Granoflow
NPM · @GRANOFLOW/MCP-SERVER · SCANNED AUG 3
Connect MCP-capable AI agents to local Granoflow tasks, reviews, cards, imports, and work memory.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security87
- No malware found by supply-chain analysis.Pass
- Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.Partial
- No install/post-install scripts declared.Pass
- Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 5 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability40
- AI-judged instruction clarity (poor).Fail
- Tool/resource definitions use about 9272 tokens (~71/item across 129 items; 129 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage74
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 22% of tool parameters carry a description.Partial
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
npm · @granoflow/mcp-server
claude mcp add com-granoflow-mcp-server -- npx -y @granoflow/mcp-server
codex mcp add com-granoflow-mcp-server -- npx -y @granoflow/mcp-server
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"com-granoflow-mcp-server": {
"type": "local",
"command": [
"npx",
"-y",
"@granoflow/mcp-server"
],
"enabled": true
}
}
} openclaw mcp add com-granoflow-mcp-server --command npx --arg -y --arg @granoflow/mcp-server
mcp_servers:
com-granoflow-mcp-server:
command: "npx"
args: ["-y", "@granoflow/mcp-server"] {
"mcpServers": {
"com-granoflow-mcp-server": {
"command": "npx",
"args": [
"-y",
"@granoflow/mcp-server"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 3 Aug 26 +7
- Known CVEs: unverified → partial ▲ security
- Schema quality: unverified → poor ▲ functional
- 2 Aug 26 +29
- Provenance: unverified → fail ▼ security
- Install scripts: unverified → pass ▲ security
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- Tool coverage: unverified → 100 ▲ functional
- License: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- Maintenance: unverified → pass ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Licence: MIT functional
- 1 Aug 26 −5
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 31 Jul 26 −18
- Malware scan: pass → unverified ▼ security
- 29 Jul 26 +19
- Tool coverage: unverified → 100 ▲ functional
- 28 Jul 26 −19
- Tool coverage: 100 → unverified ▼ functional
- First check of Schema quality: unverified functional
- 27 Jul 26 43
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 3 Aug 2026 · Analysed npm/@granoflow/[email protected]
Provenance none
Ecosystem: npm · Outcome: none
Dependencies 95 packages
95 packages in the resolved dependency tree · 95 deprecated · 29 stale.
The dependency tree was only partially resolved, so these counts may be incomplete.
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
granoflow_task_complete ~85
Low-level node-less compatibility endpoint. Never call it for a task with Work Document nodes; NodeService owns completion for node-backed tasks.
| Name | Type | Req | Description |
|---|---|---|---|
| dryRun | boolean | — | When true, previews the request without writing. |
| input | object | — | JSON object sent to the Granoflow Local HTTP API. |
| taskId | string | yes | Granoflow task id. |
No output schema declared.
No examples provided.
granoflow_task_completion_record ~106
Record an engineering task completion through Granoflow's controlled work-memory API and existing task write/complete paths.
| Name | Type | Req | Description |
|---|---|---|---|
| client | string | — | — |
| decisions | array | — | — |
| dryRun | boolean | — | When true, previews the request without writing. |
| outcome | string | yes | — |
| repo | string | — | — |
| source | object | — | — |
| summary | string | yes | — |
| tags | array | — | — |
| title | string | yes | — |
No output schema declared.
No examples provided.
granoflow_task_completion_summary_update ~67
Safely update a task description that already preserves all user text and contains exactly one Task Completion Summary managed block.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | yes | — |
| dryRun | boolean | — | — |
| expectedUpdatedAt | string | yes | — |
| taskId | string | yes | — |
No output schema declared.
No examples provided.
granoflow_task_create ~185
Create a current Granoflow task from a JSON payload in pending state. Do not include createdAt, updatedAt, startedAt, endedAt, or deletedAt. AI execution keeps the task pending until its completion owner changes it to done and records its actual start through granoflow_task_history_mutate; status=doing is reserved for human focus. AI and automation callers must include input.authoringEvidence proving an action/outcome title, plain-language review, and exact real-analogy and concrete-example excerpts. Invalid evidence returns task_authoring_quality_failed before any task write. Tags not in the local catalog are skipped automatically. Optional completionSource attaches AI/人工 source tags for completed-work capture.
| Name | Type | Req | Description |
|---|---|---|---|
| dryRun | boolean | — | When true, previews the request without writing. |
| input | object | yes | JSON object sent to the Granoflow Local HTTP API. |
No output schema declared.
