io.github.barneywohl/hugging-bay
NPM · HUGGING-BAY-MCP · 2 COMPONENTS · SCANNED SEP 20
Verified open AI artifact search, trust evidence, downloads, and agent workflows from Hugging Bay.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency19
- Repository check failed: the declared repository URL returned HTTP 404. See how to fix → View diagnostics → Fail
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 9 days ago).Pass
- Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability71
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 5178 tokens (~50/item across 102 items; 102 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management93
- Stability observed for 28 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage68
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 3% of tool parameters carry a description.Partial
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "delete_saved_search" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 102 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the io.github.barneywohl/hugging-bay MCP server?
io.github.barneywohl/hugging-bay runs locally as an npm package, launched with npx -y hugging-bay-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · hugging-bay-mcp
claude mcp add barneywohl-hugging-bay -- npx -y hugging-bay-mcp
{
"mcpServers": {
"barneywohl-hugging-bay": {
"command": "npx",
"args": [
"-y",
"hugging-bay-mcp"
]
}
}
} {
"servers": {
"barneywohl-hugging-bay": {
"command": "npx",
"args": [
"-y",
"hugging-bay-mcp"
]
}
}
} codex mcp add barneywohl-hugging-bay -- npx -y hugging-bay-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"barneywohl-hugging-bay": {
"type": "local",
"command": [
"npx",
"-y",
"hugging-bay-mcp"
],
"enabled": true
}
}
} openclaw mcp add barneywohl-hugging-bay --command npx --arg -y --arg hugging-bay-mcp
mcp_servers:
barneywohl-hugging-bay:
command: "npx"
args: ["-y", "hugging-bay-mcp"] {
"McpServers": {
"barneywohl-hugging-bay": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"hugging-bay-mcp"
]
}
}
} assistant mcp add barneywohl-hugging-bay -t stdio -c npx -a -y hugging-bay-mcp
{
"mcpServers": {
"barneywohl-hugging-bay": {
"command": "npx",
"args": [
"-y",
"hugging-bay-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 18 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 17 Sept 26 −3
- Stability: pass → 0.83 functional
- 16 Sept 26 +1
- Stability: 0.97 → pass security
- 14 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 10 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 77 to 80. That category is still filling its 30-day observation window: 23 days of observed history at the previous scan, 24 at this one. The score rises as the window fills, whether or not the server changes.
- 9 Sept 26 −4
- Stability: pass → 0.77 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/hugging-bay-mcp@0.1.2
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 0 packages
| Packages resolved | 0 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
get_recommendations ~28
Return Hugging Bay catalog expansion facts, mirror candidates, scale totals, and pack summaries.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_release_bundle ~51
Fetch a launch-ready release bundle for labs and agents: publisher claim, same-as-upstream evidence, trust bundle, hosted files, local-run commands, and reviewed fallback readiness.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | – |
No output schema declared.
No examples provided.
get_release_readiness ~55
Fetch a compact release readiness score/checklist for a lab release: namespace, provenance, license, scans, signed manifests, hosted files, runtime guidance, community proof, and reviewed fallback status.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | – |
No output schema declared.
No examples provided.
get_review_queue ~54
Fetch prioritized artifacts that need community reviews, verified-run evidence, or benchmark reports.
| Name | Type | Req | Description |
|---|---|---|---|
| hosting | string | – | – |
| limit | number | – | – |
| maxReviews | number | – | – |
| mode | string | – | – |
No output schema declared.
No examples provided.
get_saved_search_digest ~67
Return a bounded live digest for one saved catalog watchlist, including artifact/card/file URLs and mirror-request actions. Requires HUGGING_BAY_TOKEN.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | – | Deprecated alias for searchId. |
| limit | number | – | – |
| searchId | string | yes | – |
No output schema declared.
No examples provided.
get_source_coverage ~34
Return one provider's source coverage, policy, rollups, and top imported records.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | – |
No output schema declared.
No examples provided.
get_source_request_status ~40
Fetch sanitized public status for one source indexing request.
| Name | Type | Req | Description |
|---|---|---|---|
| caseId | string | yes | – |
| id | string | – | Deprecated alias for caseId. |
No output schema declared.
No examples provided.
get_stack ~28
Fetch one Hugging Bay stack pack with bounded ranked artifact rows.
| Name | Type | Req | Description |
|---|---|---|---|
| slug | string | yes | – |
No output schema declared.
