Nauro
PYPI · NAURO · SCANNED SEP 21
What every agent should know
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security50
- Malware scan not yet available for this package.Unverified
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs hatchling.build at install time, a recognised native-build step with no shell scripting around it. View diagnostics → Pass
- 3 of 45 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency35
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- License check failed: the license (Apache Software License) isn't a recognized OSI-approved license. See how to fix → Fail
- Actively maintained (last published 20 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability65
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2614 tokens (~261/item across 10 items; 10 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management90
- Stability observed for 27 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (20% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 10 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 11 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the Nauro MCP server?
Nauro runs locally as a PyPI package, launched with uvx nauro. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · nauro
claude mcp add ai-nauro-nauro -- uvx nauro
{
"mcpServers": {
"ai-nauro-nauro": {
"command": "uvx",
"args": [
"nauro"
]
}
}
} {
"servers": {
"ai-nauro-nauro": {
"command": "uvx",
"args": [
"nauro"
]
}
}
} codex mcp add ai-nauro-nauro -- uvx nauro
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"ai-nauro-nauro": {
"type": "local",
"command": [
"uvx",
"nauro"
],
"enabled": true
}
}
} openclaw mcp add ai-nauro-nauro --command uvx --arg nauro
mcp_servers:
ai-nauro-nauro:
command: "uvx"
args: ["nauro"] {
"McpServers": {
"ai-nauro-nauro": {
"Transport": "stdio",
"Command": "uvx",
"Arguments": [
"nauro"
]
}
}
} assistant mcp add ai-nauro-nauro -t stdio -c uvx -a nauro
{
"mcpServers": {
"ai-nauro-nauro": {
"command": "uvx",
"args": [
"nauro"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 −2
- Stability: pass → 0.87 functional
- 19 Sept 26 +1
- Stability: 0.97 → pass security
- 17 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 15 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 14 Sept 26 −18
- Malware scan: pass → unverified ▼ security
- Stability: pass → 0.83 functional
- 13 Sept 26 +1
- Stability: 0.97 → pass security
- 12 Sept 26 +15
- Malware scan: unverified → pass ▲ security
- 11 Sept 26 −14
- Malware scan: pass → unverified ▼ security
- Package version: 1.14.0 → 1.19.0 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 21 Sept 2026 · Analysed pypi/nauro@1.19.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | pypi |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | hatchling.build |
Background: Why install scripts are a supply-chain risk →
Dependencies 45 packages
| Packages resolved | 45 |
|---|---|
| Stale | 3 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
check_decision Check decision against existing decisions ~244
Check whether a proposed approach overlaps with existing decisions WITHOUT writing anything. Returns related decisions via BM25 keyword retrieval and a deterministic assessment string. This tool does NOT judge conflicts. Related hits carry their triage headers inline; before proposing, call `get_decision` (`mode=full`) on each decision you reason about. Consult before committing to any approach, especially on "should we / what if / can we / check if" asks. If no related decisions return and the choice should be recorded, follow this approval boundary before `propose_decision`: Present the complete add, update, or supersede draft as readable Markdown with related decisions, end the turn, and get explicit user approval from the user's next reply; the call commits immediately after validation.
| Name | Type | Req | Description |
|---|---|---|---|
| context | – | – | Optional context on why you're considering this approach. |
| cwd | – | – | Optional. Absolute working directory used to resolve the project when project_id is omitted. |
| project_id | – | – | Optional; auto-resolved for one project. With several, list ids via list_projects (hosted) or `nauro projects` (local). |
| proposed_approach | string | yes | Description of the approach you're considering. |
No output schema declared.
No examples provided.
diff_since_last_session Diff since last session ~129
Show what changed in the project context since the last snapshot. Omitting days diffs the two most recent snapshots (session-scoped); with days, diffs the nearest snapshot to N days ago against current state. Useful for catching up on other sessions or machines.
| Name | Type | Req | Description |
|---|---|---|---|
| cwd | – | – | Optional. Absolute working directory used to resolve the project when project_id is omitted. |
| days | – | – | Optional: days to look back. |
| project_id | – | – | Optional; auto-resolved for one project. With several, list ids via list_projects (hosted) or `nauro projects` (local). |
No output schema declared.
