Granoflow

NPM · @GRANOFLOW/MCP-SERVER · SCANNED AUG 3

Connect MCP-capable AI agents to local Granoflow tasks, reviews, cards, imports, and work memory.

Available components

+13 this week 56 56 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security87

No malware found by supply-chain analysis.Pass
Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.Partial
No install/post-install scripts declared.Pass
Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree. View diagnostics → Partial

Provenance & Transparency45

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
Clear OSI-approved license (MIT).Pass
Actively maintained (last published 5 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability40

AI-judged instruction clarity (poor).Fail
Tool/resource definitions use about 9272 tokens (~71/item across 129 items; 129 tools + 0 resources), lean.Pass
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management0

Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified

Tool Coverage74

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
22% of tool parameters carry a description.Partial

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Unverified: 1 category

A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · @granoflow/mcp-server

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add com-granoflow-mcp-server -- npx -y @granoflow/mcp-server

# add to Codex CLI

codex mcp add com-granoflow-mcp-server -- npx -y @granoflow/mcp-server

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-granoflow-mcp-server": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@granoflow/mcp-server"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add com-granoflow-mcp-server --command npx --arg -y --arg @granoflow/mcp-server

# ~/.hermes/config.yaml

mcp_servers:
  com-granoflow-mcp-server:
    command: "npx"
    args: ["-y", "@granoflow/mcp-server"]

// mcp.json

{
  "mcpServers": {
    "com-granoflow-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@granoflow/mcp-server"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

3 Aug 26 +7
- Known CVEs: unverified → partial ▲ security
- Schema quality: unverified → poor ▲ functional
2 Aug 26 +29
- Provenance: unverified → fail ▼ security
- Install scripts: unverified → pass ▲ security
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- Tool coverage: unverified → 100 ▲ functional
- License: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- Maintenance: unverified → pass ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Licence: MIT functional
1 Aug 26 −5
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
31 Jul 26 −18
- Malware scan: pass → unverified ▼ security
29 Jul 26 +19
- Tool coverage: unverified → 100 ▲ functional
28 Jul 26 −19
- Tool coverage: 100 → unverified ▼ functional
- First check of Schema quality: unverified functional
27 Jul 26 43

First indexed and scored.

Show 4 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/@granoflow/[email protected]

Provenance none

Ecosystem: npm · Outcome: none

Dependencies 95 packages

95 packages in the resolved dependency tree · 95 deprecated · 29 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 129 exposed · ~9,272 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

granoflow_logical_attachment_replace ~115

Replace the current typed project, milestone, or task artifact and require App-owned SHA-256 readback before it becomes current.

Input Output Examples

Name	Type	Req	Description
dryRun	boolean	—	—
entityId	string	yes	—
entityType	string	yes	—
expectedUpdatedAt	string	yes	—
filePath	string	yes	—
idempotencyKey	string	yes	—
logicalSlot	string	yes	—
visualConfirmed	boolean	—	Must be true when logicalSlot is ui_prototype.

No output schema declared.

No examples provided.

granoflow_memory_batch_preview ~92

Ask the running Granoflow app to preview an AI-agent memory batch before any write. Granoflow owns project/milestone matching and duplicate signals; this MCP tool only forwards after capability checks.

Input Output Examples

Name	Type	Req	Description
dryRun	boolean	—	When true, previews the HTTP request without calling the app.
items	array	yes	—
source	object	—	—
target	object	—	—

No output schema declared.

No examples provided.

granoflow_milestone_context_archive ~114

Preview a milestone archive context closure: final milestone state plus parent project description update. Real writes fail closed until the app exposes a safe archive API.

Input Output Examples

Name	Type	Req	Description
closure	object	yes	—
confirmArchive	boolean	—	Reserved for future safe archive writes; dry-run remains the normal mode.
dryRun	boolean	—	When true, previews the closure without writing.
milestoneId	string	yes	Granoflow milestone id.
projectId	string	yes	Parent Granoflow project id.

