Prism — Crossdeck
NPM · @CROSS-DECK/AI · 2 COMPONENTS · SCANNED AUG 3
Ask your app anything — revenue, errors, read-cost, growth — and get rendered charts back.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security87
- No malware found by supply-chain analysis.Pass
- Only part of the dependency tree could be resolved (97 of 101), so this covers what we could see, not the whole tree.Partial
- No install/post-install scripts declared.Pass
- Only part of the dependency tree could be resolved (97 of 101), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 27 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability45
- 0% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Fail
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2286 tokens (~175/item across 13 items; 11 tools + 2 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
- Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
- Supports UI / widget rendering.Pass
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
npm · @cross-deck/ai
claude mcp add com-cross-deck-prism -- npx -y @cross-deck/ai
codex mcp add com-cross-deck-prism -- npx -y @cross-deck/ai
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"com-cross-deck-prism": {
"type": "local",
"command": [
"npx",
"-y",
"@cross-deck/ai"
],
"enabled": true
}
}
} openclaw mcp add com-cross-deck-prism --command npx --arg -y --arg @cross-deck/ai
mcp_servers:
com-cross-deck-prism:
command: "npx"
args: ["-y", "@cross-deck/ai"] {
"mcpServers": {
"com-cross-deck-prism": {
"command": "npx",
"args": [
"-y",
"@cross-deck/ai"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 3 Aug 26 +4
- Stability: unverified → 0.27 ▲ functional
- 2 Aug 26 +15
- Provenance: unverified → fail ▼ security
- Known CVEs: unverified → partial ▲ security
- Install scripts: unverified → pass ▲ security
- Maintenance: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- License: unverified → pass ▲ functional
- Licence: MIT functional
- 1 Aug 26 +12
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 30 Jul 26 −40
- Known CVEs: partial → unverified ▼ security
- Malware scan: pass → unverified ▼ security
- Provenance: fail → unverified ▼ security
- Install scripts: pass → unverified ▼ security
- License: pass → unverified ▼ functional
- Dependency health: partial → unverified ▼ functional
- Maintenance: pass → unverified ▼ functional
- Licence: MIT functional
- 29 Jul 26 +46
- Provenance: unverified → fail ▼ security
- Known CVEs: unverified → partial ▲ security
- Install scripts: unverified → pass ▲ security
- Maintenance: unverified → pass ▲ functional
- Schema quality: unverified → 0 ▲ functional
- License: unverified → pass ▲ functional
- Tool coverage: unverified → 100 ▲ functional
- Schema quality: unverified → excellent ▲ functional
- Licence: MIT functional
- 28 Jul 26 −16
- Schema quality: 0 → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Dependency health: unverified → partial ▲ functional
- 27 Jul 26 42
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 3 Aug 2026 · Analysed npm/@cross-deck/[email protected]
Provenance none
Ecosystem: npm · Outcome: none
Dependencies 97 packages
97 packages in the resolved dependency tree · 97 deprecated · 29 stale.
The dependency tree was only partially resolved, so these counts may be incomplete.
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
draw_user_growth Draw user growth over time ~173
Render an interactive line chart of unique visitors and page views over time for a host you own, and return the period totals as text. Returns a rendered chart in MCP-Apps-capable hosts (a text summary elsewhere) plus the totals. Use when asked to chart, graph, draw, or visualize growth or traffic for a subdomain. The host must be a verified origin of the project, or the request is rejected.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | — | Look-back window in days (1–90, default 30). |
| host | string | yes | The host to chart, e.g. 'wes.example.com'. Must be a verified origin of the selected app. |
| project | string | — | The app to read (its project id, from list_projects). Required with a workspace key unless set via use_project. |
No output schema declared.
