Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, email [email protected] and we’ll put it right.

Granoflow

NPM · @GRANOFLOW/MCP-SERVER · SCANNED AUG 3

Connect MCP-capable AI agents to local Granoflow tasks, reviews, cards, imports, and work memory.

+13 this week 56 Trust /100
Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security87
  • No malware found by supply-chain analysis.Pass
  • Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.Partial
  • No install/post-install scripts declared.Pass
  • Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency45
Schema Quality & AI Usability40
  • AI-judged instruction clarity (poor).Fail
  • Tool/resource definitions use about 9272 tokens (~71/item across 129 items; 129 tools + 0 resources), lean.Pass
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
  • Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage74
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 22% of tool parameters carry a description.Partial
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Unverified: 1 category

A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · @granoflow/mcp-server

# add to Claude Code
claude mcp add com-granoflow-mcp-server -- npx -y @granoflow/mcp-server
# add to Codex CLI
codex mcp add com-granoflow-mcp-server -- npx -y @granoflow/mcp-server
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-granoflow-mcp-server": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@granoflow/mcp-server"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add com-granoflow-mcp-server --command npx --arg -y --arg @granoflow/mcp-server
# ~/.hermes/config.yaml
mcp_servers:
  com-granoflow-mcp-server:
    command: "npx"
    args: ["-y", "@granoflow/mcp-server"]
// mcp.json
{
  "mcpServers": {
    "com-granoflow-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@granoflow/mcp-server"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 3 Aug 26 +7
    • Known CVEs: unverified → partial security
    • Schema quality: unverified → poor functional
  • 2 Aug 26 +29
    • Provenance: unverified → fail security
    • Install scripts: unverified → pass security
    • Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
    • Tool coverage: unverified → 100 functional
    • License: unverified → pass functional
    • Dependency health: unverified → partial functional
    • Maintenance: unverified → pass functional
    • MCP protocol: unverified → pass functional
    • Licence: MIT functional
  • 1 Aug 26 −5
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 31 Jul 26 −18
    • Malware scan: pass → unverified security
  • 29 Jul 26 +19
    • Tool coverage: unverified → 100 functional
  • 28 Jul 26 −19
    • Tool coverage: 100 → unverified functional
    • First check of Schema quality: unverified functional
  • 27 Jul 26 43

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/@granoflow/[email protected]

Provenance none

Ecosystem: npm · Outcome: none

Dependencies 95 packages

95 packages in the resolved dependency tree · 95 deprecated · 29 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 129 exposed · ~9,272 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens
granoflow_task_complete ~85

Low-level node-less compatibility endpoint. Never call it for a task with Work Document nodes; NodeService owns completion for node-backed tasks.

NameTypeReqDescription
dryRunbooleanWhen true, previews the request without writing.
inputobjectJSON object sent to the Granoflow Local HTTP API.
taskIdstringyesGranoflow task id.

No output schema declared.

No examples provided.

granoflow_task_completion_record ~106

Record an engineering task completion through Granoflow's controlled work-memory API and existing task write/complete paths.

NameTypeReqDescription
clientstring
decisionsarray
dryRunbooleanWhen true, previews the request without writing.
outcomestringyes
repostring
sourceobject
summarystringyes
tagsarray
titlestringyes

No output schema declared.

No examples provided.

granoflow_task_completion_summary_update ~67

Safely update a task description that already preserves all user text and contains exactly one Task Completion Summary managed block.

NameTypeReqDescription
descriptionstringyes
dryRunboolean
expectedUpdatedAtstringyes
taskIdstringyes

No output schema declared.

No examples provided.

granoflow_task_create ~185

Create a current Granoflow task from a JSON payload in pending state. Do not include createdAt, updatedAt, startedAt, endedAt, or deletedAt. AI execution keeps the task pending until its completion owner changes it to done and records its actual start through granoflow_task_history_mutate; status=doing is reserved for human focus. AI and automation callers must include input.authoringEvidence proving an action/outcome title, plain-language review, and exact real-analogy and concrete-example excerpts. Invalid evidence returns task_authoring_quality_failed before any task write. Tags not in the local catalog are skipped automatically. Optional completionSource attaches AI/人工 source tags for completed-work capture.

NameTypeReqDescription
dryRunbooleanWhen true, previews the request without writing.
inputobjectyesJSON object sent to the Granoflow Local HTTP API.

No output schema declared.

No examples provided.

granoflow_task_create_structured ~340

Create a current Granoflow task in pending state with common structured fields. Ordinary creation never accepts startedAt or other historical physical fields. AI execution stays pending until verified completion, records its actual start through granoflow_task_history_mutate, and never claims the human doing focus slot. AI and automation callers must provide authoringEvidence for an action/outcome title, plain-language review, and exact real-analogy and concrete-example excerpts. Invalid evidence returns task_authoring_quality_failed before any task write. For a milestone-bound task, choose dueAt from context, usually today, tomorrow, or the milestone deadline. Tags not in the local catalog are skipped automatically. Defaults to dry-run.

