io.github.bea-technology/roxyon
NPM · @ROXYON/MCP · 2 COMPONENTS
Build LumenJS apps, use the Roxyon BaaS, and deploy apps and web projects to Roxyon infrastructure.
Available components
Last scanned (21 hours ago)
Scores higher than 92% of npm servers
Category Cloud Infrastructure
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security81
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects zod 3.25.76, a direct dependency. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 33 of 102 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency97
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to bea-technology/roxyon-devtools). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 1 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability82
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 3455 tokens (~88/item across 39 items; 34 tools + 5 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage82
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 45% of tool parameters carry a description.Partial
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 7 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "roxyon_deploy" implies "deploy" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 36 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 25 Oct 26 +1
- Stability: 0.97 → pass security
- 24 Oct 26 −6
- CVE-2023-54404 affects this package: high ▼ security
- Known CVEs: pass → fail ▼ security
- Stability: pass → 0.97 functional
- 19 Oct 26 0
- Security disclosure: unverified → fail ▼ functional
- 18 Oct 26 +1
- Stability: 0.97 → pass security
- Schema quality: 77 → 88 ▼ functional
- Security disclosure: fail → unverified ▼ functional
- Package version: 0.4.0 → 0.7.0 functional
- 16 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Oct 26 −3
- Security disclosure: unverified → fail ▼ functional
- Stability: pass → 0.80 functional
- 11 Oct 26 0
- Security disclosure: fail → unverified ▼ functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Nov 2026 · Analysed npm/@roxyon/mcp@0.7.0
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | bea-technology/roxyon-devtools |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/bea-technology/roxyon-devtools/.github/workflows/release.yml@refs/heads/main |
| Rekor log index | 3294620442 |
| Predicate type | SLSA build provenance https://slsa.dev/provenance/v1 |
| Subject digest | sha512:796665c2af986569b92179892017af5389d615a2552eca2c8fe3813e4bd55fb7ccd0198201cc71448a0967f5badb94f2c9166900811547bbf47d59fba |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 1 finding
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-mrhx-c7xc-m3w5 | CVE-2023-54404 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 102 packages
| Packages resolved | 102 |
|---|---|
| Stale | 33 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
roxyon_add_domain Roxyon: add a subdomain / host ~162
Provision a host — DNS + web server + automatic HTTPS. The host must be a subdomain of a domain the account already hosts (or a *.roxyon.com subdomain). Returns while it is still coming up; TLS follows a minute or two later. Needs confirm:true.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | – |
| host | string | yes | The full hostname, e.g. promo.mycompany.com |
| phpVersion | string | – | PHP version for the vhost, e.g. "8.3" (needed to run PHP apps like WordPress). |
| spa | boolean | – | Single-page app: unmatched paths serve /index.html. |
| subscription | string | – | Which subscription to attach it to (omit if the account has one). |
No output schema declared.
No examples provided.
roxyon_app_status Roxyon: application status ~53
Current status, revisions and last error for an application (by id or project dir).
| Name | Type | Req | Description |
|---|---|---|---|
| application | string | – | – |
| dir | string | – | A project directory whose roxyon.json links an application. |
No output schema declared.
No examples provided.
roxyon_baas_batch Roxyon BaaS: batch of record requests ~137
1 to 50 record requests in one call, each answered on its own (one failing doesn't stop the others). path is /Class or /Class/<objectId>; for POST/PUT the body is {"data":{...}}; for GET the body holds query options (where, fields, limit…). A batch with any write needs confirm:true. Runs as the app backend (server scope, which passes every class rule). Local MCP only.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | – |
| dir | string | – | Project directory whose .env holds RX_SECRET_KEY. Defaults to cwd. |
| requests | array | yes | – |
No output schema declared.
No examples provided.
roxyon_baas_create Roxyon BaaS: create a record ~117
Insert one record into an existing class (V2 has no schema changes with a secret key: add classes and columns in the console). For relations store the other row's objectId in a string column. Needs confirm:true. Runs as the app backend (server scope, which passes every class rule). Local MCP only.
| Name | Type | Req | Description |
|---|---|---|---|
| class | string | yes | – |
| confirm | boolean | – | – |
| data | object | yes | – |
| dir | string | – | Project directory whose .env holds RX_SECRET_KEY. Defaults to cwd. |
No output schema declared.
No examples provided.
roxyon_baas_delete Roxyon BaaS: delete a record ~84
Delete one record by objectId. Needs confirm:true. Runs as the app backend (server scope, which passes every class rule). Local MCP only.
| Name | Type | Req | Description |
|---|---|---|---|
| class | string | yes | – |
| confirm | boolean | – | – |
| dir | string | – | Project directory whose .env holds RX_SECRET_KEY. Defaults to cwd. |
| objectId | string | yes | – |
No output schema declared.
