# io.github.cletcher/chaprola (npm · @chaprola/mcp-server)

Serverless API backend: query, JOIN, pivot, batch ops, email, FHIR, programs via HTTP.

- Trust score: 71/100 (medium)
- Change this week: +18
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `@chaprola/mcp-server`: 71/100 (this document), [markdown](https://verifymcp.io/servers/cletcher-chaprola/chaprola-mcp-server.md), [page](https://verifymcp.io/servers/cletcher-chaprola/chaprola-mcp-server)

## Channel facts

- Registry: `npm`
- Package: `@chaprola/mcp-server`
- Version: `1.4.3`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 93 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 82/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 3600 tokens (~73/item across 49 items; 45 tools + 4 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add cletcher-chaprola -- npx -y @chaprola/mcp-server
```

### Codex

```bash
codex mcp add cletcher-chaprola -- npx -y @chaprola/mcp-server
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "cletcher-chaprola": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@chaprola/mcp-server"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add cletcher-chaprola --command npx --arg -y --arg @chaprola/mcp-server
```

### Hermes

```yaml
mcp_servers:
  cletcher-chaprola:
    command: "npx"
    args: ["-y", "@chaprola/mcp-server"]
```

### Other

```json
{
  "mcpServers": {
    "cletcher-chaprola": {
      "command": "npx",
      "args": [
        "-y",
        "@chaprola/mcp-server"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 71, +4)

- [functional improvement] Stability: unverified → 0.27

### 2026-08-02 (score 67, −3)

- [security regression] Known CVEs: partial → unverified
- [security] Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [functional regression] Capabilities: pass → unverified
- [functional regression] Dependency health: partial → unverified
- [functional regression] Security disclosure: fail → unverified
- [functional regression] Schema quality: 100 → unverified
- [functional regression] Tool coverage: 100 → unverified

### 2026-08-01 (score 70, +44)

- [security regression] Provenance: unverified → fail
- [security improvement] Malware scan: unverified → pass
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Schema quality: unverified → good
- [functional] Licence: MIT

### 2026-07-31 (score 26, −27)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 53, +29)

- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] Schema quality: unverified → 100

### 2026-07-28 (score 24, −29)

- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Schema quality: 100 → unverified

### 2026-07-27 (score 53)

First indexed and scored.

## MCP tools (45)

### `chaprola_hello` (~35 tokens)

Health check — verify the Chaprola API is running

Input parameters:

- `name` (string): Name to greet (default: world)

### `chaprola_register` (~72 tokens)

Register a new Chaprola account. Returns an API key — save it immediately

Input parameters:

- `passcode` (string, required): 16-128 characters. Use a long, unique passcode
- `username` (string, required): 3-40 chars, alphanumeric + hyphens/underscores, starts with letter

### `chaprola_login` (~47 tokens)

Login and get a new API key. WARNING: invalidates the previous API key

Input parameters:

- `passcode` (string, required): Your passcode
- `username` (string, required): Your registered username

### `chaprola_check_username` (~29 tokens)

Check if a username is available before registering

Input parameters:

- `username` (string, required): Username to check

### `chaprola_delete_account` (~47 tokens)

Delete an account and all associated data. Requires passcode confirmation

Input parameters:

- `passcode` (string, required): Account passcode for confirmation
- `username` (string, required): Account username to delete

### `chaprola_baa_text` (~29 tokens)

Get the current Business Associate Agreement text and version. Present to human for review before signing

### `chaprola_report` (~131 tokens)

Run a published program and return output. No auth required — program must be published first via /publish

Input parameters:

- `name` (string, required): Name of the published .PR file
- `params` (object): Parameters to inject before execution. Named params (e.g., {deck: "kanji", level: 3}) are read in programs via PARAM.name. Legacy R-variables (r1-r20) also supported. Use chaprola_report_params to di…
- `project` (string, required): Project containing the program
- `userid` (string, required): Owner of the published program

### `chaprola_report_params` (~87 tokens)

Get the parameter schema for a published report. Returns the .PF file as JSON — field names, types, and widths. Use this to discover what params a report accepts before calling chaprola_report.

Input parameters:

- `name` (string, required): Name of the published .PR file
- `project` (string, required): Project containing the program
- `userid` (string, required): Owner of the published program

### `chaprola_sign_baa` (~113 tokens)

Sign the BAA. STOP: You MUST call chaprola_baa_text first, show the FULL text to the human, and get their EXPLICIT typed approval before calling this. Never sign automatically. Only needed for PHI — non-PHI data works without a BAA.