No examples provided.
granoflow_task_create_structured ~340
Create a current Granoflow task in pending state with common structured fields. Ordinary creation never accepts startedAt or other historical physical fields. AI execution stays pending until verified completion, records its actual start through granoflow_task_history_mutate, and never claims the human doing focus slot. AI and automation callers must provide authoringEvidence for an action/outcome title, plain-language review, and exact real-analogy and concrete-example excerpts. Invalid evidence returns task_authoring_quality_failed before any task write. For a milestone-bound task, choose dueAt from context, usually today, tomorrow, or the milestone deadline. Tags not in the local catalog are skipped automatically. Defaults to dry-run.
| Name | Type | Req | Description |
|---|---|---|---|
| authoringEvidence | object | — | Required for AI or automation task creation: declare an action/outcome title, plain-language review, and exact analogy/example excerpts from the description. |
| completionSource | string | — | When ai or human, attach the matching AI/人工 source tag after ensuring it exists. Omit or unknown means no source tag. |
| description | string | — | — |
| dryRun | boolean | — | When true, previews the request without writing. |
| dueAt | string | — | Task deadline. When milestoneId is supplied, choose from context, usually today, tomorrow, or the milestone deadline, and never silently place it after the milestone deadline. |
| milestoneId | string | — | — |
| projectId | string | — | — |
| remindAt | string | — | — |
| status | string | — | Ordinary current-task creation starts pending; omit or pass pending. |
| tags | array | — | — |
| title | string | yes | — |
No output schema declared.
No examples provided.
granoflow_task_export ~128
Export task details, reusable lessons, and App-admitted prototype inputs. The App is the sole execution-admission authority; this tool never guesses current or latest prototype versions.
| Name | Type | Req | Description |
|---|---|---|---|
| assetMode | string | — | Use file to request short-lived decrypted package paths. |
| fetchMissing | boolean | — | Allow the App to fetch a missing local package before export. |
| includePrototypes | boolean | — | Include structured prototype admission and admitted assets. |
| taskId | string | yes | Granoflow task id. |
| ttlSeconds | integer | — | Temporary prototype asset lifetime, capped at 600 seconds. |
No output schema declared.
No examples provided.
granoflow_task_finish ~355
Finish a node-less compatibility task after its required Delivery gate and verify status=done. For AI execution, keep the task pending until this completion action and supply the captured actual startedAt plus confirmed endedAt; never claim status=doing or substitute discussion/creation time. Human manual focus may already have an App-recorded start from doing. Do not use for node-backed tasks. taskReview/reviewCardDrafts remain legacy explicit-inline compatibility only; deferred Review is the default.
| Name | Type | Req | Description |
|---|---|---|---|
| completionSource | string | — | Defaults to ai when an agent finishes the task. Use human for clearly human-completed work, or unknown to skip source tags. |
| confirmComplete | boolean | — | Must be true when dryRun=false. |
| dryRun | boolean | — | When true, previews the update/complete/import/readback sequence. |
| endedAt | string | — | Task end time inferred from the current agent conversation, preferably ISO-like. |
| milestoneId | string | — | Required when taskReview or reviewCardDrafts are provided. |
| projectId | string | — | Required when taskReview or reviewCardDrafts are provided. |
| reviewCardDrafts | array | — | One card per durable knowledge point worth long-term memory; omit when there is nothing worth remembering. |
| startedAt | string | — | Actual execution start time. AI execution captures this while the task stays pending and supplies it at completion. Do not use task discussion or creation time. |
| summary | string | — | Short import summary for the completion, review, and card write. |
| taskId | string | yes | Granoflow task id. |
| taskReview | string | — | Meaningful task review only. Omit this when the content would be a mere activity log. |
No output schema declared.