No examples provided.
roxyon_baas_get Roxyon BaaS: read one record ~73
Read one record by objectId. Runs as the app backend (server scope, which passes every class rule). Local MCP only.
| Name | Type | Req | Description |
|---|---|---|---|
| class | string | yes | – |
| dir | string | – | Project directory whose .env holds RX_SECRET_KEY. Defaults to cwd. |
| objectId | string | yes | – |
No output schema declared.
No examples provided.
roxyon_baas_query Roxyon BaaS: query records ~188
Read records of a class in the project's own app on BaaS V2. `where` is an object like {"Status":"active","Age":{"gt":18}}; for `in`, pass a comma-joined string. `fields` defaults to "*"; built-in meta columns must be named. Up to 200 rows a page (use skip to page). Runs as the app backend (server scope, which passes every class rule). Local MCP only.
| Name | Type | Req | Description |
|---|---|---|---|
| class | string | yes | – |
| count | boolean | – | Also return the total number of matches. |
| dir | string | – | Project directory whose .env holds RX_SECRET_KEY. Defaults to cwd. |
| fields | string | – | – |
| limit | integer | – | – |
| order | string | – | e.g. "-createdAt" |
| skip | integer | – | – |
| where | object | – | – |
No output schema declared.
No examples provided.
roxyon_baas_update Roxyon BaaS: update a record ~93
Set fields on one record by objectId. Needs confirm:true. Runs as the app backend (server scope, which passes every class rule). Local MCP only.
| Name | Type | Req | Description |
|---|---|---|---|
| class | string | yes | – |
| confirm | boolean | – | – |
| data | object | yes | – |
| dir | string | – | Project directory whose .env holds RX_SECRET_KEY. Defaults to cwd. |
| objectId | string | yes | – |
No output schema declared.
No examples provided.
roxyon_catalog Roxyon: product catalog ~156
List what Roxyon sells: cloud servers (cloud.vps.launch / scale / power) and web hosting (cloud.hosting.solo / multiple / isolated). Each product has its planId (what roxyon_quote takes), SKU, specs (vCPU, RAM GB, disk GB, IPv4 included) for servers, list prices in USD per billing cycle BEFORE tax and currency conversion, and stock ("out" = cannot be ordered now). No sign-in needed. Use roxyon_quote for the exact amount a buyer would pay. Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | Filter by category prefix, e.g. "cloud.vps" or "cloud.hosting". |
| in_stock_only | boolean | – | – |
No output schema declared.
No examples provided.
roxyon_database_create Roxyon: create a database ~122
Provision a MySQL/MariaDB database + user. The name is prefixed with the account's own username (globally unique across the shared cluster) — pass just the suffix, e.g. "wordpress". The password is shown once in the result; there is no way to retrieve it later. Needs confirm:true.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | – |
| name | string | yes | DB name suffix: lowercase letters, digits, underscore. |
| password | string | – | Omit to have Roxyon generate one. |
| subscription | string | – | – |
No output schema declared.
No examples provided.
roxyon_database_delete Roxyon: delete a database ~51
Delete a database by its objectId (from roxyon_database_create/roxyon_list_databases). Needs confirm:true.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | – |
| database | string | yes | – |
No output schema declared.
No examples provided.
roxyon_deploy Roxyon: deploy a project ~160
Build (if configured) and deploy the project in "dir" to Roxyon. Without confirm:true this returns a dry-run plan (what would build, where it would go, how many files). With confirm:true it runs the build, uploads, and — for app runtimes — waits for it to go live. Requires roxyon.json (run roxyon_init first).
| Name | Type | Req | Description |
|---|---|---|---|
| build | boolean | – | Run the configured build command (default true). |
| confirm | boolean | – | Actually deploy. Omit for a dry-run plan. |
| dir | string | yes | Absolute path to the project directory (must contain roxyon.json). |
| follow | boolean | – | For app runtimes, wait until running/failed (default true). |
No output schema declared.
No examples provided.
roxyon_deploy_content Roxyon: deploy generated files ~175
Publish a set of files you generated (HTML/CSS/JS/assets) to a host on the account. The host must already exist (roxyon_add_domain, or an existing site). Overlay by default — pass clean:true to replace the whole document root. Needs confirm:true. Limits: 60 files, 1024 KB per file, 2.0 MB total (base64-encode binaries).
| Name | Type | Req | Description |
|---|---|---|---|
| clean | boolean | – | Replace the whole docroot (keeps .well-known). |
| confirm | boolean | – | – |
| files | array | yes | – |
| folder | string | – | Sub-path under the host; "" = site root. |
| host | string | yes | Target host, e.g. promo.mycompany.com |
| spa | boolean | – | Also flip the host to SPA routing. |
No output schema declared.
