io.github.davidmosiah/eight-sleep-mcp
NPM · EIGHT-SLEEP-MCP-UNOFFICIAL
Unofficial Eight Sleep MCP server: read sleep trends, temperature, alarms; gated pod control.
Available components
Last scanned (16 hours ago)
Scores higher than 87% of npm servers
Category IoT and Hardware
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 51 of 127 dependencies flagged as unhealthy (1 deprecated). View diagnostics → Partial
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 67 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability85
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 2151 tokens (~74/item across 29 items; 26 tools + 3 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage83
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 39% of tool parameters carry a description.Partial
- Structured output schemas are declared (81% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 27 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Checks we ran (16)
- Malware scan
- Known CVEs
- Install scripts
- Dependency health
- Source repository
- Provenance
- License
- Maintenance
- Security disclosure
- Schema quality
- Stability
- Tool coverage
- Injection markers
- Destructive annotations
- Judged manipulation
- MCP protocol
Does not apply to this package (2)
- Endpoint SecurityScored on hosted endpoints only. A package has no live endpoint of its own for us to probe.
- Transport & ReachabilityScored on hosted endpoints only. A package has no live endpoint of its own for us to probe.
The score does not measure everything. What the score does not measure →
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 3 Nov 26 0
- Stability: 0.97 → pass security
- 2 Nov 26 0
- Stability: pass → 0.97 functional
- 27 Oct 26 0
- Stability: 0.97 → pass security
- 26 Oct 26 0
- Stability: pass → 0.97 functional
- 20 Oct 26 0
- Stability: 0.97 → pass security
- 19 Oct 26 0
- Stability: pass → 0.97 functional
- 17 Oct 26 +2
- Stability: 0.87 → pass security
- 15 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed npm/eight-sleep-mcp-unofficial@0.2.5
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 127 packages
| Packages resolved | 127 |
|---|---|
| Deprecated | 1 |
| Stale | 50 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
eight_sleep_agent_manifest Eight Sleep Agent Manifest ~42
Machine-readable install, runtime and client guidance for AI agents operating the Eight Sleep MCP.
| Name | Type | Req | Description |
|---|---|---|---|
| client | string | – | – |
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| agent_rules | array | yes | – |
| auth | object | yes | – |
| client | string | yes | – |
| hermes | object | yes | – |
| links | object | yes | – |
| mcp_name | string | yes | – |
| mutation_tools | array | yes | – |
| package | object | yes | – |
| project | string | yes | – |
| recommended_first_calls | array | yes | – |
| standard_tools | array | yes | – |
| troubleshooting | array | yes | – |
| unofficial | boolean | yes | – |
No examples provided.
eight_sleep_cache_status Eight Sleep Cache Status ~40
Show optional local SQLite cache status. Enable with EIGHT_SLEEP_CACHE=sqlite or EIGHT_SLEEP_CACHE=true.
| Name | Type | Req | Description |
|---|---|---|---|
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| enabled | boolean | yes | – |
| entries | integer | yes | – |
| newest_cached_at | string | – | – |
| path | string | yes | – |
No examples provided.
eight_sleep_capabilities Eight Sleep MCP Capabilities ~43
Explain supported Eight Sleep data, mutation gate, privacy modes, and project links. Does not call Eight Sleep or expose secrets.
| Name | Type | Req | Description |
|---|---|---|---|
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| api_boundary | object | yes | – |
| auth_model | object | yes | – |
| contribution_paths | array | yes | – |
| creator | object | yes | – |
| links | object | yes | – |
| mcp_name | string | yes | – |
| mutations | array | yes | – |
| privacy_modes | array | yes | – |
| project | string | yes | – |
| recommended_agent_flow | array | yes | – |
| supported_data | array | yes | – |
| unofficial | boolean | yes | – |
No examples provided.
eight_sleep_connection_status Eight Sleep Connection Status ~52
Check env, local config, token file, Node version, privacy mode and mutation gate. Does not call Eight Sleep or expose secrets.
