# Prism — Crossdeck (npm · @cross-deck/ai)

Ask your app anything — revenue, errors, read-cost, growth — and get rendered charts back.

- Trust score: 63/100 (medium)
- Change this week: +21
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `api.cross-deck.com`: 32/100, [markdown](https://verifymcp.io/servers/com-cross-deck-prism/api.md), [page](https://verifymcp.io/servers/com-cross-deck-prism/api)
- npm · `@cross-deck/ai`: 63/100 (this document), [markdown](https://verifymcp.io/servers/com-cross-deck-prism/cross-deck-ai.md), [page](https://verifymcp.io/servers/com-cross-deck-prism/cross-deck-ai)

## Channel facts

- Registry: `npm`
- Package: `@cross-deck/ai`
- Version: `0.3.2`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (97 of 101), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (97 of 101), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 27 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 45/100
  - 0% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 2286 tokens (~175/item across 13 items; 11 tools + 2 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.
  - Supports UI / widget rendering.

## Install

### Claude

```bash
claude mcp add com-cross-deck-prism -- npx -y @cross-deck/ai
```

### Codex

```bash
codex mcp add com-cross-deck-prism -- npx -y @cross-deck/ai
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-cross-deck-prism": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@cross-deck/ai"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add com-cross-deck-prism --command npx --arg -y --arg @cross-deck/ai
```

