Granoflow

NPM · @GRANOFLOW/MCP-SERVER · SCANNED AUG 3

Connect MCP-capable AI agents to local Granoflow tasks, reviews, cards, imports, and work memory.

Available components

+13 this week 56 56 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security87

No malware found by supply-chain analysis.Pass
Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.Partial
No install/post-install scripts declared.Pass
Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree. View diagnostics → Partial

Provenance & Transparency45

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
Clear OSI-approved license (MIT).Pass
Actively maintained (last published 5 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability40

AI-judged instruction clarity (poor).Fail
Tool/resource definitions use about 9272 tokens (~71/item across 129 items; 129 tools + 0 resources), lean.Pass
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management0

Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified

Tool Coverage74

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
22% of tool parameters carry a description.Partial

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Unverified: 1 category

A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · @granoflow/mcp-server

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add com-granoflow-mcp-server -- npx -y @granoflow/mcp-server

# add to Codex CLI

codex mcp add com-granoflow-mcp-server -- npx -y @granoflow/mcp-server

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-granoflow-mcp-server": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@granoflow/mcp-server"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add com-granoflow-mcp-server --command npx --arg -y --arg @granoflow/mcp-server

# ~/.hermes/config.yaml

mcp_servers:
  com-granoflow-mcp-server:
    command: "npx"
    args: ["-y", "@granoflow/mcp-server"]

// mcp.json

{
  "mcpServers": {
    "com-granoflow-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@granoflow/mcp-server"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

3 Aug 26 +7
- Known CVEs: unverified → partial ▲ security
- Schema quality: unverified → poor ▲ functional
2 Aug 26 +29
- Provenance: unverified → fail ▼ security
- Install scripts: unverified → pass ▲ security
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- Tool coverage: unverified → 100 ▲ functional
- License: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- Maintenance: unverified → pass ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Licence: MIT functional
1 Aug 26 −5
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
31 Jul 26 −18
- Malware scan: pass → unverified ▼ security
29 Jul 26 +19
- Tool coverage: unverified → 100 ▲ functional
28 Jul 26 −19
- Tool coverage: 100 → unverified ▼ functional
- First check of Schema quality: unverified functional
27 Jul 26 43

First indexed and scored.

Show 4 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/@granoflow/[email protected]

Provenance none

Ecosystem: npm · Outcome: none

Dependencies 95 packages

95 packages in the resolved dependency tree · 95 deprecated · 29 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 129 exposed · ~9,272 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

granoflow_agent_preferences_get ~74

Resolve compact Agent preferences from project YAML, MCP-local defaults, and newcomer-safe defaults. Project values win field by field. This read never grants push, publish, deploy, deletion, login, secret access, or destructive Git actions.

Input Output Examples

Name	Type	Req	Description
dryRun	boolean	—	—
projectId	string	—	—

No output schema declared.

No examples provided.

granoflow_agent_preferences_write_defaults ~59

Preview or write non-secret MCP-local Agent defaults. Per-project overrides remain in project_rules.yaml. Defaults to dry-run and returns a redacted readback.

Input Output Examples

Name	Type	Req	Description
dryRun	boolean	—	—
preferences	object	yes	—

No output schema declared.

No examples provided.

granoflow_agent_workflow_skill ~216

Read the bundled Granoflow Agent Workflow skill. Call this when a user works with Granoflow tasks, says 'Analyze the first task', says 'Start the first task', says 'Create a task from this requirement', says 'Process today's tasks', asks in their own language to analyze/start one selected task, create a task from a discussed requirement, or process tasks for a date/range/all-task scope, needs approval or missing information recorded in a task, finishes tasks, asks for weekly or monthly reviews, task reviews, review cards, historical context, decisions, lessons, similar past work, or long-term work memory, or politely/strongly signals that Granoflow/MCP/generated agent output is wrong or misaligned. Use granoflow_daily_review_skill for an explicitly requested daily review or mood/efficiency note, and granoflow_first_run_import_skill for first-run import from Cursor, Codex, Hermes, or other agents. Do not call it for unrelated venting or unrelated disagreement.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

granoflow_ai_agent_tools ~44

List Granoflow AI-agent tool contracts from the running app. Use with granoflow_agent_workflow_skill for task, review, and memory-style questions.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

granoflow_api_request ~74

Run an allowed Granoflow Local HTTP API request. Prefer dedicated tools when available.

