io.github.dappros/ethora-mcp-server
NPM · @ETHORA/MCP-SERVER · 3 COMPONENTS · SCANNED SEP 20
Ethora chat platform MCP: apps, users, rooms, AI agents, chat widgets. Hosted or stdio.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 34 of 109 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 2 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability78
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 20512 tokens (~220/item across 93 items; 89 tools + 4 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management84
- Stability check failed: the tool surface changed between 26.5.3 and 26.9.3: 4 tool removals, 0 breaking changes, 24 additions. See how to fix → Fail
Tool Coverage97
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 90% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 10 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 91 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the io.github.dappros/ethora-mcp-server server?
io.github.dappros/ethora-mcp-server runs locally as an npm package, launched with npx -y @ethora/mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @ethora/mcp-server
claude mcp add dappros-ethora-mcp-server -- npx -y @ethora/mcp-server
{
"mcpServers": {
"dappros-ethora-mcp-server": {
"command": "npx",
"args": [
"-y",
"@ethora/mcp-server"
]
}
}
} {
"servers": {
"dappros-ethora-mcp-server": {
"command": "npx",
"args": [
"-y",
"@ethora/mcp-server"
]
}
}
} codex mcp add dappros-ethora-mcp-server -- npx -y @ethora/mcp-server
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"dappros-ethora-mcp-server": {
"type": "local",
"command": [
"npx",
"-y",
"@ethora/mcp-server"
],
"enabled": true
}
}
} openclaw mcp add dappros-ethora-mcp-server --command npx --arg -y --arg @ethora/mcp-server
mcp_servers:
dappros-ethora-mcp-server:
command: "npx"
args: ["-y", "@ethora/mcp-server"] {
"McpServers": {
"dappros-ethora-mcp-server": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@ethora/mcp-server"
]
}
}
} assistant mcp add dappros-ethora-mcp-server -t stdio -c npx -a -y @ethora/mcp-server
{
"mcpServers": {
"dappros-ethora-mcp-server": {
"command": "npx",
"args": [
"-y",
"@ethora/mcp-server"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 81 to 84.
- 19 Sept 26 +11
- Known CVEs: unverified → pass ▲ security
- Dependency health: unverified → 0.86 ▲ functional
- 17 Sept 26 +5
- Known CVEs: pass → unverified ▼ security
- Stability: fail → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Malware scan: unverified → pass ▲ security
- Schema quality: 191 → 220 ▼ functional
- Dependency health: 0.86 → unverified ▼ functional
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: 100 → unverified ▼ functional
- Package version: 26.9.1 → 26.9.3 functional
- Package version: 26.9.1 → 26.9.2 functional
- 16 Sept 26 −3
No change was recorded against any check on this day. Stability & Change Management went from 94 to 71.
- 15 Sept 26 +1
- Malware scan: unverified → pass ▲ security
- Schema quality: 15297 → 17412 ▼ functional
- Security disclosure: fail → pass ▲ functional
- Destructive annotations: All 10 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation. functional
- Package version: 26.9.0 → 26.9.1 functional
- 14 Sept 26 −16
- Tool safety: pass → unverified ▼ security
- Malware scan: pass → unverified ▼ security
- Stability: 0.93 → unverified ▼ security
- Stability: 0.93 → fail ▼ security
- Tool coverage: 100% → 88% ▼ functional
- Schema quality: 100 → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Capabilities: pass → unverified ▼ functional
- Destructive annotations: 8 of 10 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "ethora-bot-instance-test-message" implies "send" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. functional
- Licence: ISC → MIT functional
- Package version: 26.5.3 → 26.9.0 functional
- 13 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Sept 26 0
- Security disclosure: unverified → fail ▼ functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/@ethora/mcp-server@26.9.3
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 109 packages
| Packages resolved | 109 |
|---|---|
| Stale | 34 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
ethora-chats-message-v2 Send Chat Message ~500
Post a message into a chat room of an app (POST /v2/apps/:appId/chats/broadcast targeting one room). The message is attributed to the app's broadcast sender (override the shown name with `senderName`). Use it to seed or test a conversation, e.g. right after `ethora-agent-invite-to-chat`, and set `waitForReplySec` (up to 60) to wait for an AI agent's answer; replies are returned in `replies`. Identify the room by `roomJid` (`${appId}_${chatId}`, exactly what `ethora-app-create-chat` returns as `jid`) or by the bare `chatId` plus the selected app. Requires: a room in the selected app (`ethora-app-create-chat`); for `replies`, an agent invited into it (`ethora-agent-invite-to-chat`). Auth: user auth (the default on the hosted server) or B2B; app-token mode is not accepted by this route. Errors: 401 not logged in; 403 not the app owner; 404 unknown app/room; 422 empty text. Reply detection needs the message archive (MAM) on the deployment; when it is unavailable `replies` is null and `historyUnavailable` is true.
| Name | Type | Req | Description |
|---|---|---|---|
| appId | string | – | 24-char hex appId. Optional when `roomJid` carries it or an app is selected. |
| chatId | string | – | Chat id: either the Mongo chat `_id` (as listed by the app's chat list) or the suffix after `${appId}_` in the room JID. Needs an app: pass `appId` or select one with `ethora-app-select`. |
| roomJid | string | – | Room JID `${appId}_${chatId}` (optionally with `@conference.<host>`), as returned by `ethora-app-create-chat`. Either this or `chatId` is required. |
| senderName | string | – | Display name shown as the message sender (defaults to the app's broadcast sender / app name). |
| text | string | yes | Message body to post (1-4000 chars). |
| waitForReplySec | integer | – | Seconds to wait for a reply from someone else in the room (an AI agent, typically). 0 (default) returns right after posting. |
No output schema declared.