### Hermes

```yaml
mcp_servers:
  com-cross-deck-prism:
    command: "npx"
    args: ["-y", "@cross-deck/ai"]
```

### Other

```json
{
  "mcpServers": {
    "com-cross-deck-prism": {
      "command": "npx",
      "args": [
        "-y",
        "@cross-deck/ai"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 63, +4)

- [functional improvement] Stability: unverified → 0.27

### 2026-08-02 (score 59, +15)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] License: unverified → pass
- [functional] Licence: MIT

### 2026-08-01 (score 44, +12)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 32, −40)

- [security regression] Known CVEs: partial → unverified
- [security regression] Malware scan: pass → unverified
- [security regression] Provenance: fail → unverified
- [security regression] Install scripts: pass → unverified
- [functional regression] License: pass → unverified
- [functional regression] Dependency health: partial → unverified
- [functional regression] Maintenance: pass → unverified
- [functional] Licence: MIT

### 2026-07-29 (score 72, +46)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Schema quality: unverified → 0
- [functional improvement] License: unverified → pass
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] Schema quality: unverified → excellent
- [functional] Licence: MIT

### 2026-07-28 (score 26, −16)

- [functional regression] Schema quality: 0 → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] Dependency health: unverified → partial

### 2026-07-27 (score 42)

First indexed and scored.

## MCP tools (11)

### `list_projects` (~94 tokens)

List your apps

List every app (project) in your Crossdeck portfolio that this connector can read — the same set your Pulse dashboard shows. Returns an array of { id, name } per app. Call this FIRST when a workspace key (cd_wk_) is connected, then pass an id to other tools or set a default with use_project. With a single-app key it returns just that one app. Read-only; takes no arguments.

### `use_project` (~134 tokens)

Select the current app

Set the current app for this conversation so later tools default to it without repeating `project`. Behaves as session state: it persists until you call this again and applies to every subsequent tool call. Returns { currentProject } — the project id now in effect. Use when the user says 'switch to <app>' or names an app to focus on; call list_projects first for valid ids. No effect with a single-app key (the project is fixed).

Input parameters:

- `project` (string, required): The project id to make current, copied from list_projects (e.g. 'proj_3a8f137bccdd4f').

### `get_revenue` (~231 tokens)

Get revenue

Get an app's recurring revenue from its maintained revenue ledger (a point-read, never a scan). Returns MRR in cents, the paying-customer count, and the per-rail split across Stripe, Apple, and Google; with granularity='day' it adds a daily time series over the window. Use for 'what's our MRR', 'how many paying customers', or revenue-trend questions. An app with no revenue yet returns zeros, not an error.

Input parameters:

- `days` (integer): Only with granularity='day': the trend window in days (1–366, default 90).
- `granularity` (string): How to aggregate: 'total' (default) = the latest snapshot; 'day' = a daily time series across the window.
- `project` (string): The app to read, as a project id from list_projects (e.g. 'proj_3a8f137bccdd4f'). With a workspace key (cd_wk_) this is required unless you've set a default via use_project; with a single-app key it…

### `get_read_cost` (~185 tokens)

Get database read-cost

Get an app's database read-cost over the last `days` days, split into per-user reads vs un-attributed overhead, plus a breakdown by operation. Per-user attribution works because Crossdeck joins read-cost to the SDK's identity, so you can see which operations drive the bill. Returns the per-user-vs-overhead totals and the by-operation breakdown. Use for 'what's driving our database reads' or 'which operation costs the most'.

Input parameters:

- `days` (integer): Look-back window in days (1–90, default 30).
- `project` (string): The app to read, as a project id from list_projects (e.g. 'proj_3a8f137bccdd4f'). With a workspace key (cd_wk_) this is required unless you've set a default via use_project; with a single-app key it…

### `get_error_impact` (~192 tokens)

Get an error's impact

For one error (by fingerprint/issue id), get its blast radius joined to identity. Returns distinct users affected, how many of those are PAYING customers, and the error's type, status, occurrence count, and first/last-seen timestamps — counts only. Use to size an error's impact. For the NAMED paying users behind the counts (and their revenue at risk), call get_error_affected_users instead.

Input parameters:

- `fingerprint` (string, required): The error's fingerprint / issue id from the Crossdeck Errors view (e.g. 'a1b2c3').
- `project` (string): The app to read, as a project id from list_projects (e.g. 'proj_3a8f137bccdd4f'). With a workspace key (cd_wk_) this is required unless you've set a default via use_project; with a single-app key it…

### `get_error_affected_users` (~235 tokens)

Get who an error hit and what they pay

For one error (by fingerprint), get the PAYING users it actually hit — the row-level moat answer: which paying customer broke, and how much are they worth. Returns a list sorted by revenue at risk (highest first), each row with your own user id, monthly revenue in cents, and when they last hit the error. Joins the error layer to identity and revenue. Returns only your own identifiers — never emails or names you didn't provide. Use when you need the actual customers, not just the counts from get_error_impact.

Input parameters:

- `fingerprint` (string, required): The error's fingerprint / issue id (e.g. 'a1b2c3').
- `limit` (integer): Max users to return (1–100, default 25), highest revenue-at-risk first.
