# Hydracept (pypi · hydracept)

Execution control plane for agents: capabilities, durable jobs, budgets, receipts, and BYOK.

- Trust score: 53/100 (low)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-29

## Components

- remote · `api.hydracept.com`: 67/100, [markdown](https://verifymcp.io/servers/com-hydracept-hydracept/api.md), [page](https://verifymcp.io/servers/com-hydracept-hydracept/api)
- pypi · `hydracept`: 53/100 (this document), [markdown](https://verifymcp.io/servers/com-hydracept-hydracept/hydracept.md), [page](https://verifymcp.io/servers/com-hydracept-hydracept/hydracept)

## Channel facts

- Registry: `pypi`
- Package: `hydracept`
- Version: `0.4.4`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-29.

- **Supply Chain Security**: 50/100
  - Malware scan not yet available for this package.
  - No known CVEs affecting this package version or its production dependencies.
  - Runs setuptools.build_meta at install time, a recognised build step with no custom scripting around it.
  - 3 of 39 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Build provenance is cryptographically sound, but it attests a different repository to the one declared in the registry. Most often the declared URL is simply stale.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 3 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 82/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 2614 tokens (~56/item across 46 items; 45 tools + 1 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 71/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 0% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Tool Safety**: 75/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "hydracept_project_watch_once" implies "execute" and declares no destructiveHint at all, which the MCP spec reads as destructive by default.
  - An AI judge read all 47 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).
  - Supports UI / widget rendering.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### How do I install the Hydracept MCP server?

Hydracept runs locally as a PyPI package, launched with uvx hydracept. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add com-hydracept-hydracept -- uvx hydracept
```

### Cursor

```json
{
  "mcpServers": {
    "com-hydracept-hydracept": {
      "command": "uvx",
      "args": [
        "hydracept"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "com-hydracept-hydracept": {
      "command": "uvx",
      "args": [
        "hydracept"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add com-hydracept-hydracept -- uvx hydracept
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-hydracept-hydracept": {
      "type": "local",
      "command": [
        "uvx",
        "hydracept"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add com-hydracept-hydracept --command uvx --arg hydracept
```

### Hermes

```yaml
mcp_servers:
  com-hydracept-hydracept:
    command: "uvx"
    args: ["hydracept"]
```

### Netclaw

```json
{
  "McpServers": {
    "com-hydracept-hydracept": {
      "Transport": "stdio",
      "Command": "uvx",
      "Arguments": [
        "hydracept"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add com-hydracept-hydracept -t stdio -c uvx -a hydracept
```

### Other

```json
{
  "mcpServers": {
    "com-hydracept-hydracept": {
      "command": "uvx",
      "args": [
        "hydracept"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-28 (score 53, 0)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-09-26 (score 53)

First indexed and scored.

## MCP tools (45)

### `hydracept_status` (~29 tokens)

Local workspace readiness. Set refresh=true for optional network verify.

Input parameters:

- `refresh` (boolean)

### `hydracept_capabilities` (~65 tokens)

List, find, or describe capabilities. Includes one-shot readiness facts. Text job_async descriptors may include features.deferredProcessing (50% off standard token rates). Works before workspace init (anonymous discovery).

Input parameters:

- `key` (string)
- `query` (string)

### `resolve_capability` (~37 tokens)

Determine whether Hydracept already provides a suitable capability. Does not spend money.

Input parameters:

- `intent` (string, required)
- `requirements`

### `estimate_capability` (~73 tokens)

HTTP alias of hydracept_quote_capability. Same 0.3 retail quote (pricing.quote). 'input' is an alias for 'body'.

Input parameters:

- `body`
- `capability` (string)
- `capabilityKey` (string)
- `capability_key` (string)
- `input`

### `hydracept_quote_capability` (~77 tokens)

POST /v1/capabilities/{key}/quote — optional preview; does not reserve or charge funds. 'input' is an alias for 'body'.

Input parameters:

- `body`
- `capability` (string)
- `capabilityKey` (string)
- `capability_key` (string)
- `input`

### `hydracept_invoke` (~67 tokens)

Invoke a synchronous capability (read-only domain/DNS and text). 'input' is an alias for 'body'.

Input parameters:

- `body`
- `capability` (string)
- `capabilityKey` (string)
- `capability_key` (string)
- `input`

### `request_capability_quote` (~40 tokens)

Create a non-binding capability implementation request. Humans must accept commission quotes. Do not pass commission quoteId as execution.quoteId.

Input parameters:

- `body`

### `get_capability_request_quote` (~40 tokens)

Read the human-paid commission quote for a capability request.

This quoteId is never an execution.quoteId.

Input parameters:

- `request_id` (string, required)

### `hydracept_get_receipt` (~63 tokens)

Fetch a sealed receipt by job/execution id or by receiptId returned from a prior result.