No examples provided.
granoflow_task_history_mutate ~172
Write evidence-based task timestamps and historical Granoflow facts through the dedicated AI-agent API. AI execution may update startedAt while the task remains pending so it never claims the human doing focus slot; node-managed completion may correct startedAt/endedAt after status=done. Every create mutation requires shared AI/automation authoringEvidence for an action/outcome title, plain language, a real analogy, and a concrete example. Use dryRun first; when dryRun=false, the running app must advertise historical_task_mutations_v1.
| Name | Type | Req | Description |
|---|---|---|---|
| dryRun | boolean | — | When true, previews without writing. Set false only with explicit user approval. |
| mutations | array | yes | — |
| source | object | — | Source metadata such as {kind, threadId, summary, startedAt, endedAt}. |
No output schema declared.
No examples provided.
granoflow_task_import ~68
Import an AI-agent task result into Granoflow. Use dryRun first unless the user explicitly asks to write.
| Name | Type | Req | Description |
|---|---|---|---|
| dryRun | boolean | — | When true, previews the request without writing. |
| input | object | yes | JSON object sent to the Granoflow Local HTTP API. |
No output schema declared.
No examples provided.
granoflow_task_knowledge_adoption_apply ~74
Apply only approved adopted references and return Reference, Usage, and association readback.
| Name | Type | Req | Description |
|---|---|---|---|
| approvedOperationIds | array | yes | — |
| idempotencyKey | string | yes | — |
| previewHash | string | yes | — |
| previewToken | string | yes | — |
| taskId | string | yes | — |
No output schema declared.
No examples provided.
granoflow_task_knowledge_adoption_preview ~47
Preview adopted, considered, or rejected Knowledge Pack decisions. Only adopted operations can write.
| Name | Type | Req | Description |
|---|---|---|---|
| decisions | array | yes | — |
| taskId | string | yes | — |
No output schema declared.
No examples provided.
granoflow_task_knowledge_audit_apply ~71
Apply approved stale-reference removals while preserving applied Knowledge Usage history.
| Name | Type | Req | Description |
|---|---|---|---|
| approvedOperationIds | array | yes | — |
| idempotencyKey | string | yes | — |
| previewHash | string | yes | — |
| previewToken | string | yes | — |
| taskId | string | yes | — |
No output schema declared.
No examples provided.
granoflow_task_knowledge_audit_preview ~46
Preview removal of Task Work references no longer present in the fully rewritten document.
| Name | Type | Req | Description |
|---|---|---|---|
| desiredReferences | array | yes | — |
| taskId | string | yes | — |
No output schema declared.
No examples provided.
granoflow_task_knowledge_pack ~54
Build a zero-write task analysis pack with separate Evidence, Experience, and Knowledge lanes.
| Name | Type | Req | Description |
|---|---|---|---|
| limitPerLane | integer | — | — |
| query | string | yes | — |
| taskId | string | yes | — |
No output schema declared.
No examples provided.
granoflow_task_knowledge_references ~32
List current structured Task Work references for one task.
| Name | Type | Req | Description |
|---|---|---|---|
| taskId | string | yes | — |
No output schema declared.
No examples provided.
granoflow_task_knowledge_usage_apply ~70
Apply one approved Knowledge Usage status transition and preserve its append-only event.
| Name | Type | Req | Description |
|---|---|---|---|
| idempotencyKey | string | yes | — |
| operationId | string | yes | — |
| previewHash | string | yes | — |
| previewToken | string | yes | — |
| taskId | string | yes | — |
No output schema declared.
No examples provided.
granoflow_task_knowledge_usage_preview ~59
Preview referenced to applied, validated, or contradicted Knowledge Usage transition with evidence.
| Name | Type | Req | Description |
|---|---|---|---|
| evidence | object | yes | — |
| materializationId | — | yes | — |
| status | string | yes | — |
| taskId | string | yes | — |
No output schema declared.
No examples provided.
granoflow_task_list ~39
List tasks from Granoflow. Optionally filter by tag slug.
| Name | Type | Req | Description |
|---|---|---|---|
| tag | string | — | Return only tasks containing this tag slug. |
No output schema declared.
No examples provided.
granoflow_task_node_batch_create ~76
Atomically create an ordered, idempotent task node batch through the Granoflow NodeService.
| Name | Type | Req | Description |
|---|---|---|---|
| dryRun | boolean | — | — |
| expectedTaskUpdatedAt | string | yes | — |
| idempotencyKey | string | yes | — |
| nodes | array | yes | — |
| taskId | string | yes | — |
No output schema declared.