- `project` (string): The app to read, as a project id from list_projects (e.g. 'proj_3a8f137bccdd4f'). With a workspace key (cd_wk_) this is required unless you've set a default via use_project; with a single-app key it…

### `get_customer` (~286 tokens)

Get a customer's full picture

Cross-match one customer across every layer Crossdeck joins by identity. Returns what they pay (monthly cents), their active entitlement count, and their database read-cost — in one view. Identify the person by ANY ONE of the identifiers below; they all resolve to the same canonical customer. Use for 'how much does this user pay and what do they cost us?'. If no customer resolves, returns a no-match result, not an error.

Input parameters:

- `anonymousId` (string): A pre-login anonymous/device id captured before the user signed in.
- `appleOriginalTransactionId` (string): Apple StoreKit originalTransactionId for the customer's purchase.
- `customerId` (string): A Crossdeck customer id ('cdcust_…').
- `googlePurchaseToken` (string): Google Play purchase token for the customer's purchase.
- `project` (string): The app to read, as a project id from list_projects (e.g. 'proj_3a8f137bccdd4f'). With a workspace key (cd_wk_) this is required unless you've set a default via use_project; with a single-app key it…
- `stripeCustomerId` (string): Stripe customer id ('cus_…').
- `userId` (string): Your own user id for this person — the value you pass to identify() in the SDK (e.g. 'user_847').

### `get_host_analytics` (~223 tokens)

Get analytics for a host

Get headless web analytics for one host/subdomain the app owns (e.g. a tenant's subdomain). Returns page views and unique visitors with totals; granularity='day' adds a daily series. The host MUST be a verified origin of the project, or the request is rejected (403). Use for per-tenant or per-subdomain traffic questions.

Input parameters:

- `days` (integer): Look-back window in days (1–90, default 30).
- `granularity` (string): 'total' (default) for totals only, or 'day' for a daily series.
- `host` (string, required): The host to read, e.g. 'wes.example.com'. Must be a verified origin of the selected app.
- `project` (string): The app to read, as a project id from list_projects (e.g. 'proj_3a8f137bccdd4f'). With a workspace key (cd_wk_) this is required unless you've set a default via use_project; with a single-app key it…

### `get_host_top_pages` (~256 tokens)

Get top pages or referrers for a host

Get the top pages or top referrers for one host the app owns, ranked and paginated. Returns rows of { key, views } highest-first, where `key` is a page path (default) or a referrer. Set dimension='top_referrers' for traffic sources. The host must belong to the selected app. Use for 'most-viewed pages on this subdomain' or 'where its traffic comes from'.

Input parameters:

- `days` (integer): Look-back window in days (1–90, default 30).
- `dimension` (string): What to rank: 'top_pages' (default) or 'top_referrers'.
- `host` (string, required): The host to read, e.g. 'wes.example.com'. Must belong to the selected app.
- `limit` (integer): Max rows to return (1–100, default 25), highest-first.
- `project` (string): The app to read, as a project id from list_projects (e.g. 'proj_3a8f137bccdd4f'). With a workspace key (cd_wk_) this is required unless you've set a default via use_project; with a single-app key it…

### `draw_user_growth` (~173 tokens)

Draw user growth over time

Render an interactive line chart of unique visitors and page views over time for a host you own, and return the period totals as text. Returns a rendered chart in MCP-Apps-capable hosts (a text summary elsewhere) plus the totals. Use when asked to chart, graph, draw, or visualize growth or traffic for a subdomain. The host must be a verified origin of the project, or the request is rejected.

Input parameters:

- `days` (integer): Look-back window in days (1–90, default 30).
- `host` (string, required): The host to chart, e.g. 'wes.example.com'. Must be a verified origin of the selected app.
- `project` (string): The app to read (its project id, from list_projects). Required with a workspace key unless set via use_project.

### `open_moat_dashboard` (~258 tokens)

Open the cross-layer dashboard

Render a customer's cross-layer dashboard — what they pay (monthly), their active entitlements, and their database read-cost, joined by identity — and return the same as a text summary. Returns a rendered dashboard in MCP-Apps-capable hosts (a text summary elsewhere). Identify the customer by ANY ONE of the identifiers below; they all resolve to the same canonical customer. Use when asked to show, open, or visualize a customer's full picture. Returns a no-match result if no customer resolves.

Input parameters:

- `anonymousId` (string): A pre-login anonymous/device id captured before sign-in.
- `appleOriginalTransactionId` (string): Apple StoreKit originalTransactionId for the purchase.
- `customerId` (string): A Crossdeck customer id ('cdcust_…').
- `googlePurchaseToken` (string): Google Play purchase token for the purchase.
- `project` (string): The app to read (its project id, from list_projects). Required with a workspace key unless set via use_project.
- `stripeCustomerId` (string): Stripe customer id ('cus_…').
- `userId` (string): Your own user id for this person — the value you pass to identify() (e.g. 'user_847').

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/com-cross-deck-prism/cross-deck-ai#diagnostics

## Score history

- 2026-08-03: 63
- 2026-08-02: 59
- 2026-08-01: 44
- 2026-07-30: 32
- 2026-07-29: 72
- 2026-07-28: 26
- 2026-07-27: 42

## Links

- npm package: https://www.npmjs.com/package/@cross-deck/ai
- Socket report: https://socket.dev/npm/package/@cross-deck/ai
- Repository: https://github.com/CrossDeckHQ/crossdeck-prism
- Website: https://cross-deck.com/
- Changelog RSS feed: https://verifymcp.io/servers/com-cross-deck-prism/cross-deck-ai/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/com-cross-deck-prism/cross-deck-ai/changelog.json
- HTML version of this page: https://verifymcp.io/servers/com-cross-deck-prism/cross-deck-ai