Input parameters:

- `organization` (string): Organization name (the Covered Entity)
- `signatory_name` (string, required): Full name of the person agreeing to the BAA
- `signatory_title` (string): Title of the signatory

### `chaprola_baa_status` (~22 tokens)

Check whether the authenticated user has signed the BAA

### `chaprola_import` (~102 tokens)

Import JSON data into Chaprola format files (.F + .DA). Sign BAA first if handling PHI

Input parameters:

- `data` (array, required): Array of flat JSON objects to import
- `expires_in_days` (number): Days until data expires (default: 90)
- `format` (string): Data format: json (default) or fhir
- `name` (string, required): File name (without extension)
- `project` (string, required): Project name

### `chaprola_import_url` (~53 tokens)

Get a presigned S3 upload URL for large files (bypasses 6MB API Gateway limit)

Input parameters:

- `name` (string, required): File name (without extension)
- `project` (string, required): Project name

### `chaprola_import_process` (~69 tokens)

Process a file previously uploaded to S3 via presigned URL. Generates .F + .DA files

Input parameters:

- `format` (string): Data format: json (default) or fhir
- `name` (string, required): File name (without extension)
- `project` (string, required): Project name

### `chaprola_import_download` (~114 tokens)

Import data directly from a public URL (CSV, TSV, JSON, NDJSON, Parquet, Excel). Optional AI-powered schema inference

Input parameters:

- `instructions` (string): Natural language instructions for AI-powered field selection and transforms
- `max_rows` (number): Maximum rows to import (default: 5,000,000)
- `name` (string, required): Output file name (without extension)
- `project` (string, required): Project name
- `url` (string, required): Public URL to download (http/https only)

### `chaprola_export` (~43 tokens)

Export Chaprola .DA + .F files back to JSON

Input parameters:

- `name` (string, required): File name (without extension)
- `project` (string, required): Project name

### `chaprola_list` (~52 tokens)

List files in a project with optional wildcard pattern

Input parameters:

- `pattern` (string): Wildcard pattern to filter files (e.g., EMP*)
- `project` (string, required): Project name (use * for all projects)

### `chaprola_compile` (~167 tokens)

Compile Chaprola source (.CS) to bytecode (.PR). READ chaprola://cookbook BEFORE writing source. Key syntax: no PROGRAM keyword (start with commands), no commas, MOVE+PRINT 0 buffer model (not PRINT field), SEEK for primary records, OPEN/READ/WRITE/CLOSE for secondary files, LET supports one operation (no parentheses), field addressing via P.field/S.field requires primary_format/secondary_format params.

Input parameters:

- `name` (string, required): Program name (without extension)
- `primary_format` (string): Primary data file name (enables P.fieldname addressing)
- `project` (string, required): Project name
- `secondary_format` (string): Secondary format file name (enables S.fieldname addressing)
- `source` (string, required): Chaprola source code

### `chaprola_run` (~125 tokens)

Execute a compiled .PR program. Use async:true for large datasets (>100K records)

Input parameters:

- `async_exec` (boolean): If true, run asynchronously and return job_id for polling
- `name` (string, required): Program name (without extension)
- `nophi` (boolean): If true, obfuscate PHI-flagged fields during execution
- `primary_file` (string): Primary data file to load
- `project` (string, required): Project name
- `record` (number): Starting record number
- `secondary_files` (array): Secondary files to make available

### `chaprola_run_status` (~47 tokens)

Check status of an async job. Returns full output when done

Input parameters:

- `job_id` (string, required): Job ID from async /run response
- `project` (string, required): Project name

### `chaprola_run_each` (~120 tokens)

Run a compiled .PR program against every record in a data file. Like CHAPRPG from the original SCIOS. Use this for scoring, bulk updates, conditional logic across records.