No examples provided.
ethora-configure Configure Connection ~306
Set the Ethora API URL and credentials for this MCP session. Stores values in memory only; each call merges with omitted fields kept. Alternative to env vars (ETHORA_API_URL / ETHORA_APP_JWT / ETHORA_APP_TOKEN / ETHORA_B2B_TOKEN). On a hosted server `apiUrl` is fixed and cannot be changed; credentials are per session. Auth: none required — this establishes auth material. Errors: only if a value is structurally invalid. Follow with an `ethora-auth-use-*` tool to pick the active mode.
| Name | Type | Req | Description |
|---|---|---|---|
| apiUrl | string | – | Full Ethora API URL including the version path, e.g. `https://api.chat.ethora.com/v1` or `http://localhost:8080/v1`. If you only have the host, set ETHORA_BASE_URL env instead and the server appends… |
| appJwt | string | – | Ethora App JWT, used only to bootstrap login/register in user-auth mode. Usually starts with `JWT `. Secret — never commit it. |
| appToken | string | – | Per-app appToken for app-scoped flows (broadcast, sources, bot). Setting this makes app-token auth available via `ethora-auth-use-app`. Secret. |
| b2bToken | string | – | B2B server token for tenant-actor `x-custom-token` auth (a JWT with `type=server`). Required for B2B provisioning flows. Secret. |
No output schema declared.
No examples provided.
ethora-doctor Connection Doctor ~124
Diagnose the session: validate the config is internally consistent for the active auth mode and ping the Ethora API (`GET /v1/ping`). Returns `{ state, checks, ping, suggestions }`. Auth: none required; report is tailored to whatever credentials are set. Errors: rarely throws — instead returns `suggestions` and a `ping.ok: false` block when the API is unreachable.
| Name | Type | Req | Description |
|---|---|---|---|
| timeoutMs | integer | – | HTTP timeout in milliseconds for the ping request. Defaults to 3000. Raise it on slow links, lower it to fail fast. |
No output schema declared.
No examples provided.
ethora-feedback-submit Send Feedback ~403
Send feedback about Ethora to the Ethora team: something that does not work, behaves differently from what the tool description promised, is missing, or is badly documented. It reaches the team directly, so prefer it over guessing or silently giving up when a tool fails. Recent failures in this session (tool, error code, request id) are attached automatically when `includeRecentErrors` is true, which is what makes a report from here more useful than a web form: the team can join it to the server-side log. Works whether or not you are signed in, so a problem that blocks sign-up can still be reported. Do not put credentials, API keys or end-user personal data in `message`; credential-shaped values in the attached context are redacted before sending. Requires: nothing. Auth: none. Works anonymously; when the session is authenticated the report is attributed to that account. Errors: 422 if `message` is shorter than 5 characters or looks like spam; 429 if too many reports were sent from this address.
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | What kind of report this is: `bug` (something is broken), `unexpected` (it works but not as described), `feature` (a request), `docs` (a description or guide is wrong or missing), `other`. Defaults t… |
| string | – | Reply address. Only useful when the session is not signed in; an authenticated report already carries the account, so leave this out unless the user offers an address. | |
| includeRecentErrors | boolean | – | Attach this session's last few tool failures (tool name, error code, request id) so the team can trace them. Default true; set false if the report is unrelated to a failure. |
| message | string | yes | What happened, in the user's own words where possible: what was attempted, what was expected, what occurred instead. No credentials or end-user personal data. |
No output schema declared.
No examples provided.
ethora-files-delete-v2 Delete File ~127
Permanently delete one of the authenticated user's files by id (`DELETE /v2/files/:id`). Removes the record and its stored content; not reversible. Requires: a file id from `ethora-files-upload-v2`. Auth: user-auth mode with an active user session. Errors: 401 not logged in; 403 not owned by the user; 404 unknown `id`. Related: get ids from `ethora-files-get-v2`.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Id of the file to delete. Get it from `ethora-files-get-v2`. |
No output schema declared.
No examples provided.
ethora-files-get-v2 Get File ~122
List the authenticated user's files, or fetch one file's metadata by id (`GET /v2/files`). Returns an array when `id` is omitted, a single record when given. Requires: a file id from `ethora-files-upload-v2`. Auth: user-auth mode with an active user session. Errors: 401 not logged in; 404 unknown `id` or not owned by the user.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | – | File id to fetch a single record. Omit to list all files owned by the logged-in user. |
No output schema declared.
