{"$schema":"https://verifymcp.io/schemas/trust-report.json","schemaVersion":1,"license":{"name":"CC BY-NC 4.0","url":"https://creativecommons.org/licenses/by-nc/4.0/"},"generatedAt":"2026-11-05T16:01:19.461Z","url":"https://verifymcp.io/servers/dev-corlabs-mcp/corlabsdev-mcp","markdownUrl":"https://verifymcp.io/servers/dev-corlabs-mcp/corlabsdev-mcp.md","server":{"slug":"dev-corlabs-mcp","name":"dev.corlabs/mcp","registryName":"dev.corlabs/mcp","description":"Scored, maintainable locators from a live page for AI coding agents, with checks and repairs.","registryStatus":"active","deletedAt":null,"statusMessage":null,"liveness":"live","publisher":{"class":"unknown","claimed":false}},"component":{"slug":"corlabsdev-mcp","type":"npm","identifier":"@corlabsdev/mcp","withdrawn":false,"url":"https://verifymcp.io/servers/dev-corlabs-mcp/corlabsdev-mcp","version":"0.1.7","transport":"stdio","scoredAt":"2026-11-05T02:13:58.256Z"},"score":{"total":65,"tier":"medium","status":"scored","weekDelta":0,"history":[{"date":"2026-11-05","total":65},{"date":"2026-11-04","total":65},{"date":"2026-11-03","total":65},{"date":"2026-11-02","total":65},{"date":"2026-11-01","total":65},{"date":"2026-10-31","total":65},{"date":"2026-10-30","total":65},{"date":"2026-10-29","total":65},{"date":"2026-10-28","total":65},{"date":"2026-10-27","total":50}]},"categories":[{"name":"Supply Chain Security","score":98,"verdict":"partial","reasons":["No malware found by supply-chain analysis.","No known CVEs affecting this package version or its production dependencies.","No install/post-install scripts declared.","30 of 93 dependencies flagged as unhealthy."],"codes":[{"code":"supplychain.malware_clean","args":{}},{"code":"cve.none","args":{}},{"code":"installscript.none","args":{}},{"code":"dephealth.assessed","args":{"deps":"93","unhealthy":"30"}}]},{"name":"Provenance & Transparency","score":32,"verdict":"fail","reasons":["Source repository is publicly reachable at the declared URL.","Provenance check failed: no build-provenance attestation is published.","Licence could not be checked: the licence is shipped as a file inside the package, not declared as a standard (SPDX) licence identifier, so we cannot tell whether it is OSI-approved.","Actively maintained (last published 9 days ago).","Disclosure check failed: no security disclosure policy was found in the source repository."],"codes":[{"code":"provenance.repo_verified","args":{}},{"code":"provenance.none","args":{}},{"code":"license.inconclusive","args":{"reason":"license_file_only"}},{"code":"maintenance.recent","args":{"age_days":"9"}},{"code":"disclosure.absent","args":{}}]},{"name":"Schema Quality & AI Usability","score":63,"verdict":"fail","reasons":["AI-judged instruction clarity (excellent).","Context-footprint check failed: tool/resource definitions use about 2423 tokens (~220/item across 11 items; 11 tools + 0 resources), over budget; trim descriptions and params.","Usage-examples check failed: none of the tools include examples."],"codes":[{"code":"schema.ai_quality","args":{"band":"excellent"}},{"code":"schema.footprint_heavy","args":{"avg":"220","items":"11","tools":"11","tokens":"2423","resources":"0"}},{"code":"schema.examples_absent","args":{}}]},{"name":"Stability & Change Management","score":0,"verdict":"unverified","reasons":["Stability not yet verified: not enough scan history yet (needs a 30-day window)."],"codes":[{"code":"stability.insufficient_history","args":{}}]},{"name":"Tool Coverage","score":100,"verdict":"pass","reasons":["100% of tools have a non-trivial description (not blank, and not just the tool's name).","100% of tool parameters carry a description."],"codes":[{"code":"toolquality.descriptions","args":{"pct":"100"}},{"code":"toolquality.param_docs","args":{"pct":"100"}}]},{"name":"Tool Safety","score":100,"verdict":"pass","reasons":["No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.","We read all 11 captured tool definition(s), and no name or description among them implies an irreversible operation.","An AI judge read all 12 captured unit(s) of tool text and found none that tries to manipulate the model reading it."],"codes":[{"code":"toolsafety.injection_clean","args":{}},{"code":"toolsafety.destructive_none","args":{"tools":"11"}},{"code":"toolsafety.manipulation_clean","args":{"units":"12","judged":"12"}}]},{"name":"Capabilities","score":100,"verdict":"pass","reasons":["Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28."],"codes":[{"code":"protocol.supported","args":{"latest":"2026-07-28","version":"2025-11-25"}}]}],"inconclusive":["Licence