# Kotlin Library Sources (oci · ghcr.io/aoreshkov/kotlin-lib-mcp:0.4.0)

Exposes the public API, KDoc and sources of Maven-published Kotlin/Java libraries to MCP clients

- Trust score: 41/100 (low)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- oci · `ghcr.io/aoreshkov/kotlin-lib-mcp:0.4.0`: 41/100 (this document), [markdown](https://verifymcp.io/servers/aoreshkov-kotlin-lib-mcp/ghcr-io-aoreshkov-kotlin-lib-mcp-0-4-0.md), [page](https://verifymcp.io/servers/aoreshkov-kotlin-lib-mcp/ghcr-io-aoreshkov-kotlin-lib-mcp-0-4-0)

## Channel facts

- Registry: `oci`
- Package: `ghcr.io/aoreshkov/kotlin-lib-mcp:0.4.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 0/100
  - Malware scan not yet available for this package.
  - CVE data not yet available for this package.
  - Install-script risk not yet assessed.
  - Dependency-health data not yet available.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (Apache-2.0).
  - Actively maintained (last published 2 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 85/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1300 tokens (~130/item across 10 items; 10 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 2 categories.** Categories scored 0 because we could not verify them: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add aoreshkov-kotlin-lib-mcp -- docker run --rm -i ghcr.io/aoreshkov/kotlin-lib-mcp:0.4.0
```

### Codex

```bash
codex mcp add aoreshkov-kotlin-lib-mcp -- docker run --rm -i ghcr.io/aoreshkov/kotlin-lib-mcp:0.4.0
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "aoreshkov-kotlin-lib-mcp": {
      "type": "local",
      "command": [
        "docker",
        "run",
        "--rm",
        "-i",
        "ghcr.io/aoreshkov/kotlin-lib-mcp:0.4.0"
      ],
      "enabled": true
    }
  }
}
```

### Hermes

```yaml
mcp_servers:
  aoreshkov-kotlin-lib-mcp:
    command: "docker"
    args: ["run", "--rm", "-i", "ghcr.io/aoreshkov/kotlin-lib-mcp:0.4.0"]
```

### Other

```json
{
  "mcpServers": {
    "aoreshkov-kotlin-lib-mcp": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "ghcr.io/aoreshkov/kotlin-lib-mcp:0.4.0"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-01 (score 41, +32)

- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Schema quality: unverified → 100
- [functional improvement] Tool coverage: unverified → 100
- [functional] First check of Tool coverage: 100
- [functional] First check of Tool coverage: 100
- [functional] First check of Schema quality: fail
- [functional] First check of Schema quality: excellent
- [functional] First check of Schema quality: fail

### 2026-07-31 (score 9)

First indexed and scored.

## MCP tools (10)

### `fetch_library` (~170 tokens)

Fetch library sources

Download, extract and analyze the sources of a Maven-published Kotlin/Java library, warming the local cache. Idempotent — call this once per coordinate before using the other tools. The version may be omitted or set to 'latest' (e.g. 'io.ktor:ktor-client-core' or 'io.ktor:ktor-client-core:latest') to fetch the latest stable release — clients that support elicitation may ask the user to pick a version in that case. Returns a summary (resolved coordinate, KMP targets, file and package counts).

Input parameters:

- `coordinate` (string, required): Maven coordinate 'group:artifact:version', e.g. 'io.ktor:ktor-client-core:3.5.1'. The version may be omitted or 'latest' to resolve the latest stable release.

Output parameters:

- `coordinate`
- `fromCache` (boolean)
- `packageCount` (integer)
- `resolvedTargets` (array)
- `sourceFileCount` (integer)

### `list_packages` (~65 tokens)

List packages

List the packages discovered in a fetched library's sources, with declaration counts and the KMP targets each package appears in.

Input parameters:

- `coordinate` (string, required): Maven coordinate 'group:artifact:version', e.g. 'io.ktor:ktor-client-core:3.5.1'

Output parameters:

- `coordinate`
- `packages` (array)

### `list_declarations` (~190 tokens)

List declarations

List classes/interfaces/objects/functions/properties of a fetched library with signatures and visibility. Optionally filter by package and visibility (public [default], internal, or all). Results are paged ('truncated: true' with a 'totalCount' when more matched than the returned page; advance 'offset' to fetch the rest).

Input parameters:

- `coordinate` (string, required): Maven coordinate 'group:artifact:version', e.g. 'io.ktor:ktor-client-core:3.5.1'
- `maxResults` (integer): Page size, 1-500 (default 100)
- `offset` (integer): Number of matching declarations to skip for paging (default 0)
- `package` (string): Only declarations in this package, e.g. 'io.ktor.client'
- `visibility` (string): Visibility filter: 'public' (default), 'internal', or 'all'

Output parameters:

- `coordinate`
- `declarations` (array)
- `packageName`
- `totalCount` (integer)
- `truncated` (boolean)

### `get_api_signature` (~109 tokens)

Get API signature

Full resolved signature of one declaration by fully-qualified name: type parameters, parameters, return type, supertypes, modifiers. 'bestEffort: true' marks signatures recovered from raw source when type resolution was incomplete.