No examples provided.
ethora-files-upload-v2 Upload File ~134
Upload 1–5 files to the authenticated user's Ethora file storage (`POST /v2/files`). Each upload is a new record (no overwrite-by-name); files passed as base64, 50MB max each. Auth: user-auth mode with an active user session (`ethora-user-login` first). Errors: 401 not logged in; 413 size limit exceeded; 422 unsupported mime type. Related: manage with `ethora-files-get-v2` / `ethora-files-delete-v2`.
| Name | Type | Req | Description |
|---|---|---|---|
| files | array | yes | 1 to 5 files to upload in this call. |
No output schema declared.
No examples provided.
ethora-generate-b2b-bootstrap-runbook Generate B2B Bootstrap Runbook ~186
Generate a human-readable runbook listing this server's tool calls in the right order for a B2B bootstrap, with example payloads. Documentation only — does not write any file or execute any step. Auth: none required — pure text generator, no API calls. Errors: effectively none. Related: to actually run the sequence use `ethora-run-recipe` or `ethora-b2b-app-bootstrap-ai`.
| Name | Type | Req | Description |
|---|---|---|---|
| apiUrl | string | – | Ethora API base URL to show in the runbook's configure step. Omit to emit a placeholder. |
| crawlUrl | string | – | Website URL to show in the runbook's source-ingest step. Omit to emit a placeholder. |
| displayName | string | – | App display name to show in the runbook's create-app step. Omit to emit a placeholder. |
No output schema declared.
No examples provided.
ethora-generate-chat-component-app-tsx Generate Chat Component App.tsx ~234
Generate a ready-to-paste React `App.tsx` snippet that mounts `@ethora/chat-component`. Returns `{ filename: "App.tsx", snippet }`; unpassed values are emitted as placeholders. Does not write any file. Get the appToken from `ethora-app-credentials { appId, confirm: true }` (other tools redact it). Auth: none required — pure code generator, no API calls. Errors: effectively none. Security note: the snippet includes `appToken` inline only as a quickstart convenience — do not ship hardcoded tokens to production.
| Name | Type | Req | Description |
|---|---|---|---|
| apiUrl | string | – | Ethora API base URL to embed in the snippet, e.g. `https://api.chat.ethora.com/v1`. Omit to emit a placeholder. |
| appToken | string | – | appToken to embed in the snippet for quickstart testing. Omit to emit a placeholder. Do NOT hardcode real tokens in production source. |
| roomJid | string | – | Room JID to open on load. Omit to emit a commented-out placeholder. |
No output schema declared.
No examples provided.
ethora-generate-env-examples Generate Env Examples ~144
Generate `.env.example` templates for the three common Ethora integration targets: the frontend chat component, the backend SDK, and this MCP server. Returns `{ target, template }` when `target` is given, or `{ templates }` with all three. Placeholder values only; does not write any file. Auth: none required — pure text generator, no API calls. Errors: effectively none.
| Name | Type | Req | Description |
|---|---|---|---|
| target | string | – | Which template to return: `frontend-chat-component` (Vite env), `backend-sdk` (@ethora/sdk-backend env), or `mcp` (this server's env). Omit to return all three. |
No output schema declared.
No examples provided.
ethora-help Help and Next Steps ~113
Task-oriented orientation for this MCP server: explains the three Ethora auth modes (user / app-token / B2B) and recommends next tool calls + recipes based on current session state. Auth: none required — inspects state, no API calls. Errors: effectively none. Related: pass a recommended recipe id to `ethora-run-recipe`.
| Name | Type | Req | Description |
|---|---|---|---|
| goal | string | – | Goal hint to tailor the recommendations and recipe list. Omit or use `auto` to get recommendations inferred from the current session state. |
No output schema declared.
No examples provided.
ethora-messages-context-v2 Get Message Context ~138
Fetch the messages surrounding a target message (GET /v2/apps/:appId/chats/:chatId/messages/context). Provide either aroundStanzaId or aroundMessageId; radius controls how many messages before/after. Requires: a message id from `ethora-messages-search-v2` or `ethora-chats-history-v2`.
| Name | Type | Req | Description |
|---|---|---|---|
| appId | string | – | Required in B2B mode unless already selected via ethora-app-select. |
| aroundMessageId | string | – | – |
| aroundStanzaId | string | – | – |
| chatId | string | yes | – |
| radius | integer | – | – |
No output schema declared.
No examples provided.
ethora-messages-search-v2 Search Messages ~173
Search an App's chat messages (GET /v2/apps/:appId/messages/search). B2B / tenant-actor auth. Filter by room (chatId), author (fromUserId), and time window. Requires: a selected app (`ethora-app-select`) or an explicit `appId`.
| Name | Type | Req | Description |
|---|---|---|---|
| appId | string | – | Required in B2B mode unless already selected via ethora-app-select. |
| chatId | string | – | – |
| fromUserId | string | – | – |
| limit | integer | – | – |
| mode | string | – | – |
| offset | integer | – | – |
| q | string | yes | Search query. |
| since | string | – | ISO date lower bound. |
| sort | string | – | – |
| until | string | – | ISO date upper bound. |
No output schema declared.