No output schema declared.

No examples provided.

granoflow_milestone_context_update ~100

Update only an active Granoflow milestone description as living context. Fails closed for archived milestones and defaults to dry-run.

Input Output Examples

Name	Type	Req	Description
description	string	yes	—
dryRun	boolean	—	When true, previews the request without writing.
evidenceSummary	string	yes	Short evidence summary for why this context description changed.
milestoneId	string	yes	Granoflow milestone id.
projectId	string	—	—

No output schema declared.

No examples provided.

granoflow_milestone_create ~135

Create a Granoflow milestone with common structured fields. When dueAt is omitted, defaults to the next available Saturday for the project. Defaults to dry-run.

Input Output Examples

Name	Type	Req	Description
description	string	—	—
dryRun	boolean	—	When true, previews the request without writing.
dueAt	string	—	Explicit deadline. When omitted, uses the next local Saturday at 23:59:59.000 and advances by whole weeks past existing deadlines in the same project.
projectId	string	yes	Granoflow project id.
status	string	—	—
title	string	yes	—

No output schema declared.

No examples provided.

granoflow_milestone_delete ~71

Safely delete a Granoflow milestone. Defaults to dry-run and requires confirmTitle for writes.

Input Output Examples

Name	Type	Req	Description
allowLinkedTasks	boolean	—	—
confirmTitle	string	—	—
dryRun	boolean	—	—
milestoneId	string	yes	Granoflow milestone id.

No output schema declared.

No examples provided.

granoflow_milestone_experiences ~34

List independent Experience records derived from tasks in one milestone.

Input Output Examples

Name	Type	Req	Description
milestoneId	string	yes	—

No output schema declared.

No examples provided.

granoflow_milestone_knowledge_usages ~42

List Knowledge actually adopted by tasks in one milestone. The result is read-only and derived.

Input Output Examples

Name	Type	Req	Description
milestoneId	string	yes	—

No output schema declared.

No examples provided.

granoflow_milestone_list ~19

List Granoflow milestones.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

granoflow_milestone_resolve ~59

Resolve Granoflow milestone candidates by title without creating or updating data.

Input Output Examples

Name	Type	Req	Description
includeDone	boolean	—	—
matchMode	string	—	—
projectId	string	—	—
query	string	yes	—

No output schema declared.

No examples provided.

granoflow_milestone_update ~116

Update a Granoflow milestone with common structured fields. Defaults to dry-run. Use granoflow_milestone_context_update for description upkeep; description updates fail closed for archived milestones.

Input Output Examples

Name	Type	Req	Description
description	string	—	—
dryRun	boolean	—	When true, previews the request without writing.
dueAt	string	—	—
milestoneId	string	yes	Granoflow milestone id.
projectId	string	—	—
status	string	—	—
title	string	—	—

No output schema declared.

No examples provided.

granoflow_milestone_workflow_skill ~79

Read the bundled Granoflow Milestone Workflow skill. Use it when one delegated outcome spans multiple child tasks and needs a stable milestone charter, evolving task portfolio, dependency and handoff coordination, bounded authorization, replanning, cross-task integration evidence, and milestone-level acceptance before closure. Child implementation remains owned by Task Work.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

granoflow_persistent_milestone_runner_skill ~78

Read the bundled provider-neutral Granoflow Persistent Milestone Runner skill. Use it for restart-safe milestone execution with leases, heartbeat, bounded attempt history, no-progress replanning, resumable interaction nodes, explicit authorization manifests, and evidence-gated completion. A separate user Skill may choose the worker command or model.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

granoflow_project_context_attachment_read ~113

Read a bounded section of project_snapshot.yaml or project_rules.yaml. Defaults to header, summary, and the smallest matching section; full read requires explicit intent.

Input Output Examples

Name	Type	Req	Description
allowFullRead	boolean	—	—
attachment	string	—	—
dryRun	boolean	—	When true, previews the HTTP request without calling the app.
intent	string	—	—
projectId	string	yes	Granoflow project id.
query	string	—	—
section	string	—	—

No output schema declared.