| Name | Type | Req | Description |
|---|---|---|---|
| client | string | – | – |
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| cache | object | yes | – |
| client | string | – | – |
| config | object | yes | – |
| missing_env | array | yes | – |
| mutations_enabled | boolean | yes | – |
| next_steps | array | yes | – |
| node | object | yes | – |
| ok | boolean | yes | – |
| privacy_mode | string | yes | – |
| ready_for_eight_sleep_api | boolean | yes | – |
| required_env | object | yes | – |
| token | object | yes | – |
No examples provided.
eight_sleep_data_inventory Eight Sleep Data Inventory ~39
Inventory supported Eight Sleep domains, mutation tools, and recommended first calls. Does not call Eight Sleep APIs.
| Name | Type | Req | Description |
|---|---|---|---|
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| api_boundary | – | – | – |
| categories | array | yes | – |
| data_access_model | string | yes | – |
| first_tools | array | yes | – |
| generated_at | string | yes | – |
| kind | string | yes | – |
| links | object | yes | – |
| mcp_name | string | yes | – |
| mutations | array | yes | – |
| notes | array | yes | – |
| privacy_modes | array | yes | – |
| recommended_agent_flow | array | yes | – |
| source | string | yes | – |
| totals | object | yes | – |
| unofficial | boolean | yes | – |
No examples provided.
eight_sleep_dismiss_alarm Dismiss Eight Sleep Alarm ~62
Dismiss an actively ringing alarm. Requires EIGHT_SLEEP_ALLOW_MUTATIONS=true.
| Name | Type | Req | Description |
|---|---|---|---|
| alarm_id | string | yes | Eight Sleep alarm id from eight_sleep_get_alarms. |
| response_format | string | – | – |
| user_id | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| data | – | – | – |
| endpoint | string | yes | – |
| method | string | yes | – |
| note | string | – | – |
| ok | boolean | yes | – |
No examples provided.
eight_sleep_efficiency Eight Sleep Sleep Efficiency ~240
v0.2.2 — Sleep efficiency calculator. For each of the last N nights (default 7), computes time_in_bed_minutes (from presenceDuration), time_asleep_minutes (from sleepDuration), efficiency_pct = (asleep / in_bed) * 100, and efficiency_band (excellent ≥85, good 75-84, fair 65-74, poor <65). Returns nights_analyzed, mean / median / min-night / max-night efficiency, a nights_by_band breakdown, per_night array, and natural-language observations (mid-week drop, all-nights-same-band, single-night dip > 15 points below mean) ONLY when supported by the data. Reuses the existing /v1/users/{id}/trends payload — no extra API calls. Graceful degradation when upstream omits presenceDuration / sleepDuration (returns nights_analyzed: 0 with a clarifying note).
| Name | Type | Req | Description |
|---|---|---|---|
| nights | integer | – | Number of recent nights to analyze. Default 7. |
| response_format | string | – | – |
| timezone | string | – | IANA timezone for grouping nightly records. Default UTC. |
No output schema declared.
No examples provided.
eight_sleep_get_alarms Get Eight Sleep Alarms ~79
Return the list of configured alarms and the recommended next alarm.
| Name | Type | Req | Description |
|---|---|---|---|
| privacy_mode | string | – | Optional per-call payload privacy override. Defaults to EIGHT_SLEEP_PRIVACY_MODE or structured. |
| response_format | string | – | – |
| user_id | string | – | Eight Sleep user id. Defaults to the authenticated user (from stored token). |
| Name | Type | Req | Description |
|---|---|---|---|
| data | – | yes | – |
| endpoint | string | yes | – |
| privacy_mode | string | yes | – |
No examples provided.
eight_sleep_get_base Get Eight Sleep Adjustable Base ~78
Return adjustable-base state: leg angle, torso angle and preset.
| Name | Type | Req | Description |
|---|---|---|---|
| privacy_mode | string | – | Optional per-call payload privacy override. Defaults to EIGHT_SLEEP_PRIVACY_MODE or structured. |
| response_format | string | – | – |
| user_id | string | – | Eight Sleep user id. Defaults to the authenticated user (from stored token). |
| Name | Type | Req | Description |
|---|---|---|---|
| data | – | yes | – |
| endpoint | string | yes | – |
| privacy_mode | string | yes | – |
No examples provided.
