Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Lumi App Finder

OCI · GHCR.IO/ALICE51849/LUMI-APP-FINDER:1.3.0 · 2 COMPONENTS

Find Lumi Studio iOS apps by task across all 50 Apple locales, with direct App Store links.

Available components

mcpb · lumi-app-finder.mcpb 65 oci · ghcr.io/alice51849/lumi-app-finder:1.3.0 0
0 this week 0 Trust /100

Last scanned (4 hours ago)

Scores higher than 0% of OCI servers

Category E-commerce

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security0
  • No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.Unverified
  • CVE check failed: an unpatched critical CVE affects this package; the score is capped at 0. See how to fix → View diagnostics → Fail
  • Install-script risk not yet assessed.Unverified
  • Dependency health could not be checked: this image's dependency list comes from an SBOM its publisher attached. It names packages and versions but not whether each is deprecated, still maintained or linked to its source, so there is nothing we can fairly grade.Unverified
Provenance & Transparency100
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to alice51849/lumi-mcp). View diagnostics → Pass
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 68 days ago).Pass
  • Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability79
  • AI-judged instruction clarity (excellent).Pass
  • Tool/resource definitions use about 153 tokens (~153/item across 1 items; 1 tools + 0 resources), lean.Pass
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
  • No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
  • Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 1 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 2 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
  • Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 1 Nov 26 0
    • Stability: 0.97 → pass security
  • 31 Oct 26 0
    • Stability: pass → 0.97 functional
  • 25 Oct 26 0
    • Stability: 0.97 → pass security
  • 24 Oct 26 0
    • Stability: pass → 0.97 functional
  • 18 Oct 26 0
    • Stability: 0.97 → pass security
  • 12 Oct 26 0
    • Source repository: unverified → pass ▲ security
  • 10 Oct 26 0
    • Provenance: pass → unverified ▼ security
  • 7 Oct 26 0
    • Stability: pass → 0.87 functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Analysed oci/ghcr.io/alice51849/lumi-app-finder:1.3.0

Provenance Verified

A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.

Result Verified
Ecosystem oci
Reason Verified
Discovered via OCI referrers API
Source repo alice51849/lumi-mcp
Certificate issuer https://token.actions.githubusercontent.com
Certificate SAN https://github.com/alice51849/lumi-mcp/.github/workflows/publish.yml@refs/tags/v1.3.0
Rekor log index 2624182102
Predicate type SLSA build provenance https://slsa.dev/provenance/v1
Subject digest sha256:4d73dda6cfbe267f2a976af59215b1a17985d8826107938bb2a162c9da2577ed