Input parameters:

- `file` (string, required): Data file to iterate (.DA)
- `program` (string, required): Compiled program name (.PR) in the same project
- `project` (string, required): Project name
- `where` (array): Optional filter — only run against matching records
- `where_logic` (string): How to combine multiple where conditions (default: and)

### `chaprola_publish` (~105 tokens)

Publish a compiled program for public access via /report

Input parameters:

- `acl` (string): Access control: public (anyone), authenticated (valid API key required), owner (owner's API key only), token (action_token required). Default: public
- `name` (string, required): Program name to publish
- `primary_file` (string): Data file to load when running the report
- `project` (string, required): Project name
- `record` (number): Starting record number

### `chaprola_unpublish` (~39 tokens)

Remove public access from a published program

Input parameters:

- `name` (string, required): Program name to unpublish
- `project` (string, required): Project name

### `chaprola_export_report` (~118 tokens)

Run a .PR program and save output as a persistent .R file in S3

Input parameters:

- `format` (string): Output format (default: text)
- `name` (string, required): Program name
- `nophi` (boolean): If true, obfuscate PHI-flagged fields
- `primary_file` (string): Primary data file to load
- `project` (string, required): Project name
- `report_name` (string): Custom output file name
- `title` (string): Report title (used in PDF header)

### `chaprola_download` (~63 tokens)

Get a presigned S3 URL to download any file you own (1-hour expiry)

Input parameters:

- `file` (string, required): File name with extension (e.g., REPORT.R)
- `project` (string, required): Project name
- `type` (string, required): File type directory

### `chaprola_query` (~223 tokens)

SQL-free data query with WHERE, SELECT, aggregation, ORDER BY, JOIN, pivot, and Mercury scoring

Input parameters:

- `aggregate` (array): Aggregation: [{field, func}]. Funcs: count, sum, avg, min, max, stddev
- `file` (string, required): Data file to query
- `join` (object): Join: {file, on, type, method}
- `limit` (number): Max results to return
- `mercury` (object): Mercury scoring: {fields: [{field, target, weight}]}
- `offset` (number): Skip this many results
- `order_by` (array): Sort: [{field, dir}]
- `pivot` (object): Pivot: {row, column, values, totals, grand_total}
- `project` (string, required): Project name
- `select` (array): Fields to include in output
- `where` (object): Filter: {field, op, value}. Ops: eq, ne, gt, ge, lt, le, between, contains, starts_with

### `chaprola_sort` (~64 tokens)

Sort a data file by one or more fields. Modifies the file in place

Input parameters:

- `file` (string, required): Data file to sort
- `project` (string, required): Project name
- `sort_by` (array, required): Sort specification: [{field, dir?, type?}]

### `chaprola_index` (~55 tokens)

Build an index file (.IDX) for fast lookups on a field

Input parameters:

- `field` (string, required): Field name to index
- `file` (string, required): Data file to index
- `project` (string, required): Project name

### `chaprola_merge` (~77 tokens)

Merge two sorted data files into one. Both must share the same format (.F)

Input parameters:

- `file_a` (string, required): First data file
- `file_b` (string, required): Second data file
- `key` (string, required): Merge key field
- `output` (string, required): Output file name
- `project` (string, required): Project name

### `chaprola_format` (~55 tokens)

Inspect a data file's schema — returns field names, positions, lengths, types, and PHI flags

Input parameters:

- `name` (string, required): Data file name (without .F extension)
- `project` (string, required): Project name

### `chaprola_alter` (~109 tokens)

Modify a data file's schema: widen/narrow/rename fields, add new fields, drop fields. Transforms existing data to match the new schema.

Input parameters:

- `add` (array): Fields to add
- `alter` (array): Fields to alter
- `drop` (array): Field names to drop
- `name` (string, required): Data file name (without extension)
- `output` (string): Output file name (default: in-place)
- `project` (string, required): Project name

### `chaprola_optimize` (~140 tokens)

Run HULDRA nonlinear optimization using a compiled .PR as the objective evaluator

Input parameters:

- `async_exec` (boolean): If true, return job_id for long optimizations
- `elements` (array, required): Parameters to optimize
- `h_initial` (number): Initial step fraction (default: 0.125)
- `max_iterations` (number): Max iterations (default: 100)
- `objectives` (array, required): Objective values to minimize
- `primary_file` (string, required): Data file to pass to the VALUE program
- `program` (string, required): Compiled .PR program name (the VALUE program)
- `project` (string, required): Project name

### `chaprola_optimize_status` (~44 tokens)

Check status of an async optimization job

Input parameters:

- `job_id` (string, required): Job ID from async /optimize response
- `project` (string, required): Project name

### `chaprola_email_inbox` (~56 tokens)

List emails in the authenticated user's mailbox

Input parameters:

- `before` (string): ISO 8601 timestamp — return emails before this time
- `limit` (number): Max emails to return (default 20, max 100)