No examples provided.
get_topic ~25
Fetch one catalog topic and its ranked artifact rows.
| Name | Type | Req | Description |
|---|---|---|---|
| slug | string | yes | – |
No output schema declared.
No examples provided.
get_traffic ~34
Return privacy-safe aggregate Hugging Bay usage, hosted-download, mirror-request, product-action, and agent/crawler discovery signals.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_traffic_summary ~34
Fetch first-party traffic, hosted download, and mirror-demand telemetry. Requires HUGGING_BAY_TOKEN with admin role.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_trending ~43
Return public trending artifacts from aggregate pageview, hosted-download, mirror-request, and product-action signals.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | – |
| window | string | – | – |
No output schema declared.
No examples provided.
get_trust_bundle ~39
Fetch artifact trust evidence: license decision, scan status, hosting state, manifest key URL, and file evidence.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | – |
No output schema declared.
No examples provided.
get_upload_session ~47
Fetch upload-session status and optional live object-storage progress. Requires HUGGING_BAY_TOKEN with session owner/admin role.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | – |
| refresh | boolean | – | – |
No output schema declared.
No examples provided.
get_user_request_automation ~38
List recent user mirror/source requests plus large-mirror direct and reviewed-weight candidates. Requires HUGGING_BAY_TOKEN with admin role.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_admin_peer_fallbacks ~46
List pending peer fallback requests for admin review. Requires HUGGING_BAY_TOKEN with admin role.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | – |
| status | string | – | – |
No output schema declared.
No examples provided.
list_answer_packs ~32
List citation-ready Hugging Bay answer packs for AI search engines, agents, and common open AI artifact questions.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_downloadable_files ~76
List files actually hosted by Hugging Bay. External metadata rows are excluded.
| Name | Type | Req | Description |
|---|---|---|---|
| artifactId | string | – | – |
| limit | number | – | – |
| pack | string | – | – |
| path | string | – | – |
| q | string | – | – |
| sourceKind | string | – | – |
| tool | string | – | – |
No output schema declared.
No examples provided.
list_files ~52
List an artifact's files with bounded pagination.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | – |
| id | string | yes | – |
| limit | number | – | – |
| q | string | – | – |
| tool | string | – | – |
No output schema declared.
No examples provided.
list_import_runs ~42
List compact import runs for agent operators. Requires HUGGING_BAY_TOKEN with admin role.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | – |
| limit | number | – | – |
No output schema declared.
No examples provided.
list_indexing_urls ~130
Fetch bounded canonical URL batches by kind for indexing/submission workflows.
| Name | Type | Req | Description |
|---|---|---|---|
| commercial | boolean | – | – |
| cursor | string | – | – |
| format | string | – | – |
| hosting | string | – | – |
| kind | string | – | – |
| license | string | – | – |
| limit | number | – | – |
| q | string | – | – |
| reviewStatus | string | – | – |
| sort | string | – | – |
| source | string | – | – |
| tool | string | – | – |
| type | string | – | – |
| verified | boolean | – | – |
| worksWith | string | – | – |
No output schema declared.
No examples provided.
list_mirror_batches ~41
List durable reviewed mirror batches. Requires HUGGING_BAY_TOKEN with admin role.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | – |
| status | string | – | – |
No output schema declared.
No examples provided.
list_mirror_demand ~44
List requested and high-download mirror candidates for prioritizing what Hugging Bay should host next.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | – |
| requestedOnly | boolean | – | – |
No output schema declared.
No examples provided.
list_mirror_packs ~33
List curated Hugging Bay packs such as Downloadable Now, RAG embeddings, and commercial-use safe artifacts.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_mirrors ~21
List registered Hugging Bay mirror nodes and health state.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_publisher_api_keys ~32
List scoped publisher automation tokens visible to HUGGING_BAY_TOKEN.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | – |
No output schema declared.
No examples provided.
list_publishers ~42
List public publisher namespaces with artifact counts, hosted-file counts, claim state, and trust stats.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | – |
| q | string | – | – |
No output schema declared.
No examples provided.
list_saved_search_alerts ~49
List enabled saved-search alerts for HUGGING_BAY_TOKEN, including new matching artifacts since the last seen window.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | – |
| previewLimit | number | – | – |
No output schema declared.
No examples provided.
list_saved_searches ~51
List saved catalog searches/watchlists for HUGGING_BAY_TOKEN.
| Name | Type | Req | Description |
|---|---|---|---|
| alertLimit | number | – | – |
| alerts | string | – | Include bounded alert state. |
| previewLimit | number | – | – |
No output schema declared.