No examples provided.
get_customer Get a customer's full picture ~286
Cross-match one customer across every layer Crossdeck joins by identity. Returns what they pay (monthly cents), their active entitlement count, and their database read-cost — in one view. Identify the person by ANY ONE of the identifiers below; they all resolve to the same canonical customer. Use for 'how much does this user pay and what do they cost us?'. If no customer resolves, returns a no-match result, not an error.
| Name | Type | Req | Description |
|---|---|---|---|
| anonymousId | string | — | A pre-login anonymous/device id captured before the user signed in. |
| appleOriginalTransactionId | string | — | Apple StoreKit originalTransactionId for the customer's purchase. |
| customerId | string | — | A Crossdeck customer id ('cdcust_…'). |
| googlePurchaseToken | string | — | Google Play purchase token for the customer's purchase. |
| project | string | — | The app to read, as a project id from list_projects (e.g. 'proj_3a8f137bccdd4f'). With a workspace key (cd_wk_) this is required unless you've set a default via use_project; with a single-app key it… |
| stripeCustomerId | string | — | Stripe customer id ('cus_…'). |
| userId | string | — | Your own user id for this person — the value you pass to identify() in the SDK (e.g. 'user_847'). |
No output schema declared.
No examples provided.
get_error_affected_users Get who an error hit and what they pay ~235
For one error (by fingerprint), get the PAYING users it actually hit — the row-level moat answer: which paying customer broke, and how much are they worth. Returns a list sorted by revenue at risk (highest first), each row with your own user id, monthly revenue in cents, and when they last hit the error. Joins the error layer to identity and revenue. Returns only your own identifiers — never emails or names you didn't provide. Use when you need the actual customers, not just the counts from get_error_impact.
| Name | Type | Req | Description |
|---|---|---|---|
| fingerprint | string | yes | The error's fingerprint / issue id (e.g. 'a1b2c3'). |
| limit | integer | — | Max users to return (1–100, default 25), highest revenue-at-risk first. |
| project | string | — | The app to read, as a project id from list_projects (e.g. 'proj_3a8f137bccdd4f'). With a workspace key (cd_wk_) this is required unless you've set a default via use_project; with a single-app key it… |
No output schema declared.
No examples provided.
get_error_impact Get an error's impact ~192
For one error (by fingerprint/issue id), get its blast radius joined to identity. Returns distinct users affected, how many of those are PAYING customers, and the error's type, status, occurrence count, and first/last-seen timestamps — counts only. Use to size an error's impact. For the NAMED paying users behind the counts (and their revenue at risk), call get_error_affected_users instead.
| Name | Type | Req | Description |
|---|---|---|---|
| fingerprint | string | yes | The error's fingerprint / issue id from the Crossdeck Errors view (e.g. 'a1b2c3'). |
| project | string | — | The app to read, as a project id from list_projects (e.g. 'proj_3a8f137bccdd4f'). With a workspace key (cd_wk_) this is required unless you've set a default via use_project; with a single-app key it… |
No output schema declared.
No examples provided.
get_host_analytics Get analytics for a host ~223
Get headless web analytics for one host/subdomain the app owns (e.g. a tenant's subdomain). Returns page views and unique visitors with totals; granularity='day' adds a daily series. The host MUST be a verified origin of the project, or the request is rejected (403). Use for per-tenant or per-subdomain traffic questions.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | — | Look-back window in days (1–90, default 30). |
| granularity | string | — | 'total' (default) for totals only, or 'day' for a daily series. |
| host | string | yes | The host to read, e.g. 'wes.example.com'. Must be a verified origin of the selected app. |
| project | string | — | The app to read, as a project id from list_projects (e.g. 'proj_3a8f137bccdd4f'). With a workspace key (cd_wk_) this is required unless you've set a default via use_project; with a single-app key it… |
No output schema declared.
No examples provided.
get_host_top_pages Get top pages or referrers for a host ~256
Get the top pages or top referrers for one host the app owns, ranked and paginated. Returns rows of { key, views } highest-first, where `key` is a page path (default) or a referrer. Set dimension='top_referrers' for traffic sources. The host must belong to the selected app. Use for 'most-viewed pages on this subdomain' or 'where its traffic comes from'.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | — | Look-back window in days (1–90, default 30). |
| dimension | string | — | What to rank: 'top_pages' (default) or 'top_referrers'. |
| host | string | yes | The host to read, e.g. 'wes.example.com'. Must belong to the selected app. |
| limit | integer | — | Max rows to return (1–100, default 25), highest-first. |
| project | string | — | The app to read, as a project id from list_projects (e.g. 'proj_3a8f137bccdd4f'). With a workspace key (cd_wk_) this is required unless you've set a default via use_project; with a single-app key it… |
No output schema declared.