No examples provided.
flag_question Flag or resolve open question ~317
Flag an unresolved question for human review, or resolve existing questions against a decision. Writes to open-questions.md in the project store. To flag: pass `question`; if an existing decision already addresses it, the response hints at it (the question is still logged). To resolve: pass `resolved_by` and the entry ids in `targets`; each is stamped resolved and, when prose-safe, moved below `## Resolved`. Before resolving, read the cited decision. Verify that it is active and answers each question's operative ask; shared terms or topic overlap are not sufficient. A bulk close-out requires a complete question census and the recorded session-decision procedure. Pass exactly one of `question` or `resolved_by`.
| Name | Type | Req | Description |
|---|---|---|---|
| context | – | – | Optional context about why this question matters. |
| cwd | – | – | Optional. Absolute working directory used to resolve the project when project_id is omitted. |
| project_id | – | – | Optional; auto-resolved for one project. With several, list ids via list_projects (hosted) or `nauro projects` (local). |
| question | – | – | The question to flag; omit when passing resolved_by. |
| resolved_by | – | – | Decision id (e.g. D123) resolving the entries in targets; when set, the call resolves instead of appending. |
| targets | – | – | Question ids (Q### or legacy timestamp form). On flag: optional duplicate candidates - if any is already resolved, the call short-circuits without appending. On resolve: the entries to stamp; every i… |
| Name | Type | Req | Description |
|---|---|---|---|
| result | – | yes | – |
No examples provided.
get_context Get project context ~203
Return project context at the requested detail level. L0 (concise): summary, current state, top open questions, last 10 active decisions. L1 adds full bodies for recent decisions. L2 includes everything in the store. Payloads scale with the store: L1 is a bounded working set; L2 can run past 100k tokens. Default to L0 plus targeted get_decision lookups. Call at session start. Do NOT call list_decisions after get_context unless you need decisions beyond the last 10 or the include_superseded filter.
| Name | Type | Req | Description |
|---|---|---|---|
| cwd | – | – | Optional. Absolute working directory used to resolve the project when project_id is omitted. |
| level | – | – | Detail level: L0 (concise), L1 (working set), L2 (full dump). |
| project_id | – | – | Optional; auto-resolved for one project. With several, list ids via list_projects (hosted) or `nauro projects` (local). |
No output schema declared.
No examples provided.
get_decision Get decision by number ~184
Return a specific decision by its number. mode=header returns the triage frontmatter (status, supersession, date, type, confidence), the title, and a short rationale lede. mode=full (default) returns the complete markdown. Use header to triage decisions surfaced by search_decisions or list_decisions (check_decision hits already carry headers inline), then full for the ones you actually reason about.
| Name | Type | Req | Description |
|---|---|---|---|
| cwd | – | – | Optional. Absolute working directory used to resolve the project when project_id is omitted. |
| mode | string | – | header: triage projection; full: complete body. Default full. |
| number | integer | yes | Decision number (e.g., 23). |
| project_id | – | – | Optional; auto-resolved for one project. With several, list ids via list_projects (hosted) or `nauro projects` (local). |
No output schema declared.
No examples provided.
get_raw_file Read raw store file ~161
Return the raw markdown content of any file in the Nauro project store. A low-level escape hatch: prefer get_context for overview, get_decision for one decision, search_decisions for topics. Valid paths: project.md, state_current.md, stack.md, open-questions.md, decisions/042-some-decision.md
| Name | Type | Req | Description |
|---|---|---|---|
| cwd | – | – | Optional. Absolute working directory used to resolve the project when project_id is omitted. |
| path | string | yes | Path relative to store root (e.g. 'project.md', 'decisions/001-initial-architecture.md'). |
| project_id | – | – | Optional; auto-resolved for one project. With several, list ids via list_projects (hosted) or `nauro projects` (local). |
No output schema declared.
No examples provided.
list_decisions List decision history ~128
Browse the full decision history. Use for decisions beyond the last 10 in get_context or for the include_superseded filter; for topical lookups, prefer search_decisions.
| Name | Type | Req | Description |
|---|---|---|---|
| cwd | – | – | Optional. Absolute working directory used to resolve the project when project_id is omitted. |
| include_superseded | boolean | – | Include superseded decisions in the result. |
| limit | integer | – | Maximum decisions to return. |
| project_id | – | – | Optional; auto-resolved for one project. With several, list ids via list_projects (hosted) or `nauro projects` (local). |
No output schema declared.