could not be checked: the licence is shipped as a file inside the package, not declared as a standard (SPDX) licence identifier, so we cannot tell whether it is OSI-approved.","Stability not yet verified: not enough scan history yet (needs a 30-day window)."],"malware":[],"components":[{"slug":"corlabsdev-mcp","type":"npm","identifier":"@corlabsdev/mcp","withdrawn":false,"score":65,"current":true,"url":"https://verifymcp.io/servers/dev-corlabs-mcp/corlabsdev-mcp","markdownUrl":"https://verifymcp.io/servers/dev-corlabs-mcp/corlabsdev-mcp.md"}],"facts":[{"label":"Registry","value":"npm"},{"label":"Package","value":"@corlabsdev/mcp"},{"label":"Version","value":"0.1.7"},{"label":"Transport","value":"stdio"}],"install":{"available":true,"bundleSha256":null},"tools":[{"name":"cor_open","title":"Open a page","description":"Open a URL in the COR-controlled browser. The browser starts on first use and is reused across calls. For a page behind a login, pass a Playwright storage-state file so the existing session is adopted. The reply lists the page's controls with refs (on a large page, a region index) — no cor_snapshot needed first — and, when the project's code already uses COR entries for this page, which members those are and whether each still finds its element.","inputs":[{"name":"storageState","type":"string","required":false,"description":"Path to a Playwright storage-state JSON file ({cookies, origins}) — e.g. from `npx playwright codegen --save-storage`."},{"name":"url","type":"string","required":true,"description":"Page to open."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":148},{"name":"cor_click","title":"Click an element","description":"Click an element to reach a page state — open a menu, go to the next step. Does not assert anything.","inputs":[{"name":"ref","type":"string","required":false,"description":"Element ref from the latest cor_snapshot, e.g. \"e4\". Alternative to target."},{"name":"target","type":"string","required":false,"description":"CSS selector for the element — must match exactly one. Alternative to ref."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":78},{"name":"cor_fill","title":"Fill a field","description":"Set the value of an input, textarea, select or editable element, firing input and change events.","inputs":[{"name":"ref","type":"string","required":false,"description":"Element ref from the latest cor_snapshot, e.g. \"e4\". Alternative to target."},{"name":"target","type":"string","required":false,"description":"CSS selector for the element — must match exactly one. Alternative to ref."},{"name":"value","type":"string","required":true,"description":"Value to set."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":84},{"name":"cor_press","title":"Press a key","description":"Press a key, e.g. Enter, Escape, Tab, ArrowDown. With a ref or target, that element is focused first.","inputs":[{"name":"key","type":"string","required":true,"description":"Key name as Playwright spells it: Enter, Escape, Tab, ArrowDown, a, Shift+Tab."},{"name":"ref","type":"string","required":false,"description":"Element ref from the latest cor_snapshot, e.g. \"e4\". Alternative to target."},{"name":"target","type":"string","required":false,"description":"CSS selector for the element — must match exactly one. Alternative to ref."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":111},{"name":"cor_close","title":"Close the browser","description":"Close the browser and forget the session. The next cor_open starts a fresh one.","inputs":[],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":25},{"name":"cor_snapshot","title":"List interactive elements","description":"Outline of the visible interactive elements on the current page, each with a ref (e1, e2…), nested only under what identifies it: landmarks, sections by heading, tables (column / row), list items. Pick the element you need, then pass its ref to cor_inspect. Markers: ✓id test attribute, +N hidden lookalikes, [disabled]/[checked]/[expanded]/[selected], [unstable id]; \"clickable\" is an element with no role that the page makes clickable (cursor: pointer). Take a new snapshot after any navigation or act call — earlier refs expire. On a large page it answers with a region index (each region's controls, the named ones first); full: true lists every control.","inputs":[{"name":"full","type":"boolean","required":false,"description":"The whole outline even on a large page, instead of the region index."