Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

LayerMap

NPM · LAYERMAP

Call graph for coding agents: callers up to HTTP routes, callees, usages for TS/JS, Go, Python, Java

Available components

52 Trust /100

Last scanned (4 hours ago)

Scores higher than 36% of npm servers

Category Code Search and Documentation

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security50
  • Malware scan not yet available for this package.Unverified
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • 0 of 24 dependencies flagged as unhealthy. View diagnostics → Pass
Provenance & Transparency48
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
  • Clear OSI-approved license (Apache-2.0).Pass
  • Actively maintained (last published 0 days ago).Pass
  • Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability54
  • AI-judged instruction clarity (good).Pass
  • Context-footprint check failed: tool/resource definitions use about 2160 tokens (~540/item across 4 items; 4 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management10
  • Stability observed for 3 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage80
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 41% of tool parameters carry a description.Partial
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 4 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 5 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 17 Oct 26 −14
    • Malware scan: pass → unverified ▼ security
    • Stability: unverified → 0.10 ▲ functional
    • Package version: 0.1.17 → 0.1.18 functional
  • 14 Oct 26 +26
    • Injection markers: unverified → pass ▲ security
    • First check of Judged manipulation: pass security
    • Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
    • Tool coverage: unverified → 100 ▲ functional
    • MCP protocol: unverified → pass ▲ functional
    • First check of Schema quality: fail functional
    • First check of Tool coverage: 41 functional
    • First check of Destructive annotations: pass functional
    • First check of Schema quality: fail functional
    • First check of Schema quality: good functional
  • 12 Oct 26 +15
    • Malware scan: unverified → pass ▲ security
    • Package version: 0.1.16 → 0.1.17 functional
  • 11 Oct 26 25

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 17 Oct 2026 · Analysed npm/layermap@0.1.18

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Dependencies 24 packages
Packages resolved 24
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 4 exposed · ~1,886 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
project_check_changes ~441

Use this once the edits are done, before reporting the work done: it lists what the uncommitted changes affect, from the changed functions up to the HTTP routes, jobs and commands that reach them, plus the existing tests related to them. Compares the working tree with a commit (HEAD by default, so uncommitted and untracked changes), finds the declarations the diff changed, removed or renamed, and follows their callers up to 8 levels. It reports, conclusion first: AFFECTED ENTRY POINTS reached through resolved calls, each route with its HTTP methods and full path and the chain to the change; POSSIBLY AFFECTED ones reached only through a call on an interface or base member; REQUESTED BY, the code and templates outside the tests that request the path of a route whose handler the change reaches or a route it removed, found by text; EXISTING TESTS CHANGED, the tests that existed before the diff and whose code it changed or removed; SHARED BY, when tests reach the changed code through more than one area (package or module), so a change meant for one feature may change others; NAMES STILL USED ELSEWHERE, environment variables and configuration keys the diff removed from a file that other files still read or set, found by text; CHECK BY HAND for what a static map cannot follow (changed configuration, templates, migrations or dependency files, changed route registrations, declarations with no callers, calls by name on receivers of unknown type); and RELATED TESTS, the existing test files that call the changed code, import a changed file or sit beside it. It does not run or write tests: run the related ones if the change needs verifying; a failing or rewritten test of a feature the request is not about means the change leaked, so restore the test and narrow the change; call it once when the edits are done; and confirm the entry points in source, since an empty list does not prove a change safe.

NameTypeReqDescription
basestring–Commit, branch or tag to compare the working tree with (HEAD, so the uncommitted changes, by default; main for a whole branch).

No output schema declared.

No examples provided.

project_explore_map ~859

Use this instead of grep to answer what calls a function or method, what changing it affects (callers traced up to entry points such as HTTP routes, handlers, jobs and commands), what it calls, and what a directory or file contains: one call returns the callers or callees up to 8 levels deep, with file paths and line numbers, for TypeScript, JavaScript, Go, Python and Java. Read the static project map, zooming from the whole project to one declaration. path "." or a directory lists modules, module imports, external packages and its files: with exported declarations when the listing is small, as file names and line counts by directory when larger, and as modules only when very large. Start here to see what exists before searching or reading. A file path lists its declarations and members, imports, importers and top-level statements. A file path with name (or Container.member), optionally narrowed by its start line, or with a line alone, shows that declaration's calls, callers (including uses as a value), writes, heritage, decorators and members, aggregated per related declaration with @line sites; closures and locals are folded into their named container. depth also expands the related declarations hop by hop: up to 8 in one direction, which traces callers up to entry points (INCOMING) or callees down (OUTGOING), and up to 3 for BOTH. To find what a change affects, select the declaration with direction INCOMING and a depth up to 8, continue from any NOT EXPANDED declarations the view names, then confirm the entry points in source. Test files and standard-library call targets are hidden and counted by default; includeTests and includeUnresolved show them. Views use kinds f function, c class, m method, p property, v variable, t type, i interface, e enum; numbers are 1-based source lines. In a declaration view, @n marks where a relationship occurs and +n counts further sites, which project_find_references lists; a quoted path after the sites is the route the call or va…