No examples provided.
ethora-run-recipe Run Recipe ~303
Execute a built-in recipe — an ordered sequence of this server's own tool calls — by id. Recipes capture common flows (B2B bootstrap, broadcast, sources ingest). Use `dryRun: true` to preview resolved steps. Omit `recipeId` to list runnable recipes for a `goal`. Requires: the inputs the chosen recipe lists; call without `recipeId` first to see the recipes and their required inputs. Auth: depends on the recipe's steps — configure those first (see `ethora-help`). Errors: stops at the first failing step and returns the partial log; a missing required `vars` entry fails fast before any step runs.
| Name | Type | Req | Description |
|---|---|---|---|
| dryRun | boolean | – | If true, resolve and return the step list with `vars` substituted but execute nothing. Use this to preview a recipe before running it for real. |
| goal | string | – | Goal scope used to look up recipes when `recipeId` is omitted. Defaults to `auto`. |
| recipeId | string | – | Id of the recipe to run. Omit to instead list the runnable recipes for the selected `goal` (get ids from `ethora-help`). |
| vars | object | – | Key/value substitutions injected into recipe steps (e.g. appId, appToken, b2bToken, appJwt, email, password, apiUrl). A recipe declares which vars it requires; missing required vars fail the run befo… |
No output schema declared.
No examples provided.
ethora-sources-docs-delete Delete Knowledge Document (Legacy) ~199
Remove a previously ingested document from an app's RAG sources by `docId` (legacy user-auth route). Deletes the document record and its embeddings; not reversible. Requires: a document id from `ethora-sources-docs-list-v2`. Auth: user-auth mode, active session; the user must own the app. Errors: 401 not logged in; 403 not owner; 404 unknown `docId`. Related: get `docId` from `ethora-sources-docs-list-v2`; app-token/B2B uses `ethora-sources-docs-delete-v2`.
| Name | Type | Req | Description |
|---|---|---|---|
| appId | string | – | 24-char hex appId the document belongs to. Optional — defaults to the app set via `ethora-app-select`. |
| docId | string | yes | Id of the ingested document to delete. Get it from `ethora-sources-docs-list-v2`. |
No output schema declared.
No examples provided.
ethora-sources-docs-delete-v2 Delete Knowledge Document ~206
Remove a previously ingested document from an app's RAG sources by `docId` (app-token / B2B variant of `ethora-sources-docs-delete`). Deletes the document record and its embeddings; not reversible. Requires: a document id from `ethora-sources-docs-list-v2`. Auth: app-token mode OR B2B mode with an explicit `appId`. Errors: 401/403 wrong auth; 404 unknown `appId` or `docId`. Related: get `docId` from `ethora-sources-docs-list-v2`.
| Name | Type | Req | Description |
|---|---|---|---|
| appId | string | – | 24-char hex appId the document belongs to. Required in B2B mode unless already set via `ethora-app-select`; ignored in app-token mode. |
| docId | string | yes | Id of the ingested document to delete. Get it from `ethora-sources-docs-list-v2`. |
No output schema declared.
No examples provided.
ethora-sources-docs-list-v2 List Knowledge Documents ~180
List an app's ingested documents, including each document's id, name, and current RAG tags. Their ids feed `ethora-sources-docs-tags-update-v2` and `ethora-sources-docs-delete-v2`. Requires: a selected app (`ethora-app-select`) or an explicit `appId`. Auth: app-token mode OR B2B mode with an explicit `appId`. Errors: 401/403 wrong auth; 404 unknown `appId`; empty list if nothing has been uploaded. Related: website-sources equivalent is `ethora-sources-site-list-v2`.
| Name | Type | Req | Description |
|---|---|---|---|
| appId | string | – | 24-char hex appId to list documents for. Required in B2B mode unless already set via `ethora-app-select`; ignored in app-token mode. |
No output schema declared.
No examples provided.
ethora-sources-docs-tags-update-v2 Update Knowledge Document Tags ~259
Set the RAG retrieval tags on an ingested document — replaces the document's tag set with the provided `tags` array (not additive; pass `[]` to clear all). Tags let the bot's `ragTags` narrow retrieval. Requires: a document id from `ethora-sources-docs-list-v2`. Auth: app-token mode OR B2B mode with an explicit `appId`. Errors: 401/403 wrong auth; 404 unknown `appId` or `docId`. Related: get `docId` from `ethora-sources-docs-list-v2`; website-source equivalent is `ethora-sources-site-tags-update-v2`.
| Name | Type | Req | Description |
|---|---|---|---|
| appId | string | – | 24-char hex appId the document belongs to. Required in B2B mode unless already set via `ethora-app-select`; ignored in app-token mode. |
| docId | string | yes | Id of the ingested document to tag. Get it from `ethora-sources-docs-list-v2`. |
| tags | array | yes | The complete desired tag set for this document (replaces any existing tags). Up to 50 tags; pass `[]` to clear all. |
No output schema declared.
No examples provided.
ethora-sources-docs-upload Upload Knowledge Document (Legacy) ~188
Upload documents (1–5; PDF, text, etc.) into an app's RAG sources (legacy user-auth route). Async — content becomes queryable once indexing finishes; files passed as base64, 50MB max each. Requires: a selected app (`ethora-app-select`) or an explicit `appId`. Auth: user-auth mode, active session; the user must own the app. Errors: 401 not logged in; 403 not owner; 413 too large; 422 unsupported document type. Related: app-token/B2B flows use `ethora-sources-docs-upload-v2`.
| Name | Type | Req | Description |
|---|---|---|---|
| appId | string | – | 24-char hex appId to ingest into. Optional — defaults to the app set via `ethora-app-select`. |
| files | array | yes | 1 to 5 documents to ingest in this call. |
No output schema declared.
