# LayerMap (npm · layermap)

Call graph for coding agents: callers up to HTTP routes, callees, usages for TS/JS, Go, Python, Java

- Trust score: 52/100 (low)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-10-17

## Components

- npm · `layermap`: 52/100 (this document), [markdown](https://verifymcp.io/servers/coffeecoproject-layermap/layermap.md), [page](https://verifymcp.io/servers/coffeecoproject-layermap/layermap)

## Channel facts

- Registry: `npm`
- Package: `layermap`
- Version: `0.1.18`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-10-17.

- **Supply Chain Security**: 50/100
  - Malware scan not yet available for this package.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 0 of 24 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 48/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (Apache-2.0).
  - Actively maintained (last published 0 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 54/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 2160 tokens (~540/item across 4 items; 4 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 10/100
  - Stability observed for 3 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 80/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 41% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 4 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 5 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the LayerMap MCP server?

LayerMap runs locally as an npm package, launched with npx -y layermap. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add coffeecoproject-layermap -- npx -y layermap
```

### Cursor

```json
{
  "mcpServers": {
    "coffeecoproject-layermap": {
      "command": "npx",
      "args": [
        "-y",
        "layermap"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "coffeecoproject-layermap": {
      "command": "npx",
      "args": [
        "-y",
        "layermap"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add coffeecoproject-layermap -- npx -y layermap
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "coffeecoproject-layermap": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "layermap"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add coffeecoproject-layermap --command npx --arg -y --arg layermap
```

### Hermes

```yaml
mcp_servers:
  coffeecoproject-layermap:
    command: "npx"
    args: ["-y", "layermap"]
```

### Netclaw

```json
{
  "McpServers": {
    "coffeecoproject-layermap": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "layermap"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add coffeecoproject-layermap -t stdio -c npx -a -y layermap
```

### Other

```json
{
  "mcpServers": {
    "coffeecoproject-layermap": {
      "command": "npx",
      "args": [
        "-y",
        "layermap"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-17 (score 52, −14)

- [security regression] Malware scan: pass → unverified
- [functional improvement] Stability: unverified → 0.10
- [functional] Package version: 0.1.17 → 0.1.18

### 2026-10-14 (score 66, +26)

- [security improvement] Injection markers: unverified → pass
- [security] First check of Judged manipulation: pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] MCP protocol: unverified → pass
- [functional] First check of Schema quality: fail
- [functional] First check of Tool coverage: 41
- [functional] First check of Destructive annotations: pass
- [functional] First check of Schema quality: fail
- [functional] First check of Schema quality: good

### 2026-10-12 (score 40, +15)

- [security improvement] Malware scan: unverified → pass
- [functional] Package version: 0.1.16 → 0.1.17

### 2026-10-11 (score 25)

First indexed and scored.

## MCP tools (4)

### `project_explore_map` (~859 tokens)

Callers, callees and impact of a change (LayerMap)

Use this instead of grep to answer what calls a function or method, what changing it affects (callers traced up to entry points such as HTTP routes, handlers, jobs and commands), what it calls, and what a directory or file contains: one call returns the callers or callees up to 8 levels deep, with file paths and line numbers, for TypeScript, JavaScript, Go, Python and Java. Read the static project map, zooming from the whole project to one declaration. path "." or a directory lists modules, module imports, external packages and its files: with exported declarations when the listing is small, as file names and line counts by directory when larger, and as modules only when very large. Start here to see what exists before searching or reading. A file path lists its declarations and members, imports, importers and top-level statements. A file path with name (or Container.member), optionally narrowed by its start line, or with a line alone, shows that declaration's calls, callers (including uses as a value), writes, heritage, decorators and members, aggregated per related declaration with @line sites; closures and locals are folded into their named container. depth also expands the related declarations hop by hop: up to 8 in one direction, which traces callers up to entry points (INCOMING) or callees down (OUTGOING), and up to 3 for BOTH. To find what a change affects, select the declaration with direction INCOMING and a depth up to 8, continue from any NOT EXPANDED declarations the view names, then confirm the entry points in source. Test files and standard-library call targets are hidden and counted by default; includeTests and includeUnresolved show them. Views use kinds f function, c class, m method, p property, v variable, t type, i interface, e enum; numbers are 1-based source lines. In a declaration view, @n marks where a relationship occurs and +n counts further sites, which project_find_references lists; a quoted path after the sites is the route the call or va…

Input parameters:

- `depth` (integer): Relationship hops for a declaration: up to 8 for INCOMING or OUTGOING (for example callers up to entry points), up to 3 for BOTH.
- `direction` (string)
- `includeTests` (boolean)
- `includeUnresolved` (boolean)
- `line` (integer): Start line of a same-named declaration; without name, the declaration containing this line.
- `name` (string): Declaration name or Container.member in the file, as printed by the map.
- `offset` (integer)
- `path` (string): "." or a directory for an overview, or a file for its declarations.

