io.github.bea-technology/roxyon
NPM · @ROXYON/MCP · 2 COMPONENTS · SCANNED SEP 20
Build LumenJS apps, use the Roxyon BaaS, and deploy apps and web projects to Roxyon infrastructure.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 34 of 105 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency97
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to bea-technology/roxyon-devtools). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 15 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability84
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 1384 tokens (~72/item across 19 items; 15 tools + 4 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management60
- Stability observed for 18 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage84
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 51% of tool parameters carry a description.Partial
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "roxyon_deploy" implies "deploy" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 17 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the io.github.bea-technology/roxyon MCP server?
io.github.bea-technology/roxyon runs locally as an npm package, launched with npx -y @roxyon/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @roxyon/mcp
claude mcp add bea-technology-roxyon -- npx -y @roxyon/mcp
{
"mcpServers": {
"bea-technology-roxyon": {
"command": "npx",
"args": [
"-y",
"@roxyon/mcp"
]
}
}
} {
"servers": {
"bea-technology-roxyon": {
"command": "npx",
"args": [
"-y",
"@roxyon/mcp"
]
}
}
} codex mcp add bea-technology-roxyon -- npx -y @roxyon/mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"bea-technology-roxyon": {
"type": "local",
"command": [
"npx",
"-y",
"@roxyon/mcp"
],
"enabled": true
}
}
} openclaw mcp add bea-technology-roxyon --command npx --arg -y --arg @roxyon/mcp
mcp_servers:
bea-technology-roxyon:
command: "npx"
args: ["-y", "@roxyon/mcp"] {
"McpServers": {
"bea-technology-roxyon": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@roxyon/mcp"
]
}
}
} assistant mcp add bea-technology-roxyon -t stdio -c npx -a -y @roxyon/mcp
{
"mcpServers": {
"bea-technology-roxyon": {
"command": "npx",
"args": [
"-y",
"@roxyon/mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 57 to 60. That category is still filling its 30-day observation window: 17 days of observed history at the previous scan, 18 at this one. The score rises as the window fills, whether or not the server changes.
- 18 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 50 to 53. That category is still filling its 30-day observation window: 15 days of observed history at the previous scan, 16 at this one. The score rises as the window fills, whether or not the server changes.
- 16 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.
- 14 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 30 to 33. That category is still filling its 30-day observation window: 9 days of observed history at the previous scan, 10 at this one. The score rises as the window fills, whether or not the server changes.
- 10 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.
- 7 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.
- 5 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/@roxyon/mcp@0.3.0
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | bea-technology/roxyon-devtools |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/bea-technology/roxyon-devtools/.github/workflows/release.yml@refs/heads/main |
| Rekor log index | 2710876830 |
| Predicate type | https://slsa.dev/provenance/v1 |
| Subject digest | sha512:ceb8871fca13833f3c9469c77fbc399fc61c4ea4d02b588023dcba19731cd189ed6bb7ddcc267c95fd961a09939c724f4c866cc9fda7c6733052e7a0f |
Background: How many MCP packages publish verified provenance →
Dependencies 105 packages
| Packages resolved | 105 |
|---|---|
| Stale | 34 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
roxyon_add_domain Roxyon: add a subdomain / host ~130
Provision a host — DNS + web server + automatic HTTPS. The host must be a subdomain of a domain the account already hosts (or a *.roxyon.com subdomain). Returns while it is still coming up; TLS follows a minute or two later. Needs confirm:true.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | – |
| host | string | yes | The full hostname, e.g. promo.mycompany.com |
| spa | boolean | – | Single-page app: unmatched paths serve /index.html. |
| subscription | string | – | Which subscription to attach it to (omit if the account has one). |
No output schema declared.
No examples provided.
roxyon_app_status Roxyon: application status ~53
Current status, revisions and last error for an application (by id or project dir).
| Name | Type | Req | Description |
|---|---|---|---|
| application | string | – | – |
| dir | string | – | A project directory whose roxyon.json links an application. |
No output schema declared.
No examples provided.
roxyon_deploy Roxyon: deploy a project ~160
Build (if configured) and deploy the project in "dir" to Roxyon. Without confirm:true this returns a dry-run plan (what would build, where it would go, how many files). With confirm:true it runs the build, uploads, and — for app runtimes — waits for it to go live. Requires roxyon.json (run roxyon_init first).
| Name | Type | Req | Description |
|---|---|---|---|
| build | boolean | – | Run the configured build command (default true). |
| confirm | boolean | – | Actually deploy. Omit for a dry-run plan. |
| dir | string | yes | Absolute path to the project directory (must contain roxyon.json). |
| follow | boolean | – | For app runtimes, wait until running/failed (default true). |
No output schema declared.
