ModWrench
NPM · @MODWRENCH/CLI · SCANNED SEP 20
One MCP server for mod platforms and local modding diagnostics. No data kept.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security99
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 117 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to 171county/modwrench). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 2 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability83
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2587 tokens (~152/item across 17 items; 17 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management58
- Stability check failed: the tool surface changed between 0.0.1 and 0.2.4: 7 tool removals, 0 breaking changes, 4 additions. See how to fix → Fail
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 17 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 17 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the ModWrench MCP server?
ModWrench runs locally as an npm package, launched with npx -y @modwrench/cli. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @modwrench/cli
claude mcp add 171county-modwrench -- npx -y @modwrench/cli
{
"mcpServers": {
"171county-modwrench": {
"command": "npx",
"args": [
"-y",
"@modwrench/cli"
]
}
}
} {
"servers": {
"171county-modwrench": {
"command": "npx",
"args": [
"-y",
"@modwrench/cli"
]
}
}
} codex mcp add 171county-modwrench -- npx -y @modwrench/cli
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"171county-modwrench": {
"type": "local",
"command": [
"npx",
"-y",
"@modwrench/cli"
],
"enabled": true
}
}
} openclaw mcp add 171county-modwrench --command npx --arg -y --arg @modwrench/cli
mcp_servers:
171county-modwrench:
command: "npx"
args: ["-y", "@modwrench/cli"] {
"McpServers": {
"171county-modwrench": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@modwrench/cli"
]
}
}
} assistant mcp add 171county-modwrench -t stdio -c npx -a -y @modwrench/cli
{
"mcpServers": {
"171county-modwrench": {
"command": "npx",
"args": [
"-y",
"@modwrench/cli"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 55 to 58.
- 18 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 48 to 52.
- 17 Sept 26 0
- Stability: fail → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: 100 → unverified ▼ functional
- Package version: 0.2.3 → 0.2.4 functional
- 16 Sept 26 +23
- Malware scan: unverified → pass ▲ security
- Known CVEs: unverified → pass ▲ security
- Dependency health: unverified → 0.89 ▲ functional
- 15 Sept 26 −25
- Known CVEs: pass → unverified ▼ security
- Malware scan: pass → unverified ▼ security
- Dependency health: 0.89 → unverified ▼ functional
- Package version: 0.2.0 → 0.2.3 functional
- Package version: 0.2.0 → 0.2.2 functional
- Package version: 0.2.0 → 0.2.1 functional
- 14 Sept 26 +15
- Malware scan: unverified → pass ▲ security
- 13 Sept 26 +22
- Malware scan: unverified → pass ▲ security
- Known CVEs: unverified → pass ▲ security
- Provenance: fail → pass ▲ security
- The attested source repository moved: 171county/modwrench security
- Dependency health: unverified → 0.89 ▲ functional
- Package version: 0.1.1 → 0.2.0 functional
- 12 Sept 26 −29
- Stability: 0.87 → unverified ▼ security
- Malware scan: pass → unverified ▼ security
- Known CVEs: pass → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Stability: 0.87 → fail ▼ security
- Schema quality: 128 → 152 ▼ functional
- Capabilities: pass → unverified ▼ functional
- Dependency health: 0.89 → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: unverified → 100 ▲ functional
- Licence: Apache-2.0 → MIT functional
- Package version: 0.0.1 → 0.1.1 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/@modwrench/cli@0.2.4
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | 171county/modwrench |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/171county/modwrench/.github/workflows/release.yml@refs/tags/v0.2.4 |
| Rekor log index | 2877387559 |
| Predicate type | https://slsa.dev/provenance/v1 |
| Subject digest | sha512:ae1b99380076479113a349e58cc7b6669b3f9bcfa176c6bcd8f2a479f3117ca6e7eb23c0432811f41b59b44f10c17e2c8908fbe22579dd468dd0b3225 |
Background: How many MCP packages publish verified provenance →
Dependencies 117 packages
| Packages resolved | 117 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
mw_activate_platform ~119
Activate an additional platform's tool set without restarting the meta-server. Use this when the user adds credentials or asks about a platform that wasn't loaded at boot. After activation, the new tools appear in the catalog and become callable. Returns the activation result (success with toolCount + baseUrl, or failure with reason — usually a missing-credential hint pointing at `modwrench auth login <platform>`).
| Name | Type | Req | Description |
|---|---|---|---|
| platform_id | string | yes | Platform identifier. Idempotent — activating an already-active platform returns alreadyActive: true with no side effects. |
No output schema declared.