No examples provided.
get_read_cost Get database read-cost ~185
Get an app's database read-cost over the last `days` days, split into per-user reads vs un-attributed overhead, plus a breakdown by operation. Per-user attribution works because Crossdeck joins read-cost to the SDK's identity, so you can see which operations drive the bill. Returns the per-user-vs-overhead totals and the by-operation breakdown. Use for 'what's driving our database reads' or 'which operation costs the most'.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | — | Look-back window in days (1–90, default 30). |
| project | string | — | The app to read, as a project id from list_projects (e.g. 'proj_3a8f137bccdd4f'). With a workspace key (cd_wk_) this is required unless you've set a default via use_project; with a single-app key it… |
No output schema declared.
No examples provided.
get_revenue Get revenue ~231
Get an app's recurring revenue from its maintained revenue ledger (a point-read, never a scan). Returns MRR in cents, the paying-customer count, and the per-rail split across Stripe, Apple, and Google; with granularity='day' it adds a daily time series over the window. Use for 'what's our MRR', 'how many paying customers', or revenue-trend questions. An app with no revenue yet returns zeros, not an error.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | — | Only with granularity='day': the trend window in days (1–366, default 90). |
| granularity | string | — | How to aggregate: 'total' (default) = the latest snapshot; 'day' = a daily time series across the window. |
| project | string | — | The app to read, as a project id from list_projects (e.g. 'proj_3a8f137bccdd4f'). With a workspace key (cd_wk_) this is required unless you've set a default via use_project; with a single-app key it… |
No output schema declared.
No examples provided.
list_projects List your apps ~94
List every app (project) in your Crossdeck portfolio that this connector can read — the same set your Pulse dashboard shows. Returns an array of { id, name } per app. Call this FIRST when a workspace key (cd_wk_) is connected, then pass an id to other tools or set a default with use_project. With a single-app key it returns just that one app. Read-only; takes no arguments.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
open_moat_dashboard Open the cross-layer dashboard ~258
Render a customer's cross-layer dashboard — what they pay (monthly), their active entitlements, and their database read-cost, joined by identity — and return the same as a text summary. Returns a rendered dashboard in MCP-Apps-capable hosts (a text summary elsewhere). Identify the customer by ANY ONE of the identifiers below; they all resolve to the same canonical customer. Use when asked to show, open, or visualize a customer's full picture. Returns a no-match result if no customer resolves.
| Name | Type | Req | Description |
|---|---|---|---|
| anonymousId | string | — | A pre-login anonymous/device id captured before sign-in. |
| appleOriginalTransactionId | string | — | Apple StoreKit originalTransactionId for the purchase. |
| customerId | string | — | A Crossdeck customer id ('cdcust_…'). |
| googlePurchaseToken | string | — | Google Play purchase token for the purchase. |
| project | string | — | The app to read (its project id, from list_projects). Required with a workspace key unless set via use_project. |
| stripeCustomerId | string | — | Stripe customer id ('cus_…'). |
| userId | string | — | Your own user id for this person — the value you pass to identify() (e.g. 'user_847'). |
No output schema declared.
No examples provided.
use_project Select the current app ~134
Set the current app for this conversation so later tools default to it without repeating `project`. Behaves as session state: it persists until you call this again and applies to every subsequent tool call. Returns { currentProject } — the project id now in effect. Use when the user says 'switch to <app>' or names an app to focus on; call list_projects first for valid ids. No effect with a single-app key (the project is fixed).
| Name | Type | Req | Description |
|---|---|---|---|
| project | string | yes | The project id to make current, copied from list_projects (e.g. 'proj_3a8f137bccdd4f'). |
No output schema declared.
No examples provided.