supragnosis
OCI · GHCR.IO/ASHON/SUPRAGNOSIS
Memory for AI agents that remembers who said it.
Available components
Last scanned (23 hours ago)
Scores higher than 64% of OCI servers
Category Memory and Knowledge
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security0
- No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.Unverified
- Known CVEs could not be checked: this artifact ships no SBOM or dependency manifest, so there is no dependency list to read.Unverified
- Install-script risk not yet assessed.Unverified
- Dependency health could not be checked: this artifact ships no SBOM or dependency manifest, so there is no dependency list to read.Unverified
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT OR Apache-2.0).Pass
- Actively maintained (last published 6 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability76
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 3294 tokens (~193/item across 17 items; 13 tools + 4 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management25
- Stability check failed: the tool surface changed between 0.10.3 and 0.11.0: 0 tool removals, 3 breaking changes, 0 additions. See how to fix → Fail
Tool Coverage98
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 93% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 13 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 15 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 22 to 25.
- 2 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 15 to 18.
- 31 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 8 to 12.
- 29 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 2 to 5.
- 28 Oct 26 −1
- Tool safety: pass → unverified ▼ security
- Stability: 0.10 → unverified ▼ security
- Stability: 0.10 → fail ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: 100 → unverified ▼ functional
- Package version: 0.10.3 → 0.11.0 functional
- 26 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.
- 24 Oct 26 41
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Nov 2026 · Analysed oci/ghcr.io/ashon/supragnosis@0.11.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | oci |
| Reason | No attestation published |
Background: How many MCP packages publish verified provenance →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
define_type ~205
Define ontology types (T-Box) for a workspace: give an entity type or relation type a name and a natural-language definition of what it means. Use this to record the vocabulary of the ontology so a type is not just a bare label but has a stated meaning (e.g. entity type 'Driver' = 'a kernel module that ...'; relation type 'depends_on' = 'X requires Y at runtime'). A description is required. Scoped to the workspace. Read them back via the supragnosis://workspace/{ws}/types resource.
| Name | Type | Req | Description |
|---|---|---|---|
| defs | array | yes | The type definitions to record (at least one). |
| on_behalf_of | string|null | – | (Optional) Delegation subject this agent acts on behalf of. |
| source_ref | string|null | – | Source reference (file path/URL/tool, etc.). |
| workspace | string | yes | The workspace whose vocabulary this is, named as for observe. The T-Box is scoped to the workspace. |
No output schema declared.
No examples provided.
get_entity ~31
Look up an entity and its relations/provenance by entity id.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Entity id. |
No output schema declared.
No examples provided.
get_proposal ~129
Get one proposal's folded state (kind/targets/into/rationale/state/verdicts/workspace) by id, with its belief diff and checks, read in the workspace it lives in; a merged claim_promotion also carries granted_tier, the tier it granted. A tbox_change or a recall carries no_effect_yet: its kind has no commit effect yet, so it cannot be merged.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | The proposal id. |
| workspace | string|null | – | Scope to a workspace (when omitted or '*', the proposal is read in the workspace it lives in). |
No output schema declared.
No examples provided.
list_proposals ~121
List proposals in a workspace (newest first) with their folded state (open/blocked/merged/rejected/withdrawn), kind, targets, verdict count and the workspace each lives in; a merged claim_promotion also carries granted_tier, the tier it granted. A verdict counts only in its proposal's workspace. A tbox_change or a recall carries no_effect_yet: its kind has no commit effect yet, so it cannot be merged.
| Name | Type | Req | Description |
|---|---|---|---|
| workspace | string|null | – | Scope to a workspace (all workspaces when omitted or '*'). |
No output schema declared.
No examples provided.
observe ~370
Ingest a knowledge fragment - how anything new enters the graph. Stores it as an immutable observation (the source of truth: superseded later, never edited or deleted) and links the entities and relations you extracted alongside it into the ontology. Use it as facts, decisions and the reasons behind them come up; to reshape knowledge that is already stored - merging duplicates, changing trust, retracting - use `propose` instead. Returns the observation id, the linked entity/relation ids and the workspace written to; a write that makes a new workspace adds a note naming the ones that hold knowledge.
