{"$schema":"https://verifymcp.io/schemas/trust-report.json","schemaVersion":1,"license":{"name":"CC BY-NC 4.0","url":"https://creativecommons.org/licenses/by-nc/4.0/"},"generatedAt":"2026-11-05T16:24:06.987Z","url":"https://verifymcp.io/servers/chadixearth-graphyloop/graphyloop","markdownUrl":"https://verifymcp.io/servers/chadixearth-graphyloop/graphyloop.md","server":{"slug":"chadixearth-graphyloop","name":"GraphyLoop","registryName":"io.github.chadixearth/graphyloop","description":"Workflow planner, wave dispatcher, persistent swarm memory, and deploy preflight for AI agents.","registryStatus":"active","deletedAt":null,"statusMessage":null,"liveness":"live","publisher":{"class":"unknown","claimed":false}},"component":{"slug":"graphyloop","type":"npm","identifier":"graphyloop","withdrawn":false,"url":"https://verifymcp.io/servers/chadixearth-graphyloop/graphyloop","version":"0.6.5","transport":"stdio","scoredAt":"2026-11-05T10:04:15.601Z"},"score":{"total":79,"tier":"medium","status":"scored","weekDelta":14,"history":[{"date":"2026-11-05","total":79},{"date":"2026-11-04","total":79},{"date":"2026-11-03","total":78},{"date":"2026-11-02","total":78},{"date":"2026-11-01","total":77},{"date":"2026-10-31","total":77},{"date":"2026-10-30","total":76},{"date":"2026-10-29","total":65}]},"categories":[{"name":"Supply Chain Security","score":100,"verdict":"pass","reasons":["No malware found by supply-chain analysis.","No known CVEs affecting this package version or its production dependencies.","No install/post-install scripts declared.","No production dependencies, so there is no dependency health to assess."],"codes":[{"code":"supplychain.malware_clean","args":{}},{"code":"cve.none","args":{}},{"code":"installscript.none","args":{}},{"code":"dephealth.no_dependencies","args":{"deps":"0","unhealthy":"0"}}]},{"name":"Provenance & Transparency","score":97,"verdict":"fail","reasons":["Source repository is publicly reachable at the declared URL.","Cryptographically verified build provenance (signed, bound to chadixearth/graphyloop).","Clear OSI-approved license (MIT).","Actively maintained (last published 3 days ago).","Disclosure check failed: no security disclosure policy was found in the source repository."],"codes":[{"code":"provenance.repo_verified","args":{}},{"code":"provenance.verified","args":{"repo":"chadixearth/graphyloop"}},{"code":"license.osi","args":{"spdx":"MIT"}},{"code":"maintenance.recent","args":{"age_days":"3"}},{"code":"disclosure.absent","args":{}}]},{"name":"Schema Quality & AI Usability","score":74,"verdict":"fail","reasons":["AI-judged instruction clarity (good).","Tool/resource definitions use about 1596 tokens (~106/item across 15 items; 15 tools + 0 resources), lean.","Usage-examples check failed: none of the tools include examples."],"codes":[{"code":"schema.ai_quality","args":{"band":"good"}},{"code":"schema.footprint_lean","args":{"avg":"106","items":"15","tools":"15","tokens":"1596","resources":"0"}},{"code":"schema.examples_absent","args":{}}]},{"name":"Stability & Change Management","score":23,"verdict":"partial","reasons":["Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses."],"codes":[{"code":"stability.building_history","args":{"days":"7"}}]},{"name":"Tool Coverage","score":100,"verdict":"pass","reasons":["100% of tools have a non-trivial description (not blank, and not just the tool's name).","100% of tool parameters carry a description."],"codes":[{"code":"toolquality.descriptions","args":{"pct":"100"}},{"code":"toolquality.param_docs","args":{"pct":"100"}}]},{"name":"Tool Safety","score":75,"verdict":"fail","reasons":["No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.","0 of 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; \"memory_forget\" implies \"delete\" and declares no destructiveHint at all, which the MCP spec reads as destructive by default.","An AI judge read all 15 captured unit(s) of tool text and found none that tries to manipulate the model reading it."],"codes":[{"code":"toolsafety.injection_clean","args":{}},{"code":"toolsafety.destructive_undeclared","args":{"pct":"0","tool":"memory_forget","verb":"delete","declared":"none","annotated":"0","destructive":"2"}},{"code":"toolsafety.manipulation_clean","args":{"units":"15","judged":"15"}}]},{"name":"Capabilities","score":20,"verdict":"fail","reasons":["Spec-recency check failed: implements MCP spec 2024-11-05; the latest is 2026-07-28."],"codes":[{"code":"protocol.outdated","args":{"latest":"2026-07-28","version":"2024-11-05"}}]}],"inconclusive":[],"malware":[],"components":[{"slug":"graphyloop","type":"npm","identifier":"graphyloop","withdrawn":false,"score":79,"current":true,"url":"https://verifymcp.io/servers/chadixearth-graphyloop/graphyloop","markdownUrl":"https://verifymcp.io/servers/chadixearth-graphyloop/graphyloop.md"}],"facts":[{"label":"Registry","value":"npm"},{"label":"Package","value":"graphyloop"},{"label":"Version","value":"0.6.5"},{"label":"Transport","value":"stdio"}],"install":{"available":true,"bundleSha256":null},"tools":[{"name":"agent_spawn","title":null,"description":"Spawn