eight_sleep_get_current_device Get Current Eight Sleep Device ~81
Return the bed side currently assigned to the user (solo/left/right).
| Name | Type | Req | Description |
|---|---|---|---|
| privacy_mode | string | – | Optional per-call payload privacy override. Defaults to EIGHT_SLEEP_PRIVACY_MODE or structured. |
| response_format | string | – | – |
| user_id | string | – | Eight Sleep user id. Defaults to the authenticated user (from stored token). |
| Name | Type | Req | Description |
|---|---|---|---|
| data | – | yes | – |
| endpoint | string | yes | – |
| privacy_mode | string | yes | – |
No examples provided.
eight_sleep_get_me Get Eight Sleep Profile (me) ~54
Return the authenticated user's Eight Sleep profile and assigned devices.
| Name | Type | Req | Description |
|---|---|---|---|
| privacy_mode | string | – | Optional per-call payload privacy override. Defaults to EIGHT_SLEEP_PRIVACY_MODE or structured. |
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| data | – | yes | – |
| endpoint | string | yes | – |
| privacy_mode | string | yes | – |
No examples provided.
eight_sleep_get_temperature Get Eight Sleep Temperature ~80
Return current heating level, smart-schedule levels and side on/off state.
| Name | Type | Req | Description |
|---|---|---|---|
| privacy_mode | string | – | Optional per-call payload privacy override. Defaults to EIGHT_SLEEP_PRIVACY_MODE or structured. |
| response_format | string | – | – |
| user_id | string | – | Eight Sleep user id. Defaults to the authenticated user (from stored token). |
| Name | Type | Req | Description |
|---|---|---|---|
| data | – | yes | – |
| endpoint | string | yes | – |
| privacy_mode | string | yes | – |
No examples provided.
eight_sleep_get_trends Get Eight Sleep Sleep Trends ~98
Return nightly sleep sessions and scores for a date range.
| Name | Type | Req | Description |
|---|---|---|---|
| from_date | string | yes | Start date in YYYY-MM-DD. |
| privacy_mode | string | – | Optional per-call payload privacy override. Defaults to EIGHT_SLEEP_PRIVACY_MODE or structured. |
| response_format | string | – | – |
| timezone | string | – | – |
| to_date | string | yes | End date in YYYY-MM-DD. |
| user_id | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| data | – | yes | – |
| endpoint | string | yes | – |
| privacy_mode | string | yes | – |
No examples provided.
eight_sleep_get_user Get Eight Sleep User ~81
Return Eight Sleep profile data for a specific user_id (defaults to authenticated user).
| Name | Type | Req | Description |
|---|---|---|---|
| privacy_mode | string | – | Optional per-call payload privacy override. Defaults to EIGHT_SLEEP_PRIVACY_MODE or structured. |
| response_format | string | – | – |
| user_id | string | – | Eight Sleep user id. Defaults to the authenticated user (from stored token). |
| Name | Type | Req | Description |
|---|---|---|---|
| data | – | yes | – |
| endpoint | string | yes | – |
| privacy_mode | string | yes | – |
No examples provided.
eight_sleep_logout Eight Sleep Logout ~34
Delete the local Eight Sleep token file. Use when the user explicitly wants to disconnect.
| Name | Type | Req | Description |
|---|---|---|---|
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| local_tokens_cleared | boolean | yes | – |
| note | string | yes | – |
| ok | boolean | yes | – |
| token_path | string | yes | – |
No examples provided.
eight_sleep_nightly_summary Eight Sleep Nightly Summary ~75
Compute a multi-night sleep summary (best night, worst night, mean score, nights under 70 / over 85) from Eight Sleep trend data. One call replaces post-processing raw `get_trends`.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | – | – |
| response_format | string | – | – |
| timezone | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| generated_at | string | yes | – |
| kind | string | yes | – |
No examples provided.
eight_sleep_onboarding Eight Sleep onboarding ~85
Returns the 11-question onboarding flow for the shared Delx Wellness profile (en or pt-BR). The agent should ask these questions next so Eight Sleep (and the rest of the wellness stack) can personalize responses — non-secret data only, stored at ~/.delx-wellness/profile.json.
| Name | Type | Req | Description |
|---|---|---|---|
| locale | string | – | – |
| response_format | string | – | – |
No output schema declared.