No examples provided.

granoflow_project_context_attachment_reconcile ~74

Check or reconcile project context YAML freshness. Low-risk factual snapshot deltas can reconcile; rules and wording conflicts return a proposal.

Input Output Examples

Name	Type	Req	Description
attachment	string	—	—
dryRun	boolean	—	When true, previews reconcile without writing.
projectId	string	yes	Granoflow project id.

No output schema declared.

No examples provided.

granoflow_project_context_attachment_write ~110

Write a project context YAML attachment through app-owned safety gates. project_rules.yaml requires confirmation; secret/privacy risks fail closed.

Input Output Examples

Name	Type	Req	Description
attachment	string	—	—
confirmed	boolean	—	Required for project_rules.yaml rule, wording, or decision-note changes.
content	string	yes	—
dryRun	boolean	—	When true, previews the HTTP request without calling the app.
projectId	string	yes	Granoflow project id.
section	string	—	—

No output schema declared.

No examples provided.

granoflow_project_context_attachments_ensure ~68

Ensure Granoflow canonical project context YAML attachments exist: project_snapshot.yaml and project_rules.yaml. Defaults to dry-run.

Input Output Examples

Name	Type	Req	Description
dryRun	boolean	—	When true, previews missing attachments without writing.
projectId	string	yes	Granoflow project id.

No output schema declared.

No examples provided.

granoflow_project_context_update ~87

Update only a Granoflow project description as living context. Defaults to dry-run and requires an evidence summary.

Input Output Examples

Name	Type	Req	Description
description	string	yes	—
dryRun	boolean	—	When true, previews the request without writing.
evidenceSummary	string	yes	Short evidence summary for why this context description changed.
projectId	string	yes	Granoflow project id.

No output schema declared.

No examples provided.

granoflow_project_create ~72

Create a Granoflow project with common structured fields. Defaults to dry-run.

Input Output Examples

Name	Type	Req	Description
description	string	—	—
domainTag	string	—	—
dryRun	boolean	—	When true, previews the request without writing.
status	string	—	—
title	string	yes	—

No output schema declared.

No examples provided.

granoflow_project_definition_skill ~57

Read the bundled Granoflow Project Definition skill. Use it to build or refine one Project Work YAML step by step or from a vague request, then gate manual and automatic project actions through App-owned readiness and artifact readback.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

granoflow_project_delete ~69

Safely delete a Granoflow project. Defaults to dry-run and requires confirmTitle for writes.

Input Output Examples

Name	Type	Req	Description
allowLinkedTasks	boolean	—	—
confirmTitle	string	—	—
dryRun	boolean	—	—
projectId	string	yes	Granoflow project id.

No output schema declared.

No examples provided.

granoflow_project_design_baseline_import ~115

Import one validated high-fidelity prototype package as the App-owned project design baseline. The App owns package validation, immutable versions, project linking, deduplication, and exact SHA-256 readback.

Input Output Examples

Name	Type	Req	Description
dryRun	boolean	—	—
filePath	string	yes	Absolute path to a local .zip package.
idempotencyKey	string	yes	—
projectId	string	yes	—
prototypeId	string	—	Existing App-owned prototype id when adding a new baseline version.

No output schema declared.

No examples provided.

granoflow_project_design_baseline_read ~65

Read back one exact App-owned project design baseline reference. Never guesses the latest version.

Input Output Examples

Name	Type	Req	Description
expectedPackageSha256	string	yes	—
projectId	string	yes	—
prototypeId	string	yes	—
versionId	string	yes	—

No output schema declared.

No examples provided.

granoflow_project_experiences ~32

List independent Experience records derived from tasks in one project.

Input Output Examples

Name	Type	Req	Description
projectId	string	yes	—

No output schema declared.

No examples provided.

granoflow_project_interaction_style ~62

Resolve the current project's explanation style. Missing or incomplete settings default to newcomer-friendly, detailed explanations; this tool never asks the user to choose.

