io.github.cletcher/chaprola
NPM · @CHAPROLA/MCP-SERVER
Serverless API backend: query, JOIN, pivot, batch ops, email, FHIR, programs via HTTP.
Available components
Last scanned (4 hours ago)
Scores higher than 62% of npm servers
Category Databases
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security81
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects zod 3.25.76, a direct dependency. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 30 of 93 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 187 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability87
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Tool/resource definitions use about 3600 tokens (~73/item across 49 items; 45 tools + 4 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 10 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "chaprola_delete_account" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 46 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 0
- Stability: 0.97 → pass security
- 4 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 3 Nov 26 −1
- Stability: pass → 0.93 functional
- 28 Oct 26 0
- Stability: 0.97 → pass security
- 27 Oct 26 0
- Stability: pass → 0.97 functional
- 24 Oct 26 −6
- CVE-2023-54404 affects this package: high ▼ security
- Known CVEs: pass → fail ▼ security
- 21 Oct 26 +1
- Stability: 0.97 → pass security
- 20 Oct 26 −1
- Stability: pass → 0.97 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed npm/@chaprola/mcp-server@1.4.3
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 1 finding
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-mrhx-c7xc-m3w5 | CVE-2023-54404 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 93 packages
| Packages resolved | 93 |
|---|---|
| Stale | 30 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
chaprola_alter ~109
Modify a data file's schema: widen/narrow/rename fields, add new fields, drop fields. Transforms existing data to match the new schema.
| Name | Type | Req | Description |
|---|---|---|---|
| add | array | – | Fields to add |
| alter | array | – | Fields to alter |
| drop | array | – | Field names to drop |
| name | string | yes | Data file name (without extension) |
| output | string | – | Output file name (default: in-place) |
| project | string | yes | Project name |
No output schema declared.
No examples provided.
chaprola_baa_status ~22
Check whether the authenticated user has signed the BAA
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
chaprola_baa_text ~29
Get the current Business Associate Agreement text and version. Present to human for review before signing
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
chaprola_check_username ~29
Check if a username is available before registering
| Name | Type | Req | Description |
|---|---|---|---|
| username | string | yes | Username to check |
No output schema declared.
No examples provided.
chaprola_compile ~167
Compile Chaprola source (.CS) to bytecode (.PR). READ chaprola://cookbook BEFORE writing source. Key syntax: no PROGRAM keyword (start with commands), no commas, MOVE+PRINT 0 buffer model (not PRINT field), SEEK for primary records, OPEN/READ/WRITE/CLOSE for secondary files, LET supports one operation (no parentheses), field addressing via P.field/S.field requires primary_format/secondary_format params.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | Program name (without extension) |
| primary_format | string | – | Primary data file name (enables P.fieldname addressing) |
| project | string | yes | Project name |
| secondary_format | string | – | Secondary format file name (enables S.fieldname addressing) |
| source | string | yes | Chaprola source code |
No output schema declared.
No examples provided.
chaprola_consolidate ~74
Merge a .MRG file into its parent .DA, producing a clean sorted data file. Deletes .MRG and .IGN after success. Aborts if .MRG was modified during the operation.
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | yes | Data file name (without extension) |
| project | string | yes | Project name |
No output schema declared.
No examples provided.
chaprola_delete_account ~47
Delete an account and all associated data. Requires passcode confirmation
| Name | Type | Req | Description |
|---|---|---|---|
| passcode | string | yes | Account passcode for confirmation |
| username | string | yes | Account username to delete |
No output schema declared.
No examples provided.
chaprola_delete_record ~73
Delete a single record matched by a where clause. Marks the record as ignored (.IGN). Physically removed on consolidation.
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | yes | Data file name (without extension) |
| project | string | yes | Project name |
| where | object | yes | Field name → value pairs to identify exactly one record |
No output schema declared.
No examples provided.
chaprola_download ~63
Get a presigned S3 URL to download any file you own (1-hour expiry)
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | yes | File name with extension (e.g., REPORT.R) |
| project | string | yes | Project name |
| type | string | yes | File type directory |
No output schema declared.
No examples provided.
chaprola_email_delete ~30
Delete a specific email from your mailbox
| Name | Type | Req | Description |
|---|---|---|---|
| message_id | string | yes | Message ID to delete |
No output schema declared.
No examples provided.
chaprola_email_inbox ~56
List emails in the authenticated user's mailbox
| Name | Type | Req | Description |
|---|---|---|---|
| before | string | – | ISO 8601 timestamp — return emails before this time |
| limit | number | – | Max emails to return (default 20, max 100) |
No output schema declared.