No examples provided.
eight_sleep_privacy_audit Eight Sleep Privacy Audit ~44
Return local privacy, cache, token-path, env-presence, mutation gate and redaction posture without revealing secret values.
| Name | Type | Req | Description |
|---|---|---|---|
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| cache_enabled | boolean | yes | – |
| cache_path | string | yes | – |
| config_source | string | yes | – |
| local_config_exists | boolean | yes | – |
| local_config_path | string | yes | – |
| local_config_secure_permissions | boolean | – | – |
| mutations_enabled | boolean | yes | – |
| notes | array | yes | – |
| privacy_mode_default | string | yes | – |
| project | string | yes | – |
| raw_payloads_opt_in | boolean | yes | – |
| redacted_key_patterns | array | yes | – |
| required_env_present | object | yes | – |
| secret_env_vars | array | yes | – |
| stdout_safe | boolean | yes | – |
| token_path | string | yes | – |
| unofficial | boolean | yes | – |
No examples provided.
eight_sleep_profile_get Eight Sleep profile get ~63
Returns the shared Delx Wellness profile (~/.delx-wellness/profile.json). Read-only. Surfaces preferred sleep window, age, goals, and devices so eight_sleep_nightly_summary and bedtime experiments can personalize recommendations.
| Name | Type | Req | Description |
|---|---|---|---|
| response_format | string | – | – |
No output schema declared.
No examples provided.
eight_sleep_profile_update Eight Sleep profile update ~170
Persist a partial patch to the shared Delx Wellness profile (~/.delx-wellness/profile.json). Requires explicit_user_intent: true. Rejects any field whose key looks like a credential (oauth/token/secret/password/cookie/refresh/api_key/bearer/credential/session_id) or whose value matches credential-shaped patterns (JWT, Bearer token, sk_live_, sk-proj-, xoxb-, github_pat_).
| Name | Type | Req | Description |
|---|---|---|---|
| explicit_user_intent | boolean | – | Pass true only after the user explicitly asked to save, log, set, or delete this personal wellness profile data. |
| patch | object | yes | Partial WellnessProfileDocument patch. Top-level keys: profile, goals, devices, training, nutrition, preferences, safety, notes. |
| response_format | string | – | – |
No output schema declared.
No examples provided.
eight_sleep_set_away_mode Set Eight Sleep Away Mode ~50
Toggle away mode. Requires EIGHT_SLEEP_ALLOW_MUTATIONS=true.
| Name | Type | Req | Description |
|---|---|---|---|
| is_away | boolean | yes | – |
| response_format | string | – | – |
| user_id | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| data | – | – | – |
| endpoint | string | yes | – |
| method | string | yes | – |
| note | string | – | – |
| ok | boolean | yes | – |
No examples provided.
eight_sleep_set_side Set Eight Sleep Side On/Off ~63
Turn the user's bed side on or off. Requires EIGHT_SLEEP_ALLOW_MUTATIONS=true.
| Name | Type | Req | Description |
|---|---|---|---|
| is_on | boolean | yes | Turn the side on (true) or off (false). |
| response_format | string | – | – |
| user_id | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| data | – | – | – |
| endpoint | string | yes | – |
| method | string | yes | – |
| note | string | – | – |
| ok | boolean | yes | – |
No examples provided.
eight_sleep_set_temperature Set Eight Sleep Temperature Level ~102
Set the heating level (-100 .. 100). Optionally set a duration in seconds. Requires EIGHT_SLEEP_ALLOW_MUTATIONS=true.
| Name | Type | Req | Description |
|---|---|---|---|
| duration_seconds | integer | – | Optional duration in seconds. Omit for persistent override. |
| level | integer | yes | Heating level. -100 = coldest, 0 = neutral, 100 = hottest. Eight Sleep clamps client-side. |
| response_format | string | – | – |
| user_id | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| data | – | – | – |
| endpoint | string | yes | – |
| method | string | yes | – |
| note | string | – | – |
| ok | boolean | yes | – |
No examples provided.