Input Output Examples

Name	Type	Req	Description
dryRun	boolean	—	When true, previews write requests.
input	object	—	JSON object sent to the Granoflow Local HTTP API.
method	string	—	—
path	string	yes	—

No output schema declared.

No examples provided.

granoflow_bundled_skill_reference ~86

Read one public Markdown reference from a bundled Granoflow skill. Discover valid referenceId values from that skill's references manifest first. This read-only package operation does not call the Granoflow Local HTTP API or require an API token.

Input Output Examples

Name	Type	Req	Description
referenceId	string	yes	Reference identifier from the selected skill's references manifest.
skillId	string	yes	—

No output schema declared.

No examples provided.

granoflow_capabilities ~22

List capabilities exposed by the running Granoflow app.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

granoflow_context_pack ~109

Read a structured Granoflow work-memory context pack for the current agent task. Returns typed facts and match signals, not planning hints or recommendations.

Input Output Examples

Name	Type	Req	Description
client	string	—	—
dryRun	boolean	—	When true, previews the request without calling the app.
limit	integer	—	—
projectId	string	—	—
query	string	—	—
repo	string	—	—
scope	string	—	—
taskId	string	—	—

No output schema declared.

No examples provided.

granoflow_context_steward_status ~49

Read Granoflow project and milestone context-steward state, including active milestones and the archived-milestone final-snapshot policy.

Input Output Examples

Name	Type	Req	Description
projectId	string	—	—

No output schema declared.

No examples provided.

granoflow_daily_review_skill ~73

Read the bundled Granoflow Daily Review skill. Call this when a user explicitly asks to review, summarize, or journal one day, including mood or efficiency notes. It requires display of evidence and a draft, conversation and explicit confirmation, then write and App/API readback of only approved daily-review fields.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

granoflow_delegated_authorization_skill ~67

Read the bundled Granoflow Delegated Authorization skill. Use it when a user wants bounded unattended continuation or when a Task Work phase gate may consume a confirmed, current authorization envelope. The skill and its validator never infer consent from tags, urgency, or absence.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

granoflow_evidence_authoring_apply ~93

Apply only user-approved Evidence operations from a current preview and return App readback.

Input Output Examples

Name	Type	Req	Description
approvedOperationIds	array	yes	—
expectedTaskReviewHash	string	yes	—
expectedTaskReviewRevision	integer	yes	—
idempotencyKey	string	yes	—
previewHash	string	yes	—
previewToken	string	yes	—
taskId	string	yes	—

No output schema declared.

No examples provided.

granoflow_evidence_authoring_preview ~40

Preview Evidence candidates for a reviewed task with zero writes.

Input Output Examples

Name	Type	Req	Description
candidates	array	yes	—
taskId	string	yes	—

No output schema declared.

No examples provided.

granoflow_evidence_delete ~52

Delete existing Evidence after explicit confirmation. This does not run during sync or backup restore.

Input Output Examples

Name	Type	Req	Description
confirmed	boolean	yes	—
evidenceId	string	yes	—
expectedRevision	integer	yes	—

No output schema declared.

No examples provided.

granoflow_evidence_get ~32

Get one Evidence item with its task ownership and internal link.

Input Output Examples

Name	Type	Req	Description
evidenceId	string	yes	—

No output schema declared.

No examples provided.

granoflow_evidence_list ~34

List Evidence owned by one task, including source status and internal links.

Input Output Examples

Name	Type	Req	Description
taskId	string	yes	—

No output schema declared.

No examples provided.

granoflow_evidence_search ~42

Search the independent Evidence lane. The app reports vector or explicit degraded fallback status.

Input Output Examples

Name	Type	Req	Description
limit	integer	—	—
query	string	yes	—

No output schema declared.

No examples provided.

granoflow_evidence_update ~43

Edit existing Evidence with optimistic revision checking.

Input Output Examples

Name	Type	Req	Description
evidenceId	string	yes	—
expectedRevision	integer	yes	—
statement	string	yes	—

No output schema declared.

No examples provided.

granoflow_experience_authoring_apply ~60

Apply only user-approved Experience operations from a current preview.

Input Output Examples

Name	Type	Req	Description
approvedOperationIds	array	yes	—
idempotencyKey	string	yes	—
previewHash	string	yes	—
previewToken	string	yes	—

No output schema declared.