No examples provided.
mw_check_known_conflicts ~246
Check a list of mods/plugins for known pairwise incompatibilities. Two sources: LOOT's masterlist (live, Bethesda games) and ModWrench's bundled community conflict database (any game). Returns conflicts with severity, description, source attribution, and an optional patch suggestion. It flags what's on the list — it won't promise the game runs clean. Input ids can be plugin filenames ("Skyrim.esp") or platform-prefixed mod ids ("nexus:12345"). Use when the user asks "what's conflicting", "will these mods fight", or "known issues between X and Y".
| Name | Type | Req | Description |
|---|---|---|---|
| gameId | string | yes | Canonical game ID (e.g. 'skyrimspecialedition', 'lethalcompany'). LOOT support is Bethesda-only; non-Bethesda games rely on the community database only. |
| modIds | array | yes | List of mods/plugins to check pairwise. Entries can be plugin filenames ('Skyrim.esp') or platform-prefixed mod IDs ('nexus:12345', 'modio:67890', 'thunderstore:Author-ModName'). At least 2 required… |
No output schema declared.
No examples provided.
mw_deck ~138
Open the ModWrench deck: a themed, interactive MCP-UI surface (a ui:// resource) showing the active connectors and flagship games in four skins (Skyrim, Fallout Pip-Boy, Lethal Company, Valheim). Stateless — rendered fresh from the current catalog, holds nothing. Use when the user says "open the deck", "summon/show ModWrench", or wants a visual dashboard. Optional args set the initial theme and view.
| Name | Type | Req | Description |
|---|---|---|---|
| theme | string | – | Initial theme: skyrim | fallout | lethal | valheim. Default skyrim. |
| view | string | – | Initial view. Default 'deck'. |
No output schema declared.
No examples provided.
mw_detect_environment ~113
See what you're working with. Auto-detects OS, Steam Deck, installed mod-friendly games (Bethesda / Unity co-op), per-game loaders (SKSE / F4SE / BepInEx), mod managers (MO2 / Vortex / r2modman), and Proton versions on Linux. Read-only — reads known config/save locations and touches nothing else. Use when the user asks "what've I got installed", "find my games", or before any tool that needs to know their setup.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
mw_diagnose_crash ~243
Crash log in, culprit shortlist out. Parses the log, then correlates its suspects with the loaded plugins and (with a gameId) the known-conflict database into one bundle: which suspected mods are actually in the load order, at what index, and which loaded plugins have known conflicts. It lines up the evidence; it does NOT name the cause — that's the model's call, reasoned over the data. Use when the user says "what's causing my crash", "which mod is it", or pastes a crash log and wants the answer.
| Name | Type | Req | Description |
|---|---|---|---|
| gameId | string | – | Canonical game id (e.g. 'skyrimspecialedition', 'fallout4') to include the known-conflict cross-check. Omit to skip it. |
| logContent | string | – | Crashlog content as a string. Provide this OR logPath. |
| logPath | string | – | Absolute path to a crashlog on disk (the SKSE/F4SE crash folder, or the game's BepInEx/LogOutput.log). |
| logType | string | – | Format hint. Default 'auto' — detect from content. |
No output schema declared.