Input Output Examples

Name	Type	Req	Description
dryRun	boolean	—	—
projectId	string	yes	Granoflow project id.

No output schema declared.

No examples provided.

granoflow_project_knowledge_usages ~40

List Knowledge actually adopted by tasks in one project. The result is read-only and derived.

Input Output Examples

Name	Type	Req	Description
projectId	string	yes	—

No output schema declared.

No examples provided.

granoflow_project_list ~17

List Granoflow projects.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

granoflow_project_resolve ~49

Resolve Granoflow project candidates by title without creating or updating data.

Input Output Examples

Name	Type	Req	Description
includeDone	boolean	—	—
matchMode	string	—	—
query	string	yes	—

No output schema declared.

No examples provided.

granoflow_project_update ~85

Update a Granoflow project with common structured fields. Defaults to dry-run.

Input Output Examples

Name	Type	Req	Description
description	string	—	—
domainTag	string	—	—
dryRun	boolean	—	When true, previews the request without writing.
projectId	string	yes	Granoflow project id.
status	string	—	—
title	string	—	—

No output schema declared.

No examples provided.

granoflow_project_work_confirm ~78

Confirm the exact current Project Work content hash in the App. Confirmation does not authorize execution, commit, push, publish, deploy, deletion, payment, or messaging.

Input Output Examples

Name	Type	Req	Description
confirmed	boolean	yes	—
dryRun	boolean	—	—
expectedContentSha256	string	yes	—
projectId	string	yes	—

No output schema declared.

No examples provided.

granoflow_project_work_evaluate ~71

Evaluate the current Project Work YAML for a manual or automatic action. Partial attachment is allowed; gated actions fail with all relevant missing paths.

Input Output Examples

Name	Type	Req	Description
action	string	yes	—
dryRun	boolean	—	—
projectId	string	yes	—
requiredPaths	array	—	—

No output schema declared.

No examples provided.

granoflow_review_card_authoring_apply ~80

Apply only user-approved operations from a current review-card authoring preview. Returns app-owned readback; never call without explicit approval of the previewed operations.

Input Output Examples

Name	Type	Req	Description
approvedFieldsByOperation	object	—	—
approvedOperationIds	array	yes	—
previewHash	string	yes	—
previewToken	string	yes	—

No output schema declared.

No examples provided.

granoflow_review_card_authoring_preview ~66

Preview controlled review-card creation, existing-card linking, or field-level updates for an existing project or inbox task. This endpoint performs no writes and returns a confirmation token plus shared-note impact.

Input Output Examples

Name	Type	Req	Description
operations	array	yes	—
taskId	string	yes	—

No output schema declared.

No examples provided.

granoflow_review_card_draft_schema ~55

Fetch the Granoflow review card draft template and field schema from the running app. Call before creating reviewCardDrafts so card types, note fields, layouts, and fallbacks match app import rules.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

granoflow_review_card_draft_skill ~70

Read the bundled core Granoflow review-card authoring skill. Call it for every lifecycle Card Checkpoint and every card search, link, create, or modification so similarity fallback, AI filtering, note quality, preview, approval, controlled writes, and readback use one workflow.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

granoflow_review_card_record ~101

Record a reusable review-card lesson through Granoflow's controlled work-memory API. The app may fail closed until controlled review-card import/create paths are available.

Input Output Examples

Name	Type	Req	Description
client	string	—	—
dryRun	boolean	—	When true, previews the request without writing.
problem	string	yes	—
solution	string	yes	—
source	object	—	—
tags	array	—	—
title	string	yes	—

No output schema declared.

No examples provided.

granoflow_review_card_similar ~71

Find potentially similar Granoflow review cards. The app prefers vector search and falls back to agent-supplied keywords; the agent must prefilter results before showing them to the user.

Input Output Examples

Name	Type	Req	Description
keywords	array	—	—
limit	integer	—	—
summary	string	yes	—

No output schema declared.