No examples provided.
chaprola_email_read ~31
Read a specific email by message_id
| Name | Type | Req | Description |
|---|---|---|---|
| message_id | string | yes | Message ID from inbox listing |
No output schema declared.
No examples provided.
chaprola_email_send ~79
Send an email from your @chaprola.org address. Subject to content moderation
| Name | Type | Req | Description |
|---|---|---|---|
| from | string | – | Sender local part (default: your username) |
| html | string | – | HTML body |
| subject | string | yes | Email subject |
| text | string | yes | Plain text body |
| to | string | yes | Recipient email address |
No output schema declared.
No examples provided.
chaprola_export ~43
Export Chaprola .DA + .F files back to JSON
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | File name (without extension) |
| project | string | yes | Project name |
No output schema declared.
No examples provided.
chaprola_export_report ~118
Run a .PR program and save output as a persistent .R file in S3
| Name | Type | Req | Description |
|---|---|---|---|
| format | string | – | Output format (default: text) |
| name | string | yes | Program name |
| nophi | boolean | – | If true, obfuscate PHI-flagged fields |
| primary_file | string | – | Primary data file to load |
| project | string | yes | Project name |
| report_name | string | – | Custom output file name |
| title | string | – | Report title (used in PDF header) |
No output schema declared.
No examples provided.
chaprola_fetch ~89
Fetch any URL and return clean content. HTML pages converted to markdown. SSRF-protected. Rate limit: 20/day per user
| Name | Type | Req | Description |
|---|---|---|---|
| format | string | – | Output format (default: markdown) |
| max_length | number | – | Max output characters (default: 50000, max: 200000) |
| url | string | yes | URL to fetch (http:// or https://) |
No output schema declared.
No examples provided.
chaprola_format ~55
Inspect a data file's schema — returns field names, positions, lengths, types, and PHI flags
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | Data file name (without .F extension) |
| project | string | yes | Project name |
No output schema declared.
No examples provided.
chaprola_hello ~35
Health check — verify the Chaprola API is running
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | – | Name to greet (default: world) |
No output schema declared.
No examples provided.
chaprola_import ~102
Import JSON data into Chaprola format files (.F + .DA). Sign BAA first if handling PHI
| Name | Type | Req | Description |
|---|---|---|---|
| data | array | yes | Array of flat JSON objects to import |
| expires_in_days | number | – | Days until data expires (default: 90) |
| format | string | – | Data format: json (default) or fhir |
| name | string | yes | File name (without extension) |
| project | string | yes | Project name |
No output schema declared.
No examples provided.
chaprola_import_download ~114
Import data directly from a public URL (CSV, TSV, JSON, NDJSON, Parquet, Excel). Optional AI-powered schema inference
| Name | Type | Req | Description |
|---|---|---|---|
| instructions | string | – | Natural language instructions for AI-powered field selection and transforms |
| max_rows | number | – | Maximum rows to import (default: 5,000,000) |
| name | string | yes | Output file name (without extension) |
| project | string | yes | Project name |
| url | string | yes | Public URL to download (http/https only) |
No output schema declared.
No examples provided.
chaprola_import_process ~69
Process a file previously uploaded to S3 via presigned URL. Generates .F + .DA files
| Name | Type | Req | Description |
|---|---|---|---|
| format | string | – | Data format: json (default) or fhir |
| name | string | yes | File name (without extension) |
| project | string | yes | Project name |
No output schema declared.
No examples provided.
chaprola_import_url ~53
Get a presigned S3 upload URL for large files (bypasses 6MB API Gateway limit)
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | File name (without extension) |
| project | string | yes | Project name |
No output schema declared.
No examples provided.
chaprola_index ~55
Build an index file (.IDX) for fast lookups on a field
| Name | Type | Req | Description |
|---|---|---|---|
| field | string | yes | Field name to index |
| file | string | yes | Data file to index |
| project | string | yes | Project name |
No output schema declared.
No examples provided.
chaprola_insert_record ~78
Insert a new record into a data file's merge file (.MRG). The record appears at the end of the file until consolidation.
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | yes | Data file name (without extension) |
| project | string | yes | Project name |
| record | object | yes | Field name → value pairs. Unspecified fields default to blanks. |
No output schema declared.
No examples provided.
chaprola_list ~52
List files in a project with optional wildcard pattern
| Name | Type | Req | Description |
|---|---|---|---|
| pattern | string | – | Wildcard pattern to filter files (e.g., EMP*) |
| project | string | yes | Project name (use * for all projects) |
No output schema declared.