No examples provided.

granoflow_experience_authoring_preview ~51

Preview Experience distillation for a task or periodic review with zero writes.

Input Output Examples

Name	Type	Req	Description
candidates	array	yes	—
scopeId	string	yes	—
scopeType	string	yes	—

No output schema declared.

No examples provided.

granoflow_experience_delete ~67

Permanently delete an Experience and all relations after both impact and final confirmation.

Input Output Examples

Name	Type	Req	Description
expectedRevision	integer	yes	—
experienceId	string	yes	—
impactConfirmed	boolean	yes	—
permanentConfirmed	boolean	yes	—
previewHash	string	yes	—

No output schema declared.

No examples provided.

granoflow_experience_delete_impact ~35

Preview the full impact of permanently deleting an Experience with zero writes.

Input Output Examples

Name	Type	Req	Description
experienceId	string	yes	—

No output schema declared.

No examples provided.

granoflow_experience_get ~36

Get one Experience with provenance, task usages, Knowledge links, and merge redirect.

Input Output Examples

Name	Type	Req	Description
experienceId	string	yes	—

No output schema declared.

No examples provided.

granoflow_experience_list ~59

List independent Experience records, optionally for a daily, weekly, or monthly review scope.

Input Output Examples

Name	Type	Req	Description
limit	integer	—	—
offset	integer	—	—
periodKind	string	—	—
scopeId	string	—	—

No output schema declared.

No examples provided.

granoflow_experience_merge_apply ~75

Apply an approved Experience merge and return the stable redirect readback.

Input Output Examples

Name	Type	Req	Description
canonicalExperienceId	string	yes	—
confirmed	boolean	yes	—
expectedCanonicalRevision	integer	yes	—
expectedMergedRevision	integer	yes	—
mergedExperienceId	—	yes	—
previewHash	string	yes	—

No output schema declared.

No examples provided.

granoflow_experience_merge_preview ~41

Preview merging one Experience into a canonical Experience with zero writes.

Input Output Examples

Name	Type	Req	Description
canonicalExperienceId	string	yes	—
mergedExperienceId	—	yes	—

No output schema declared.

No examples provided.

granoflow_experience_search ~39

Search the independent Experience lane with explicit vector or degraded fallback status.

Input Output Examples

Name	Type	Req	Description
limit	integer	—	—
query	string	yes	—

No output schema declared.

No examples provided.

granoflow_experience_update ~77

Edit all required fields of an independent Experience with optimistic revision checking.

Input Output Examples

Name	Type	Req	Description
boundary	string	yes	—
conclusion	string	yes	—
context	string	yes	—
expectedRevision	integer	yes	—
experienceId	string	yes	—
nextAction	string	yes	—
rationale	string	yes	—

No output schema declared.

No examples provided.

granoflow_experience_usage_link ~59

Link or update a confirmed task usage for an Experience.

Input Output Examples

Name	Type	Req	Description
confirmed	boolean	yes	—
experienceId	string	yes	—
kind	string	yes	—
note	string	—	—
taskId	—	yes	—

No output schema declared.

No examples provided.

granoflow_experience_usage_unlink ~47

Unlink an Experience from one task without deleting Experience provenance.

Input Output Examples

Name	Type	Req	Description
confirmed	boolean	yes	—
experienceId	string	yes	—
taskId	—	yes	—

No output schema declared.

No examples provided.

granoflow_experience_usage_unlink_impact ~46

Preview whether unlinking an Experience from a task would leave it without task relations.

Input Output Examples

Name	Type	Req	Description
experienceId	string	yes	—
taskId	—	yes	—

No output schema declared.

No examples provided.

granoflow_first_run_import_skill ~111

Read the bundled Granoflow First-Run Import skill. Call this when a user says 'Initialize Granoflow', optionally asks to import data, or uses an equivalent request in their own language. The workflow checks the connection, offers all unavailable recommended AI capability collections using only their names and plain-language functions, and previews authorized Cursor, Codex, Hermes, or other agent records as projects, monthly milestones, tasks, review-card candidates, and context backfills before any requested import write.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

granoflow_gfmcp_candidates ~39

List pending Granoflow tasks tagged GFMCP. The tag marks eligibility but does not grant authorization for privileged or external actions.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

granoflow_gfmcp_prepare ~49

Create or repair the GFMCP custom tag and its app-localized task description template. Granoflow owns localization and idempotency.