No examples provided.
list_stacks ~41
List practical Hugging Bay AI stack packs for RAG, local LLMs, agent tools, commercial-safe AI, verified downloads, and research/code discovery.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_topics ~24
List generated catalog topics by task, type, license, framework, and source.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
mark_review_helpful ~36
Mark a public artifact review as helpful with duplicate protection.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | – |
| reviewId | string | yes | – |
No output schema declared.
No examples provided.
plan_source_import ~154
Plan a resumable metadata-only source import using provider cursors. Requires HUGGING_BAY_TOKEN with admin role.
| Name | Type | Req | Description |
|---|---|---|---|
| arxiv | number | – | – |
| datacite | number | – | – |
| dataverse | number | – | – |
| github | number | – | – |
| modelscope | number | – | – |
| opencompass | number | – | – |
| opendatalab | number | – | – |
| openml | number | – | – |
| pack | string | – | – |
| pageSize | number | – | – |
| paperswithcode | number | – | – |
| query | string | – | – |
| source | string | – | – |
| targetRecords | number | – | – |
| zenodo | number | – | – |
No output schema declared.
No examples provided.
preview_file ~40
Preview one Hugging Bay-hosted text-like file with bounded text and optional row samples.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | – |
| path | string | yes | – |
No output schema declared.
No examples provided.
recommend_artifacts ~76
Return ranked artifacts for a concrete use case, with fit reasons, tool commands, hosted download links, and mirror actions.
| Name | Type | Req | Description |
|---|---|---|---|
| commercial | boolean | – | – |
| hosted | boolean | – | – |
| limit | number | – | – |
| q | string | – | – |
| tool | string | – | – |
| useCase | string | – | – |
No output schema declared.
No examples provided.
recover_mirror_batch ~65
Recover failed rows in a durable mirror batch by retrying, reopening for review, or marking reviewed failures as skipped. Requires HUGGING_BAY_TOKEN with admin role.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | – |
| id | string | yes | – |
| note | string | – | – |
No output schema declared.
No examples provided.
register_mirror ~48
Register a reviewed public mirror node. Requires HUGGING_BAY_TOKEN with admin role.
| Name | Type | Req | Description |
|---|---|---|---|
| endpoint | string | yes | – |
| name | string | yes | – |
| region | string | yes | – |
No output schema declared.
No examples provided.
report_review ~52
Report a public artifact review for moderation.
| Name | Type | Req | Description |
|---|---|---|---|
| evidence | string | – | – |
| id | string | yes | – |
| reason | string | – | – |
| reviewId | string | yes | – |
| summary | string | – | – |
No output schema declared.
No examples provided.
request_mirror ~90
Record mirror demand for an external Hugging Face artifact by artifact id.
| Name | Type | Req | Description |
|---|---|---|---|
| contact | string | – | – |
| desiredFiles | array | – | – |
| id | string | yes | – |
| query | string | – | – |
| ranking | string | – | – |
| sourceRoute | string | – | – |
| targetTool | string | – | – |
| topic | string | – | – |
| useCase | string | – | – |
No output schema declared.
No examples provided.
request_source_indexing ~73
Queue a missing supported upstream source URL or repo for Hugging Bay indexing and mirror review.
| Name | Type | Req | Description |
|---|---|---|---|
| contact | string | – | – |
| desiredFiles | array | – | – |
| repo | string | yes | – |
| source | string | – | – |
| targetTool | string | – | – |
| useCase | string | – | – |
No output schema declared.
No examples provided.
resolve_artifact ~62
Resolve an upstream repo URL, owner/name, or artifact id to a Hugging Bay artifact plus hosted download and mirror actions.
| Name | Type | Req | Description |
|---|---|---|---|
| q | string | – | – |
| repo | string | – | – |
| source | string | – | – |
| url | string | – | – |
No output schema declared.
No examples provided.
resume_upload_session ~39
Refresh signed PUT URLs for incomplete upload-session files. Requires HUGGING_BAY_TOKEN with session owner/admin role.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | – |
No output schema declared.
No examples provided.
revoke_publisher_api_key ~47
Revoke a scoped publisher automation token visible to HUGGING_BAY_TOKEN.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | – | Deprecated alias for keyId. |
| keyId | string | yes | – |
No output schema declared.
