# io.github.AaronVick/echorift-mcp (npm · @echorift/mcp)

MCP server for EchoRift infrastructure primitives (BlockWire, CronSynth, Switchboard, Arbiter)

- Trust score: 49/100 (low)
- Change this week: +31
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `@echorift/mcp`: 49/100 (this document), [markdown](https://verifymcp.io/servers/aaronvick-echorift-mcp/echorift-mcp.md), [page](https://verifymcp.io/servers/aaronvick-echorift-mcp/echorift-mcp)

## Channel facts

- Registry: `npm`
- Package: `@echorift/mcp`
- Version: `0.1.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 72/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known high-severity CVE affects @modelcontextprotocol/sdk 0.5.0, a direct dependency. A fixed version is available.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (22 of 23), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 19/100
  - Repository check failed: the declared repository URL returned HTTP 404.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 232 days ago).
  - Security-disclosure policy not yet verified: we couldn't inspect the source repository.
- **Schema Quality & AI Usability**: 71/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (fair).
  - Tool/resource definitions use about 764 tokens (~47/item across 16 items; 12 tools + 4 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 79/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 37% of tool parameters carry a description.
- **Capabilities**: 20/100
  - Spec-recency check failed: implements MCP spec 2024-11-05; the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add aaronvick-echorift-mcp -- npx -y @echorift/mcp
```

### Codex

```bash
codex mcp add aaronvick-echorift-mcp -- npx -y @echorift/mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "aaronvick-echorift-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@echorift/mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add aaronvick-echorift-mcp --command npx --arg -y --arg @echorift/mcp
```

### Hermes

```yaml
mcp_servers:
  aaronvick-echorift-mcp:
    command: "npx"
    args: ["-y", "@echorift/mcp"]
```

### Other

```json
{
  "mcpServers": {
    "aaronvick-echorift-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@echorift/mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 49, +24)

- [security regression] Known CVEs: unverified → fail
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional regression] MCP protocol: unverified → fail
- [functional improvement] Schema quality: unverified → 100
- [functional improvement] Schema quality: unverified → fair
- [functional improvement] Tool coverage: unverified → 100

### 2026-08-02 (score 25, −23)

- [security regression] Known CVEs: fail → unverified
- [security] Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [functional regression] Schema quality: 100 → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Capabilities: fail → unverified

### 2026-08-01 (score 48, +23)

- [security regression] Provenance: unverified → fail
- [security improvement] Malware scan: unverified → pass
- [security improvement] Install scripts: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional regression] MCP protocol: unverified → fail
- [functional improvement] License: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional] Licence: MIT

### 2026-07-31 (score 25, −1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 26, −24)

- [security regression] Malware scan: pass → unverified
- [security regression] Known CVEs: fail → unverified
- [security improvement] CVE-2025-66414 no longer affects this package
- [functional regression] Dependency health: partial → unverified

### 2026-07-28 (score 50, +32)

- [security regression] CVE-2025-66414 affects this package: high
- [security regression] Known CVEs: unverified → fail
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] Schema quality: unverified → 100
- [functional] First check of Schema quality: pass
- [functional] First check of Schema quality: fail
- [functional] First check of Schema quality: unverified
- [functional] First check of Tool coverage: 37

### 2026-07-27 (score 18)

First indexed and scored.

## MCP tools (12)

### `blockwire_subscribe_prepare_tx` (~106 tokens)

Generate on-chain transaction payload for BlockWire webhook subscription

Input parameters:

- `eventTypes` (required): Either an array of types OR the bitmask integer supported by BlockWire.
- `hours` (integer, required)
- `signature` (string): Optional if MCP server can sign. If provided, must match BlockWire SubscribeRequest expectations.
- `signer` (string): 0x… wallet address. Optional if MCP server is configured with a local signer.
- `webhookUrl` (string, required)

### `blockwire_feed` (~44 tokens)

Pull recent blockchain events via paid x402 endpoint

Input parameters:

- `limit` (integer)
- `since` (integer): Unix timestamp (seconds).
- `types` (array)

### `cronsynth_schedule_create` (~88 tokens)

Create a scheduled webhook trigger with cron expression

Input parameters:

- `cron` (string, required): Standard 5-field cron. Minimum 1-minute interval. UTC.
- `label` (string)
- `webhookUrl` (string, required): Must be HTTPS per CronSynth rules.
- `x402Session` (string): Optional override. If omitted, MCP server uses env CRONSYNTH_X402_SESSION.

### `cronsynth_schedule_list` (~28 tokens)

List all scheduled webhook triggers

Input parameters:

- `x402Session` (string): Optional override.

### `cronsynth_schedule_delete` (~44 tokens)

Delete a scheduled webhook trigger

Input parameters:

- `id` (string, required): Schedule id (e.g., sch_...).
- `x402Session` (string): Optional override.

### `switchboard_task_enqueue` (~69 tokens)

Enqueue a task to a Switchboard swarm queue

Input parameters:

- `agentId` (string): 0x… Optional if MCP server uses local signer identity.
- `auth` (object): Optional bring-your-own-auth mode.
- `swarmId` (string, required)
- `task` (object, required)

### `switchboard_task_claim` (~51 tokens)

Claim a task from a Switchboard swarm queue

Input parameters:

- `agentId` (string)
- `auth` (object)
- `swarmId` (string, required)
- `taskId` (string, required)

### `switchboard_task_complete` (~55 tokens)

Mark a claimed task as complete

Input parameters:

- `agentId` (string)
- `auth` (object)
- `result` (object, required)
- `swarmId` (string, required)
- `taskId` (string, required)

### `arbiter_lock_acquire` (~76 tokens)

Acquire a distributed lock with fencing token

Input parameters:

- `mode` (string)
- `resource` (string, required): Lock key, e.g. 'portfolio:main'.
- `swarmId` (string, required)
- `ttlSeconds` (integer)
- `x402` (object): Optional bring-your-own x402 proof/headers.

### `arbiter_lock_release` (~58 tokens)

Release a distributed lock using fencing token

Input parameters:

- `fencingToken` (integer, required): Returned by acquire. Used to prevent stale releases.
- `resource` (string, required)
- `swarmId` (string, required)
- `x402` (object)

### `arbiter_leader_get` (~26 tokens)

Get current leader for a swarm

Input parameters:

- `swarmId` (string, required)

### `arbiter_election_run` (~61 tokens)

Run a leader election for a swarm

Input parameters:

- `candidates` (array, required)
- `mode` (string)
- `swarmId` (string, required)
- `termHint` (integer): Optional optimistic concurrency hint.
- `x402` (object)

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/aaronvick-echorift-mcp/echorift-mcp#diagnostics

## Score history

- 2026-08-03: 49
- 2026-08-02: 25
- 2026-08-01: 48
- 2026-07-31: 25
- 2026-07-30: 26
- 2026-07-28: 50
- 2026-07-27: 18

## Links

- npm package: https://www.npmjs.com/package/@echorift/mcp
- Socket report: https://socket.dev/npm/package/@echorift/mcp
- Changelog RSS feed: https://verifymcp.io/servers/aaronvick-echorift-mcp/echorift-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/aaronvick-echorift-mcp/echorift-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/aaronvick-echorift-mcp/echorift-mcp