### `chaprola_email_read` (~31 tokens)

Read a specific email by message_id

Input parameters:

- `message_id` (string, required): Message ID from inbox listing

### `chaprola_email_send` (~79 tokens)

Send an email from your @chaprola.org address. Subject to content moderation

Input parameters:

- `from` (string): Sender local part (default: your username)
- `html` (string): HTML body
- `subject` (string, required): Email subject
- `text` (string, required): Plain text body
- `to` (string, required): Recipient email address

### `chaprola_email_delete` (~30 tokens)

Delete a specific email from your mailbox

Input parameters:

- `message_id` (string, required): Message ID to delete

### `chaprola_search` (~86 tokens)

Search the web via Brave Search API. Returns titles, URLs, and snippets. Optional AI-grounded summary. Rate limit: 10/day per user

Input parameters:

- `count` (number): Number of results to return (default 5, max 20)
- `query` (string, required): Search query string
- `summarize` (boolean): Include AI-grounded summary from Brave Answers API

### `chaprola_fetch` (~89 tokens)

Fetch any URL and return clean content. HTML pages converted to markdown. SSRF-protected. Rate limit: 20/day per user

Input parameters:

- `format` (string): Output format (default: markdown)
- `max_length` (number): Max output characters (default: 50000, max: 200000)
- `url` (string, required): URL to fetch (http:// or https://)

### `chaprola_schedule` (~139 tokens)

Create a scheduled job that runs a Chaprola endpoint on a recurring cron. Max 10 schedules/user, 15-min minimum interval

Input parameters:

- `body` (object, required): Request body for the target endpoint. userid is injected automatically
- `cron` (string, required): Standard 5-field cron expression (min hour day month weekday). Minimum interval: 15 minutes
- `endpoint` (string, required): Target endpoint to call
- `name` (string, required): Unique name for this schedule (alphanumeric + hyphens/underscores)
- `skip_if_unchanged` (boolean): Skip when response matches previous run (SHA-256 hash). Default: false

### `chaprola_schedule_list` (~26 tokens)

List all scheduled jobs for the authenticated user with run history and next execution time

### `chaprola_schedule_delete` (~30 tokens)

Delete a scheduled job by name

Input parameters:

- `name` (string, required): Name of the schedule to delete

### `chaprola_insert_record` (~78 tokens)

Insert a new record into a data file's merge file (.MRG). The record appears at the end of the file until consolidation.

Input parameters:

- `file` (string, required): Data file name (without extension)
- `project` (string, required): Project name
- `record` (object, required): Field name → value pairs. Unspecified fields default to blanks.

### `chaprola_update_record` (~98 tokens)

Update fields in a single record matched by a where clause. If no sort-key changes, updates in place; otherwise marks old record ignored and appends to merge file.

Input parameters:

- `file` (string, required): Data file name (without extension)
- `project` (string, required): Project name
- `set` (object, required): Field name → new value pairs to update
- `where` (object, required): Field name → value pairs to identify exactly one record

### `chaprola_delete_record` (~73 tokens)

Delete a single record matched by a where clause. Marks the record as ignored (.IGN). Physically removed on consolidation.

Input parameters:

- `file` (string, required): Data file name (without extension)
- `project` (string, required): Project name
- `where` (object, required): Field name → value pairs to identify exactly one record

### `chaprola_consolidate` (~74 tokens)

Merge a .MRG file into its parent .DA, producing a clean sorted data file. Deletes .MRG and .IGN after success. Aborts if .MRG was modified during the operation.

Input parameters:

- `file` (string, required): Data file name (without extension)
- `project` (string, required): Project name

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/cletcher-chaprola/chaprola-mcp-server#diagnostics

## Score history

- 2026-08-03: 71
- 2026-08-02: 67
- 2026-08-01: 70
- 2026-07-31: 26
- 2026-07-30: 53
- 2026-07-28: 24
- 2026-07-27: 53

## Links

- npm package: https://www.npmjs.com/package/@chaprola/mcp-server
- Socket report: https://socket.dev/npm/package/@chaprola/mcp-server
- Repository: https://github.com/cletcher/chaprola-mcp
- Changelog RSS feed: https://verifymcp.io/servers/cletcher-chaprola/chaprola-mcp-server/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/cletcher-chaprola/chaprola-mcp-server/changelog.json
- HTML version of this page: https://verifymcp.io/servers/cletcher-chaprola/chaprola-mcp-server