a swarm agent. type (required): coder|tester|reviewer|architect|explorer|security|coordinator|frontend|data. Optional: id (default auto-generated), capabilities (comma-separated overrides), role (worker|peer|leader).","inputs":[{"name":"capabilities","type":"string","required":false,"description":"Comma-separated capability overrides"},{"name":"id","type":"string","required":false,"description":"Custom agent id (default auto-generated)"},{"name":"role","type":"string","required":false,"description":"worker | peer | leader (default: worker)"},{"name":"type","type":"string","required":true,"description":"Agent type: coder, tester, reviewer, architect, explorer, security, coordinator, frontend, data"}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":129},{"name":"agent_list","title":null,"description":"List all swarm agents with type, status, role, and health.","inputs":[],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":22},{"name":"task_distribute","title":null,"description":"Distribute tasks across swarm agents. tasks (required): JSON string array of {id, type, description, priority}. Returns per-task assignments with opencodeAgentType and prompt.","inputs":[{"name":"tasks","type":"string","required":true,"description":"JSON array of {id, type, description, priority} task objects"}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":66},{"name":"swarm_state","title":null,"description":"Swarm status: agents, active agents, tasks completed/failed, pending tasks, memory count.","inputs":[],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":28},{"name":"task_record","title":null,"description":"Record a task result and update agent metrics. taskId + status (required; status: completed|failed). Optional: agentId, error.","inputs":[{"name":"agentId","type":"string","required":false,"description":"Agent id (default: task assigned agent)"},{"name":"error","type":"string","required":false,"description":"Error message when failed"},{"name":"status","type":"string","required":true,"description":"completed | failed"},{"name":"taskId","type":"string","required":true,"description":"Task id"}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":84},{"name":"memory_store","title":null,"description":"Store a memory entry. content (required). Optional: agent (default system), type (decision|pattern|lesson|event|task, default event), metadata (object or JSON string).","inputs":[{"name":"agent","type":"string","required":false,"description":"Agent id (default: system)"},{"name":"content","type":"string","required":true,"description":"Memory text"},{"name":"metadata","type":"object","required":false,"description":"Optional metadata object"},{"name":"type","type":"string","required":false,"description":"decision | pattern | lesson | event | task (default: event)"}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":98},{"name":"memory_search","title":null,"description":"Keyword-search stored memories, ranked by match quality with a recency bias. query (required), limit (optional, default 10), type (optional: decision|pattern|lesson|event|task).","inputs":[{"name":"limit","type":"string","required":false,"description":"Max results (default 10)"},{"name":"query","type":"string","required":true,"description":"Search query"},{"name":"type","type":"string","required":false,"description":"Only search this memory type: decision | pattern | lesson | event | task"}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":93},{"name":"memory_forget","title":null,"description":"Delete one memory entry by id (ids come from memory_search results). Use this to correct a wrong or outdated memory instead of letting it be recalled forever.","inputs":[{"name":"id","type":"string","required":true,"description":"Memory id to delete, e.g. mem-1700000000000-ab12"}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":64},{"name":"plan_feature","title":null,"description":"Plan a multi-layer feature as parallel waves before writing any code. goal (required): the request in plain words, e.g. \"inventory system with stock levels, a dashboard and deploy to vercel\". Returns wave 0 (the driver, or ONE agent when the code is unmapped, freezes the contract: schema + API + props + test scenarios, AND the context pack ctx-<slug>.md next to it: per lane path:line + current code excerpt + pattern to copy) -> wave 1 parallel builders (data, backend, frontend, tests; the driver keeps the most coupled lane) -> wave 2 integration -> wave 3 parallel verifiers (test, typecheck, security, performance, review) -> wave 4 gated deploy, with per-task file ownership, acceptance checks and