No examples provided.
chaprola_login ~47
Login and get a new API key. WARNING: invalidates the previous API key
| Name | Type | Req | Description |
|---|---|---|---|
| passcode | string | yes | Your passcode |
| username | string | yes | Your registered username |
No output schema declared.
No examples provided.
chaprola_merge ~77
Merge two sorted data files into one. Both must share the same format (.F)
| Name | Type | Req | Description |
|---|---|---|---|
| file_a | string | yes | First data file |
| file_b | string | yes | Second data file |
| key | string | yes | Merge key field |
| output | string | yes | Output file name |
| project | string | yes | Project name |
No output schema declared.
No examples provided.
chaprola_optimize ~140
Run HULDRA nonlinear optimization using a compiled .PR as the objective evaluator
| Name | Type | Req | Description |
|---|---|---|---|
| async_exec | boolean | – | If true, return job_id for long optimizations |
| elements | array | yes | Parameters to optimize |
| h_initial | number | – | Initial step fraction (default: 0.125) |
| max_iterations | number | – | Max iterations (default: 100) |
| objectives | array | yes | Objective values to minimize |
| primary_file | string | yes | Data file to pass to the VALUE program |
| program | string | yes | Compiled .PR program name (the VALUE program) |
| project | string | yes | Project name |
No output schema declared.
No examples provided.
chaprola_optimize_status ~44
Check status of an async optimization job
| Name | Type | Req | Description |
|---|---|---|---|
| job_id | string | yes | Job ID from async /optimize response |
| project | string | yes | Project name |
No output schema declared.
No examples provided.
chaprola_publish ~105
Publish a compiled program for public access via /report
| Name | Type | Req | Description |
|---|---|---|---|
| acl | string | – | Access control: public (anyone), authenticated (valid API key required), owner (owner's API key only), token (action_token required). Default: public |
| name | string | yes | Program name to publish |
| primary_file | string | – | Data file to load when running the report |
| project | string | yes | Project name |
| record | number | – | Starting record number |
No output schema declared.
No examples provided.
chaprola_query ~223
SQL-free data query with WHERE, SELECT, aggregation, ORDER BY, JOIN, pivot, and Mercury scoring
| Name | Type | Req | Description |
|---|---|---|---|
| aggregate | array | – | Aggregation: [{field, func}]. Funcs: count, sum, avg, min, max, stddev |
| file | string | yes | Data file to query |
| join | object | – | Join: {file, on, type, method} |
| limit | number | – | Max results to return |
| mercury | object | – | Mercury scoring: {fields: [{field, target, weight}]} |
| offset | number | – | Skip this many results |
| order_by | array | – | Sort: [{field, dir}] |
| pivot | object | – | Pivot: {row, column, values, totals, grand_total} |
| project | string | yes | Project name |
| select | array | – | Fields to include in output |
| where | object | – | Filter: {field, op, value}. Ops: eq, ne, gt, ge, lt, le, between, contains, starts_with |
No output schema declared.
No examples provided.
chaprola_register ~72
Register a new Chaprola account. Returns an API key — save it immediately
| Name | Type | Req | Description |
|---|---|---|---|
| passcode | string | yes | 16-128 characters. Use a long, unique passcode |
| username | string | yes | 3-40 chars, alphanumeric + hyphens/underscores, starts with letter |
No output schema declared.
No examples provided.
chaprola_report ~131
Run a published program and return output. No auth required — program must be published first via /publish
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | Name of the published .PR file |
| params | object | – | Parameters to inject before execution. Named params (e.g., {deck: "kanji", level: 3}) are read in programs via PARAM.name. Legacy R-variables (r1-r20) also supported. Use chaprola_report_params to di… |
| project | string | yes | Project containing the program |
| userid | string | yes | Owner of the published program |
No output schema declared.
No examples provided.
chaprola_report_params ~87
Get the parameter schema for a published report. Returns the .PF file as JSON — field names, types, and widths. Use this to discover what params a report accepts before calling chaprola_report.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | Name of the published .PR file |
| project | string | yes | Project containing the program |
| userid | string | yes | Owner of the published program |
No output schema declared.
No examples provided.
chaprola_run ~125
Execute a compiled .PR program. Use async:true for large datasets (>100K records)
| Name | Type | Req | Description |
|---|---|---|---|
| async_exec | boolean | – | If true, run asynchronously and return job_id for polling |
| name | string | yes | Program name (without extension) |
| nophi | boolean | – | If true, obfuscate PHI-flagged fields during execution |
| primary_file | string | – | Primary data file to load |
| project | string | yes | Project name |
| record | number | – | Starting record number |
| secondary_files | array | – | Secondary files to make available |
No output schema declared.
