThe MCP server automatically detects your authentication method.
# Choose ONE (token preferred)
export GLEAN_API_TOKEN="your-api-token" # preferred
# OR
export GLEAN_COOKIES="your-browser-cookies"
# Set your Glean instance
export GLEAN_BASE_URL="https://your-company-be.glean.com" # or set GLEAN_INSTANCE=your-company
# Run the MCP server locally
python -m glean_mcp.serverDocker (example):
docker run --pull always --rm \
-e GLEAN_API_TOKEN="$GLEAN_API_TOKEN" \
-e GLEAN_BASE_URL="$GLEAN_BASE_URL" \
ghcr.io/alankyshum/glean-mcp-server:latestUpgrade: use --pull always (Docker) or pip install -U glean-mcp (pip).
Cookie-based:
from glean_mcp import GleanClient
client = GleanClient(base_url, cookies)
results = await client.search("onboarding docs")
await client.close()Token-based:
from glean_mcp import TokenBasedGleanClient
client = TokenBasedGleanClient(base_url, api_token)
results = await client.search("onboarding docs")
await client.close()Auto-detection (same logic as server):
from glean_mcp import create_glean_client
client = create_glean_client() # Uses env vars; prefers token
results = await client.search("onboarding docs")
await client.close()Two supported methods:
GLEAN_COOKIES/api/v1/ endpointsGLEAN_API_TOKEN/rest/api/v1/ endpoints1) If GLEAN_API_TOKEN is set → token-based auth 2) Else if GLEAN_COOKIES is set → cookie-based auth 3) If both are set → token preferred 4) If neither is set → error with guidance
Required for server/library:
GLEAN_BASE_URL (e.g. https://your-company-be.glean.com) or GLEAN_INSTANCEGLEAN_API_TOKEN (preferred) or GLEAN_COOKIESOptional (server behavior):
GLEAN_DEFAULT_PAGE_SIZE (default: 14)GLEAN_DEFAULT_SNIPPET_SIZE (default: 215)GLEAN_TOOL_DESCRIPTION (tool description text)GLEAN_AUTO_OPEN_BROWSER (default: true)git clone https://github.com/alankyshum/glean-mcp-server.git
cd glean-mcp-server
python -m venv .venv && source .venv/bin/activate
pip install -e '.[dev]'
pytest -qvX.Y.Z after updating version strings; CI publishes to PyPI/GHCR if versions matchMIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.