Input parameters:

- `coordinate` (string, required): Maven coordinate 'group:artifact:version', e.g. 'io.ktor:ktor-client-core:3.5.1'
- `fqName` (string, required): Fully-qualified declaration name, e.g. 'io.ktor.client.HttpClient'

Output parameters:

- `symbol`

### `get_kdoc` (~108 tokens)

Get KDoc

KDoc of one declaration by fully-qualified name: summary, description, and structured tags (@param, @return, @throws, @sample, …). 'kdoc: null' means the declaration is undocumented.

Input parameters:

- `coordinate` (string, required): Maven coordinate 'group:artifact:version', e.g. 'io.ktor:ktor-client-core:3.5.1'
- `fqName` (string, required): Fully-qualified declaration name, e.g. 'io.ktor.client.HttpClient'

Output parameters:

- `fqName` (string)
- `kdoc`

### `get_source` (~125 tokens)

Get source

Raw source of a whole file (by 'path', as returned by other tools, e.g. 'jvm/io/ktor/client/HttpClient.kt') or of a single declaration (by 'fqName'). Provide exactly one of the two.

Input parameters:

- `coordinate` (string, required): Maven coordinate 'group:artifact:version', e.g. 'io.ktor:ktor-client-core:3.5.1'
- `fqName` (string): Fully-qualified declaration name to slice out of its file
- `path` (string): Source file path relative to the extracted sources root

Output parameters:

- `content` (string)
- `path` (string)
- `startLine` (integer)

### `search_source` (~142 tokens)

Search sources

Search a fetched library's sources line by line and return file:line hits with a snippet. Substring match by default; set 'regex' for Kotlin regex syntax. Results are capped ('truncated: true' when more existed).

Input parameters:

- `coordinate` (string, required): Maven coordinate 'group:artifact:version', e.g. 'io.ktor:ktor-client-core:3.5.1'
- `maxResults` (integer): Result cap, 1-200 (default 50)
- `query` (string, required): Substring (default) or regex to search for
- `regex` (boolean): Treat 'query' as a regular expression (default false)

Output parameters:

- `hits` (array)
- `query` (string)
- `truncated` (boolean)

### `get_dependencies` (~103 tokens)

Get dependency tree

Dependency tree of a library parsed from its .pom/.module metadata: direct dependencies with scopes, optionally transitive to a bounded depth. Works without fetch_library (reads repository metadata, not sources).

Input parameters:

- `coordinate` (string, required): Maven coordinate 'group:artifact:version', e.g. 'io.ktor:ktor-client-core:3.5.1'
- `depth` (integer): Transitive resolution depth, 1-5 (default 1 = direct only)

Output parameters:

- `root`

### `list_versions` (~76 tokens)

List versions

List the published versions of an artifact from the repository's maven-metadata.xml. Accepts 'group:artifact' or a full 'group:artifact:version' coordinate (the version part is ignored). Works without fetch_library.

Input parameters:

- `coordinate` (string, required): Maven coordinate 'group:artifact' or 'group:artifact:version'

Output parameters:

- `artifact` (string)
- `group` (string)
- `versions` (array)

### `get_latest_version` (~122 tokens)

Get latest version

Resolve the latest version of an artifact from the repository's maven-metadata.xml. Accepts 'group:artifact' or a full 'group:artifact:version' coordinate (the version part is ignored). Returns the latest stable release plus the newest version overall (including pre-releases) and the total version count. Works without fetch_library.

Input parameters:

- `coordinate` (string, required): Maven coordinate 'group:artifact' or 'group:artifact:version'
- `includePreReleases` (boolean): Treat the newest pre-release as 'the latest' (default false)

Output parameters:

- `artifact` (string)
- `group` (string)
- `includedPreReleases` (boolean)
- `latest`
- `latestStable`
- `totalVersions` (integer)

## Diagnostics

Captured diagnostic sections: Provenance. The full working is on the page: https://verifymcp.io/servers/aoreshkov-kotlin-lib-mcp/ghcr-io-aoreshkov-kotlin-lib-mcp-0-4-0#diagnostics

## Score history

- 2026-08-03: 41
- 2026-08-02: 41
- 2026-08-01: 41
- 2026-07-31: 9

## Links

- Repository: https://github.com/aoreshkov/kotlin-lib-mcp
- Changelog RSS feed: https://verifymcp.io/servers/aoreshkov-kotlin-lib-mcp/ghcr-io-aoreshkov-kotlin-lib-mcp-0-4-0/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/aoreshkov-kotlin-lib-mcp/ghcr-io-aoreshkov-kotlin-lib-mcp-0-4-0/changelog.json
- HTML version of this page: https://verifymcp.io/servers/aoreshkov-kotlin-lib-mcp/ghcr-io-aoreshkov-kotlin-lib-mcp-0-4-0