Mingle — Agent-Native Connection Protocol

NPM · MINGLE-MCP · SCANNED AUG 3

Meet the people you're looking for. Your agent composes, you approve. Nothing scores or ranks you.

Available components

+17 this week 62 62 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security73

No malware found by supply-chain analysis.Pass
CVE check failed: a known high-severity CVE affects uuid 9.0.1, reached via agent-passport-system > uuid. A fixed version is available. View diagnostics → Fail
Runs a script at install time (postinstall) that we could not recognise. It may be perfectly ordinary, but we do not read the published tarball, so we cannot say what it does. View diagnostics → Partial
Only part of the dependency tree could be resolved (105 of 109), so this covers what we could see, not the whole tree. View diagnostics → Partial

Provenance & Transparency45

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
Clear OSI-approved license (Apache-2.0).Pass
Actively maintained (last published 12 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability66

AI-judged instruction clarity (good).Pass
Tool/resource definitions use about 1644 tokens (~86/item across 19 items; 19 tools + 0 resources), lean.Pass
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management27

Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial

Tool Coverage89

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
66% of tool parameters carry a description.Partial

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · mingle-mcp

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add aeoess-mingle -- npx -y mingle-mcp

# add to Codex CLI

codex mcp add aeoess-mingle -- npx -y mingle-mcp

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "aeoess-mingle": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "mingle-mcp"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add aeoess-mingle --command npx --arg -y --arg mingle-mcp

# ~/.hermes/config.yaml

mcp_servers:
  aeoess-mingle:
    command: "npx"
    args: ["-y", "mingle-mcp"]

// mcp.json

{
  "mcpServers": {
    "aeoess-mingle": {
      "command": "npx",
      "args": [
        "-y",
        "mingle-mcp"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

3 Aug 26 +15
- CVE-2026-41686 affects this package: high ▼ security
- CVE-2026-41907 affects this package: high ▼ security
- Provenance: unverified → fail ▼ security
- Known CVEs: unverified → fail ▼ security
- Install scripts: unverified → partial ▲ security
- The scripts that run when this package is installed changed: postinstall security
- Stability: unverified → 0.27 ▲ functional
- License: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- Maintenance: unverified → pass ▲ functional
- Licence: Apache-2.0 functional
2 Aug 26 +15
- Malware scan: unverified → pass ▲ security
1 Aug 26 +12
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- MCP protocol: unverified → pass ▲ functional
- Schema quality: unverified → good ▲ functional
31 Jul 26 −7
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
30 Jul 26 −18
- Malware scan: pass → unverified ▼ security
27 Jul 26 45

First indexed and scored.

Show 2 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/[email protected]

Provenance none

Ecosystem: npm · Outcome: none

Install scripts 1 script

Hook	Tier	Command
postinstall	unreviewed	`echo '\n🤝 Mingle installed! Run: npx mingle-mcp setup\n'`

Vulnerabilities 2 findings

ID	CVE	Severity	Vector	Fix available
GHSA-p7fg-763f-g4gf	CVE-2026-41686	medium		yes
GHSA-w5hq-g745-h8pq	CVE-2026-41907	high	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	yes

Dependencies 105 packages

105 packages in the resolved dependency tree · 104 deprecated · 30 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 19 exposed · ~1,644 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

compose_connection_card ~185

Step 1 of publishing. Build the exact card the principal approves. Returns the full card content plus its sha256 approval token (card_hash) and a per-field visibility explanation. Nothing is published. Show the rendered card to the principal, then call the matching publish tool echoing card_hash back once they say yes.

Input Output Examples

Name	Type	Req	Description
artifacts	array	—	—
event_ref	object	—	—
headline	string	yes	Headline in the principal's voice
intents	array	yes	—
offering	array	—	—
preferences	array	—	Explicit self-declared values only, never inferred traits
seeking	array	—	—
team_size_sought	integer	—	—
ttl_days	integer	—	Days until auto-expiry (default 21)
visibility	object	—	Per-field audience; unlisted content fields default to network

No output schema declared.

No examples provided.

compose_opportunity_card ~186

Input Output Examples

Name	Type	Req	Description
artifacts	array	—	—
event_ref	object	—	—
headline	string	yes	Headline in the principal's voice
intents	array	yes	—
offering	array	—	—
preferences	array	—	Explicit self-declared values only, never inferred traits
seeking	array	—	—
team_size_sought	integer	—	—
ttl_days	integer	—	Days until auto-expiry (default 21)
visibility	object	—	Per-field audience; unlisted content fields default to network

No output schema declared.

No examples provided.

delete_server_copy ~58

Ask the server to delete its stored copy of a v3 card. Content is blanked; status shows deleted. Counterparties may retain what they already received.

Input Output Examples

Name	Type	Req	Description
card_id	string	yes	The v3 card_id to act on

No output schema declared.

No examples provided.

get_card_status ~48

Show the current server status of the v3 cards you have published (adapts the digest to v3 card types). Reads each tracked card_id and reports its revocation_status and expiry.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

get_digest ~41

Check what's happening on the Mingle network for you. Returns pending intro requests, top matches, and card status. Call this at session start to surface anything important.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

publish_connection_card ~77

Step 2 of publishing. Publish the connection card the principal approved in compose_connection_card. Requires the exact card object and the approved_hash returned by compose; a mismatch is refused so only approved content is published.