No examples provided.
propose_decision Propose a decision ~622
Record an architectural decision. The write commits in a single call once structural validation passes. Similarity hits are advisory: returned on similar_decisions, never blocking the write. Present the complete add, update, or supersede draft as readable Markdown with related decisions, end the turn, and get explicit user approval from the user's next reply; the call commits immediately after validation. Never pair the draft with an approval prompt (AskUserQuestion) in the same turn - text before a tool call may never render. Prompt only once the draft is on screen from a prior turn. Arguments stay internal; show raw JSON only when debugging is requested. Use for approach choices, dependency swaps, new patterns, and scope cuts; include what was rejected and why.
| Name | Type | Req | Description |
|---|---|---|---|
| affected_decision_id | – | – | Required for update and supersede: the id (e.g. 'decision-042') being modified. |
| confidence | – | – | Author's confidence: 'high' only with explicit source approval; 'medium' best available; 'low' working assumption. |
| cwd | – | – | Optional. Absolute working directory used to resolve the project when project_id is omitted. |
| decision_type | – | – | Optional architectural category; omit when none applies cleanly. |
| files_affected | – | – | Optional repo-relative paths most affected, anchoring the decision to code. |
| operation | string | – | Pick the right `operation`: - `add` (default) - genuinely new ground. - `update` - rationale-only; needs `affected_decision_id`. The server rejects `title`, `confidence`, `decision_type`, `reversibil… |
| project_id | – | – | Optional; auto-resolved for one project. With several, list ids via list_projects (hosted) or `nauro projects` (local). |
| rationale | string | yes | Why this decision was made, including constraints and tradeoffs. |
| rejected | – | – | Alternatives considered and rejected. Each item needs a non-empty 'alternative' key (legacy alias: 'name') plus a 'reason'. |
| resolves_questions | – | – | When a proposal closes an open question, include its `[Q###]` id (legacy timestamp ids accepted) in `resolves_questions`. Named entries get a back-reference and, when prose-safe, move under `## Resol… |
| reversibility | – | – | Cost to reverse later: 'easy' = config or one-file change; 'moderate' = multi-day migration; 'hard' = major rework. |
| title | string | – | Short title for the decision. Required non-empty for add and supersede; omit for update, which appends rationale only and rejects a non-empty title. |
No output schema declared.
No examples provided.
search_decisions Search decisions ~169
Search all project decisions with BM25 ranking against titles and rationale. Active decisions by default; pass include_superseded=true to include superseded ones. More token-efficient than list_decisions for topical lookups. Returns number, title, date, status, and a relevance snippet; the query must be non-empty.
| Name | Type | Req | Description |
|---|---|---|---|
| cwd | – | – | Optional. Absolute working directory used to resolve the project when project_id is omitted. |
| include_superseded | boolean | – | Include superseded decisions in the result. |
| limit | integer | – | Maximum results to return. |
| project_id | – | – | Optional; auto-resolved for one project. With several, list ids via list_projects (hosted) or `nauro projects` (local). |
| query | string | yes | Search text (required, non-empty). |
No output schema declared.
No examples provided.
update_state Update project state ~140
Update the project's current state with a progress delta and trigger a snapshot. If the delta appears to repeat recent state entries, a warning returns (the update still applies). Use when you complete a meaningful unit of work so the next session starts with current context.
| Name | Type | Req | Description |
|---|---|---|---|
| cwd | – | – | Optional. Absolute working directory used to resolve the project when project_id is omitted. |
| delta | string | yes | Description of what changed (e.g. "Deployed v0.2.0 to staging"). |
| project_id | – | – | Optional; auto-resolved for one project. With several, list ids via list_projects (hosted) or `nauro projects` (local). |
| Name | Type | Req | Description |
|---|---|---|---|
| result | – | yes | – |
No examples provided.
What is the Nauro MCP server?
Nauro is an MCP server listed in the public MCP registry as ai.nauro/nauro. What every agent should know. This page covers its PyPI package (nauro).
Is the Nauro MCP server safe to use?
Nauro scores 64 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 21 September 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Nauro MCP server expose?
Nauro exposes 10 tools: get_context, get_raw_file, list_decisions, get_decision, diff_since_last_session, and 5 more. Their descriptions and schemas cost roughly 2,297 tokens of context every time the server is loaded.
Is the Nauro MCP server still maintained?
Nauro is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.