No examples provided.
ethora-sources-docs-upload-v2 Upload Knowledge Document ~218
Upload documents (1–5; PDF, text, etc.) into an app's RAG sources (app-token / B2B variant of `ethora-sources-docs-upload`). Async — content becomes queryable once indexing finishes; files passed as base64, 50MB max each. Requires: a selected app (`ethora-app-select`) or an explicit `appId`. Auth: app-token mode OR B2B mode with an explicit `appId`. Errors: 401/403 wrong auth; 404 unknown `appId`; 413 too large; 422 unsupported document type. Related: `ethora-sources-docs-list-v2`, `ethora-sources-docs-delete-v2`.
| Name | Type | Req | Description |
|---|---|---|---|
| appId | string | – | 24-char hex appId to ingest into. Required in B2B mode unless already set via `ethora-app-select`; ignored in app-token mode. |
| files | array | yes | 1 to 5 documents to ingest in this call. |
No output schema declared.
No examples provided.
ethora-sources-site-crawl-v2 Crawl Website Source ~239
Crawl a website URL and ingest its content into an app's RAG sources (app-token / B2B variant of `ethora-sources-site-crawl`). Async — returns once the job is accepted; `followLink: true` follows in-domain links and can ingest many pages. Requires: a selected app (`ethora-app-select`) or an explicit `appId`. Auth: app-token mode OR B2B mode with an explicit `appId`. Errors: 401/403 wrong auth; 400 malformed `url`; 404 unknown `appId`. Related: `ethora-sources-site-crawl-v2-wait` (block until done).
| Name | Type | Req | Description |
|---|---|---|---|
| appId | string | – | 24-char hex appId to ingest into. Required in B2B mode unless already set via `ethora-app-select`; ignored in app-token mode. |
| followLink | boolean | – | If true, also crawl in-domain links reachable from `url`. Can ingest many pages — use with care. |
| url | string | yes | Absolute URL to crawl, e.g. `https://example.com/docs`. |
No output schema declared.
No examples provided.
ethora-sources-site-crawl-v2-wait Crawl Website Source and Wait ~323
Crawl a website URL and wait for the crawl to finish: enqueues the job, then polls it until it reports `completed` or `failed`. Returns `{ done, status, jobId, polls, durationMs, result }`; `done: false` with a `note` means the budget ran out while the job was still running (it usually finishes server-side anyway). Requires: a selected app (`ethora-app-select`) or an explicit `appId`. Auth: app-token mode OR B2B mode with an explicit `appId`. Errors: 401/403 wrong auth; 400 malformed `url`; 504/timeout if it takes longer than `timeoutMs` (the job may still complete server-side — check with `ethora-sources-site-list-v2`).
| Name | Type | Req | Description |
|---|---|---|---|
| appId | string | – | 24-char hex appId to ingest into. Required in B2B mode unless already set via `ethora-app-select`; ignored in app-token mode. |
| followLink | boolean | – | If true, also crawl in-domain links reachable from `url`. Can ingest many pages — use with care. |
| timeoutMs | integer | – | How long to poll for the crawl to finish, in milliseconds. Default 45000, chosen to stay under the ~60s request timeout most MCP clients enforce. Caps at 600000 (10 min) for clients that allow longer… |
| url | string | yes | Absolute URL to crawl, e.g. `https://example.com/docs`. |
No output schema declared.
No examples provided.
ethora-sources-site-delete-url-v2 Delete Website Source URL ~251
Remove a single crawled URL from an app's RAG sources, matched by its exact url string (app-token / B2B variant of `ethora-sources-site-delete-url`). Deletes the source record and its embeddings; not reversible. Matches on the exact stored URL string. Requires: an indexed site URL from `ethora-sources-site-list-v2` (crawled with `ethora-sources-site-crawl-v2`). Auth: app-token mode OR B2B mode with an explicit `appId`. Errors: 401/403 wrong auth; 404 `url` not a crawled source. Related: get the stored value from `ethora-sources-site-list-v2`; bulk-by-id is `ethora-sources-site-delete-url-v2-batch`.
| Name | Type | Req | Description |
|---|---|---|---|
| appId | string | – | 24-char hex appId the URL belongs to. Required in B2B mode unless already set via `ethora-app-select`; ignored in app-token mode. |
| url | string | yes | Exact crawled URL string to remove (must match what was stored — get it from `ethora-sources-site-list-v2`). |
No output schema declared.
No examples provided.
ethora-sources-site-list-v2 List Website Sources ~176
List an app's crawled website sources, including each source's id, URL, and current RAG tags. Their ids feed `ethora-sources-site-tags-update-v2`, `ethora-sources-site-delete-url-v2-batch`, and `ethora-sources-site-reindex-v2`. Requires: a selected app (`ethora-app-select`) or an explicit `appId`. Auth: app-token mode OR B2B mode with an explicit `appId`. Errors: 401/403 wrong auth; 404 unknown `appId`; empty list if nothing has been crawled.
| Name | Type | Req | Description |
|---|---|---|---|
| appId | string | – | 24-char hex appId to list sources for. Required in B2B mode unless already set via `ethora-app-select`; ignored in app-token mode. |
No output schema declared.
