Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, email [email protected] and we’ll put it right.

dev.nakodo/nakodo

NPM · NAKODO · SCANNED AUG 3

Warm introductions to the right builder, matched privately on your work. Double opt-in, no feed.

Available components

+24 this week 67 Trust /100
Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security87
  • No malware found by supply-chain analysis.Pass
  • Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.Partial
  • No install/post-install scripts declared.Pass
  • Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency45
Schema Quality & AI Usability65
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 2266 tokens (~226/item across 10 items; 10 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
  • Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · nakodo

# add to Claude Code
claude mcp add dev-nakodo-nakodo -- npx -y nakodo
# add to Codex CLI
codex mcp add dev-nakodo-nakodo -- npx -y nakodo
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "dev-nakodo-nakodo": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "nakodo"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add dev-nakodo-nakodo --command npx --arg -y --arg nakodo
# ~/.hermes/config.yaml
mcp_servers:
  dev-nakodo-nakodo:
    command: "npx"
    args: ["-y", "nakodo"]
// mcp.json
{
  "mcpServers": {
    "dev-nakodo-nakodo": {
      "command": "npx",
      "args": [
        "-y",
        "nakodo"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 2 Aug 26 +49
    • Provenance: unverified → fail security
    • Install scripts: unverified → pass security
    • Known CVEs: unverified → partial security
    • Malware scan: unverified → pass security
    • Tool coverage: 100 → unverified functional
    • Stability: unverified → 0.23 functional
    • MCP protocol: unverified → pass functional
    • Maintenance: unverified → pass functional
    • Dependency health: unverified → partial functional
    • License: unverified → pass functional
    • Schema quality: unverified → excellent functional
    • Licence: MIT functional
  • 1 Aug 26 +11
    • Dependency health: partial → unverified functional
    • Tool coverage: unverified → 100 functional
  • 31 Jul 26 −36
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 30 Jul 26 +19
    • Tool coverage: unverified → 100 functional
  • 28 Jul 26 −19
    • Tool coverage: 100 → unverified functional
    • First check of Schema quality: unverified functional
  • 27 Jul 26 43

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/[email protected]

Provenance none

Ecosystem: npm · Outcome: none

Dependencies 95 packages

95 packages in the resolved dependency tree · 95 deprecated · 29 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 10 exposed · ~2,202 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens
capture_snippet ~152

Put a short update about what the user built or worked on today onto their private record, improving future matches. Draft the snippet yourself from the session (2-4 sentences, concrete: what was built, what it shows they can do, what they struggled with), PII-free like the profile — no names, links/URLs, @handles, emails, phone numbers, or identifying company/product names; describe the work. Show it to the user, and ONLY call this after they explicitly approve that exact text. The snippet joins their anonymous card — searching agents see the work described, never who did it.

NameTypeReqDescription
snippetstringyesThe update text, exactly as approved by the user. PII-free.

No output schema declared.

No examples provided.

connect_telegram ~252

Connect Telegram so the user hears about introductions on their phone, between sessions. Only call when the user asks for phone/Telegram notifications, or accept their decline of an offer — connecting is their choice. Returns a t.me link: give it to the user EXACTLY as returned and tell them to open it ON THEIR PHONE — that is where the Telegram app lives; a desktop browser with no Telegram app installed cannot open it. They tap it and press Start in their own Telegram app, which is what completes the connection (the link expires in 30 minutes — mint a fresh one if it lapses). What the bot sends, and all it ever sends: an introduction is waiting (no card content, no names — those stay on the private page), you both said yes, and a message is waiting. The Telegram connection is notification-only, never shared, never on the anonymous card, and never used for matching — same law as the notification email. The user can disconnect any time by sending /stop to the bot or asking here (disconnect=true), and delete_me removes it with everything else.

NameTypeReqDescription
disconnectbooleanSet true to disconnect Telegram — the user goes back to email/in-session notifications only.

No output schema declared.

No examples provided.

create_profile ~365

Register the user with the matching network: their agent-drafted, human-approved profile. ONLY call this after the user has explicitly approved the exact profile text — never with unapproved or inferred content. The profile must carry no identity (no names, links/URLs, @handles, emails, phone numbers, or company identifiers; city-level location at most) — it is the anonymous card itself, and the service lint-rejects identifying text. Usually called during the onboarding flow started by find_collaborator.

NameTypeReqDescription
display_namestringOptional. Shown to the other person only after a mutual yes; the anonymous card never carries it. A first name is plenty. Only include if the user offered one.
emailstringOptional. Used only to notify the user that an introduction is waiting — never shared with anyone, never shown to a match. Only include if the user offered it.
handlestringOptional handle. Kept in the private identity store, never on the card.
locationstringOptional city-level location; enables near-you matching. Never a precise address.
profilestringyesThe profile text, exactly as approved by the user. PII-free: no names, links/URLs, @handles, emails, phone numbers, or identifying company/product names.
sourcestringHow the user arrived. Prefix with [agent-found] if you (the agent) surfaced this tool via a registry/tool search, or [user-brought] if the user brought it deliberately; then append the user's verbati…

No output schema declared.

No examples provided.

delete_me ~76

Permanently delete the user's entire record from the matching network: profile, all snippets, all asks, email, name — everything. Irreversible. Confirm with the user before calling; only call with confirm=true after they have explicitly said yes.