No examples provided.
mw_parse_crashlog ~273
Crash log in, structure out. Parses a crashlog (file path or pasted content) into fields: exception type, call stack, loaded plugins, registers, suspected FormID refs. Handles Crash Logger SSE (Skyrim), Buffout 4 (Fallout 4), NetScriptFramework (older Skyrim), and BepInEx (Unity). Returns parsed structure only — naming the culprit is the model's job, reasoned over the actual load order, not pattern-matched from a list. Use when the user says "my game crashed", "CTD", "here's my crash log", or "why did it crash".
| Name | Type | Req | Description |
|---|---|---|---|
| logContent | string | – | Crashlog file content as a string. Provide this OR logPath. |
| logPath | string | – | Absolute path to a crashlog file on disk. Common locations: ~/Documents/My Games/Skyrim Special Edition/SKSE/crash-*.log for Crash Logger SSE, ~/Documents/My Games/Fallout4/F4SE/crash-*.log for Buffo… |
| logType | string | – | Format hint. Default 'auto' — detect from content. Pass an explicit type when the auto-detect heuristic fails on a truncated log. |
No output schema declared.
No examples provided.
mw_query_mod_metadata ~256
Put a name and a source on a mod. Looks up metadata across platforms (Nexus, mod.io) in one normalized shape: id, name, author, version, downloads, endorsements, pageUrl, and a permissions block that always carries attribution. Use it to enrich a crashlog suspect or a load-order entry — "who made this", "look up this mod", "what version is X". Thunderstore support is planned.
| Name | Type | Req | Description |
|---|---|---|---|
| gameId | string | – | Platform-specific game identifier. For Nexus: the domain name (e.g. 'skyrimspecialedition'). For mod.io: the numeric game id as a string. Use modio_list_games / nexus_list_games to discover these. |
| modId | string | – | Platform-specific mod ID. Nexus IDs are numeric (from the URL); mod.io IDs are numeric too. Required for direct lookup. |
| modName | string | – | Mod name for fuzzy lookup (mod.io only — Nexus has no public search endpoint). Pass with gameId. |
| platform | string | – | Which platform to query. Default 'any' — tries Nexus first when a numeric modId + gameId are given, then mod.io. Use explicit platform to skip the cascade. |
No output schema declared.
No examples provided.
mw_read_load_order ~246
Post your load order — but here, not in a Discord. Reads it for a specific game from whichever manager the user runs (MO2, r2modman, or best-effort Vortex). Normalized output: each entry has name, enabled state, load-order index, and attribution when available. Read-only. Use when the user says "show/post my load order", "what mods do I have enabled", or "what order are my mods in".
| Name | Type | Req | Description |
|---|---|---|---|
| gameId | string | yes | Canonical game ID (e.g. 'skyrimspecialedition', 'lethalcompany'). Use mw_detect_environment to discover the games on this machine. |
| instancePath | string | – | Optional override for MO2's instance path — useful for portable MO2 installs that don't live under %LOCALAPPDATA%/ModOrganizer. |
| modManager | string | – | Which mod manager to read from. Default 'auto' — picks the most likely manager for this game's family. |
| profileName | string | – | Profile name. MO2 reads the active profile from ModOrganizer.ini if omitted; r2modman defaults to the first profile alphabetically (typically 'Default'). |
No output schema declared.
No examples provided.
thunderstore_get_community ~117
Get details for a single Thunderstore community (game) by its identifier. Returns name, links (Discord, wiki), and metadata flags. Thunderstore has no single-community detail endpoint — this walks the paginated list and early-exits on match, so cost grows with how late in the list the target is.
| Name | Type | Req | Description |
|---|---|---|---|
| identifier | string | yes | Community identifier (slug) — e.g. 'lethal-company', 'valheim', 'risk-of-rain-2'. Use thunderstore_list_communities to discover these. |
No output schema declared.
No examples provided.
thunderstore_get_mod ~134
Get full details for a single mod by namespace (author) + name. Returns the latest version, total downloads, rating, community_listings (which games the mod is published in), and metadata. Thunderstore mods are identified globally by namespace+name — no community arg is needed at this endpoint.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | Mod name — the part after the dash in full_name. |
| namespace | string | yes | Mod author/namespace — the part before the dash in a Thunderstore mod's full_name (e.g. 'BepInEx' for 'BepInEx-BepInExPack'). |
No output schema declared.