No examples provided.
ethora-sources-site-reindex-v2 Reindex Website Source ~246
Re-crawl and re-embed a previously crawled URL by its `urlId`, refreshing its RAG content (app-token / B2B variant of `ethora-sources-site-reindex`). Async — the existing source record is updated in place once indexing finishes. Requires: an indexed site URL from `ethora-sources-site-list-v2` (crawled with `ethora-sources-site-crawl-v2`). Auth: app-token mode OR B2B mode with an explicit `appId`. Errors: 401/403 wrong auth; 404 unknown `appId` or `urlId`. Related: get `urlId` from `ethora-sources-site-list-v2`; `ethora-sources-site-reindex-v2-wait` blocks until done.
| Name | Type | Req | Description |
|---|---|---|---|
| appId | string | – | 24-char hex appId the URL belongs to. Required in B2B mode unless already set via `ethora-app-select`; ignored in app-token mode. |
| urlId | string | yes | Id of a previously crawled URL record. Get it from `ethora-sources-site-list-v2`. |
No output schema declared.
No examples provided.
ethora-sources-site-reindex-v2-wait Reindex Website Source and Wait ~331
Re-crawl and re-embed a previously crawled URL and wait for it to finish: enqueues the job, then polls it until it reports `completed` or `failed`. Returns `{ done, status, jobId, polls, durationMs, result }`; `done: false` with a `note` means the budget ran out while the job was still running. Requires: an indexed site URL from `ethora-sources-site-list-v2` (crawled with `ethora-sources-site-crawl-v2`). Auth: app-token mode OR B2B mode with an explicit `appId`. Errors: 401/403 wrong auth; 404 unknown `appId` or `urlId`; 504/timeout if it takes longer than `timeoutMs` (the job may still complete server-side). Related: get `urlId` from `ethora-sources-site-list-v2`.
| Name | Type | Req | Description |
|---|---|---|---|
| appId | string | – | 24-char hex appId the URL belongs to. Required in B2B mode unless already set via `ethora-app-select`; ignored in app-token mode. |
| timeoutMs | integer | – | How long to poll for the reindex to finish, in milliseconds. Default 45000, chosen to stay under the ~60s request timeout most MCP clients enforce. Caps at 600000 (10 min) for clients that allow long… |
| urlId | string | yes | Id of a previously crawled URL record. Get it from `ethora-sources-site-list-v2`. |
No output schema declared.
No examples provided.
ethora-sources-site-tags-update-v2 Update Website Source Tags ~275
Set the RAG retrieval tags on a crawled website source — replaces the source's tag set with the provided `tags` array (not additive; pass `[]` to clear all). Tags let the bot's `ragTags` narrow retrieval. Requires: an indexed site URL from `ethora-sources-site-list-v2` (crawled with `ethora-sources-site-crawl-v2`). Auth: app-token mode OR B2B mode with an explicit `appId`. Errors: 401/403 wrong auth; 404 unknown `appId` or `sourceId`. Related: get `sourceId` from `ethora-sources-site-list-v2`; doc equivalent is `ethora-sources-docs-tags-update-v2`.
| Name | Type | Req | Description |
|---|---|---|---|
| appId | string | – | 24-char hex appId the source belongs to. Required in B2B mode unless already set via `ethora-app-select`; ignored in app-token mode. |
| sourceId | string | yes | Id of the crawled site source to tag. Get it from `ethora-sources-site-list-v2`. |
| tags | array | yes | The complete desired tag set for this source (replaces any existing tags). Up to 50 tags; pass `[]` to clear all. |
No output schema declared.
No examples provided.
ethora-status Session Status ~97
Report the current Ethora MCP session state: configured API URL, active auth mode, which credentials are present (booleans like `hasAppJwt` — values never echoed), the selected appId/agentId, and `hosted`/`sessionId` on the hosted (Streamable HTTP) server. Auth: none required. Errors: effectively none. Related: `ethora-doctor` for an active connectivity check.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
ethora-unread-counts-v2 Get Unread Counts ~149
Batch per-room unread message counts for a set of users (POST /v2/apps/:appId/users/unread-counts). mode=count returns numbers (capped); mode=flag returns booleans. Requires Mongo message archiving enabled on the deployment. Requires: a selected app (`ethora-app-select`) or an explicit `appId`.
| Name | Type | Req | Description |
|---|---|---|---|
| appId | string | – | Required in B2B mode unless already selected via ethora-app-select. |
| cap | integer | – | – |
| concurrency | integer | – | – |
| mode | string | – | – |
| userIds | array | yes | uuid / Mongo _id / xmppUsername, 1..200. |
No output schema declared.