### `project_search_map` (~257 tokens)

Find a declaration (LayerMap)

Use this to find where a function, method, class or type is declared, by name or by words in its name, path or documentation, before exploring its callers with project_explore_map. Find declarations and files whose names, paths or source documentation match query terms. ANY (default) matches any term, ALL requires every term, LITERAL matches the exact text. Results are ranked by relevance and grouped by file with the declaration name, kind, 1-based line range and matched fields (kinds f function, c class, m method, p property, v variable, t type, i interface, e enum; numbers are 1-based source lines). Zoom into a result with project_explore_map({path,name}) or read its line range in the file. This is not a full-text search and does not prove absence; search the source text itself for exact text. Continue with offset and unchanged conditions.

Input parameters:

- `kinds` (array)
- `matchMode` (string): ANY matches one or more query terms; ALL requires every term; LITERAL matches the complete text literally.
- `maxResults` (integer)
- `offset` (integer)
- `path` (string)
- `query` (string, required)

### `project_find_references` (~329 tokens)

All usages of a declaration (LayerMap)

Use this to list every place a declaration is used (calls, imports, re-exports, reads and writes), compiled from current source: more complete than searching for its name. Compute usages of a mapped declaration from current source, including aliases, re-exports and non-call references. Select it with symbol {path,name,line?} as printed by project_explore_map or project_search_map (line is its start line when names repeat), or with an entityRef or locator {path,start,kind}. Broader and more expensive than the cached callers in project_explore_map; file or unsupported declarations may lack a reference target. path and kinds filter usage locations before paging. objects contains compact declarations; targetRef and reference ownerRef identify them. Read a reference at its line range. A file that several compiler contexts read (such as packages of one workspace) lists its references once per context, each with that context's configPath. Continue with nextCursor and unchanged conditions, including after an empty partial page. Filtered exhaustion and missing results do not prove absence.

Input parameters:

- `cursor` (string)
- `entityRef` (string)
- `kinds` (array)
- `locator` (object): Declaration location: path and UTF-16 start offset; include kind to distinguish declarations at the same offset.
- `maxResults` (integer)
- `path` (string): Filter usage locations; compiler inputs and declarations may lie elsewhere in the project.
- `symbol` (object): Declaration as printed by the map: file path, name or Container.member, and start line when names repeat.

### `project_check_changes` (~441 tokens)

What uncommitted changes affect (LayerMap)

Use this once the edits are done, before reporting the work done: it lists what the uncommitted changes affect, from the changed functions up to the HTTP routes, jobs and commands that reach them, plus the existing tests related to them. Compares the working tree with a commit (HEAD by default, so uncommitted and untracked changes), finds the declarations the diff changed, removed or renamed, and follows their callers up to 8 levels. It reports, conclusion first: AFFECTED ENTRY POINTS reached through resolved calls, each route with its HTTP methods and full path and the chain to the change; POSSIBLY AFFECTED ones reached only through a call on an interface or base member; REQUESTED BY, the code and templates outside the tests that request the path of a route whose handler the change reaches or a route it removed, found by text; EXISTING TESTS CHANGED, the tests that existed before the diff and whose code it changed or removed; SHARED BY, when tests reach the changed code through more than one area (package or module), so a change meant for one feature may change others; NAMES STILL USED ELSEWHERE, environment variables and configuration keys the diff removed from a file that other files still read or set, found by text; CHECK BY HAND for what a static map cannot follow (changed configuration, templates, migrations or dependency files, changed route registrations, declarations with no callers, calls by name on receivers of unknown type); and RELATED TESTS, the existing test files that call the changed code, import a changed file or sit beside it. It does not run or write tests: run the related ones if the change needs verifying; a failing or rewritten test of a feature the request is not about means the change leaked, so restore the test and narrow the change; call it once when the edits are done; and confirm the entry points in source, since an empty list does not prove a change safe.

Input parameters:

- `base` (string): Commit, branch or tag to compare the working tree with (HEAD, so the uncommitted changes, by default; main for a whole branch).

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/coffeecoproject-layermap/layermap#diagnostics

## Score history

- 2026-10-17: 52
- 2026-10-16: 66
- 2026-10-15: 66
- 2026-10-14: 66
- 2026-10-13: 40
- 2026-10-12: 40
- 2026-10-11: 25

## Common questions

### What is the LayerMap MCP server?

LayerMap is an MCP server listed in the public MCP registry as io.github.coffeecoproject/layermap. Call graph for coding agents: callers up to HTTP routes, callees, usages for TS/JS, Go, Python, Java. This page covers its npm package (layermap).

### Is the LayerMap MCP server safe to use?

LayerMap scores 52 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 17 October 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the LayerMap MCP server expose?

LayerMap exposes 4 tools: project_explore_map, project_search_map, project_find_references, project_check_changes. Their descriptions and schemas cost roughly 1,886 tokens of context every time the server is loaded.

### Is the LayerMap MCP server still maintained?

LayerMap is still listed as active in the MCP registry. We last reached this channel on 17 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the LayerMap MCP server under?

LayerMap declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/layermap
- Socket report: https://socket.dev/npm/package/layermap
- Repository: https://github.com/coffeecoproject/layermap
- Changelog RSS feed: https://verifymcp.io/servers/coffeecoproject-layermap/layermap.xml
- Changelog JSON feed: https://verifymcp.io/servers/coffeecoproject-layermap/layermap.json
- HTML version of this page: https://verifymcp.io/servers/coffeecoproject-layermap/layermap