Background: How many MCP packages publish verified provenance →

Vulnerabilities 64 findings
ID CVE Severity Vector Fix available
DEBIAN-CVE-2022-27943 CVE-2022-27943 medium CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H no
DEBIAN-CVE-2026-102010 CVE-2026-102010 high CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H no
DEBIAN-CVE-2026-114690 CVE-2026-114690 medium CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H no
DEBIAN-CVE-2026-114691 CVE-2026-114691 medium CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H no
DEBIAN-CVE-2026-115455 CVE-2026-115455 medium CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H no
DEBIAN-CVE-2026-95619 CVE-2026-95619 high CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H no
DEBIAN-CVE-2010-4756 CVE-2010-4756 none no
DEBIAN-CVE-2018-20796 CVE-2018-20796 high CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H no
DEBIAN-CVE-2019-1010022 CVE-2019-1010022 critical CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H no
DEBIAN-CVE-2019-1010023 CVE-2019-1010023 high CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H no
DEBIAN-CVE-2019-1010024 CVE-2019-1010024 medium CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N no
DEBIAN-CVE-2019-1010025 CVE-2019-1010025 medium CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N no
DEBIAN-CVE-2019-9192 CVE-2019-9192 high CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H no
DEBIAN-CVE-2025-15281 CVE-2025-15281 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes
DEBIAN-CVE-2026-0861 CVE-2026-0861 high CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H yes
DEBIAN-CVE-2026-0915 CVE-2026-0915 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N yes
DEBIAN-CVE-2026-18374 CVE-2026-18374 medium CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L no
DEBIAN-CVE-2026-19499 CVE-2026-19499 high CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H no
DEBIAN-CVE-2026-19542 CVE-2026-19542 medium CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L no
DEBIAN-CVE-2026-4046 CVE-2026-4046 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes
DEBIAN-CVE-2026-4437 CVE-2026-4437 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes
DEBIAN-CVE-2026-4438 CVE-2026-4438 medium CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N yes
DEBIAN-CVE-2026-5435 CVE-2026-5435 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L no
DEBIAN-CVE-2026-5450 CVE-2026-5450 critical CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H no
DEBIAN-CVE-2026-5928 CVE-2026-5928 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H no
DEBIAN-CVE-2026-6238 CVE-2026-6238 medium CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L no
DEBIAN-CVE-2026-6368 CVE-2026-6368 none no
DEBIAN-CVE-2026-6791 CVE-2026-6791 none no
DEBIAN-CVE-2026-77117 CVE-2026-77117 medium CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H no
DEBIAN-CVE-2026-80489 CVE-2026-80489 medium CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H no
DEBIAN-CVE-2026-84243 CVE-2026-84243 high CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H no
DEBIAN-CVE-2026-8674 CVE-2026-8674 medium CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H no
DEBIAN-CVE-2026-86805 CVE-2026-86805 medium CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L no
DEBIAN-CVE-2026-89092 CVE-2026-89092 medium CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L no
DEBIAN-CVE-2026-95818 CVE-2026-95818 low CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N no
DEBIAN-CVE-2026-97399 CVE-2026-97399 low CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L no
DEBIAN-CVE-2025-27587 CVE-2025-27587 medium CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N no
DEBIAN-CVE-2026-28387 CVE-2026-28387 high CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H yes
DEBIAN-CVE-2026-28388 CVE-2026-28388 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes
DEBIAN-CVE-2026-28389 CVE-2026-28389 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes
DEBIAN-CVE-2026-28390 CVE-2026-28390 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes
DEBIAN-CVE-2026-31789 CVE-2026-31789 critical CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H yes
DEBIAN-CVE-2026-31790 CVE-2026-31790 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N yes
DEBIAN-CVE-2026-34180 CVE-2026-34180 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes
DEBIAN-CVE-2026-34182 CVE-2026-34182 critical CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N yes
DEBIAN-CVE-2026-35189 CVE-2026-35189 medium CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L yes
DEBIAN-CVE-2026-42766 CVE-2026-42766 medium CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H yes
DEBIAN-CVE-2026-42767 CVE-2026-42767 medium CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H yes
DEBIAN-CVE-2026-42770 CVE-2026-42770 low CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N yes
DEBIAN-CVE-2026-45445 CVE-2026-45445 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N yes

Showing 50 of 64 vulnerabilities.

Background: What a vulnerability scan can and cannot prove →

MCP tools · 1 exposed · ~112 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
find_ios_apps ~112

Search the transparent first-party Lumi Studio catalog for iPhone and iPad apps matching a task, app name, or buyer need. Returns editorially localized context, purchase model, detailed guide, and direct App Store links. Text relevance is not an independent ranking.

NameTypeReqDescription
limitinteger–Maximum number of text-relevance matches.
localestring–Apple locale for localized context and the matching storefront.
querystringyesThe task, app name, or buyer need, in any supported language.
NameTypeReqDescription
catalog_content_digeststringyes–
catalog_date_modifiedstringyes–
catalog_record_countintegeryes–
catalog_sourcestringyes–
catalog_source_urlstringyes–
disclosurestringyes–
localestringyes–
non_measured_disclosurestringyes–
querystringyes–
resultsarrayyes–

No examples provided.

Install

How do I install the Lumi App Finder MCP server?

Lumi App Finder runs locally as a container image, launched with docker run --rm -i ghcr.io/alice51849/lumi-app-finder:1.3.0. Ready-made configuration for Claude, Cursor, VS Code, Codex and 3 more is on this page, copied from each client's own documentation.

oci · ghcr.io/alice51849/lumi-app-finder:1.3.0

# add to Claude Code
claude mcp add alice51849-lumi-app-finder -- docker run --rm -i ghcr.io/alice51849/lumi-app-finder:1.3.0
Common questions

What is the Lumi App Finder MCP server?

Lumi App Finder is an MCP server listed in the public MCP registry as io.github.alice51849/lumi-app-finder. Find Lumi Studio iOS apps by task across all 50 Apple locales, with direct App Store links. This page covers its container image (ghcr.io/alice51849/lumi-app-finder:1.3.0).

What tools does the Lumi App Finder MCP server expose?

Lumi App Finder exposes 1 tool: find_ios_apps. Their descriptions and schemas cost roughly 112 tokens of context every time the server is loaded.

Is the Lumi App Finder MCP server still maintained?

Lumi App Finder is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the Lumi App Finder MCP server under?

Lumi App Finder declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.