No examples provided.
ethora-user-login Log In ~280
Authenticate as an existing Ethora user with email + password. Stores the user session token in this MCP session and unlocks user-auth tools (`ethora-app-list`, `ethora-files-*`, `ethora-wallet-*`). Auth: user-auth mode (`ethora-auth-use-user` first) and a configured `appJwt`. Errors: 401/403 bad credentials; 404 email not registered; 429 per-IP rate limit — retry with backoff.
| Name | Type | Req | Description |
|---|---|---|---|
| apiKeyName | string | – | Label for the API key when `createApiKey` is true (e.g. `claude-code-laptop`). |
| apiKeyTtlDays | integer | – | Lifetime of the API key in days when `createApiKey` is true. Server default applies when omitted. |
| createApiKey | boolean | – | When true, also mint a long-lived API key for this user and return it once, so headless clients / agents can reconnect with `Authorization: Bearer <key>` instead of logging in again. Default false. |
| string | yes | User's registered email address (RFC 5322). Must match an account created via `ethora-user-register`. | |
| password | string | yes | Plain-text password the user set during registration. Sent over TLS to the Ethora API; never echoed back or logged. |
No output schema declared.
No examples provided.
ethora-user-register Register Account ~333
Create a new Ethora user account by email + first/last name, then log in and bind the session. A password is generated when omitted and returned once. By default also mints a long-lived API key so an agent can reconnect later with `Authorization: Bearer <key>` (no human step needed). Auth: user-auth mode and a configured `appJwt` (on a hosted server this is preset). Errors: 401 no `appJwt`; 422 email already registered or password shorter than 6 chars; 429 rate limited. Related: bulk provisioning uses `ethora-users-batch-create-v2`.
| Name | Type | Req | Description |
|---|---|---|---|
| apiKeyName | string | – | Label for the API key (default `mcp-signup`). |
| apiKeyTtlDays | integer | – | API key lifetime in days. Server default applies when omitted. |
| createApiKey | boolean | – | Mint a long-lived API key right after signup and return it once. Default true. Set false if you only need this session. |
| string | yes | Email address for the new user. Must be RFC-5322 valid and not already registered within this app. No confirmation click is required to log in; the address is used for password reset. | |
| firstName | string | yes | First name shown in the user's profile and message attributions across chat rooms and the app UI. |
| lastName | string | yes | Last name shown in the user's profile. |
| password | string | – | Password for the account (min 6 chars). Omit to have a strong random password generated and returned once in the result. |
No output schema declared.
No examples provided.
ethora-users-batch-create-v2 Batch Create Users ~215
Provision many Ethora users (1–100) in one asynchronous batch job — the bulk equivalent of `ethora-user-register`. Enqueues a background job (HTTP 202); the job reports per-user conflicts rather than failing the whole batch. Returns `{ jobId, statusUrl }`. Auth: B2B mode (`ethora-auth-use-b2b` + a configured `b2bToken`). Errors: 401/403 not in B2B mode; 422 `usersList` validation. Related: track with `ethora-wait-users-batch-job-v2`.
| Name | Type | Req | Description |
|---|---|---|---|
| bypassEmailConfirmation | boolean | – | If true, created users skip email verification and are immediately usable. If false/omitted, each user receives a verification link. |
| timeoutMs | integer | – | HTTP timeout for the job-creation request (not the job itself), in milliseconds. Default 30000. |
| usersList | array | yes | The users to create, 1–100 per batch. |
No output schema declared.
No examples provided.
ethora-users-batch-job-v2 Get Users Batch Job ~198
Fetch the current status and per-user results of a users batch job by `jobId` (one-shot, no polling). Returns the job object with its `state` (pending/running/completed/failed) and per-user outcomes. Requires: a `jobId` returned by `ethora-users-batch-create-v2`. Auth: B2B mode (`ethora-auth-use-b2b` + a configured `b2bToken`) — must match the auth used to create the job. Errors: 401/403 not in B2B mode; 404 unknown `jobId`. Related: `ethora-wait-users-batch-job-v2` for a blocking wait.
| Name | Type | Req | Description |
|---|---|---|---|
| jobId | string | yes | Job id returned by `ethora-users-batch-create-v2`. |
| timeoutMs | integer | – | HTTP timeout for this status request, in milliseconds. Default 10000. |
No output schema declared.
No examples provided.
ethora-wait-broadcast-job-v2 Wait for Broadcast Job ~262
Block until a broadcast job reaches a terminal state (`completed` or `failed`) or until `timeoutMs` — read-only polling wrapper around `ethora-chats-broadcast-job-v2`. Returns `{ done, state, job }`, or `{ done: false, reason: "timeout" }` on timeout. Requires: a `jobId` returned by `ethora-chats-broadcast-job-v2`. Auth: app-token mode OR B2B mode with an explicit `appId` — must match the auth used to enqueue the job. Errors: 401/403 wrong auth; 404 unknown `jobId`.
| Name | Type | Req | Description |
|---|---|---|---|
| appId | string | – | 24-char hex appId the job belongs to. Required in B2B mode unless already set via `ethora-app-select`; ignored in app-token mode. |
| intervalMs | integer | – | Delay between status checks, in milliseconds. Default 1000. Lower = more responsive but more API calls. |
| jobId | string | yes | Job id returned by `ethora-chats-broadcast-v2`. |
| timeoutMs | integer | – | Maximum time to wait, in milliseconds. Default 60000. Caps at 300000 (5 min). |
No output schema declared.