Input parameters:

- `jobId` (string)
- `job_id` (string)
- `receiptId` (string)
- `receipt_id` (string)

### `hydracept_download_artifact` (~72 tokens)

Download an artifact into the workspace; out/output_path select the destination.

Input parameters:

- `artifact_id` (string)
- `job_id` (string, required)
- `label` (string)
- `out` (string)
- `outputPath` (string)
- `output_path` (string)

### `hydracept_smoke` (~69 tokens)

Explicit managed-trial smoke. Downloads first artifact when available.

Input parameters:

- `capability` (string)
- `capabilityKey` (string)
- `capability_key` (string)
- `output_path` (string)
- `poll_seconds` (integer)
- `prompt` (string)

### `hydracept_pinned_run` (~81 tokens)

POST /v1/inference/pinned — exact pin, scientific receipt. Standard processing by default. Opt in with processing=deferred on eligible OpenAI Responses pins (50% Flex). One logical model execution, no truncation rewrite, no Flex→Standard fallback. Pre-inference capacity 429s may retry.

Input parameters:

- `body`

### `hydracept_pinned_bulk` (~37 tokens)

POST /v1/inference/pinned/bulk — concurrent pinned items, one logical execution each.

Input parameters:

- `body`

### `hydracept_pinned_get` (~32 tokens)

GET /v1/inference/pinned/{receipt_id}.

Input parameters:

- `receipt_id` (string, required)

### `hydracept_pinned_bulk_get` (~51 tokens)

GET /v1/inference/pinned/bulk/{bulk_id} once. If nextAction is poll, wait pollAfterSeconds and call again.

Input parameters:

- `bulk_id` (string, required)

### `hydracept_manifest_create` (~36 tokens)

POST /v1/provenance/manifests — hash related pinned receipts into a run manifest.

Input parameters:

- `body`

### `hydracept_manifest_verify` (~35 tokens)

POST /v1/provenance/manifests/{manifest_id}/verify.

Input parameters:

- `manifest_id` (string, required)

### `hydracept_lockfile_emit` (~43 tokens)

GET /v1/provenance/lockfile?receipt_id= — AI lockfile from a pinned receipt.

Input parameters:

- `receipt_id` (string, required)

### `hydracept_verify_lockfile` (~47 tokens)

POST /v1/provenance/lockfile/verify. Prefer `python -m hydracept verify` for local hydracept.lock.

Input parameters:

- `body`

### `hydracept_jobs_find` (~51 tokens)

Find recent, failed, or reusable jobs in this checkout without asking for a job id.

Input parameters:

- `capability_key` (string)
- `intent` (string)
- `limit` (integer)

### `hydracept_job_inspect` (~38 tokens)

Inspect one job's error, diagnostics, receipt summary, request snapshot, and reuse candidate.

Input parameters:

- `job_id` (string, required)

### `hydracept_project_status` (~29 tokens)

Login-persistent project up status. Stdio only; cwd must be the game repo.

### `hydracept_project_up_install` (~27 tokens)

Same as project up --install; credentials come from workspace, not arguments.

### `hydracept_surface_apply` (~34 tokens)

Apply one surface JSON or all project surfaces. Does not grant the allowlist.

Input parameters:

- `path` (string)

### `hydracept_project_sync` (~29 tokens)

Sync the operations allowlist from tools/hydracept/manifest.json. Wholesale replace.

### `hydracept_project_watch_once` (~25 tokens)

Execute requested operations once unless login-persistent project up is running.

### `hydracept_project_request_operation` (~51 tokens)

Request an allowlisted project operation; watcher or watch_once executes it.

Input parameters:

- `action_key` (string)
- `command` (string, required)
- `context`
- `input`

### `hydracept_project_get_operation` (~36 tokens)

GET a project operation by id. Poll until reported when a watcher is running.

Input parameters:

- `operation_id` (string, required)

### `hydracept_ui_submit_job` (~56 tokens)

Panel submit. Same execution as hydracept_submit_job; no App remount (no resourceUri).

Input parameters:

- `body`
- `capability_key` (string)
- `idempotency_key` (string)

### `hydracept_ui_poll_job` (~39 tokens)

Panel job poll. Same projection as hydracept_job_status; proves the App is mounted.

Input parameters:

- `job_id` (string, required)

### `hydracept_ui_download_artifact` (~70 tokens)

Panel workspace save. Iframe has no API token; server uses the workspace client.

Input parameters:

- `artifactId` (string)
- `artifact_id` (string)
- `jobId` (string)
- `job_id` (string)
- `output_path` (string)

### `hydracept_ui_artifact_preview` (~63 tokens)

App-only bounded media preview. Server uses the workspace client; iframe has no API token.