dependsOn. Every lane brief ends with the turn-economy footer (batch reads, first edit by turn 5, no project-wide lint/test/build). A goal with no data/backend/frontend/pipeline signal answers shape no-fanout; work touching 8 known files or fewer (inlineThreshold 8) is done inline unless it splits into 2+ independent slices of about 5 minutes each. Pass the returned tasks array (JSON) straight to task_distribute.","inputs":[{"name":"goal","type":"string","required":true,"description":"The feature request, verbatim"},{"name":"includeDeploy","type":"boolean","required":false,"description":"Force the deploy wave on even if the goal does not mention shipping"},{"name":"maxParallel","type":"string","required":false,"description":"Local builder concurrency cap (default 4, RAM-bound)"}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":320},{"name":"secrets_status","title":null,"description":"Masked readiness report for the project credentials (Supabase, Vercel): which keys are set, where each one comes from (process env, graphyloop store, .env file), and what is still missing. Values are NEVER returned — only a mask. Call this before database or deploy work instead of asking the user to paste keys.","inputs":[{"name":"provider","type":"string","required":false,"description":"supabase | vercel | all (default all)"}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":95},{"name":"secrets_set","title":null,"description":"Store one credential in the project-local secret store (<project>/.graphyloop/secrets.json, chmod 600, git-ignored before the first write). key (required) e.g. SUPABASE_URL, SUPABASE_ANON_KEY, SUPABASE_SERVICE_ROLE_KEY, VERCEL_TOKEN. value (required) is written to disk and echoed back masked only. Use this once per key, then env_sync.","inputs":[{"name":"key","type":"string","required":true,"description":"UPPER_SNAKE_CASE key name"},{"name":"provider","type":"string","required":false,"description":"supabase | vercel (optional; inferred from the key)"},{"name":"value","type":"string","required":true,"description":"The credential value (stored, never echoed back)"}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":145},{"name":"env_sync","title":null,"description":"Write the stored credentials into the env file the framework actually reads (default .env.local), add the framework public aliases for public keys only (NEXT_PUBLIC_*/VITE_*, never for a service-role key), refresh a values-free .env.example, and make sure .gitignore covers the env files. Values move file-to-file: the result lists key NAMES, never values.","inputs":[{"name":"force","type":"boolean","required":false,"description":"Overwrite a key that already has a different value (a timestamped backup is kept)"},{"name":"providers","type":"string","required":false,"description":"Comma-separated provider filter, e.g. \"supabase\""},{"name":"target","type":"string","required":false,"description":"Env file name inside the project (default .env.local)"}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":147},{"name":"preflight","title":null,"description":"Readiness check + ordered command plan for database setup and/or deploy. target: db | deploy | all (default all). Returns the detected stack, blockers (missing credentials, no build script, env file not git-ignored), warnings, and the exact commands to run — every destructive step (db push, --prod deploy) carries the approval gate it needs. Executes nothing itself.","inputs":[{"name":"target","type":"string","required":false,"description":"db | deploy | all (default all)"}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":100},{"name":"skills_status","title":null,"description":"Which skills are actually installed on this machine (project .opencode/skills, .dsh/skills, .agents/skills; ~/.config/opencode/skills, ~/.claude/skills, ~/.dsh/skills, ~/.omp/agent/skills, ~/.gemini/skills, ~/.agents/skills). Reports the graphyloop-bundled skills (70, of which 12 are graphyloop-authored: graphyloop-waves, graphyloop-workflow, api-contract-design, api-hardening, frontend-security, web-accessibility, web-performance, dependency-audit, supabase-setup, vercel-deploy, secrets-hygiene, swarm-memory) and which skills the squad routes on but are missing. Call it before claiming a skill was used — a missing skill is stated in one line, never faked.","inputs":[],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":180},{"name":"shutdown","title":null,"description":"Shut down the swarm (terminates agents, keeps memory) and exit the MCP server.","inputs":[],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":25}],"toolsTruncatedAtCapture":false,"diagnostics":{"capturedAt":"2026-11-05T10:04:15.000Z","track":"package","endpoint":null,"declaredUrl":null,"truncated":false,"tls":null,"dnssec":null,"auth":null,"httpsRedirect":null,"transports":[],"provenance":{"outcome":"verified","label":"Verified","reason":"verified","reasonLabel":"Verified","discovery":"attestation_endpoint","discoveryLabel":"Registry