No examples provided.
ethora-wait-users-batch-job-v2 Wait for Users Batch Job ~223
Block until a users batch job reaches a terminal state (`completed` or `failed`) or `timeoutMs` — read-only polling wrapper around `ethora-users-batch-job-v2`. Returns `{ done, state, job }`, or `{ done: false, reason: "timeout" }` on timeout. Requires: a `jobId` returned by `ethora-users-batch-create-v2`. Auth: B2B mode (`ethora-auth-use-b2b` + a configured `b2bToken`) — must match the auth used to create the job. Errors: 401/403 not in B2B mode; 404 unknown `jobId`.
| Name | Type | Req | Description |
|---|---|---|---|
| intervalMs | integer | – | Delay between status checks, in milliseconds. Default 1000. |
| jobId | string | yes | Job id returned by `ethora-users-batch-create-v2`. |
| timeoutMs | integer | – | Maximum time to wait, in milliseconds. Default 60000. Caps at 300000 (5 min). |
No output schema declared.
No examples provided.
ethora-wallet-get-balance Get Wallet Balance ~53
Read the authenticated user's on-chain ERC-20 wallet balance(s). Auth: user-auth (log in first). Errors: 401 not logged in; 503 wallet RPC unreachable — retry with backoff.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
ethora-widget-embed-snippet Widget Embed Snippet ~495
Generate the <script> tag that embeds the Ethora AI chat widget (the floating launcher + chat panel that website visitors use) for an app, plus the prerequisites that must hold before it answers. No API call; pure generator using this deployment's hosted widget URL and public API base. The widget answers with the app's ACTIVE bot: for API-created apps run `ethora-agents-create-v2` -> `ethora-agent-invite-to-chat` -> `ethora-agents-activate-v2 { agentId, chatJid }` first, otherwise `POST /v2/widget/sessions` returns 422 and the widget stays silent. Requires: an activated agent on the app (`ethora-agents-activate-v2`); without it the widget opens but never answers. Auth: none required (uses the selected app when `appId` is omitted). Errors: effectively none; when no hosted widget is configured the snippet carries a `<WIDGET_URL>` placeholder. Related: `ethora-agents-activate-v2`, `ethora-bot-widget-v2` (legacy per-app bot only).
| Name | Type | Req | Description |
|---|---|---|---|
| apiBase | string | – | Override the public API base (`data-api-base`). Defaults to this deployment's public API URL. |
| appId | string | – | App the widget belongs to (24-char hex). Defaults to the app from `ethora-app-select`. |
| botAvatar | string | – | Avatar image URL shown for the bot (`data-bot-avatar`). |
| botId | string | – | Legacy `data-bot-id` (bot XMPP address); only for old embeds. Prefer `appId`: the backend picks the active agent from the app. |
| botName | string | – | Display name shown in the widget header (`data-bot-name`), e.g. the agent's name. |
| greeting | string | – | Greeting shown when the panel opens (`data-greeting-message`). |
| locale | string | – | UI locale (`data-locale`), e.g. `en`, `fr`, `es`. |
| position | string | – | Launcher corner (`data-position`). |
| primaryColor | string | – | Brand colour for launcher and bubbles (`data-primary-color`), e.g. `#0052CC`. |
| widgetUrl | string | – | Override the widget bundle base URL (the script is `<widgetUrl>/assistant.js`). |
No output schema declared.
No examples provided.
fetch Fetch Doc ~82
Fetch the full text of a documentation section or tool reference entry by the id returned from `search` (e.g. `tool:ethora-app-create`, `doc:auth-map#app-jwt`, `doc:hosted-guide`). Auth: none required. Errors: unknown id.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Document id from a `search` result. |
No output schema declared.
No examples provided.
search Search Docs ~133
Search the Ethora documentation and tool reference: auth model (app JWT vs app token vs B2B token vs API keys), hosted-server getting started, chat-component and backend SDK quickstarts, recipes, and a reference entry for every tool with its inputs. Use it for any "how do I ..." question about Ethora before guessing; then call `fetch` with a result id to read the full text. Auth: none required.
| Name | Type | Req | Description |
|---|---|---|---|
| query | string | yes | Free-text query, e.g. 'create an app', 'invite agent to chat', 'api key bearer header'. Empty returns the getting-started guides. |
No output schema declared.
No examples provided.
What is the io.github.dappros/ethora-mcp-server server?
io.github.dappros/ethora-mcp-server is listed in the public MCP registry as io.github.dappros/ethora-mcp-server. Ethora chat platform MCP: apps, users, rooms, AI agents, chat widgets. Hosted or stdio. This page covers its npm package (@ethora/mcp-server).
Is the io.github.dappros/ethora-mcp-server server safe to use?
io.github.dappros/ethora-mcp-server scores 83 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.dappros/ethora-mcp-server server expose?
io.github.dappros/ethora-mcp-server exposes 89 tools: ethora-configure, ethora-status, ethora-help, ethora-run-recipe, ethora-doctor, and 84 more. Their descriptions and schemas cost roughly 20,156 tokens of context every time the server is loaded.
Is the io.github.dappros/ethora-mcp-server server still maintained?
io.github.dappros/ethora-mcp-server is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.dappros/ethora-mcp-server server under?
io.github.dappros/ethora-mcp-server declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.