Bluet
NPM · BLUET-MCP · 2 COMPONENTS · SCANNED SEP 26
Product memory your agents read before they work: briefs, plan checks against decisions, debriefs.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 38 of 119 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency19
- Repository check failed: no source repository is declared. See how to fix → View diagnostics → Fail
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (Apache-2.0).Pass
- Actively maintained (last published 1 days ago).Pass
- Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability73
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 2290 tokens (~76/item across 30 items; 30 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management7
- Stability observed for 2 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage75
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 26% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 30 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 31 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the Bluet MCP server?
Bluet runs locally as an npm package, launched with npx -y bluet-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · bluet-mcp
claude mcp add dev-bluet-bluet -- npx -y bluet-mcp
{
"mcpServers": {
"dev-bluet-bluet": {
"command": "npx",
"args": [
"-y",
"bluet-mcp"
]
}
}
} {
"servers": {
"dev-bluet-bluet": {
"command": "npx",
"args": [
"-y",
"bluet-mcp"
]
}
}
} codex mcp add dev-bluet-bluet -- npx -y bluet-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"dev-bluet-bluet": {
"type": "local",
"command": [
"npx",
"-y",
"bluet-mcp"
],
"enabled": true
}
}
} openclaw mcp add dev-bluet-bluet --command npx --arg -y --arg bluet-mcp
mcp_servers:
dev-bluet-bluet:
command: "npx"
args: ["-y", "bluet-mcp"] {
"McpServers": {
"dev-bluet-bluet": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"bluet-mcp"
]
}
}
} assistant mcp add dev-bluet-bluet -t stdio -c npx -a -y bluet-mcp
{
"mcpServers": {
"dev-bluet-bluet": {
"command": "npx",
"args": [
"-y",
"bluet-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 26 Sept 26 +40
- Injection markers: unverified → pass ▲ security
- Known CVEs: unverified → pass ▲ security
- MCP protocol: unverified → pass ▲ functional
- Tool coverage: unverified → 100 ▲ functional
- Stability: unverified → 0.07 ▲ functional
- Dependency health: unverified → 0.86 ▲ functional
- Package version: 0.4.9 → 0.5.1 functional
- 25 Sept 26 −29
- Tool safety: pass → unverified ▼ security
- Known CVEs: unverified → pass ▲ security
- Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Dependency health: unverified → 0.86 ▲ functional
- First check of Schema quality: unverified functional
- Package version: 0.4.9 → 0.5.1 functional
- Package version: 0.4.9 → 0.5.0 functional
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 24 Sept 26 52
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 26 Sept 2026 · Analysed npm/bluet-mcp@0.5.1
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 119 packages
| Packages resolved | 119 |
|---|---|
| Stale | 38 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
bluet_bet_list List bets ~31
List bets for a product
| Name | Type | Req | Description |
|---|---|---|---|
| product | string | yes | – |
| status | string | – | – |
No output schema declared.
No examples provided.
bluet_bet_upsert Record or update a bet ~172
Create or update a bet — a hypothesis the product is testing
| Name | Type | Req | Description |
|---|---|---|---|
| conviction | string | – | How far it has been borne out. Distinct from status, which is lifecycle |
| falsifier | string | – | What would change our mind. A bet with no falsifier cannot be lost, only defended |
| hypothesis | string | – | The claim, in one sentence |
| id | string | – | – |
| priority | number | – | Higher sorts earlier; this is the order of the argument |
| product | string | yes | – |
| reasoning | string | – | Why we believe it — the argument, not the claim |
| started_at | string | – | ISO date the bet was actually taken, when that is not today |
| status | string | – | – |
| title | string | yes | – |
No output schema declared.
No examples provided.
bluet_brief_get Get an agent's brief ~39
Get an agent brief (or all briefs if agent_key omitted)
| Name | Type | Req | Description |
|---|---|---|---|
| agent_key | string | – | – |
| product | string | yes | – |
No output schema declared.
No examples provided.
bluet_brief_push Send agent briefs to a webhook ~78
Push agent brief(s) to endpoints (webhook) and/or queue for MCP poll. Always upserts the canonical brief store and records a delivery row.
| Name | Type | Req | Description |
|---|---|---|---|
| agent_name | string | – | Single agent key; omit with all=true |
| all | boolean | – | Push every brief for the product |
| product | string | yes | – |
No output schema declared.
No examples provided.
bluet_brief_set Set an agent's brief ~61
Create or update an agent brief
| Name | Type | Req | Description |
|---|---|---|---|
| agent_key | string | yes | – |
| brief | string | yes | – |
| constraints | string | – | – |
| goals | string | – | – |
| product | string | yes | – |
| title | string | yes | – |
No output schema declared.