No examples provided.
thunderstore_list_communities ~72
List all communities (games) supported on Thunderstore — Lethal Company, Valheim, R.E.P.O., Risk of Rain 2, Dyson Sphere Program, BONEWORKS, and many more. Returns each community's identifier (slug used in other tool calls) and display name.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
thunderstore_list_mods ~88
List mods in a specific Thunderstore community. Returns a summary view per mod (name, author, rating, downloads, latest version). Paginated server-side; default page size is whatever the community returns.
| Name | Type | Req | Description |
|---|---|---|---|
| community | string | yes | Community identifier (e.g. 'lethal-company'). |
| limit | integer | – | Max results to return (1-100). Default 30. |
No output schema declared.
No examples provided.
thunderstore_mod_dependencies ~95
List the dependencies of a Thunderstore mod's latest version — the other packages (e.g. BepInEx) it needs to run. The backbone of a correct r2modman profile. Returns each dependency's full_name.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | Mod name — the part after the dash in full_name. |
| namespace | string | yes | Mod author/namespace — the part before the dash in full_name. |
No output schema declared.
No examples provided.
thunderstore_mod_versions ~135
List the full version history of a specific mod. Each entry includes version number, download count, file size, dependencies, and release date. Newest first. Version history is only available via the community listing endpoint, so a community must be specified — pick any community the mod is published in (use thunderstore_get_mod's community_listings field to discover).
| Name | Type | Req | Description |
|---|---|---|---|
| community | string | yes | Community identifier (e.g. 'lethal-company'). Any community where the mod is listed; the version history is identical across communities. |
| name | string | yes | Mod name. |
| namespace | string | yes | Mod author/namespace. |
No output schema declared.
No examples provided.
thunderstore_resolve_dependencies ~166
Resolve a Thunderstore mod's ENTIRE dependency tree — not just its direct deps, but its deps' deps, all the way down. De-duped and cycle-safe; returns an install-first order (dependencies before the things that need them), the full tree, and any refs it couldn't resolve. The 'find every mod this needs before I download it' answer in one shot. Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| maxDepth | integer | – | How deep to walk the tree. Default 6 — deep enough for real BepInEx stacks, capped so a pathological graph can't run away. |
| name | string | yes | Mod name — the part after the dash in full_name. |
| namespace | string | yes | Mod author/namespace — the part before the dash in full_name. |
No output schema declared.
No examples provided.
thunderstore_search_mods ~77
Search mods in a Thunderstore community by name substring. Case-insensitive. Returns a summary view per match.
| Name | Type | Req | Description |
|---|---|---|---|
| community | string | yes | Community identifier. |
| limit | integer | – | Max results (1-50). Default 20. |
| query | string | yes | Substring to match against mod name (case-insensitive). |
No output schema declared.
No examples provided.
thunderstore_top_mods ~69
Get the highest-rated mods in a Thunderstore community. Sorted by rating_score descending. Use this for 'what's popular' style queries.
| Name | Type | Req | Description |
|---|---|---|---|
| community | string | yes | Community identifier. |
| limit | integer | – | Number of top mods to return (1-50). Default 10. |
No output schema declared.
No examples provided.
What is the ModWrench MCP server?
ModWrench is an MCP server listed in the public MCP registry as io.github.171county/modwrench. One MCP server for mod platforms and local modding diagnostics. No data kept. This page covers its npm package (@modwrench/cli).
Is the ModWrench MCP server safe to use?
ModWrench scores 91 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the ModWrench MCP server expose?
ModWrench exposes 17 tools: thunderstore_list_communities, thunderstore_get_community, thunderstore_list_mods, thunderstore_get_mod, thunderstore_search_mods, and 12 more. Their descriptions and schemas cost roughly 2,587 tokens of context every time the server is loaded.
Is the ModWrench MCP server still maintained?
ModWrench is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the ModWrench MCP server under?
ModWrench declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.