# Mingle — Agent-Native Connection Protocol (npm · mingle-mcp)

Meet the people you're looking for. Your agent composes, you approve. Nothing scores or ranks you.

- Trust score: 62/100 (medium)
- Change this week: +17
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `mingle-mcp`: 62/100 (this document), [markdown](https://verifymcp.io/servers/aeoess-mingle/mingle-mcp.md), [page](https://verifymcp.io/servers/aeoess-mingle/mingle-mcp)

## Channel facts

- Registry: `npm`
- Package: `mingle-mcp`
- Version: `3.0.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 73/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known high-severity CVE affects uuid 9.0.1, reached via agent-passport-system > uuid. A fixed version is available.
  - Runs a script at install time (postinstall) that we could not recognise. It may be perfectly ordinary, but we do not read the published tarball, so we cannot say what it does.
  - Only part of the dependency tree could be resolved (105 of 109), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (Apache-2.0).
  - Actively maintained (last published 12 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 66/100
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 1644 tokens (~86/item across 19 items; 19 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 89/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 66% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add aeoess-mingle -- npx -y mingle-mcp
```

### Codex

```bash
codex mcp add aeoess-mingle -- npx -y mingle-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "aeoess-mingle": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "mingle-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add aeoess-mingle --command npx --arg -y --arg mingle-mcp
```

### Hermes

```yaml
mcp_servers:
  aeoess-mingle:
    command: "npx"
    args: ["-y", "mingle-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "aeoess-mingle": {
      "command": "npx",
      "args": [
        "-y",
        "mingle-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 62, +15)

- [security regression] CVE-2026-41686 affects this package: high
- [security regression] CVE-2026-41907 affects this package: high
- [security regression] Provenance: unverified → fail
- [security regression] Known CVEs: unverified → fail
- [security improvement] Install scripts: unverified → partial
- [security] The scripts that run when this package is installed changed: postinstall
- [functional improvement] Stability: unverified → 0.27
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional] Licence: Apache-2.0

### 2026-08-02 (score 47, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-08-01 (score 32, +12)

- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Schema quality: unverified → good

### 2026-07-31 (score 20, −7)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 27, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-27 (score 45)

First indexed and scored.

## MCP tools (19)

### `publish_intent_card` (~163 tokens)

Publish your profile to the Mingle network — what you're looking for and what you can offer. Cards are Ed25519 signed with your persistent identity and expire after 48h. Returns your top matches immediately.

Input parameters:

- `context` (string): Rich context for better matching (private — never shown to others)
- `hours` (number): Hours until card expires (default 48)
- `name` (string, required): Your name or alias
- `needs` (array): What you're looking for (plain text list)
- `offers` (array): What you can provide (plain text list)
- `open_to` (array): Open to (e.g. 'introductions', 'partnerships')
- `topic` (string): What you're working on (short summary)

### `search_matches` (~127 tokens)

Find people relevant to you on the Mingle network. Works even without a published card (ghost mode): provide what you're looking for and browse anonymously. Returns ranked matches based on semantic similarity between needs and offers.

Input parameters:

- `max_results` (number): Max results (default: 15)
- `min_score` (number): Minimum relevance score 0-1 (default: 0.3)
- `query_needs` (array): Ghost mode: describe what you need without a published card
- `query_offers` (array): Ghost mode: describe what you offer without a published card

### `get_digest` (~41 tokens)

Check what's happening on the Mingle network for you. Returns pending intro requests, top matches, and card status. Call this at session start to surface anything important.

### `request_intro` (~84 tokens)

Reach out to someone you matched with on Mingle. Send a message explaining why you'd be a good connection. Nothing personal crosses until both sides say yes.

Input parameters:

- `match_id` (string, required): Match ID from search_matches
- `message` (string, required): Short message explaining why this intro would be valuable
- `to` (string, required): Agent ID of the person you want to meet

### `respond_to_intro` (~86 tokens)

Respond to an introduction on Mingle. Someone's AI reached out because they think you'd be a good match. Approve to connect, decline to pass. No details shared unless both sides say yes.

Input parameters:

- `approve` (boolean, required): true to approve, false to decline
- `intro_id` (string, required): Intro ID from your digest
- `message` (string): Optional response message

### `remove_intent_card` (~45 tokens)

Remove your card from the Mingle network. Your identity and connection history are preserved. Publish a fresh card anytime.

Input parameters:

- `card_id` (string, required): Card ID to remove

### `rate_connection` (~84 tokens)

Rate a connection you made through Mingle. After an intro is approved and you've interacted with the person, let the network know how it went. This helps improve matching for everyone.

Input parameters:

- `comment` (string): Optional: brief note on why
- `intro_id` (string, required): Intro ID of the connection to rate
- `rating` (string, required): How useful was this connection?