No examples provided.
roxyon_deploy_content Roxyon: deploy generated files ~175
Publish a set of files you generated (HTML/CSS/JS/assets) to a host on the account. The host must already exist (roxyon_add_domain, or an existing site). Overlay by default — pass clean:true to replace the whole document root. Needs confirm:true. Limits: 60 files, 1024 KB per file, 2.0 MB total (base64-encode binaries).
| Name | Type | Req | Description |
|---|---|---|---|
| clean | boolean | – | Replace the whole docroot (keeps .well-known). |
| confirm | boolean | – | – |
| files | array | yes | – |
| folder | string | – | Sub-path under the host; "" = site root. |
| host | string | yes | Target host, e.g. promo.mycompany.com |
| spa | boolean | – | Also flip the host to SPA routing. |
No output schema declared.
No examples provided.
roxyon_env_get Roxyon: read environment variables ~34
An application's environment variables as KEY=value lines.
| Name | Type | Req | Description |
|---|---|---|---|
| application | string | – | – |
| dir | string | – | – |
No output schema declared.
No examples provided.
roxyon_env_set Roxyon: set environment variables ~93
Merge variables into an application's environment and bump its revision. Run roxyon_deploy afterwards to apply. Needs confirm:true. PORT and HOST are platform-managed and ignored.
| Name | Type | Req | Description |
|---|---|---|---|
| application | string | – | – |
| confirm | boolean | – | – |
| dir | string | – | – |
| remove | array | – | Keys to delete. |
| vars | object | yes | { KEY: "value", ... } to set. |
No output schema declared.
No examples provided.
roxyon_init Roxyon: initialise a project ~107
Detect a project's type and write roxyon.json. Run this once per project before roxyon_deploy. Does not create anything on the platform.
| Name | Type | Req | Description |
|---|---|---|---|
| dir | string | yes | Absolute path to the project directory. |
| folder | string | – | Sub-path under the host; "" = site root. |
| host | string | – | Deploy host (a domain on the subscription). |
| overwrite | boolean | – | Replace an existing roxyon.json. |
| runtime | string | – | – |
No output schema declared.
No examples provided.
roxyon_link_github Roxyon: connect a git remote ~99
Connect a git repository to an application for push-to-deploy. Returns the deploy key and webhook URL to add to the repo. Needs confirm:true.
| Name | Type | Req | Description |
|---|---|---|---|
| application | string | – | – |
| branch | string | – | Branch to deploy (default main). |
| confirm | boolean | – | – |
| dir | string | – | – |
| repoUrl | string | yes | SSH git URL, e.g. git@github.com:you/app.git |
No output schema declared.
No examples provided.
roxyon_list_apps Roxyon: list applications ~24
List the applications on the active subscription with their status and revision.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
roxyon_list_domains Roxyon: list hosts ~27
List the domains (hosts) on the active subscription — the possible deploy targets.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
roxyon_list_files Roxyon: list a site’s files ~49
The files currently deployed to a host's document root.
| Name | Type | Req | Description |
|---|---|---|---|
| folder | string | – | – |
| host | string | yes | – |
| path | string | – | List under this sub-path only. |
No output schema declared.
No examples provided.
roxyon_logs Roxyon: application logs ~51
Recent journal lines for an application (by id or project dir).
| Name | Type | Req | Description |
|---|---|---|---|
| application | string | – | – |
| dir | string | – | – |
| lines | integer | – | How many lines (default 100). |
No output schema declared.
No examples provided.
roxyon_read_file Roxyon: read a site file ~56
Read one file from a host's document root (to review or edit it).
| Name | Type | Req | Description |
|---|---|---|---|
| folder | string | – | – |
| host | string | yes | – |
| path | string | yes | Relative path, e.g. index.html |
No output schema declared.
No examples provided.
roxyon_restart Roxyon: restart an application ~43
Bounce the application process (no rebuild). Needs confirm:true.
| Name | Type | Req | Description |
|---|---|---|---|
| application | string | – | – |
| confirm | boolean | – | – |
| dir | string | – | – |
No output schema declared.
No examples provided.
roxyon_whoami Roxyon: who am I ~28
Show the signed-in Roxyon user and their subscriptions (which one is active).
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
What is the io.github.bea-technology/roxyon MCP server?
io.github.bea-technology/roxyon is an MCP server listed in the public MCP registry as io.github.bea-technology/roxyon. Build LumenJS apps, use the Roxyon BaaS, and deploy apps and web projects to Roxyon infrastructure. This page covers its npm package (@roxyon/mcp).
Is the io.github.bea-technology/roxyon MCP server safe to use?
io.github.bea-technology/roxyon scores 88 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.bea-technology/roxyon MCP server expose?
io.github.bea-technology/roxyon exposes 15 tools: roxyon_whoami, roxyon_list_domains, roxyon_list_apps, roxyon_init, roxyon_deploy, and 10 more. Their descriptions and schemas cost roughly 1,129 tokens of context every time the server is loaded.
Is the io.github.bea-technology/roxyon MCP server still maintained?
io.github.bea-technology/roxyon is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.bea-technology/roxyon MCP server under?
io.github.bea-technology/roxyon declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.