NameTypeReqDescription
authoringEvidenceobjectRequired for AI or automation task creation: declare an action/outcome title, plain-language review, and exact analogy/example excerpts from the description.
completionSourcestringWhen ai or human, attach the matching AI/人工 source tag after ensuring it exists. Omit or unknown means no source tag.
descriptionstring
dryRunbooleanWhen true, previews the request without writing.
dueAtstringTask deadline. When milestoneId is supplied, choose from context, usually today, tomorrow, or the milestone deadline, and never silently place it after the milestone deadline.
milestoneIdstring
projectIdstring
remindAtstring
statusstringOrdinary current-task creation starts pending; omit or pass pending.
tagsarray
titlestringyes

No output schema declared.

No examples provided.

granoflow_task_export ~128

Export task details, reusable lessons, and App-admitted prototype inputs. The App is the sole execution-admission authority; this tool never guesses current or latest prototype versions.

NameTypeReqDescription
assetModestringUse file to request short-lived decrypted package paths.
fetchMissingbooleanAllow the App to fetch a missing local package before export.
includePrototypesbooleanInclude structured prototype admission and admitted assets.
taskIdstringyesGranoflow task id.
ttlSecondsintegerTemporary prototype asset lifetime, capped at 600 seconds.

No output schema declared.

No examples provided.

granoflow_task_finish ~355

Finish a node-less compatibility task after its required Delivery gate and verify status=done. For AI execution, keep the task pending until this completion action and supply the captured actual startedAt plus confirmed endedAt; never claim status=doing or substitute discussion/creation time. Human manual focus may already have an App-recorded start from doing. Do not use for node-backed tasks. taskReview/reviewCardDrafts remain legacy explicit-inline compatibility only; deferred Review is the default.

NameTypeReqDescription
completionSourcestringDefaults to ai when an agent finishes the task. Use human for clearly human-completed work, or unknown to skip source tags.
confirmCompletebooleanMust be true when dryRun=false.
dryRunbooleanWhen true, previews the update/complete/import/readback sequence.
endedAtstringTask end time inferred from the current agent conversation, preferably ISO-like.
milestoneIdstringRequired when taskReview or reviewCardDrafts are provided.
projectIdstringRequired when taskReview or reviewCardDrafts are provided.
reviewCardDraftsarrayOne card per durable knowledge point worth long-term memory; omit when there is nothing worth remembering.
startedAtstringActual execution start time. AI execution captures this while the task stays pending and supplies it at completion. Do not use task discussion or creation time.
summarystringShort import summary for the completion, review, and card write.
taskIdstringyesGranoflow task id.
taskReviewstringMeaningful task review only. Omit this when the content would be a mere activity log.

No output schema declared.

No examples provided.

granoflow_task_history_mutate ~172

Write evidence-based task timestamps and historical Granoflow facts through the dedicated AI-agent API. AI execution may update startedAt while the task remains pending so it never claims the human doing focus slot; node-managed completion may correct startedAt/endedAt after status=done. Every create mutation requires shared AI/automation authoringEvidence for an action/outcome title, plain language, a real analogy, and a concrete example. Use dryRun first; when dryRun=false, the running app must advertise historical_task_mutations_v1.

NameTypeReqDescription
dryRunbooleanWhen true, previews without writing. Set false only with explicit user approval.
mutationsarrayyes
sourceobjectSource metadata such as {kind, threadId, summary, startedAt, endedAt}.

No output schema declared.

No examples provided.

granoflow_task_import ~68

Import an AI-agent task result into Granoflow. Use dryRun first unless the user explicitly asks to write.

NameTypeReqDescription
dryRunbooleanWhen true, previews the request without writing.
inputobjectyesJSON object sent to the Granoflow Local HTTP API.

No output schema declared.

No examples provided.

granoflow_task_knowledge_adoption_apply ~74

Apply only approved adopted references and return Reference, Usage, and association readback.

NameTypeReqDescription
approvedOperationIdsarrayyes
idempotencyKeystringyes
previewHashstringyes
previewTokenstringyes
taskIdstringyes

No output schema declared.

No examples provided.

granoflow_task_knowledge_adoption_preview ~47

Preview adopted, considered, or rejected Knowledge Pack decisions. Only adopted operations can write.

NameTypeReqDescription
decisionsarrayyes
taskIdstringyes

No output schema declared.

No examples provided.

granoflow_task_knowledge_audit_apply ~71

Apply approved stale-reference removals while preserving applied Knowledge Usage history.

NameTypeReqDescription
approvedOperationIdsarrayyes
idempotencyKeystringyes
previewHashstringyes
previewTokenstringyes
taskIdstringyes

No output schema declared.

No examples provided.

granoflow_task_knowledge_audit_preview ~46

Preview removal of Task Work references no longer present in the fully rewritten document.

NameTypeReqDescription
desiredReferencesarrayyes
taskIdstringyes

No output schema declared.

No examples provided.

granoflow_task_knowledge_pack ~54

Build a zero-write task analysis pack with separate Evidence, Experience, and Knowledge lanes.