No examples provided.
chaprola_run_each ~120
Run a compiled .PR program against every record in a data file. Like CHAPRPG from the original SCIOS. Use this for scoring, bulk updates, conditional logic across records.
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | yes | Data file to iterate (.DA) |
| program | string | yes | Compiled program name (.PR) in the same project |
| project | string | yes | Project name |
| where | array | – | Optional filter — only run against matching records |
| where_logic | string | – | How to combine multiple where conditions (default: and) |
No output schema declared.
No examples provided.
chaprola_run_status ~47
Check status of an async job. Returns full output when done
| Name | Type | Req | Description |
|---|---|---|---|
| job_id | string | yes | Job ID from async /run response |
| project | string | yes | Project name |
No output schema declared.
No examples provided.
chaprola_schedule ~139
Create a scheduled job that runs a Chaprola endpoint on a recurring cron. Max 10 schedules/user, 15-min minimum interval
| Name | Type | Req | Description |
|---|---|---|---|
| body | object | yes | Request body for the target endpoint. userid is injected automatically |
| cron | string | yes | Standard 5-field cron expression (min hour day month weekday). Minimum interval: 15 minutes |
| endpoint | string | yes | Target endpoint to call |
| name | string | yes | Unique name for this schedule (alphanumeric + hyphens/underscores) |
| skip_if_unchanged | boolean | – | Skip when response matches previous run (SHA-256 hash). Default: false |
No output schema declared.
No examples provided.
chaprola_schedule_delete ~30
Delete a scheduled job by name
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | Name of the schedule to delete |
No output schema declared.
No examples provided.
chaprola_schedule_list ~26
List all scheduled jobs for the authenticated user with run history and next execution time
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
chaprola_search ~86
Search the web via Brave Search API. Returns titles, URLs, and snippets. Optional AI-grounded summary. Rate limit: 10/day per user
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | – | Number of results to return (default 5, max 20) |
| query | string | yes | Search query string |
| summarize | boolean | – | Include AI-grounded summary from Brave Answers API |
No output schema declared.
No examples provided.
chaprola_sign_baa ~113
Sign the BAA. STOP: You MUST call chaprola_baa_text first, show the FULL text to the human, and get their EXPLICIT typed approval before calling this. Never sign automatically. Only needed for PHI — non-PHI data works without a BAA.
| Name | Type | Req | Description |
|---|---|---|---|
| organization | string | – | Organization name (the Covered Entity) |
| signatory_name | string | yes | Full name of the person agreeing to the BAA |
| signatory_title | string | – | Title of the signatory |
No output schema declared.
No examples provided.
chaprola_sort ~64
Sort a data file by one or more fields. Modifies the file in place
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | yes | Data file to sort |
| project | string | yes | Project name |
| sort_by | array | yes | Sort specification: [{field, dir?, type?}] |
No output schema declared.
No examples provided.
chaprola_unpublish ~39
Remove public access from a published program
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | Program name to unpublish |
| project | string | yes | Project name |
No output schema declared.
No examples provided.
chaprola_update_record ~98
Update fields in a single record matched by a where clause. If no sort-key changes, updates in place; otherwise marks old record ignored and appends to merge file.
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | yes | Data file name (without extension) |
| project | string | yes | Project name |
| set | object | yes | Field name → new value pairs to update |
| where | object | yes | Field name → value pairs to identify exactly one record |
No output schema declared.
No examples provided.
How do I install the io.github.cletcher/chaprola MCP server?
io.github.cletcher/chaprola runs locally as an npm package, launched with npx -y @chaprola/mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @chaprola/mcp-server
claude mcp add cletcher-chaprola -- npx -y @chaprola/mcp-server
What is the io.github.cletcher/chaprola MCP server?
io.github.cletcher/chaprola is an MCP server listed in the public MCP registry as io.github.cletcher/chaprola. Serverless API backend: query, JOIN, pivot, batch ops, email, FHIR, programs via HTTP. This page covers its npm package (@chaprola/mcp-server).
Is the io.github.cletcher/chaprola MCP server safe to use?
io.github.cletcher/chaprola scores 79 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.cletcher/chaprola MCP server expose?
io.github.cletcher/chaprola exposes 45 tools: chaprola_hello, chaprola_register, chaprola_login, chaprola_check_username, chaprola_delete_account, and 40 more. Their descriptions and schemas cost roughly 3,485 tokens of context every time the server is loaded.
Is the io.github.cletcher/chaprola MCP server still maintained?
io.github.cletcher/chaprola is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.cletcher/chaprola MCP server under?
io.github.cletcher/chaprola declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.