No examples provided.
roxyon_email_create Roxyon: create a mailbox ~129
Provision a mailbox on a host already on the account. The password is shown once in the result; there is no way to retrieve it later. Needs confirm:true.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | – |
| domain | string | yes | A hostname already on the account. |
| forwardTo | string | – | – |
| localPart | string | yes | The part before @, e.g. "info". |
| password | string | – | Omit to have Roxyon generate one. |
| quota | integer | – | Quota in MB (default 1024). |
| saveCopy | boolean | – | – |
No output schema declared.
No examples provided.
roxyon_email_delete Roxyon: delete a mailbox ~51
Delete a mailbox by its objectId (from roxyon_email_create/roxyon_list_emails). Needs confirm:true.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | – |
| string | yes | – |
No output schema declared.
No examples provided.
roxyon_env_get Roxyon: read environment variables ~34
An application's environment variables as KEY=value lines.
| Name | Type | Req | Description |
|---|---|---|---|
| application | string | – | – |
| dir | string | – | – |
No output schema declared.
No examples provided.
roxyon_env_set Roxyon: set environment variables ~93
Merge variables into an application's environment and bump its revision. Run roxyon_deploy afterwards to apply. Needs confirm:true. PORT and HOST are platform-managed and ignored.
| Name | Type | Req | Description |
|---|---|---|---|
| application | string | – | – |
| confirm | boolean | – | – |
| dir | string | – | – |
| remove | array | – | Keys to delete. |
| vars | object | yes | { KEY: "value", ... } to set. |
No output schema declared.
No examples provided.
roxyon_init Roxyon: initialise a project ~107
Detect a project's type and write roxyon.json. Run this once per project before roxyon_deploy. Does not create anything on the platform.
| Name | Type | Req | Description |
|---|---|---|---|
| dir | string | yes | Absolute path to the project directory. |
| folder | string | – | Sub-path under the host; "" = site root. |
| host | string | – | Deploy host (a domain on the subscription). |
| overwrite | boolean | – | Replace an existing roxyon.json. |
| runtime | string | – | – |
No output schema declared.
No examples provided.
roxyon_install_wordpress Roxyon: install WordPress ~189
One-shot recipe: create a subdomain (if it does not already exist), provision a database for it, download WordPress core, and deploy it. v1 scope — core only, no plugin/theme selection, single site. Local-only (needs your filesystem to unpack WordPress into) — run this from the CLI-backed MCP, not the hosted mcp.roxyon.com connector. Needs confirm:true.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | – |
| dbName | string | – | Database name suffix (default derived from the host). See roxyon_database_create. |
| folder | string | – | Sub-path under the host; "" = site root (recommended). |
| host | string | yes | The site host, e.g. blog.mycompany.com — created if it does not exist. |
| phpVersion | string | – | Default "8.3". |
| subscription | string | – | – |
No output schema declared.
No examples provided.
roxyon_link_github Roxyon: connect a git remote ~99
Connect a git repository to an application for push-to-deploy. Returns the deploy key and webhook URL to add to the repo. Needs confirm:true.
| Name | Type | Req | Description |
|---|---|---|---|
| application | string | – | – |
| branch | string | – | Branch to deploy (default main). |
| confirm | boolean | – | – |
| dir | string | – | – |
| repoUrl | string | yes | SSH git URL, e.g. git@github.com:you/app.git |
No output schema declared.
No examples provided.
roxyon_list_apps Roxyon: list applications ~24
List the applications on the active subscription with their status and revision.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
roxyon_list_databases Roxyon: list databases ~26
Databases on the active subscription.
| Name | Type | Req | Description |
|---|---|---|---|
| subscription | string | – | – |
No output schema declared.
No examples provided.
roxyon_list_domains Roxyon: list hosts ~27
List the domains (hosts) on the active subscription — the possible deploy targets.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
roxyon_list_emails Roxyon: list mailboxes ~26
Mailboxes on the active subscription.
| Name | Type | Req | Description |
|---|---|---|---|
| subscription | string | – | – |
No output schema declared.
No examples provided.
roxyon_list_files Roxyon: list a site’s files ~49
The files currently deployed to a host's document root.
| Name | Type | Req | Description |
|---|---|---|---|
| folder | string | – | – |
| host | string | yes | – |
| path | string | – | List under this sub-path only. |
No output schema declared.