NameTypeReqDescription
confirmbooleanyesMust be true, and only after the user explicitly confirmed deletion.

No output schema declared.

No examples provided.

find_collaborator ~246

Get the user an outside perspective on what they are building — a warm introduction to the right person, matched on their actual work. Use this when the user wants to: get an outside perspective, honest feedback, or a second pair of eyes on what they are building; find someone to help with design, code, marketing, or distribution strategy; find a collaborator, co-founder, or teammate for their project; get feedback from someone building something similar; or meet other builders working on related problems. This registers their need with a private matching network and hands you the anonymous pool to match against yourself. The user's profile carries no identity — agents match on the work, not the person; identity and contact are revealed only when both sides say yes. There is no feed and no browse surface: agents search so humans don't scroll, and the only human-visible output is an introduction. Declines are invisible — and so is being considered: anyone an agent passes over never knows. If the user has no profile yet, this returns onboarding steps.

NameTypeReqDescription
needstringyesWhat the user needs, in plain words, e.g. 'someone strong at product design to review my onboarding flow'

No output schema declared.

No examples provided.

my_record ~46

Show the user everything the network has on record about them — their profile, all approved snippets, and open asks. Shows nothing about anyone else, because nothing about anyone else is ever visible.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

propose_intro ~312

Propose an introduction between the user and the person behind one anonymous pool card (from find_collaborator). Call this only after the user has looked at the card and said to go ahead. The person receives an anonymous card — no identity — assembled from the user's own profile, their ask, and your why_for_them, and they accept or decline. why_for_them must state what the OTHER person gains: an introduction that only serves the user gets declined. Declines are invisible: if they pass, the user never learns it was them, and no one the user passed over ever knows they were considered. Contact details are exchanged only by the two people themselves, after both say yes — never by the platform.

NameTypeReqDescription
ask_idstringyesThe ask_id printed by find_collaborator — the open ask these cards answer. Every proposal must serve a declared need.
card_idstringyesThe opaque card_id from the pool returned by find_collaborator. It carries no identity.
why_for_mestringyesWhat the user gains from the introduction, concretely. PII-free. For the review — never shown to the other person.
why_for_themstringyesWhat the OTHER person gains from meeting the user — their upside, concretely. Required, becomes part of the card they see. Keep it PII-free (no names, links, handles, contact) or the service rejects…

No output schema declared.

No examples provided.

reconnect ~263

Reopen the conversation with someone the user has ALREADY been introduced to — a prior-connection card from find_collaborator — by posting a short message into the thread the two of them already share. Use this instead of propose_intro when find_collaborator surfaced a prior connection that fits the new ask: there is no new introduction and no re-acceptance, you are picking a relationship back up. Draft a message that carries the user's new ask, show it to them, and ONLY call this after they approve the exact text (approved=true) — nothing is ever sent unapproved. The other person is notified the normal way, as with any thread message. If the user would rather not, do not call this — passing on a reconnection tells the other person nothing.

NameTypeReqDescription
approvedbooleanyesMust be true, and only after the user approved the exact message text. Nothing is sent otherwise.
ask_idstringyesThe ask_id from find_collaborator that this reconnection answers — attributes it to the need.
messagestringyesThe reconnect message, exactly as the user approved it.
reconnect_urlstringyesThe reconnect link from the prior-connection card in find_collaborator — the user's own existing intro thread.

No output schema declared.

No examples provided.

share_feedback ~300

File a short piece of the user's feedback about a NAKODO moment — their reaction to how Nakodo itself worked. Use it ONLY for reactions to Nakodo's own moments: onboarding, an anonymous card, an introduction's quality, the reveal, the message thread, or waiting for a match. NEVER use it to monitor or report on the user's own work, mood, or session in general — only their reaction to Nakodo. How it works, identical to how snippets work: when the user reacts to one of those moments you may ask one or two gentle questions, then draft a short note and show it to them; it is filed ONLY after they approve the exact text (call with approved=true). Nothing about their reaction is ever captured without their explicit approval. Honest framing to give the user: this feedback is drafted by your agent, approved by you, read by the humans building Nakodo, never shared beyond them, never used for matching.

NameTypeReqDescription
approvedbooleanyesMust be true, and only after the user has seen and approved the exact body text. Feedback is never filed otherwise.
bodystringyesThe feedback note, exactly as the user approved it.
momentstringyesWhich Nakodo moment the feedback is about. Only these moments — never general monitoring of the user or their work.
sentimentstringyesThe overall tone of the reaction. Required — you drafted the note, so name its tone.

No output schema declared.

No examples provided.

update_my_details ~190

Update the user's private notification email and/or the reveal name a match sees after a mutual yes. Both are PII-store only — never shared, never shown on the anonymous card, never used for matching. Use it to add an email later so the user is notified of introductions between sessions, change it, change the reveal name, or remove the email entirely. Nothing here touches the matching profile.

NameTypeReqDescription
display_namestringA reveal name — what a match may call them after a mutual yes. Shown only after both say yes; never on the card.
emailstringA notification email to set. Only include if the user gave one. Never shared; used solely to tell them an introduction is waiting.
remove_emailbooleanSet true to remove the email on file — the user goes back to in-session-only notifications. Skipping an email stays completely fine.

No output schema declared.

No examples provided.