Input Output Examples

Name	Type	Req	Description
approved_hash	string	yes	The card_hash the principal approved
card	—	—	The exact card object returned by compose

No output schema declared.

No examples provided.

publish_intent_card ~163

Publish your profile to the Mingle network — what you're looking for and what you can offer. Cards are Ed25519 signed with your persistent identity and expire after 48h. Returns your top matches immediately.

Input Output Examples

Name	Type	Req	Description
context	string	—	Rich context for better matching (private — never shown to others)
hours	number	—	Hours until card expires (default 48)
name	string	yes	Your name or alias
needs	array	—	What you're looking for (plain text list)
offers	array	—	What you can provide (plain text list)
open_to	array	—	Open to (e.g. 'introductions', 'partnerships')
topic	string	—	What you're working on (short summary)

No output schema declared.

No examples provided.

publish_opportunity_card ~79

Step 2 of publishing. Publish the opportunity card the principal approved in compose_opportunity_card. Requires the exact card object and the approved_hash returned by compose; a mismatch is refused so only approved content is published.

Input Output Examples

Name	Type	Req	Description
approved_hash	string	yes	The card_hash the principal approved
card	—	—	The exact card object returned by compose

No output schema declared.

No examples provided.

rate_connection ~84

Rate a connection you made through Mingle. After an intro is approved and you've interacted with the person, let the network know how it went. This helps improve matching for everyone.

Input Output Examples

Name	Type	Req	Description
comment	string	—	Optional: brief note on why
intro_id	string	yes	Intro ID of the connection to rate
rating	string	yes	How useful was this connection?

No output schema declared.

No examples provided.

remove_intent_card ~45

Remove your card from the Mingle network. Your identity and connection history are preserved. Publish a fresh card anytime.

Input Output Examples

Name	Type	Req	Description
card_id	string	yes	Card ID to remove

No output schema declared.

No examples provided.

request_counterparty_deletion ~50

Ask counterparties who received your card to delete their copy. Phase 2 feature; not yet active. Counterparties may retain what they already received.

Input Output Examples

Name	Type	Req	Description
card_id	string	yes	—

No output schema declared.

No examples provided.

request_intro ~84

Reach out to someone you matched with on Mingle. Send a message explaining why you'd be a good connection. Nothing personal crosses until both sides say yes.

Input Output Examples

Name	Type	Req	Description
match_id	string	yes	Match ID from search_matches
message	string	yes	Short message explaining why this intro would be valuable
to	string	yes	Agent ID of the person you want to meet

No output schema declared.

No examples provided.

respond_to_intro ~86

Respond to an introduction on Mingle. Someone's AI reached out because they think you'd be a good match. Approve to connect, decline to pass. No details shared unless both sides say yes.

Input Output Examples

Name	Type	Req	Description
approve	boolean	yes	true to approve, false to decline
intro_id	string	yes	Intro ID from your digest
message	string	—	Optional response message

No output schema declared.

No examples provided.

revoke_agent_authority ~51

Revoke all future agent authority tied to a v3 card. The card leaves search and its status shows authority_revoked.

Input Output Examples

Name	Type	Req	Description
card_id	string	yes	The v3 card_id to act on

No output schema declared.

No examples provided.

search_cards ~141

Search Mingle v3 cards by explicit fields (card_type, intents, topics, engagement, location, event_ref) and, when a query is given, semantic similarity over published card text. Returns network-visible fields only; private fields never appear. Relevance ordering for your own query is search, not a judgment of people.

Input Output Examples

Name	Type	Req	Description
card_type	string	—	—
engagement	string	—	—
event_ref	string	—	—
intents	array	—	—
limit	integer	—	—
location	string	—	—
query	string	—	Free-text query for semantic ranking over published text
topics	array	—	—

No output schema declared.

No examples provided.

search_matches ~127

Find people relevant to you on the Mingle network. Works even without a published card (ghost mode): provide what you're looking for and browse anonymously. Returns ranked matches based on semantic similarity between needs and offers.

Input Output Examples

Name	Type	Req	Description
max_results	number	—	Max results (default: 15)
min_score	number	—	Minimum relevance score 0-1 (default: 0.3)
query_needs	array	—	Ghost mode: describe what you need without a published card
query_offers	array	—	Ghost mode: describe what you offer without a published card

No output schema declared.

No examples provided.

stop_new_matches ~43

Stop new matches against a v3 card without withdrawing it. Status shows stopped_new_matches.

Input Output Examples

Name	Type	Req	Description
card_id	string	yes	The v3 card_id to act on

No output schema declared.

No examples provided.

supersede_claims ~48

Mark a v3 card superseded (its claims are replaced by a newer card). Status shows superseded.

Input Output Examples

Name	Type	Req	Description
card_id	string	yes	The v3 card_id to act on

No output schema declared.

No examples provided.

withdraw_card ~48

Withdraw a v3 card from the network. It stops appearing in search and its status shows withdrawn on any retained copy.

Input Output Examples

Name	Type	Req	Description
card_id	string	yes	The v3 card_id to act on

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

27 Jul 3 Aug