},{"name":"within","type":"string","required":false,"description":"Show one region in full instead — every line of text, prices and labels included. A ref (its region: the card, row, column or section that identifies it) or a region's name (a heading, a landmark lab…"}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":255},{"name":"cor_inspect","title":"Get ranked locators for an element","description":"Rank, score and match-count locators for one element, rendered for the chosen test framework. Pass a ref from cor_snapshot, or a CSS selector that matches exactly one element — or targets: many of them in one call, one entry each. The response leads with the recommendation; below the quality floor it recommends an application change (a test attribute) instead of a fragile locator. Use the locator as given; write the surrounding test code yourself.","inputs":[{"name":"all","type":"boolean","required":false,"description":"List every alternative. By default: the runner-up and the best of each other locator kind, up to 3."},{"name":"detail","type":"boolean","required":false,"description":"P4: the full reply — alternatives, facts, why this order, the durable annotation. By default: the answer and its code, about 6 lines."},{"name":"framework","type":"string","required":false,"description":"Test framework to render and rank for. Default: the project's framework as cor_open reported it, else playwright."},{"name":"ref","type":"string","required":false,"description":"Element ref from the latest cor_snapshot, e.g. \"e4\"."},{"name":"selector","type":"string","required":false,"description":"CSS or Playwright selector (:text-is, >>, text=) matching exactly one element — alternative to ref."},{"name":"targets","type":"array","required":false,"description":"P2a: several refs or selectors at once — every element you need from this page in one call. Each gets its entry only (no alternatives); inspect one ref alone for the detail."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":291},{"name":"cor_grade","title":"Grade an existing selector","description":"Diagnose a selector that already exists — from a test file, a failing test, or a pull request — against the open page. When a test fails on a locator, call this FIRST, before re-identifying the element. It says whether the locator is broken (matches nothing), ambiguous (matches several), fragile, or healthy. If it reports Healthy, STOP: the locator is not why the test failed — look at the product or the assertion instead of replacing it. Accepts a CSS selector, an XPath, page.getByRole/getByText/getByLabel/getByPlaceholder/getByTestId/getByAltText/getByTitle(…) or page.locator('…') — chained with .locator/.getBy*/.filter({ has, hasNot, hasText, hasNotText, visible })/.or()/.and()/.first()/.last()/.nth(n) — cy.get('…') or cy.contains(…), chained with .find/.filter/.not/.closest/.parent/.children/.contains/.eq/.first/.last — $('…') / $$('…') with a WebdriverIO selector (CSS, XPath, tag=text, tag.class=text, *=text), chained with .$/.$$/[n]/.parentElement() and .filter/.find((el) => el.isDisplayed() | (await el.getText()) === … | (await el.$(…).isExisting())).","inputs":[{"name":"framework","type":"string","required":false,"description":"Framework to render alternatives for. Default: the framework of the project as cor_open reported it, else the form of the selector (getBy* → playwright, cy.* → cypress), else playwright."},{"name":"locator","type":"string","required":false,"description":"Same as selector."},{"name":"param","type":"string","required":false,"description":"For a parameterised helper: the variable in the selector (e.g. title in getByText(title, { exact: true })). COR runs the locator for every value and says which items no value reaches."},{"name":"selector","type":"string","required":false,"description":"The selector exactly as written in the test, e.g. page.getByRole('button', { name: 'Save' }) or cy.get('.btn')."},{"name":"values","type":"array","required":false,"description":"Values to run the parameterised locator with. Omit to let COR find each item's values on the page (needs the chain to start with page.locator('css'))."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":479},{"name":"cor_check","title":"Check every locator in the test files carries a COR id","description":"Run before the tests. Scans the test and locator files changed on this branch (or all: true for the whole project) and fails any locator without a COR id (the // COR cor:… comment an entry carries), any id COR did not issue here, and any positional pick (.first(), .nth(), .eq(), [n]). With the locator's page open it returns the fix: COR's entry to paste, or the id to add for a locator COR already has a record of.","inputs":[{"name":"all","type":"boolean","required":false,"description":"Check every file in the project instead of the changed ones."