No examples provided.
roxyon_list_invoices Roxyon: my invoices ~90
The signed-in user's own invoices, newest first: number, type, status (pending = unpaid, paid, overdue, void, failed, cancelled), total and currency, due date, and payUrl (the console page where the user pays; null when paid). Read-only: this never pays anything.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Default 25. |
| status | string | – | – |
No output schema declared.
No examples provided.
roxyon_list_subscriptions Roxyon: my subscriptions (billing) ~69
The signed-in user's own subscriptions with billing details: plan + SKU, status, billing cycle, recurring price and currency, next billing date, auto-renew, and for servers the state (building / running / stopped…) and public IP. Only subscriptions the user owns. Read-only.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
roxyon_logs Roxyon: application logs ~51
Recent journal lines for an application (by id or project dir).
| Name | Type | Req | Description |
|---|---|---|---|
| application | string | – | – |
| dir | string | – | – |
| lines | integer | – | How many lines (default 100). |
No output schema declared.
No examples provided.
roxyon_pay_link Roxyon: where to pay an invoice ~100
The URL where the signed-in user pays one of their own open invoices (status pending, overdue or failed), plus its amount and due date. Give the invoice number (e.g. "INV2610055") or id from roxyon_list_invoices. A human opens the link and pays in the console; this tool never charges anything. Paid or void invoices have no link.
| Name | Type | Req | Description |
|---|---|---|---|
| invoice | string | yes | Invoice number or id. |
No output schema declared.
No examples provided.
roxyon_quote Roxyon: price a new subscription ~185
The exact amount Roxyon's checkout would charge for a NEW subscription to one plan, computed by the platform itself (same server pricing the console checkout uses, setup fee included): line items, subtotal, tax, total, in the requested currency. Pass the buyer currency and country: without them the quote is in USD with no tax, while checkout uses the account's own currency/country. No sign-in needed. Read-only: creates no order. Domains are not priced by this tool yet.
| Name | Type | Req | Description |
|---|---|---|---|
| country | string | – | ISO 3166 alpha-2, decides tax, e.g. "SA". |
| currency | string | – | ISO 4217, e.g. "USD", "SAR". |
| cycle | string | yes | – |
| plan | string | yes | planId (or SKU, e.g. "SCALE-S") from roxyon_catalog. |
No output schema declared.
No examples provided.
roxyon_read_file Roxyon: read a site file ~56
Read one file from a host's document root (to review or edit it).
| Name | Type | Req | Description |
|---|---|---|---|
| folder | string | – | – |
| host | string | yes | – |
| path | string | yes | Relative path, e.g. index.html |
No output schema declared.
No examples provided.
roxyon_restart Roxyon: restart an application ~43
Bounce the application process (no rebuild). Needs confirm:true.
| Name | Type | Req | Description |
|---|---|---|---|
| application | string | – | – |
| confirm | boolean | – | – |
| dir | string | – | – |
No output schema declared.
No examples provided.
roxyon_ssh_reset_password Roxyon: reset the SSH/SFTP password ~105
Reset a subscription's shell password — used for SSH, SFTP, and the file manager. Changing it signs out anything using the old one. The password is shown once in the result; the platform never stores or re-shows it. Needs confirm:true.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | – |
| password | string | – | Omit to have Roxyon generate one (12+ chars, mixed case, number, symbol). |
| subscription | string | – | – |
No output schema declared.
No examples provided.
roxyon_whoami Roxyon: who am I ~28
Show the signed-in Roxyon user and their subscriptions (which one is active).
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
How do I install the io.github.bea-technology/roxyon MCP server?
io.github.bea-technology/roxyon runs locally as an npm package, launched with npx -y @roxyon/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @roxyon/mcp
claude mcp add bea-technology-roxyon -- npx -y @roxyon/mcp
What is the io.github.bea-technology/roxyon MCP server?
io.github.bea-technology/roxyon is an MCP server listed in the public MCP registry as io.github.bea-technology/roxyon. Build LumenJS apps, use the Roxyon BaaS, and deploy apps and web projects to Roxyon infrastructure. This page covers its npm package (@roxyon/mcp).
Is the io.github.bea-technology/roxyon MCP server safe to use?
io.github.bea-technology/roxyon scores 88 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 4 November 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.bea-technology/roxyon MCP server expose?
io.github.bea-technology/roxyon exposes 34 tools: roxyon_whoami, roxyon_list_domains, roxyon_list_apps, roxyon_init, roxyon_deploy, and 29 more. Their descriptions and schemas cost roughly 3,152 tokens of context every time the server is loaded.
Is the io.github.bea-technology/roxyon MCP server still maintained?
io.github.bea-technology/roxyon is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.bea-technology/roxyon MCP server under?
io.github.bea-technology/roxyon declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.