No examples provided.
bluet_brief_today Today's product brief ~84
The last day for a product: what is waiting on the owner (proposals, drift), recent activity, the rules agents are told, and questions only the owner can answer.
| Name | Type | Req | Description |
|---|---|---|---|
| format | string | – | 'session' returns the short text a session starts with, without the written brief; 'status' returns counts only |
| product | string | yes | – |
No output schema declared.
No examples provided.
bluet_check Check a plan against decisions ~81
Check a plan or diff against everything the product has decided. Returns conflicts, each citing the decision, rule or non-goal it collides with. verdict 'conflicts' with severity 'blocking' means stop and ask the user.
| Name | Type | Req | Description |
|---|---|---|---|
| plan | string | yes | The plan, or a diff / summary of the change |
| product | string | yes | – |
No output schema declared.
No examples provided.
bluet_constraint_list List constraints ~32
List derived constraints from strategy non-goals/principles and agent briefs
| Name | Type | Req | Description |
|---|---|---|---|
| product | string | yes | – |
No output schema declared.
No examples provided.
bluet_context_get Get a product's full context ~49
Get full product context (strategy, bets, roadmap, releases, decisions, gotchas, briefs, constraints)
| Name | Type | Req | Description |
|---|---|---|---|
| product | string | yes | Product slug or id (e.g. pasiv) |
No output schema declared.
No examples provided.
bluet_debrief Propose what a session settled ~110
Call when you finish work that settled something. List the decisions you made (a choice between options, a constraint you adopted) and traps you hit. They are PROPOSED for the owner to accept, never recorded directly. The summary is also checked against the record, and a contradiction is raised as drift.
| Name | Type | Req | Description |
|---|---|---|---|
| decisions | array | – | – |
| gotchas | array | – | – |
| product | string | yes | – |
| summary | string | yes | What the session did, in a few sentences |
No output schema declared.
No examples provided.
bluet_decision_get Get a decision ~25
Get a single decision by id
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | – |
No output schema declared.
No examples provided.
bluet_decision_list List decisions ~34
List decisions for a product
| Name | Type | Req | Description |
|---|---|---|---|
| include_superseded | boolean | – | – |
| product | string | yes | – |
No output schema declared.
No examples provided.
bluet_decision_record Record a decision ~99
Record a product decision (optionally superseding a prior one)
| Name | Type | Req | Description |
|---|---|---|---|
| bet | string | – | The bet this decision serves, by name or id. Counted as evidence on Intent |
| decision | string | yes | – |
| product | string | yes | – |
| rationale | string | – | – |
| source | string | – | – |
| status | string | – | – |
| supersedes_id | string | – | – |
| title | string | yes | – |
No output schema declared.
No examples provided.
bluet_decision_update Update a decision ~60
Edit fields on an existing product decision without creating a new version
| Name | Type | Req | Description |
|---|---|---|---|
| decision | string | – | – |
| id | string | yes | – |
| rationale | string|null | – | – |
| status | string | – | – |
| title | string | – | – |
No output schema declared.
No examples provided.
bluet_drift_list List conflicts ~45
List drift: where product memory and the outside world disagree. Each item carries the tool call that resolves it, or why none exists.
| Name | Type | Req | Description |
|---|---|---|---|
| product | string | yes | – |
No output schema declared.
No examples provided.
bluet_gotcha_add Record a rule ~85
Add a gotcha / trap / tribal knowledge note
| Name | Type | Req | Description |
|---|---|---|---|
| bet | string | – | The bet this gotcha is evidence about, by name or id |
| body | string | yes | – |
| product | string | yes | – |
| severity | string | – | – |
| source | string | – | – |
| tags | string | – | – |
| title | string | yes | – |
No output schema declared.
No examples provided.
bluet_gotcha_list List rules ~26
List gotchas for a product
| Name | Type | Req | Description |
|---|---|---|---|
| product | string | yes | – |
No output schema declared.
No examples provided.
bluet_gotcha_search Search rules ~33
Search gotchas by text query
| Name | Type | Req | Description |
|---|---|---|---|
| product | string | yes | – |
| query | string | yes | – |
No output schema declared.
No examples provided.
bluet_ingest Ingest a note or link ~91
Ingest a note/url/payload into Bluet as decision|gotcha|roadmap|release|brief|signal
| Name | Type | Req | Description |
|---|---|---|---|
| notes | string | – | – |
| payload | object | – | – |
| product | string | yes | – |
| title | string | – | – |
| type | string | yes | decision | gotcha | roadmap | release | brief | signal | note |
| url | string | – | – |
No output schema declared.