Input Output Examples

Name	Type	Req	Description
dryRun	boolean	—	—

No output schema declared.

No examples provided.

granoflow_gfmcp_runner_skill ~48

Read the bundled GFMCP automatic task runner skill. Use it to install, operate, or diagnose the optional five-minute Python worker for pending tasks tagged GFMCP.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

granoflow_gfmcp_safe_sync ~55

Ask the Granoflow app to perform a safe pre-poll sync only when current authorization permits it. Defaults to dry-run and never guesses membership or key state.

Input Output Examples

Name	Type	Req	Description
dryRun	boolean	—	—

No output schema declared.

No examples provided.

granoflow_git_missing_notice_record ~56

Record that the one-time newcomer Git-unavailable notice was shown. This stores only a boolean marker and never installs Git or changes a repository.

Input Output Examples

Name	Type	Req	Description
dryRun	boolean	—	—
shown	boolean	—	—

No output schema declared.

No examples provided.

granoflow_health ~22

Check whether the Granoflow Local HTTP API is reachable.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

granoflow_historical_task_candidates ~102

Read App-owned historical task candidate facts and bounded evidence for one current task. The tool never ranks again or turns relationship facts into recommendations.

Input Output Examples

Name	Type	Req	Description
dryRun	boolean	—	When true, previews the request without calling the app.
errorText	string	—	—
limit	integer	—	—
module	string	—	—
paths	array	—	—
summary	string	—	—
taskId	string	yes	—

No output schema declared.

No examples provided.

granoflow_knowledge_assessment_apply ~63

Apply only approved Knowledge assessment operations; this does not materialize cards.

Input Output Examples

Name	Type	Req	Description
approvedOperationIds	array	yes	—
idempotencyKey	string	yes	—
previewHash	string	yes	—
previewToken	string	yes	—

No output schema declared.

No examples provided.

granoflow_knowledge_assessment_get ~33

Get one Knowledge assessment with typed source snapshots and freshness.

Input Output Examples

Name	Type	Req	Description
assessmentId	string	yes	—

No output schema declared.

No examples provided.

granoflow_knowledge_assessment_list ~22

List Knowledge eligibility assessments without creating cards.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

granoflow_knowledge_assessment_preview ~36

Preview eligibility, disposition, learning cost, and duplicate handling with zero writes.

Input Output Examples

Name	Type	Req	Description
candidates	array	yes	—

No output schema declared.

No examples provided.

granoflow_knowledge_control_apply ~63

Apply approved control evidence. Verified status remains App-owned and requires readback evidence.

Input Output Examples

Name	Type	Req	Description
idempotencyKey	string	yes	—
operationId	string	yes	—
previewHash	string	yes	—
previewToken	string	yes	—

No output schema declared.

No examples provided.

granoflow_knowledge_control_preview ~47

Preview implemented or verified system-control evidence with zero writes.

Input Output Examples

Name	Type	Req	Description
evidence	object	yes	—
materializationId	string	yes	—
status	string	yes	—

No output schema declared.

No examples provided.

granoflow_knowledge_materialization_apply ~63

Apply approved Knowledge materializations atomically and return Note/Card readback.

Input Output Examples

Name	Type	Req	Description
approvedOperationIds	array	yes	—
idempotencyKey	string	yes	—
previewHash	string	yes	—
previewToken	string	yes	—

No output schema declared.

No examples provided.

granoflow_knowledge_materialization_get ~40

Get one Knowledge materialization with Note, Cards, source health, and control evidence.

Input Output Examples

Name	Type	Req	Description
materializationId	string	yes	—

No output schema declared.

No examples provided.

granoflow_knowledge_materialization_list ~27

List approved Knowledge materializations backed by existing Review Notes and Cards.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

granoflow_knowledge_materialization_preview ~37

Preview atomic Knowledge Note/Card creation or existing-Knowledge reuse with zero writes.

Input Output Examples

Name	Type	Req	Description
candidates	array	yes	—

No output schema declared.

No examples provided.

granoflow_logical_attachment_read ~71

Read bounded Markdown or YAML content and App-owned SHA-256 for one current logical attachment. Acceptance HTML is previewed by the App and uses replace-response hash readback.

Input Output Examples

Name	Type	Req	Description
attachmentId	string	yes	—
entityId	string	yes	—
entityType	string	yes	—

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

27 Jul 3 Aug