Input parameters:

- `artifactId` (string)
- `artifact_id` (string)
- `jobId` (string)
- `job_id` (string)

### `hydracept_ui_quote` (~39 tokens)

App-only quote adapter. Same primitive as hydracept_quote_capability.

Input parameters:

- `body`
- `capability_key` (string, required)

### `hydracept_ui_run` (~58 tokens)

App-only run adapter. Uses the existing run façade (invoke vs jobs from executionModes).

Input parameters:

- `body`
- `capability_key` (string, required)
- `idempotency_key` (string)
- `max_cost`

### `hydracept_ui_connect_project` (~47 tokens)

App-only init adapter. Canonical init owns binding writes.

Input parameters:

- `displayName` (string)
- `environment` (string)
- `project_name` (string)

### `hydracept_ui_connection_recheck` (~33 tokens)

Re-read authoritative connection/runnability. Never accepts secrets.

Input parameters:

- `capability_key` (string)

### `hydracept_ui_approve_job` (~45 tokens)

Exact POST /v1/jobs/{id}/approve. For awaiting_approval human gates only.

Input parameters:

- `body`
- `job_id` (string, required)

### `hydracept_ui_reject_job` (~32 tokens)

Exact POST /v1/jobs/{id}/reject.

Input parameters:

- `job_id` (string, required)

### `hydracept_ui_select_variant` (~40 tokens)

Exact POST /v1/jobs/{id}/variants/select.

Input parameters:

- `artifact_id` (string, required)
- `job_id` (string, required)

### `hydracept_ui_cancel_job` (~31 tokens)

Explicit job cancel. Stop watching must not call this.

Input parameters:

- `job_id` (string, required)

### `hydracept_ui_promote` (~32 tokens)

Project-local apply_surfaces(path). Cloud never writes the repository.

Input parameters:

- `path` (string, required)

### `hydracept_run` (~107 tokens)

Canonical run. Waits for terminal completion by default; pass wait=false for a continuation. 'input' is an alias for 'body'.

Input parameters:

- `body`
- `capability` (string)
- `capabilityKey` (string)
- `capability_key` (string)
- `idempotency_key` (string)
- `input`
- `max_cost`
- `out` (string)
- `timeout`
- `wait` (boolean)

### `hydracept_submit_job` (~101 tokens)

Submit a capability job. Omit quoteId; the API seals pricing at admission. Eligible durable text jobs use deferred processing at 50% of standard token rates. Returns nextAction. 'input' is an alias for 'body'.

Input parameters:

- `body`
- `capability` (string)
- `capabilityKey` (string)
- `capability_key` (string)
- `idempotency_key` (string)
- `input`

### `hydracept_job_status` (~52 tokens)

GET /v1/jobs/{jobId} once. If nextAction is poll, wait pollAfterSeconds and call again.

Input parameters:

- `jobId` (string)
- `job_id` (string)

### `hydracept_interaction_surface` (~46 tokens)

Present one human-facing Hydracept interaction; never pass secrets in context.

Input parameters:

- `context`
- `interactive` (boolean)
- `surface` (string, required)

## Diagnostics

Captured diagnostic sections: Provenance, Install scripts, Dependencies. The full working is on the page: https://verifymcp.io/servers/com-hydracept-hydracept/hydracept#diagnostics

## Score history

- 2026-09-29: 53
- 2026-09-28: 53
- 2026-09-27: 53
- 2026-09-26: 53

## Common questions

### What is the Hydracept MCP server?

Hydracept is an MCP server listed in the public MCP registry as com.hydracept/hydracept. Execution control plane for agents: capabilities, durable jobs, budgets, receipts, and BYOK. This page covers its PyPI package (hydracept).

### Is the Hydracept MCP server safe to use?

Hydracept scores 53 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 29 September 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Hydracept MCP server expose?

Hydracept exposes 45 tools: hydracept_status, hydracept_capabilities, resolve_capability, estimate_capability, hydracept_quote_capability, and 40 more. Their descriptions and schemas cost roughly 2,205 tokens of context every time the server is loaded.

### Is the Hydracept MCP server still maintained?

Hydracept is still listed as active in the MCP registry. We last reached this channel on 29 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the Hydracept MCP server under?

Hydracept declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- PyPI project: https://pypi.org/project/hydracept/
- Socket report: https://socket.dev/pypi/package/hydracept
- Repository: https://github.com/zencodeinc/hydracept-public
- Website: https://hydracept.com/plugin
- Changelog RSS feed: https://verifymcp.io/servers/com-hydracept-hydracept/hydracept.xml
- Changelog JSON feed: https://verifymcp.io/servers/com-hydracept-hydracept/hydracept.json
- HTML version of this page: https://verifymcp.io/servers/com-hydracept-hydracept/hydracept