No examples provided.

granoflow_review_day_show ~35

Show a Granoflow daily review by date.

Input Output Examples

Name	Type	Req	Description
date	string	yes	Date in YYYY-MM-DD format.

No output schema declared.

No examples provided.

granoflow_setup_detect_local_api ~49

Probe a bounded localhost port list for Granoflow identity. This never scans all ports or writes config.

Input Output Examples

Name	Type	Req	Description
ports	array	—	—
timeoutMs	integer	—	—

No output schema declared.

No examples provided.

granoflow_setup_open_app ~103

Preview or open the installed Granoflow app after user approval. Uses a cross-process launch lease for real opens, and refuses if another MCP launch is in progress, any Granoflow process is already running, or process state cannot be verified, even when the configured Local HTTP API URL or port is unreachable. Defaults to dry-run.

Input Output Examples

Name	Type	Req	Description
appName	string	—	—
appPath	string	—	—
dryRun	boolean	—	—

No output schema declared.

No examples provided.

granoflow_setup_open_config ~43

Create and optionally open the MCP-owned non-secret Granoflow config file.

Input Output Examples

Name	Type	Req	Description
createIfMissing	boolean	—	—
open	boolean	—	—

No output schema declared.

No examples provided.

granoflow_setup_status ~26

Inspect Granoflow MCP config and Local HTTP API health without printing secrets.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

granoflow_setup_write_config ~70

Preview or write one user-confirmed MCP-owned non-secret Granoflow API URL or local port. Defaults to dry-run; writes are reread and verified immediately.

Input Output Examples

Name	Type	Req	Description
apiBaseUrl	string	—	—
apiPort	integer	—	—
dryRun	boolean	—	—

No output schema declared.

No examples provided.

granoflow_source_tags_ensure ~63

Ensure the AI and 人工 completion source tags exist in Granoflow. Idempotent: reuses existing tags matched by slug or label.

Input Output Examples

Name	Type	Req	Description
dryRun	boolean	—	When true, only inspects the current catalog without creating missing tags.

No output schema declared.

No examples provided.

granoflow_tag_create ~62

Create a custom Granoflow tag. Defaults to dry-run.

Input Output Examples

Name	Type	Req	Description
dryRun	boolean	—	When true, previews the request without writing.
iconKey	string	—	—
label	string	yes	—
slug	string	—	—

No output schema declared.

No examples provided.

granoflow_tag_list ~38

List tags from the Granoflow local catalog.

Input Output Examples

Name	Type	Req	Description
kind	string	—	Optional tag kind filter forwarded to the Local HTTP API.

No output schema declared.

No examples provided.

granoflow_task_attachment_add_markdown ~88

Conditionally attach a versioned Task Work Document, legacy Task Analysis/Plan, or Task Delivery Markdown file and verify App-owned content/hash readback.

Input Output Examples

Name	Type	Req	Description
dryRun	boolean	—	—
expectedTaskUpdatedAt	string	yes	—
filePath	string	yes	—
idempotencyKey	string	yes	—
taskId	string	yes	—

No output schema declared.

No examples provided.

granoflow_task_attachment_delete ~51

Delete a task attachment after explicit confirmation.

Input Output Examples

Name	Type	Req	Description
attachmentId	string	yes	—
confirmed	boolean	yes	—
dryRun	boolean	—	—
taskId	string	yes	—

No output schema declared.

No examples provided.

granoflow_task_attachment_list ~29

List attachments for a Granoflow task.

Input Output Examples

Name	Type	Req	Description
taskId	string	yes	—

No output schema declared.

No examples provided.

granoflow_task_attachment_read_markdown ~58

Read a bounded Task Work Document, legacy Task Analysis/Plan, or Task Delivery Markdown attachment with its App-owned SHA-256 for verification.

Input Output Examples

Name	Type	Req	Description
attachmentId	string	yes	—
taskId	string	yes	—

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

27 Jul 3 Aug