No examples provided.
bluet_preflight Brief an agent before a task ~114
CALL FIRST, before changing code. Given a task (and optionally the files you expect to touch), returns what you must know: rules not to break, decisions that constrain the work, non-goals, the bet it serves, and open questions — each numbered and sourced. One call replaces reading every table.
| Name | Type | Req | Description |
|---|---|---|---|
| files | array | – | Paths you expect to touch |
| product | string | yes | Product slug or id |
| task | string | yes | What you are about to do, in a sentence or two |
No output schema declared.
No examples provided.
bluet_product_create Create a product ~71
Create a product to hold memory. Required before anything else on a fresh install.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | – | – |
| name | string | yes | Display name, e.g. Pasiv |
| slug | string | – | URL-safe id; derived from name when omitted |
| url | string | – | – |
No output schema declared.
No examples provided.
bluet_products_list List products ~18
List all products in Bluet memory
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
bluet_proposal_judge Accept or dismiss a proposal ~49
Accept or dismiss one pending proposal — ONLY when the user has said to. Accepting writes it into the record.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | – |
| id | string | yes | – |
No output schema declared.
No examples provided.
bluet_proposals_list List what awaits the owner ~68
List what is waiting for the owner's judgment: decisions read from pull requests and issues, traps, drift, and what agents debriefed. Show these to the user; accept or dismiss only on their say-so with bluet_proposal_judge.
| Name | Type | Req | Description |
|---|---|---|---|
| product | string | yes | – |
No output schema declared.
No examples provided.
bluet_release_list List releases ~23
List releases for a product
| Name | Type | Req | Description |
|---|---|---|---|
| product | string | yes | – |
No output schema declared.
No examples provided.
bluet_release_upsert Record or update a release ~104
Create or update a release plan
| Name | Type | Req | Description |
|---|---|---|---|
| bet_id | string|null | – | Link to the bet this delivers |
| decision_id | string|null | – | Link to the decision that authorised it |
| id | string | – | – |
| name | string | yes | – |
| notes | string | – | – |
| platforms | – | – | – |
| product | string | yes | – |
| status | string | – | – |
| target_date | string | – | – |
| version | string | – | – |
No output schema declared.
No examples provided.
bluet_repo_ingest Record a repository read locally ~150
Record a repository's material read on the caller's machine (README, files written for agents, merged pull requests, issues) against a product. Used by `npx bluet-mcp init` when linked to bluet.dev, so a repository GitHub will not let bluet.dev read can still be read. Same rule as a sync: transcriptions are recorded, inferences are proposed.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string|null | – | – |
| files | array | – | – |
| issues | array | – | – |
| product | string | yes | – |
| pulls | array | – | – |
| readme | string|null | – | – |
| repo | string | yes | owner/name, or the directory name |
No output schema declared.
No examples provided.
bluet_roadmap_list List roadmap items ~26
List roadmap items for a product
| Name | Type | Req | Description |
|---|---|---|---|
| product | string | yes | – |
No output schema declared.
No examples provided.
bluet_roadmap_upsert Record or update a roadmap item ~70
Create or update a roadmap item
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | – | – |
| horizon | string | – | – |
| id | string | – | – |
| product | string | yes | – |
| sort_order | number | – | – |
| status | string | – | – |
| title | string | yes | – |
No output schema declared.
No examples provided.
bluet_strategy_set Set a product's strategy ~204
Set the product strategy. Supersedes the current one, keeping the previous version linked rather than overwriting it.
| Name | Type | Req | Description |
|---|---|---|---|
| measure_comparison | string | – | What it was before, e.g. 'from 41% in June' |
| measure_detail | string | – | What the measure is and why it is the one that counts |
| measure_label | string | – | Name of the single measure, e.g. 'The one measure' |
| measure_value | string | – | Its current value, e.g. '68%' |
| non_goals | string | – | One per line; becomes a constraint |
| north_star | string | – | The one sentence the product exists to make true. Shown as the Intent headline |
| positioning | string | – | – |
| principles | string | – | One per line; becomes a constraint |
| product | string | yes | – |
| source | string | – | – |
| summary | string | – | – |
| title | string | yes | – |
No output schema declared.
No examples provided.
What is the Bluet MCP server?
Bluet is an MCP server listed in the public MCP registry as dev.bluet/bluet. Product memory your agents read before they work: briefs, plan checks against decisions, debriefs. This page covers its npm package (bluet-mcp).
Is the Bluet MCP server safe to use?
Bluet scores 63 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 26 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Bluet MCP server expose?
Bluet exposes 30 tools: bluet_products_list, bluet_context_get, bluet_decision_list, bluet_decision_get, bluet_gotcha_list, and 25 more. Their descriptions and schemas cost roughly 2,132 tokens of context every time the server is loaded.
Is the Bluet MCP server still maintained?
Bluet is still listed as active in the MCP registry. We last reached this channel on 26 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Bluet MCP server under?
Bluet declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.