No examples provided.
run_hf_worker_batch ~57
Run a small metadata-only HF worker batch, optionally scoped to a run id. Requires HUGGING_BAY_TOKEN with admin role and enabled worker.
| Name | Type | Req | Description |
|---|---|---|---|
| maxPages | number | – | – |
| runId | string | – | – |
No output schema declared.
No examples provided.
run_mirror_batch ~55
Dry-run or execute an approved durable mirror batch. Requires HUGGING_BAY_TOKEN with admin role.
| Name | Type | Req | Description |
|---|---|---|---|
| dryRun | boolean | – | – |
| id | string | yes | – |
| stopOnFailure | boolean | – | – |
No output schema declared.
No examples provided.
run_mirror_queue_batch ~69
Run a bounded reviewed mirror queue batch using exact selected useful files. Requires HUGGING_BAY_TOKEN with admin role.
| Name | Type | Req | Description |
|---|---|---|---|
| dryRun | boolean | – | – |
| limit | number | – | – |
| maxPlannedBytes | number | – | – |
| targetHostedFiles | number | – | – |
No output schema declared.
No examples provided.
run_source_import ~189
Run metadata-only source import from ModelScope, GitHub, arXiv, OpenML, Zenodo, Dataverse, DataCite, Papers with Code, OpenDataLab, and/or OpenCompass. Requires HUGGING_BAY_TOKEN with admin role.
| Name | Type | Req | Description |
|---|---|---|---|
| arxiv | number | – | – |
| datacite | number | – | – |
| dataverse | number | – | – |
| dryRun | boolean | – | – |
| github | number | – | – |
| limit | number | – | – |
| modelscope | number | – | – |
| opencompass | number | – | – |
| opendatalab | number | – | – |
| openml | number | – | – |
| pack | string | – | – |
| paperswithcode | number | – | – |
| query | string | – | – |
| source | string | – | – |
| strict | boolean | – | – |
| zenodo | number | – | – |
No output schema declared.
No examples provided.
run_source_worker_batch ~54
Run a scoped metadata-only source worker batch. Requires HUGGING_BAY_TOKEN with admin role.
| Name | Type | Req | Description |
|---|---|---|---|
| maxErrors | number | – | – |
| maxPages | number | – | – |
| runId | string | – | – |
No output schema declared.
No examples provided.
save_saved_search ~125
Save a durable catalog watchlist with filters, sort, browser path, and agent-ready API path for HUGGING_BAY_TOKEN.
| Name | Type | Req | Description |
|---|---|---|---|
| alert | object | – | – |
| delivery | object | – | – |
| filters | object | – | – |
| id | string | – | – |
| label | string | – | – |
| notificationsEnabled | boolean | – | – |
| resultCount | number | – | – |
| route | string | – | – |
| searchId | string | – | Stable saved-search id. Alias of id for clients that use searchId consistently. |
| sortKey | string | – | – |
No output schema declared.
No examples provided.
search_artifacts ~128
Search the bounded public catalog summary API with optional semantic reranking.
| Name | Type | Req | Description |
|---|---|---|---|
| commercial | string | – | – |
| cursor | string | – | – |
| explain | string | – | – |
| format | string | – | – |
| framework | string | – | – |
| hosting | string | – | – |
| license | string | – | – |
| limit | number | – | – |
| q | string | – | – |
| reviewStatus | string | – | – |
| semantic | string | – | – |
| sort | string | – | – |
| source | string | – | – |
| task | string | – | – |
| type | string | – | – |
No output schema declared.
No examples provided.
What is the io.github.barneywohl/hugging-bay MCP server?
io.github.barneywohl/hugging-bay is an MCP server listed in the public MCP registry as io.github.barneywohl/hugging-bay. Verified open AI artifact search, trust evidence, downloads, and agent workflows from Hugging Bay. This page covers its npm package (hugging-bay-mcp).
Is the io.github.barneywohl/hugging-bay MCP server safe to use?
io.github.barneywohl/hugging-bay scores 74 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.barneywohl/hugging-bay MCP server expose?
io.github.barneywohl/hugging-bay exposes 102 tools: get_health, get_catalog_coverage, get_open_source_radar, get_trending, get_traffic, and 97 more. Their descriptions and schemas cost roughly 5,178 tokens of context every time the server is loaded.
Is the io.github.barneywohl/hugging-bay MCP server still maintained?
io.github.barneywohl/hugging-bay is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.barneywohl/hugging-bay MCP server under?
io.github.barneywohl/hugging-bay declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.