No examples provided.
granoflow_task_node_delete ~68
Soft-delete a task node tree after a confirmed Work Document amendment and explicit confirmation.
| Name | Type | Req | Description |
|---|---|---|---|
| confirmed | boolean | yes | — |
| dryRun | boolean | — | — |
| expectedUpdatedAt | string | yes | — |
| nodeId | string | yes | — |
| taskId | string | yes | — |
No output schema declared.
No examples provided.
granoflow_task_node_list ~41
Read the latest Granoflow task nodes before planning, executing, or reconciling cross-device changes.
| Name | Type | Req | Description |
|---|---|---|---|
| taskId | string | yes | — |
No output schema declared.
No examples provided.
granoflow_task_node_update ~74
Update a task node title or apply pending/finished status with optimistic concurrency.
| Name | Type | Req | Description |
|---|---|---|---|
| dryRun | boolean | — | — |
| expectedUpdatedAt | string | yes | — |
| nodeId | string | yes | — |
| status | string | — | — |
| taskId | string | yes | — |
| title | string | — | — |
No output schema declared.
No examples provided.
granoflow_task_orchestrator_skill ~85
Read the bundled context-aware Granoflow Task Orchestrator. Use it as the single upper-layer entrypoint when natural language or gf shortcuts may mean quick capture, context enrichment, Analysis, Planning, end-to-end local-safe execution, or completion audit. It delegates every phase to the existing workflow owners and never turns inferred intent into external or destructive authorization.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
granoflow_task_resolve ~65
Resolve Granoflow task candidates by title without creating or updating data.
| Name | Type | Req | Description |
|---|---|---|---|
| includeDone | boolean | — | — |
| matchMode | string | — | — |
| milestoneId | string | — | — |
| projectId | string | — | — |
| query | string | yes | — |
No output schema declared.
No examples provided.
granoflow_task_review_update ~78
Safely write a confirmed structured Task Review to any task, including completed inbox tasks, using the latest task revision. Review cards and context promotion remain separate controlled steps.
| Name | Type | Req | Description |
|---|---|---|---|
| dryRun | boolean | — | — |
| expectedUpdatedAt | string | yes | — |
| taskId | string | yes | — |
| taskReview | string | yes | — |
No output schema declared.
No examples provided.
granoflow_task_update ~132
Update a current Granoflow task through the Local HTTP API. Do not include historical physical fields. AI execution must not set status=doing: keep pending, record actual startedAt through granoflow_task_history_mutate, and complete through NodeService or granoflow_task_finish. Human manual focus may set doing. Tags not in the local catalog are skipped automatically.
| Name | Type | Req | Description |
|---|---|---|---|
| dryRun | boolean | — | When true, previews the request without writing. |
| input | object | yes | JSON object sent to the Granoflow Local HTTP API. |
| taskId | string | yes | Granoflow task id. |
No output schema declared.
No examples provided.
granoflow_task_update_structured ~229
Update a current Granoflow task with common structured fields. AI execution never sets status=doing: it remains pending until verified completion and writes actual execution time through granoflow_task_history_mutate. status=doing is for human manual focus and keeps the App-recorded start behavior. When moving it into a milestone, choose dueAt from context, usually today, tomorrow, or the milestone deadline. Defaults to dry-run.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | — | — |
| dryRun | boolean | — | When true, previews the request without writing. |
| dueAt | string | — | Task deadline. When milestoneId is supplied, choose from context, usually today, tomorrow, or the milestone deadline, and never silently place it after the milestone deadline. |
| expectedUpdatedAt | string | — | — |
| milestoneId | string | — | — |
| projectId | string | — | — |
| remindAt | string | — | — |
| status | string | — | — |
| taskId | string | yes | Granoflow task id. |
| taskReview | string | — | — |
| title | string | — | — |
No output schema declared.
No examples provided.
granoflow_task_validate ~43
Validate an AI-agent task result before importing it into Granoflow.
| Name | Type | Req | Description |
|---|---|---|---|
| input | object | yes | JSON object sent to the Granoflow Local HTTP API. |
No output schema declared.
No examples provided.
granoflow_version ~22
Show Granoflow app and Local HTTP API version metadata.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.