| Name | Type | Req | Description |
|---|---|---|---|
| confidence | number|null | – | Confidence 0.0-1.0. If omitted, it is preserved as unspecified (no default substitution) - omit it when you cannot assess it. Out-of-range values are rejected on ingest. |
| content | string | yes | Knowledge fragment to ingest (natural language or structured text). |
| derived_from | array | – | (Optional) Ids of the observations this knowledge was derived from: the records you read that shaped it. Lineage, for contamination tracking. |
| entities | array | – | (Optional) Entities extracted by the client. |
| on_behalf_of | string|null | – | (Optional) Delegation subject - the person/principal this agent acts on behalf of (e.g. "ashon"). |
| relations | array | – | (Optional) Relations extracted by the client. |
| source_ref | string|null | – | Source reference (file path/URL/tool, etc.). |
| workspace | string | yes | The workspace this fragment belongs to. Name it after the project you work in - the repository's name, also from a git worktree, never the worktree's directory - and keep using that name, so one proj… |
No output schema declared.
No examples provided.
propose ~833
Open a proposal to change the canon - the one path by which anything enters shared knowledge. Use it to reshape what is already there rather than to add: entity_merge and entity_split for identity, claim_promotion and claim_demotion for trust, tbox_change for the type vocabulary, recall for retracting a contaminated derivation tree - those two have no commit effect yet, so neither can be merged until it has one. To state something new, use `observe` instead. A proposal is itself an observation and changes nothing until `review` accepts it; `get_proposal` shows where it stands, and `kind` describes what each one does and which arguments it needs. Returns the proposal id, the workspace, its state and found - true when an identical proposal was already there, since a proposal is its content - with a note saying what is left.
| Name | Type | Req | Description |
|---|---|---|---|
| affected_types | array | – | For tbox_change: the entity/relation types this proposal defines or changes, so the viewer can highlight the affected nodes (entity types) / edges (relation types) when previewing it. Each item is {t… |
| into | string|null | – | For entity_merge: the canonical target id the other targets fold into (must be one of targets). |
| kind | string | yes | Proposal kind, one of: - `entity_merge` - fold duplicate entities into one canonical id. - `entity_split` - reverse a merge. The folded entities separate again and the pair stops being suggested fo… |
| on_behalf_of | string|null | – | – |
| rationale | string|null | – | Why (natural language) - the proposal rationale. Required to re-merge a pair that was split: a proposal is its content, so a verbatim re-open is the same proposal and stays reversed. Say what makes t… |
| source_ref | string|null | – | – |
| targets | array | yes | Entity/observation ids the proposal acts on (get them from the Review/curation signals or a search hit). For entity_merge an entity may also be named by its name in the workspace; it is stored as its… |
| tier | string|null | – | For claim_promotion/claim_demotion: the requested trust tier - unverified | agent_extracted | host_signed | human_confirmed. Required for those kinds; targets are then OBSERVATION ids. Note: a verdic… |
| workspace | string | yes | The workspace the proposal acts in, the one its targets live in. |
No output schema declared.
No examples provided.
review ~262
Cast a verdict on a proposal. decision is merge (accept), reject, comment, or withdraw. In a single-user workspace the verdict is self-attested. The state is a deterministic fold of the events; a merge is the absorbing outcome. A claim_promotion merged through this agent surface grants at most host_signed - promotion to human_confirmed is the person's own act in the Supragnosis app: never cast it yourself, by this tool or any other way. A merge on a recall is refused here for the same reason, and a merge on a tbox_change or a recall is refused on every surface while the kind has no commit effect; comment, reject and withdraw are accepted. Returns the recorded observation id and the workspace it was filed in, the proposal's own.
| Name | Type | Req | Description |
|---|---|---|---|
| decision | string | yes | Verdict/action: merge | reject | comment | withdraw. |
| note | string|null | – | Optional note/comment. |
| on_behalf_of | string|null | – | – |
| proposal | string | yes | The proposal id (from propose / list_proposals). |
| workspace | string|null | – | The proposal's workspace, where the verdict is filed and counts. On this node it may be left out, or '*', and the proposal's own is used. |
No output schema declared.
No examples provided.
search_knowledge ~209
Search knowledge (entities/observations). The response mode reports the surface actually used: hybrid (semantic+keyword) or keyword (keyword-only degrade - an empty result in this mode may be a recall failure). score is for rank comparison only - its scale differs per mode, so the absolute value is not a confidence.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer|null | – | Maximum number of results (defaults to 20 when omitted). |
| query | string | yes | Search query. |
| scope | string|null | – | Search scope: "local" (this node only, default), "remote" (the configured sync servers' ontologies - federated retrieval), or "both". Local state can lag the remote store - use remote/both when a loc… |
| workspace | string|null | – | Scope to a workspace (all workspaces when omitted). |
No output schema declared.