NameTypeReqDescription
depthinteger–Relationship hops for a declaration: up to 8 for INCOMING or OUTGOING (for example callers up to entry points), up to 3 for BOTH.
directionstring––
includeTestsboolean––
includeUnresolvedboolean––
lineinteger–Start line of a same-named declaration; without name, the declaration containing this line.
namestring–Declaration name or Container.member in the file, as printed by the map.
offsetinteger––
pathstring–"." or a directory for an overview, or a file for its declarations.

No output schema declared.

No examples provided.

project_find_references ~329

Use this to list every place a declaration is used (calls, imports, re-exports, reads and writes), compiled from current source: more complete than searching for its name. Compute usages of a mapped declaration from current source, including aliases, re-exports and non-call references. Select it with symbol {path,name,line?} as printed by project_explore_map or project_search_map (line is its start line when names repeat), or with an entityRef or locator {path,start,kind}. Broader and more expensive than the cached callers in project_explore_map; file or unsupported declarations may lack a reference target. path and kinds filter usage locations before paging. objects contains compact declarations; targetRef and reference ownerRef identify them. Read a reference at its line range. A file that several compiler contexts read (such as packages of one workspace) lists its references once per context, each with that context's configPath. Continue with nextCursor and unchanged conditions, including after an empty partial page. Filtered exhaustion and missing results do not prove absence.

NameTypeReqDescription
cursorstring––
entityRefstring––
kindsarray––
locatorobject–Declaration location: path and UTF-16 start offset; include kind to distinguish declarations at the same offset.
maxResultsinteger––
pathstring–Filter usage locations; compiler inputs and declarations may lie elsewhere in the project.
symbolobject–Declaration as printed by the map: file path, name or Container.member, and start line when names repeat.

No output schema declared.

No examples provided.

project_search_map ~257

Use this to find where a function, method, class or type is declared, by name or by words in its name, path or documentation, before exploring its callers with project_explore_map. Find declarations and files whose names, paths or source documentation match query terms. ANY (default) matches any term, ALL requires every term, LITERAL matches the exact text. Results are ranked by relevance and grouped by file with the declaration name, kind, 1-based line range and matched fields (kinds f function, c class, m method, p property, v variable, t type, i interface, e enum; numbers are 1-based source lines). Zoom into a result with project_explore_map({path,name}) or read its line range in the file. This is not a full-text search and does not prove absence; search the source text itself for exact text. Continue with offset and unchanged conditions.

NameTypeReqDescription
kindsarray––
matchModestring–ANY matches one or more query terms; ALL requires every term; LITERAL matches the complete text literally.
maxResultsinteger––
offsetinteger––
pathstring––
querystringyes–

No output schema declared.

No examples provided.

Install

How do I install the LayerMap MCP server?

LayerMap runs locally as an npm package, launched with npx -y layermap. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · layermap

# add to Claude Code
claude mcp add coffeecoproject-layermap -- npx -y layermap
Common questions

What is the LayerMap MCP server?

LayerMap is an MCP server listed in the public MCP registry as io.github.coffeecoproject/layermap. Call graph for coding agents: callers up to HTTP routes, callees, usages for TS/JS, Go, Python, Java. This page covers its npm package (layermap).

Is the LayerMap MCP server safe to use?

LayerMap scores 52 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 17 October 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the LayerMap MCP server expose?

LayerMap exposes 4 tools: project_explore_map, project_search_map, project_find_references, project_check_changes. Their descriptions and schemas cost roughly 1,886 tokens of context every time the server is loaded.

Is the LayerMap MCP server still maintained?

LayerMap is still listed as active in the MCP registry. We last reached this channel on 17 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the LayerMap MCP server under?

LayerMap declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.