# Amendor (npm · amendor-mcp)

Pull change requests from your Amendor board into your coding agent to build and open PRs.

- Trust score: 66/100 (medium)
- Change this week: +20
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `amendor.site`: 74/100, [markdown](https://verifymcp.io/servers/deslay1-amendor-mcp/amendor.md), [page](https://verifymcp.io/servers/deslay1-amendor-mcp/amendor)
- npm · `amendor-mcp`: 66/100 (this document), [markdown](https://verifymcp.io/servers/deslay1-amendor-mcp/amendor-mcp.md), [page](https://verifymcp.io/servers/deslay1-amendor-mcp/amendor-mcp)

## Channel facts

- Registry: `npm`
- Package: `amendor-mcp`
- Version: `1.0.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 13 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 77/100
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 484 tokens (~69/item across 7 items; 7 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add deslay1-amendor-mcp -- npx -y amendor-mcp
```

### Codex

```bash
codex mcp add deslay1-amendor-mcp -- npx -y amendor-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "deslay1-amendor-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "amendor-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add deslay1-amendor-mcp --command npx --arg -y --arg amendor-mcp
```

### Hermes

```yaml
mcp_servers:
  deslay1-amendor-mcp:
    command: "npx"
    args: ["-y", "amendor-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "deslay1-amendor-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "amendor-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 66, +61)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] License: unverified → pass
- [functional] Licence: MIT

### 2026-07-31 (score 5, −23)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 28, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-27 (score 46)

First indexed and scored.

## MCP tools (7)

### `list_change_requests` (~70 tokens)

List change requests

List change requests submitted by end users on sites you ship. Optionally filter by status. Start here to see what people are asking for.

Input parameters:

- `status` (string): Optional status filter: new, accepted, building, preview, approved, shipped, or rejected. Omit to list every open request.

Output parameters:

- `requests` (array): Matching change requests, newest first.

### `get_change_request` (~70 tokens)

Get change request

Get full detail for one change request so you can implement it: the user request, the exact element they pointed at (CSS selector + outerHTML), the page URL, and a screenshot URL. Call this before making the change.

Input parameters:

- `id` (string, required): Change request id, from list_change_requests.

Output parameters:

- `attachment_urls` (array): Absolute URLs of any extra attachments.
- `elements` (array): Elements attached to the request; empty for a general request.
- `id` (string): Change request id.
- `page_url` (string): URL of the page the request was made on.
- `request_text` (string): What the user wants.
- `requested_by` (string): Requester email, or "anonymous".
- `revision_comment` (string): The revision note, or empty string if none.
- `revision_requested` (boolean): True if the requester reviewed a preview and asked for changes; push to the same branch/PR.
- `screenshot_url` (string): Absolute screenshot URL, or empty string.
- `status` (string): Current status.

### `set_preview_url` (~58 tokens)

Attach preview URL

Attach a deploy-preview URL to a change request and mark it ready for the requester to review.

Input parameters:

- `id` (string, required): Change request id.
- `url` (string, required): Deploy-preview URL (from your host) that the requester will review.

Output parameters:

- `id` (string): Change request id.
- `review_url` (string): Page where the requester reviews and approves the change.
- `status` (string): New status, set to "preview".

### `update_status` (~57 tokens)

Update status

Update a change request status as it moves through the build and review flow.

Input parameters:

- `id` (string, required): Change request id.
- `status` (string, required): New status: new, accepted, building, preview, approved, shipped, or rejected.

Output parameters:

- `id` (string): Change request id.
- `status` (string): The status now set on the request.

### `start_build` (~112 tokens)

Start local build

LOCAL MODE ONLY (repo on this machine, no host). Cuts a branch + git worktree the local Amendor serves at /preview/<id>/. For the normal GitHub flow, do NOT call this: instead branch "relay/task-<id>" in your own repo clone, edit, commit, push, and open a PR tagged "relay-task:<id>" — the host builds the preview and the webhook captures it automatically.

Input parameters:

- `id` (string, required): Change request id to start a local build for.

Output parameters:

- `base` (string): Base branch it was cut from.
- `branch` (string): Branch that was created.
- `id` (string): Change request id.
- `preview_url` (string): URL that serves the worktree live for review.
- `worktree` (string): Local folder to edit; commit your change here.

### `publish_preview` (~57 tokens)

Publish preview

Mark a change request ready for the requester to review. The preview is already live from the worktree; this flips status to "in preview" and surfaces the link.

Input parameters:

- `id` (string, required): Change request id whose local preview is ready.

Output parameters:

- `id` (string): Change request id.
- `review_url` (string): Page where the requester reviews and approves the change.
- `status` (string): New status, set to "preview".

### `ship_change` (~60 tokens)

Ship change

Ship an approved change: merge the task branch into the project base, remove the worktree, and mark it shipped. Production (the live site) now reflects the change.

Input parameters:

- `id` (string, required): Change request id to ship (should be approved first).

Output parameters:

- `id` (string): Change request id.
- `into` (string): Base branch it was merged into.
- `merged` (string): Branch that was merged.
- `status` (string): New status, set to "shipped".

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/deslay1-amendor-mcp/amendor-mcp#diagnostics

## Score history

- 2026-08-03: 66
- 2026-08-02: 66
- 2026-08-01: 5
- 2026-07-31: 5
- 2026-07-30: 28
- 2026-07-28: 46
- 2026-07-27: 46

## Links

- npm package: https://www.npmjs.com/package/amendor-mcp
- Socket report: https://socket.dev/npm/package/amendor-mcp
- Repository: https://github.com/deslay1/amendor-mcp
- Website: https://amendor.site/
- Changelog RSS feed: https://verifymcp.io/servers/deslay1-amendor-mcp/amendor-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/deslay1-amendor-mcp/amendor-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/deslay1-amendor-mcp/amendor-mcp