### `compose_connection_card` (~185 tokens)

Step 1 of publishing. Build the exact card the principal approves. Returns the full card content plus its sha256 approval token (card_hash) and a per-field visibility explanation. Nothing is published. Show the rendered card to the principal, then call the matching publish tool echoing card_hash back once they say yes.

Input parameters:

- `artifacts` (array)
- `event_ref` (object)
- `headline` (string, required): Headline in the principal's voice
- `intents` (array, required)
- `offering` (array)
- `preferences` (array): Explicit self-declared values only, never inferred traits
- `seeking` (array)
- `team_size_sought` (integer)
- `ttl_days` (integer): Days until auto-expiry (default 21)
- `visibility` (object): Per-field audience; unlisted content fields default to network

### `publish_connection_card` (~77 tokens)

Step 2 of publishing. Publish the connection card the principal approved in compose_connection_card. Requires the exact card object and the approved_hash returned by compose; a mismatch is refused so only approved content is published.

Input parameters:

- `approved_hash` (string, required): The card_hash the principal approved
- `card`: The exact card object returned by compose

### `compose_opportunity_card` (~186 tokens)

Step 1 of publishing. Build the exact card the principal approves. Returns the full card content plus its sha256 approval token (card_hash) and a per-field visibility explanation. Nothing is published. Show the rendered card to the principal, then call the matching publish tool echoing card_hash back once they say yes.

Input parameters:

- `artifacts` (array)
- `event_ref` (object)
- `headline` (string, required): Headline in the principal's voice
- `intents` (array, required)
- `offering` (array)
- `preferences` (array): Explicit self-declared values only, never inferred traits
- `seeking` (array)
- `team_size_sought` (integer)
- `ttl_days` (integer): Days until auto-expiry (default 21)
- `visibility` (object): Per-field audience; unlisted content fields default to network

### `publish_opportunity_card` (~79 tokens)

Step 2 of publishing. Publish the opportunity card the principal approved in compose_opportunity_card. Requires the exact card object and the approved_hash returned by compose; a mismatch is refused so only approved content is published.

Input parameters:

- `approved_hash` (string, required): The card_hash the principal approved
- `card`: The exact card object returned by compose

### `search_cards` (~141 tokens)

Search Mingle v3 cards by explicit fields (card_type, intents, topics, engagement, location, event_ref) and, when a query is given, semantic similarity over published card text. Returns network-visible fields only; private fields never appear. Relevance ordering for your own query is search, not a judgment of people.

Input parameters:

- `card_type` (string)
- `engagement` (string)
- `event_ref` (string)
- `intents` (array)
- `limit` (integer)
- `location` (string)
- `query` (string): Free-text query for semantic ranking over published text
- `topics` (array)

### `withdraw_card` (~48 tokens)

Withdraw a v3 card from the network. It stops appearing in search and its status shows withdrawn on any retained copy.

Input parameters:

- `card_id` (string, required): The v3 card_id to act on

### `supersede_claims` (~48 tokens)

Mark a v3 card superseded (its claims are replaced by a newer card). Status shows superseded.

Input parameters:

- `card_id` (string, required): The v3 card_id to act on

### `revoke_agent_authority` (~51 tokens)

Revoke all future agent authority tied to a v3 card. The card leaves search and its status shows authority_revoked.

Input parameters:

- `card_id` (string, required): The v3 card_id to act on

### `delete_server_copy` (~58 tokens)

Ask the server to delete its stored copy of a v3 card. Content is blanked; status shows deleted. Counterparties may retain what they already received.

Input parameters:

- `card_id` (string, required): The v3 card_id to act on

### `stop_new_matches` (~43 tokens)

Stop new matches against a v3 card without withdrawing it. Status shows stopped_new_matches.

Input parameters:

- `card_id` (string, required): The v3 card_id to act on

### `request_counterparty_deletion` (~50 tokens)

Ask counterparties who received your card to delete their copy. Phase 2 feature; not yet active. Counterparties may retain what they already received.

Input parameters:

- `card_id` (string, required)

### `get_card_status` (~48 tokens)

Show the current server status of the v3 cards you have published (adapts the digest to v3 card types). Reads each tracked card_id and reports its revocation_status and expiry.

## Diagnostics

Captured diagnostic sections: Provenance, Install scripts, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/aeoess-mingle/mingle-mcp#diagnostics

## Score history

- 2026-08-03: 62
- 2026-08-02: 47
- 2026-08-01: 32
- 2026-07-31: 20
- 2026-07-30: 27
- 2026-07-28: 45
- 2026-07-27: 45

## Links

- npm package: https://www.npmjs.com/package/mingle-mcp
- Socket report: https://socket.dev/npm/package/mingle-mcp
- Repository: https://github.com/aeoess/mingle-mcp
- Website: https://aeoess.com/mingle
- Changelog RSS feed: https://verifymcp.io/servers/aeoess-mingle/mingle-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/aeoess-mingle/mingle-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/aeoess-mingle/mingle-mcp