},{"name":"files","type":"array","required":false,"description":"Files to check, relative to the project root. Default: changed files."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":149},{"name":"cor_heal","title":"Propose a replacement for a broken locator","description":"When a test fails because a locator no longer finds its element. Pass the locator line as it is in the file (its // COR cor:… comment included) or its id, with the page open where the element should be. COR opens the committed record for that id, tries the locators it recorded while this one worked, then the element's fingerprint, and proposes a graded replacement — or declines. It never edits a file. With no id, it lists the elements on this page whose recorded locators all fail.","inputs":[{"name":"id","type":"string","required":false,"description":"The entry's id (the 6 characters after cor:)."},{"name":"locator","type":"string","required":false,"description":"The broken locator line, its cor: comment included."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":151},{"name":"cor_explore","title":"Run several steps in one call","description":"Discovery in one call: a list of steps, run in order — { open: url }, { click: ref|selector }, { fill: ref|selector, value }, { press: key, target? }, { inspect: ref|selector|[…] }, { within: region }, { expect: \"exact text shown\" }. Each step replies as its own tool would; refs from one step work in the next until a step opens a new page. No conditions or loops. It stops at the first step that fails (an element that is not exactly one, text not shown) and returns what ran, the page's region index with refs, and the step to resume from (resumeFrom). Put static elements first and the step that navigates away last.","inputs":[{"name":"resumeFrom","type":"integer","required":false,"description":"Skip to this step number (1-based) — from a previous stopped run."},{"name":"steps","type":"array","required":true,"description":"Steps, in order."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":196}],"toolsTruncatedAtCapture":false,"diagnostics":{"capturedAt":"2026-11-05T02:13:58.000Z","track":"package","endpoint":null,"declaredUrl":null,"truncated":false,"tls":null,"dnssec":null,"auth":null,"httpsRedirect":null,"transports":[],"provenance":{"outcome":"none","label":"No attestation","reason":null,"reasonLabel":null,"discovery":null,"discoveryLabel":null,"sourceRepo":null,"attestationSkipped":null,"attestationSkippedLabel":null},"installScripts":[],"installScriptsTotal":null,"vulnerabilities":[],"vulnerabilitiesTotal":null,"dependencies":{"nodes":93,"partial":false,"deprecated":null,"stale":30,"noRepo":null}},"mismatches":[],"changelog":{"trackingSince":"2026-10-27","recent":[{"id":"chg_01a18046-b8ef-7d7b-89ae-860bce497724","kind":"check.reverified","summary":"Malware scan (unverified → pass)","materiality":"security","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-28","url":"https://verifymcp.io/servers/dev-corlabs-mcp/corlabsdev-mcp#chg-chg_01a18046-b8ef-7d7b-89ae-860bce497724"},{"id":"chg_01a18046-b8f0-7c43-9f89-f2718900516f","kind":"score.total_changed","summary":"Trust score (50 → 65)","materiality":"functional","direction":"improvement","scoreDelta":15,"occurredOn":"2026-10-28","url":"https://verifymcp.io/servers/dev-corlabs-mcp/corlabsdev-mcp#chg-chg_01a18046-b8f0-7c43-9f89-f2718900516f"},{"id":"chg_01a17c1d-762f-7b9c-9399-290ea717a307","kind":"score.first_scored","summary":"First indexed and scored","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-27","url":"https://verifymcp.io/servers/dev-corlabs-mcp/corlabsdev-mcp#chg-chg_01a17c1d-762f-7b9c-9399-290ea717a307"}],"truncated":false,"feedUrl":"https://verifymcp.io/servers/dev-corlabs-mcp/corlabsdev-mcp/changelog.json"},"links":{"html":"https://verifymcp.io/servers/dev-corlabs-mcp/corlabsdev-mcp","markdown":"https://verifymcp.io/servers/dev-corlabs-mcp/corlabsdev-mcp.md","changelogJson":"https://verifymcp.io/servers/dev-corlabs-mcp/corlabsdev-mcp/changelog.json","changelogRss":"https://verifymcp.io/servers/dev-corlabs-mcp/corlabsdev-mcp.xml","external":[{"label":"npm package","href":"https://www.npmjs.com/package/@corlabsdev/mcp"},{"label":"Socket report","href":"https://socket.dev/npm/package/@corlabsdev/mcp"},{"label":"Repository","href":"https://github.com/kushshah12/cor-mcp"}]}}