eight_sleep_snooze_alarm Snooze Eight Sleep Alarm ~63
Snooze an actively ringing alarm. Requires EIGHT_SLEEP_ALLOW_MUTATIONS=true.
| Name | Type | Req | Description |
|---|---|---|---|
| alarm_id | string | yes | Eight Sleep alarm id from eight_sleep_get_alarms. |
| response_format | string | – | – |
| user_id | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| data | – | – | – |
| endpoint | string | yes | – |
| method | string | yes | – |
| note | string | – | – |
| ok | boolean | yes | – |
No examples provided.
eight_sleep_temperature_trend Eight Sleep Temperature Trend ~151
Workflow tool: returns the current smart-temperature schedule (bedtime/initial/final level), per-night sleep scores for the last N nights, mean/median/range/most-common for bedtime AND wake temperature settings when the trends payload exposes them, and a correlation note (e.g. 'colder bedtime → higher sleep score') ONLY when 3+ paired nights support |r| >= 0.5. Reuses get_temperature + get_trends data — no extra API calls.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | – | Number of recent nights to summarize. Default 7. |
| response_format | string | – | – |
| timezone | string | – | IANA timezone for grouping nightly records. Default UTC. |
No output schema declared.
No examples provided.
eight_sleep_wellness_context Eight Sleep Wellness Context ~121
Build a normalized `delx-wellness-context/v1` payload from recent Eight Sleep trends so other Delx Wellness tools (nourish, exercise catalog, Telegram coaches) can read sleep context without knowing the Eight Sleep API.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | – | Lookback window in days for Eight Sleep trends. |
| injury_flags | array | – | – |
| notes | string | – | – |
| response_format | string | – | – |
| soreness | array | – | – |
| timezone | string | – | IANA timezone used by the Eight Sleep API. |
| Name | Type | Req | Description |
|---|---|---|---|
| context_contract_version | string | yes | – |
| context_type | string | yes | – |
| data_quality | – | – | – |
| generated_at | string | yes | – |
| injury_flags | array | yes | – |
| notes | array | yes | – |
| recent_training_load | string | yes | – |
| recommended_handoff | object | yes | – |
| recovery_score | number | – | – |
| sleep_score | number | – | – |
| soreness | array | yes | – |
| source | string | yes | – |
| strain_score | number | – | – |
| telegram_summary | string | – | – |
| window | object | yes | – |
No examples provided.
How do I install the io.github.davidmosiah/eight-sleep-mcp server?
io.github.davidmosiah/eight-sleep-mcp runs locally as an npm package, launched with npx -y eight-sleep-mcp-unofficial. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · eight-sleep-mcp-unofficial
claude mcp add davidmosiah-eight-sleep-mcp -- npx -y eight-sleep-mcp-unofficial
What is the io.github.davidmosiah/eight-sleep-mcp server?
io.github.davidmosiah/eight-sleep-mcp is listed in the public MCP registry as io.github.davidmosiah/eight-sleep-mcp. Unofficial Eight Sleep MCP server: read sleep trends, temperature, alarms; gated pod control. This page covers its npm package (eight-sleep-mcp-unofficial).
Is the io.github.davidmosiah/eight-sleep-mcp server safe to use?
io.github.davidmosiah/eight-sleep-mcp scores 85 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.davidmosiah/eight-sleep-mcp server expose?
io.github.davidmosiah/eight-sleep-mcp exposes 26 tools: eight_sleep_profile_get, eight_sleep_profile_update, eight_sleep_onboarding, eight_sleep_data_inventory, eight_sleep_capabilities, and 21 more. Their descriptions and schemas cost roughly 2,090 tokens of context every time the server is loaded.
Is the io.github.davidmosiah/eight-sleep-mcp server still maintained?
io.github.davidmosiah/eight-sleep-mcp is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.davidmosiah/eight-sleep-mcp server under?
io.github.davidmosiah/eight-sleep-mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.
What did VerifyMCP test on the io.github.davidmosiah/eight-sleep-mcp server?
VerifyMCP ran 16 checks on io.github.davidmosiah/eight-sleep-mcp, covering Malware scan, Known CVEs, Install scripts, Dependency health and 12 more. Endpoint Security and Transport & Reachability do not apply to an npm package, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.