RCA-MCP
PYPI · RCA-MCP-CONNECTOR · SCANNED SEP 21
Causal root-cause analysis MCP server -- 56 tools across graphs, RCA models, PyRCA.
Available components
Recent critical change
CVE-2026-32871 affects this package (2 Aug 2026). See the changelog before you install this server.
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security25
- Malware scan not yet available for this package.Unverified
- CVE check failed: an unpatched critical CVE affects this package; the score is capped at 0. See how to fix → View diagnostics → Fail
- Runs hatchling.build at install time, a recognised native-build step with no shell scripting around it. View diagnostics → Pass
- 8 of 75 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 10 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability67
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 11685 tokens (~208/item across 56 items; 56 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management87
- Stability observed for 26 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage71
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 0% of tool parameters carry a description.Fail
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 8 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 56 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the RCA-MCP server?
RCA-MCP runs locally as a PyPI package, launched with uvx rca-mcp-connector. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · rca-mcp-connector
claude mcp add dave1362-rca-mcp-connector -- uvx rca-mcp-connector
{
"mcpServers": {
"dave1362-rca-mcp-connector": {
"command": "uvx",
"args": [
"rca-mcp-connector"
]
}
}
} {
"servers": {
"dave1362-rca-mcp-connector": {
"command": "uvx",
"args": [
"rca-mcp-connector"
]
}
}
} codex mcp add dave1362-rca-mcp-connector -- uvx rca-mcp-connector
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"dave1362-rca-mcp-connector": {
"type": "local",
"command": [
"uvx",
"rca-mcp-connector"
],
"enabled": true
}
}
} openclaw mcp add dave1362-rca-mcp-connector --command uvx --arg rca-mcp-connector
mcp_servers:
dave1362-rca-mcp-connector:
command: "uvx"
args: ["rca-mcp-connector"] {
"McpServers": {
"dave1362-rca-mcp-connector": {
"Transport": "stdio",
"Command": "uvx",
"Arguments": [
"rca-mcp-connector"
]
}
}
} assistant mcp add dave1362-rca-mcp-connector -t stdio -c uvx -a rca-mcp-connector
{
"mcpServers": {
"dave1362-rca-mcp-connector": {
"command": "uvx",
"args": [
"rca-mcp-connector"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 19 Sept 26 0
- Stability: pass → 0.80 functional
- 18 Sept 26 0
- Stability: 0.97 → pass security
- 17 Sept 26 0
- Malware scan: pass → unverified ▼ security
- 16 Sept 26 0
- Malware scan: unverified → pass ▲ security
- 14 Sept 26 0
- Malware scan: pass → unverified ▼ security
- 12 Sept 26 0
- Malware scan: unverified → pass ▲ security
- Stability: pass → 0.80 functional
- 11 Sept 26 0
- Stability: 0.97 → pass security
- Package version: 4.1.18 → 4.1.20 functional
- 10 Sept 26 0
- Package version: 4.1.16 → 4.1.18 functional
- Package version: 4.1.16 → 4.1.17 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 21 Sept 2026 · Analysed pypi/rca-mcp-connector@4.1.20
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | pypi |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | hatchling.build |
Background: Why install scripts are a supply-chain risk →
Vulnerabilities 6 findings
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-m8x7-r2rg-vh5g | CVE-2025-64340 | medium | CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H | yes |
| GHSA-rww4-4w9c-7733 | CVE-2026-27124 | high | yes | |
| GHSA-vv7q-7jx5-f767 | CVE-2026-32871 | critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | yes |
| PYSEC-2026-2475 | CVE-2025-64340 | medium | CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H | yes |
| PYSEC-2026-2476 | CVE-2026-27124 | none | yes | |
| PYSEC-2026-338 | CVE-2026-32871 | critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 75 packages
| Packages resolved | 75 |
|---|---|
| Stale | 5 |
| No linked repository | 3 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
rca_pyrca_epsilon_diagnosis ~299
[Adapted from Salesforce PyRCA — BSD-3-Clause] Identify anomalous metrics contributing to a Service Level Indicator (SLI) anomaly by comparing metric distributions in normal vs. incident windows. Uses z-score thresholding: metrics with |z| > epsilon in the incident window relative to the normal baseline are flagged as root cause candidates. Best used as a FIRST STEP in RCA to narrow down candidate metrics before applying more compute-intensive causal methods like rca_pyrca_ht_diagnosis or rca_pyrca_random_walk -- this one needs no causal graph at all, just two data windows. Requires the pyrca feature (Starter+). Args: params (EpsilonDiagnosisInput): - normal_data: baseline {metric: [values]} (min 3 per metric) - anomaly_data: incident window {metric: [values]} - sli_metric: the observed anomaly metric - epsilon: z-score threshold (default 3.0 = 3σ) Returns: str: JSON with root_causes (anomalous metrics ranked by |z_score|), all_metrics, sli_z_score, epsilon_threshold Attribution: Adapted from PyRCA EpsilonDiagnosis (Salesforce, BSD-3-Clause) Zhen et al. (2022) ε-Diagnosis
| Name | Type | Req | Description |
|---|---|---|---|
| params | – | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
rca_pyrca_ht_diagnosis ~340