attestation endpoint","sourceRepo":null,"attestationSkipped":null,"attestationSkippedLabel":null},"installScripts":[],"installScriptsTotal":null,"vulnerabilities":[],"vulnerabilitiesTotal":null,"dependencies":{"nodes":0,"partial":false,"deprecated":null,"stale":null,"noRepo":null}},"mismatches":[],"changelog":{"trackingSince":"2026-10-29","recent":[{"id":"chg_01a1a603-66a2-7e0a-82cd-665f6b850102","kind":"score.total_changed","summary":"Trust score (78 → 79)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-11-04","url":"https://verifymcp.io/servers/chadixearth-graphyloop/graphyloop#chg-chg_01a1a603-66a2-7e0a-82cd-665f6b850102"},{"id":"chg_01a1a0dd-a56b-7ba2-bd1a-6803e55d5482","kind":"check.reverified","summary":"Security disclosure (unverified → fail)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-11-03","url":"https://verifymcp.io/servers/chadixearth-graphyloop/graphyloop#chg-chg_01a1a0dd-a56b-7ba2-bd1a-6803e55d5482"},{"id":"chg_01a19a97-90e5-7a70-a564-e384627baf4b","kind":"check.unverifiable","summary":"Security disclosure (fail → unverified)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-11-02","url":"https://verifymcp.io/servers/chadixearth-graphyloop/graphyloop#chg-chg_01a19a97-90e5-7a70-a564-e384627baf4b"},{"id":"chg_01a19a97-90e6-7912-a003-f4b3136647ce","kind":"package.version_changed","summary":"Package version (0.6.4 → 0.6.5)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-02","url":"https://verifymcp.io/servers/chadixearth-graphyloop/graphyloop#chg-chg_01a19a97-90e6-7912-a003-f4b3136647ce"},{"id":"chg_01a19a97-90e6-7e01-83fb-6ced2e2045dc","kind":"score.total_changed","summary":"Trust score (77 → 78)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-11-02","url":"https://verifymcp.io/servers/chadixearth-graphyloop/graphyloop#chg-chg_01a19a97-90e6-7e01-83fb-6ced2e2045dc"},{"id":"chg_01a1916b-8741-769b-aac9-57ae49c4a1e3","kind":"score.total_changed","summary":"Trust score (76 → 77)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-31","url":"https://verifymcp.io/servers/chadixearth-graphyloop/graphyloop#chg-chg_01a1916b-8741-769b-aac9-57ae49c4a1e3"},{"id":"chg_01a18c44-6d1a-764c-8f74-1d4ce745d5d4","kind":"check.reverified","summary":"Known CVEs (unverified → pass)","materiality":"security","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-30","url":"https://verifymcp.io/servers/chadixearth-graphyloop/graphyloop#chg-chg_01a18c44-6d1a-764c-8f74-1d4ce745d5d4"},{"id":"chg_01a18c44-6d1a-7dfe-94eb-44d963136e73","kind":"check.reverified","summary":"Dependency health (unverified → pass)","materiality":"functional","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-30","url":"https://verifymcp.io/servers/chadixearth-graphyloop/graphyloop#chg-chg_01a18c44-6d1a-7dfe-94eb-44d963136e73"},{"id":"chg_01a18c44-6d1b-74e6-9845-ea4ba25d39ef","kind":"score.total_changed","summary":"Trust score (65 → 76)","materiality":"functional","direction":"improvement","scoreDelta":11,"occurredOn":"2026-10-30","url":"https://verifymcp.io/servers/chadixearth-graphyloop/graphyloop#chg-chg_01a18c44-6d1b-74e6-9845-ea4ba25d39ef"},{"id":"chg_01a186db-2538-7392-950b-cedeba317874","kind":"score.first_scored","summary":"First indexed and scored","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-29","url":"https://verifymcp.io/servers/chadixearth-graphyloop/graphyloop#chg-chg_01a186db-2538-7392-950b-cedeba317874"},{"id":"chg_01a1867b-34e4-70e8-9aea-074f0f79399f","kind":"score.first_scored","summary":"First indexed and scored","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-29","url":"https://verifymcp.io/servers/chadixearth-graphyloop/graphyloop#chg-chg_01a1867b-34e4-70e8-9aea-074f0f79399f"},{"id":"chg_01a18640-43ab-7b74-90d7-72d578c74b74","kind":"score.first_scored","summary":"First indexed and scored","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-29","url":"https://verifymcp.io/servers/chadixearth-graphyloop/graphyloop#chg-chg_01a18640-43ab-7b74-90d7-72d578c74b74"}],"truncated":false,"feedUrl":"https://verifymcp.io/servers/chadixearth-graphyloop/graphyloop/changelog.json"},"links":{"html":"https://verifymcp.io/servers/chadixearth-graphyloop/graphyloop","markdown":"https://verifymcp.io/servers/chadixearth-graphyloop/graphyloop.md","changelogJson":"https://verifymcp.io/servers/chadixearth-graphyloop/graphyloop/changelog.json","changelogRss":"https://verifymcp.io/servers/chadixearth-graphyloop/graphyloop.xml","external":[{"label":"npm package","href":"https://www.npmjs.com/package/graphyloop"},{"label":"Socket report","href":"https://socket.dev/npm/package/graphyloop"},{"label":"Repository","href":"https://github.com/chadixearth/graphyloop"},{"label":"Website","href":"https://chadixearth.github.io/graphyloop/"}]}}