No examples provided.
sync_pull ~62
Pull the workspace's missing knowledge from the configured sync servers and apply it (verify signatures -> dedup/absorb -> re-materialize the projection). Returns per-server accepted/rejected counts.
| Name | Type | Req | Description |
|---|---|---|---|
| workspace | string|null | – | Workspace to pull (node default when omitted). |
No output schema declared.
No examples provided.
sync_push ~74
Push the workspace's local knowledge to the configured sync servers (backfill-stamp unstamped attestations, then send what each server lacks per its advertised version vector). Only share-whitelisted workspaces leave this node.
| Name | Type | Req | Description |
|---|---|---|---|
| workspace | string|null | – | Workspace to push (node default when omitted; must be on the share whitelist). |
No output schema declared.
No examples provided.
sync_status ~168
Federation sync status of this node: node id, public key, share whitelist, configured sync servers, the workspace's version vector (what this node holds per origin), `config_notes` (federation configuration this build worked around rather than obeyed - read these, they are the reason something is not syncing), and `negotiated` - what each host last said this node may reach, as a three-way difference against the share whitelist (`both` / `local_only` = listed here but not admitted there, a setup error / `peer_only` = admitted there but not shared here). A host with state `unknown` has not answered yet; that is not an empty grant set. Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| workspace | string|null | – | Workspace to report (node default when omitted). |
No output schema declared.
No examples provided.
traverse ~135
Traverse the graph from an entity, following relation direction (from->to). Returns the entities reachable within the maximum hops (max_depth), along with their shortest distance. Reachability runs THROUGH a relation endpoint that no entity row describes yet (partial ingest), but such an endpoint is not listed - so a hit can sit deeper than any listed neighbor. That gap is unknown, not a missing edge.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Start entity id. |
| limit | integer|null | – | Maximum number of results (defaults to 100 when omitted). |
| max_depth | integer|null | – | Maximum number of hops (defaults to 3 when omitted). |
No output schema declared.
No examples provided.
workspace_map ~233
Survey a workspace's main co-occurrence contexts (hyperedges - the set of entities asserted together in a single observation). For cold-start orientation: before searching, grasp by name 'what is here and in what clusters'. Clusters are sorted by size (number of co-occurring entities) and sources is the number of supporting observations. This is a directional signal, not an asserted relation - confirm actual relations/details with search_knowledge/get_entity. To solidify a recurring context into first-class structure, observe a group entity (e.g. type Context) with member_of relations from each member and derived_from listing the co-asserting observation ids - the assertion then carries provenance and trust like any other edge.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer|null | – | Maximum number of clusters (defaults to 20 when omitted). Truncated in descending order of size. |
| min_size | integer|null | – | Minimum cluster size = number of co-occurring entities (defaults to 2 when omitted). Values of 3 or more exclude trivial pairs. |
| workspace | string|null | – | Scope to a workspace (all workspaces when omitted or '*'). |
No output schema declared.
No examples provided.
How do I install the supragnosis MCP server?
supragnosis runs locally as a container image, launched with docker run --rm -i ghcr.io/ashon/supragnosis:0.11.0. Ready-made configuration for Claude, Cursor, VS Code, Codex and 3 more is on this page, copied from each client's own documentation.
oci · ghcr.io/ashon/supragnosis
claude mcp add ashon-supragnosis -- docker run --rm -i ghcr.io/ashon/supragnosis:0.11.0
What is the supragnosis MCP server?
supragnosis is an MCP server listed in the public MCP registry as io.github.Ashon/supragnosis. Memory for AI agents that remembers who said it. This page covers its container image (ghcr.io/ashon/supragnosis).
Is the supragnosis MCP server safe to use?
supragnosis scores 45 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the supragnosis MCP server expose?
supragnosis exposes 13 tools: define_type, get_entity, get_proposal, list_proposals, observe, and 8 more. Their descriptions and schemas cost roughly 2,832 tokens of context every time the server is loaded.
Is the supragnosis MCP server still maintained?
supragnosis is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the supragnosis MCP server under?
supragnosis declares the MIT OR Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.