[Adapted from Salesforce PyRCA — BSD-3-Clause] Hypothesis-testing RCA with descendant adjustment (HT-ADJ / CIRCA). Tests whether the SLI anomaly can be statistically explained by causal propagation from each ancestor node. Applies descendant adjustment to reduce indirect cause scores and surface true root causes. This is the most statistically rigorous PyRCA algorithm and is recommended when you have a well-validated causal graph and sufficient pre-anomaly data -- reach for rca_pyrca_epsilon_diagnosis instead if you don't have a graph yet, or rca_pyrca_random_walk if you have a graph but not enough pre-anomaly history for a hypothesis test. Requires the pyrca feature (Starter+). Args: params (HTDiagnosisInput): - data: {metric: [values]} full time series - adjacency: causal graph - sli_metric: observed anomaly metric - anomaly_start_idx: index where anomaly starts - significance: p-value threshold (default 0.05) - use_descendant_adjustment: enable HT-ADJ (default True) Returns: str: JSON with root_causes (is_root_cause=true), all_results, method (HT or HT-ADJ) Attribution: Adapted from PyRCA HT/CIRCA concept (Salesforce, BSD-3-Clause) Shen et al. (2022) CIRCA; Zheng et al. (2023) arXiv:2306.11417
| Name | Type | Req | Description |
|---|---|---|---|
| params | – | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
rca_pyrca_random_walk ~239
[Adapted from Salesforce PyRCA — BSD-3-Clause] Graph-based root cause localisation via personalised PageRank random walk. Propagates backward through a causal adjacency graph from the SLI node, weighting transitions by anomaly scores to compute root cause probabilities. Requires the pyrca feature (Starter+) and, unlike rca_pyrca_epsilon_diagnosis, needs an adjacency graph you already have (from rca_graph_get's "adjacency" format, or hand-built) plus precomputed anomaly scores per metric -- it doesn't compute those scores itself. Args: params (RandomWalkInput): - adjacency: {source: {target: weight}} causal graph - anomaly_scores: {metric: score} anomaly magnitudes - sli_metric: starting node - restart_prob: personalisation (higher = proximity-weighted) Returns: str: JSON with root_causes ranked by composite_score, converged, iterations Attribution: Adapted from PyRCA random walk concept (Salesforce, BSD-3-Clause)
| Name | Type | Req | Description |
|---|---|---|---|
| params | – | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
rca_pyrca_validate_setup ~227
Validate the PyRCA integration setup and report which strategy is active — a read-only diagnostic, not an action. Takes no parameters beyond authentication (token/client_id); there is nothing else to configure on this call. Run this once before your first rca_pyrca_epsilon_diagnosis, rca_pyrca_ht_diagnosis, or rca_pyrca_random_walk call if you're unsure which strategy is active, or if a PyRCA call errors unexpectedly — the response's "recommendations" field will say what to fix. Checks: - Strategy B (pure Python): always available, no extra setup - Strategy A (subprocess): requires sfr-pyrca in .venv_pyrca - sklearn version in host env vs PyRCA's requirement - Attribution compliance (BSD-3-Clause notice present) Returns: str: JSON with strategy_active, sklearn_version, sfr_pyrca_available, compliance, recommendations
| Name | Type | Req | Description |
|---|---|---|---|
| params | – | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
rca_report_compare ~202
Generate a comparative report across 2–10 RCA results, showing consensus root causes, model agreement percentages, and per-model summaries. Use this instead of rca_analysis_compare when you want a shareable formatted document rather than raw comparison JSON. `format: "html"` requires Starter+ (Free plan gets a plan_required error and should use the default "markdown" instead). Args: params (ReportCompareInput): - result_ids: 2–10 result IDs to compare (from rca_analysis_run or rca_analysis_list_results) - format: "markdown" (default, all plans) or "html" (Starter+) - title: report title, up to 200 chars - save: persist the report server-side for later retrieval (default true) Returns: str: Comparative report (text/html) with consensus_root_causes table
| Name | Type | Req | Description |
|---|---|---|---|
| params | – | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
rca_report_generate ~337
Generate a styled, professional report from a SINGLE RCA analysis result -- use rca_report_compare instead if you want a report covering multiple results together. Supported formats (plan-gated -- Free: markdown only, Starter+: adds html/pdf, Pro+: adds excel; requesting an ungated format returns a security_violation error, not a silent downgrade): pdf — Professional PDF with tables, score bars, and styled sections (requires reportlab; falls back to plaintext if not installed) html — Styled HTML with CSS — embeddable in dashboards or emails (requires jinja2; falls back to minimal HTML) excel — 4-sheet Excel workbook: Summary, Root Causes, Actions, Metadata (requires openpyxl) markdown — Plain Markdown; always available; good for GitHub/Slack/Notion All formats include: - Executive summary with metric cards - Root cause ranking table with priority badges - Recommended actions (IMMEDIATE / MONITOR / TRACK) - Analysis metadata - Optional raw output appendix Args: params (ReportGenerateInput): - result_id: source RCA result - format: pdf | html | excel | markdown - title: custom report title - include_raw: include model output appendix - save: persist report to storage Returns: str: JSON with content_b64 (bytes formats), content_text (text formats), byte_size, format, report_id (if saved), storage_path (if saved)
| Name | Type | Req | Description |
|---|---|---|---|
| params | – | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
What is the RCA-MCP server?
RCA-MCP is listed in the public MCP registry as io.github.dave1362/rca-mcp-connector. Causal root-cause analysis MCP server -- 56 tools across graphs, RCA models, PyRCA. This page covers its PyPI package (rca-mcp-connector).
What tools does the RCA-MCP server expose?
RCA-MCP exposes 56 tools: rca_auth_generate_token, rca_auth_list_keys, rca_auth_rotate_key, rca_auth_revoke_token, rca_admin_health, and 51 more. Their descriptions and schemas cost roughly 11,685 tokens of context every time the server is loaded.
Is the RCA-MCP server still maintained?
RCA-MCP is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the RCA-MCP server under?
RCA-MCP declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.