NameTypeReqDescription
limitPerLaneinteger
querystringyes
taskIdstringyes

No output schema declared.

No examples provided.

granoflow_task_knowledge_references ~32

List current structured Task Work references for one task.

NameTypeReqDescription
taskIdstringyes

No output schema declared.

No examples provided.

granoflow_task_knowledge_usage_apply ~70

Apply one approved Knowledge Usage status transition and preserve its append-only event.

NameTypeReqDescription
idempotencyKeystringyes
operationIdstringyes
previewHashstringyes
previewTokenstringyes
taskIdstringyes

No output schema declared.

No examples provided.

granoflow_task_knowledge_usage_preview ~59

Preview referenced to applied, validated, or contradicted Knowledge Usage transition with evidence.

NameTypeReqDescription
evidenceobjectyes
materializationIdyes
statusstringyes
taskIdstringyes

No output schema declared.

No examples provided.

granoflow_task_list ~39

List tasks from Granoflow. Optionally filter by tag slug.

NameTypeReqDescription
tagstringReturn only tasks containing this tag slug.

No output schema declared.

No examples provided.

granoflow_task_node_batch_create ~76

Atomically create an ordered, idempotent task node batch through the Granoflow NodeService.

NameTypeReqDescription
dryRunboolean
expectedTaskUpdatedAtstringyes
idempotencyKeystringyes
nodesarrayyes
taskIdstringyes

No output schema declared.

No examples provided.

granoflow_task_node_delete ~68

Soft-delete a task node tree after a confirmed Work Document amendment and explicit confirmation.

NameTypeReqDescription
confirmedbooleanyes
dryRunboolean
expectedUpdatedAtstringyes
nodeIdstringyes
taskIdstringyes

No output schema declared.

No examples provided.

granoflow_task_node_list ~41

Read the latest Granoflow task nodes before planning, executing, or reconciling cross-device changes.

NameTypeReqDescription
taskIdstringyes

No output schema declared.

No examples provided.

granoflow_task_node_update ~74

Update a task node title or apply pending/finished status with optimistic concurrency.

NameTypeReqDescription
dryRunboolean
expectedUpdatedAtstringyes
nodeIdstringyes
statusstring
taskIdstringyes
titlestring

No output schema declared.

No examples provided.

granoflow_task_orchestrator_skill ~85

Read the bundled context-aware Granoflow Task Orchestrator. Use it as the single upper-layer entrypoint when natural language or gf shortcuts may mean quick capture, context enrichment, Analysis, Planning, end-to-end local-safe execution, or completion audit. It delegates every phase to the existing workflow owners and never turns inferred intent into external or destructive authorization.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

granoflow_task_resolve ~65

Resolve Granoflow task candidates by title without creating or updating data.

NameTypeReqDescription
includeDoneboolean
matchModestring
milestoneIdstring
projectIdstring
querystringyes

No output schema declared.

No examples provided.

granoflow_task_review_update ~78

Safely write a confirmed structured Task Review to any task, including completed inbox tasks, using the latest task revision. Review cards and context promotion remain separate controlled steps.

NameTypeReqDescription
dryRunboolean
expectedUpdatedAtstringyes
taskIdstringyes
taskReviewstringyes

No output schema declared.

No examples provided.

granoflow_task_update ~132

Update a current Granoflow task through the Local HTTP API. Do not include historical physical fields. AI execution must not set status=doing: keep pending, record actual startedAt through granoflow_task_history_mutate, and complete through NodeService or granoflow_task_finish. Human manual focus may set doing. Tags not in the local catalog are skipped automatically.

NameTypeReqDescription
dryRunbooleanWhen true, previews the request without writing.
inputobjectyesJSON object sent to the Granoflow Local HTTP API.
taskIdstringyesGranoflow task id.

No output schema declared.

No examples provided.

granoflow_task_update_structured ~229

Update a current Granoflow task with common structured fields. AI execution never sets status=doing: it remains pending until verified completion and writes actual execution time through granoflow_task_history_mutate. status=doing is for human manual focus and keeps the App-recorded start behavior. When moving it into a milestone, choose dueAt from context, usually today, tomorrow, or the milestone deadline. Defaults to dry-run.

NameTypeReqDescription
descriptionstring
dryRunbooleanWhen true, previews the request without writing.
dueAtstringTask deadline. When milestoneId is supplied, choose from context, usually today, tomorrow, or the milestone deadline, and never silently place it after the milestone deadline.
expectedUpdatedAtstring
milestoneIdstring
projectIdstring
remindAtstring
statusstring
taskIdstringyesGranoflow task id.
taskReviewstring
titlestring

No output schema declared.

No examples provided.

granoflow_task_validate ~43

Validate an AI-agent task result before importing it into Granoflow.

NameTypeReqDescription
inputobjectyesJSON object sent to the Granoflow Local HTTP API.

No output schema declared.

No examples provided.

granoflow_version ~22

Show Granoflow app and Local HTTP API version metadata.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.