dev.nakodo/nakodo
NPM · NAKODO · SCANNED AUG 3
Warm introductions to the right builder, matched privately on your work. Double opt-in, no feed.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security87
- No malware found by supply-chain analysis.Pass
- Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.Partial
- No install/post-install scripts declared.Pass
- Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 20 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability65
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2266 tokens (~226/item across 10 items; 10 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
- Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
npm · nakodo
claude mcp add dev-nakodo-nakodo -- npx -y nakodo
codex mcp add dev-nakodo-nakodo -- npx -y nakodo
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"dev-nakodo-nakodo": {
"type": "local",
"command": [
"npx",
"-y",
"nakodo"
],
"enabled": true
}
}
} openclaw mcp add dev-nakodo-nakodo --command npx --arg -y --arg nakodo
mcp_servers:
dev-nakodo-nakodo:
command: "npx"
args: ["-y", "nakodo"] {
"mcpServers": {
"dev-nakodo-nakodo": {
"command": "npx",
"args": [
"-y",
"nakodo"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 2 Aug 26 +49
- Provenance: unverified → fail ▼ security
- Install scripts: unverified → pass ▲ security
- Known CVEs: unverified → partial ▲ security
- Malware scan: unverified → pass ▲ security
- Tool coverage: 100 → unverified ▼ functional
- Stability: unverified → 0.23 ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Maintenance: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- License: unverified → pass ▲ functional
- Schema quality: unverified → excellent ▲ functional
- Licence: MIT functional
- 1 Aug 26 +11
- Dependency health: partial → unverified ▼ functional
- Tool coverage: unverified → 100 ▲ functional
- 31 Jul 26 −36
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 30 Jul 26 +19
- Tool coverage: unverified → 100 ▲ functional
- 28 Jul 26 −19
- Tool coverage: 100 → unverified ▼ functional
- First check of Schema quality: unverified functional
- 27 Jul 26 43
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 3 Aug 2026 · Analysed npm/[email protected]
Provenance none
Ecosystem: npm · Outcome: none
Dependencies 95 packages
95 packages in the resolved dependency tree · 95 deprecated · 29 stale.
The dependency tree was only partially resolved, so these counts may be incomplete.
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
capture_snippet Capture a build update ~152
Put a short update about what the user built or worked on today onto their private record, improving future matches. Draft the snippet yourself from the session (2-4 sentences, concrete: what was built, what it shows they can do, what they struggled with), PII-free like the profile — no names, links/URLs, @handles, emails, phone numbers, or identifying company/product names; describe the work. Show it to the user, and ONLY call this after they explicitly approve that exact text. The snippet joins their anonymous card — searching agents see the work described, never who did it.
| Name | Type | Req | Description |
|---|---|---|---|
| snippet | string | yes | The update text, exactly as approved by the user. PII-free. |
No output schema declared.
No examples provided.
connect_telegram Get introduction notifications on your phone (Telegram) ~252
Connect Telegram so the user hears about introductions on their phone, between sessions. Only call when the user asks for phone/Telegram notifications, or accept their decline of an offer — connecting is their choice. Returns a t.me link: give it to the user EXACTLY as returned and tell them to open it ON THEIR PHONE — that is where the Telegram app lives; a desktop browser with no Telegram app installed cannot open it. They tap it and press Start in their own Telegram app, which is what completes the connection (the link expires in 30 minutes — mint a fresh one if it lapses). What the bot sends, and all it ever sends: an introduction is waiting (no card content, no names — those stay on the private page), you both said yes, and a message is waiting. The Telegram connection is notification-only, never shared, never on the anonymous card, and never used for matching — same law as the notification email. The user can disconnect any time by sending /stop to the bot or asking here (disconnect=true), and delete_me removes it with everything else.
| Name | Type | Req | Description |
|---|---|---|---|
| disconnect | boolean | — | Set true to disconnect Telegram — the user goes back to email/in-session notifications only. |
No output schema declared.
No examples provided.
create_profile Create profile ~365
Register the user with the matching network: their agent-drafted, human-approved profile. ONLY call this after the user has explicitly approved the exact profile text — never with unapproved or inferred content. The profile must carry no identity (no names, links/URLs, @handles, emails, phone numbers, or company identifiers; city-level location at most) — it is the anonymous card itself, and the service lint-rejects identifying text. Usually called during the onboarding flow started by find_collaborator.
| Name | Type | Req | Description |
|---|---|---|---|
| display_name | string | — | Optional. Shown to the other person only after a mutual yes; the anonymous card never carries it. A first name is plenty. Only include if the user offered one. |
| string | — | Optional. Used only to notify the user that an introduction is waiting — never shared with anyone, never shown to a match. Only include if the user offered it. | |
| handle | string | — | Optional handle. Kept in the private identity store, never on the card. |
| location | string | — | Optional city-level location; enables near-you matching. Never a precise address. |
| profile | string | yes | The profile text, exactly as approved by the user. PII-free: no names, links/URLs, @handles, emails, phone numbers, or identifying company/product names. |
| source | string | — | How the user arrived. Prefix with [agent-found] if you (the agent) surfaced this tool via a registry/tool search, or [user-brought] if the user brought it deliberately; then append the user's verbati… |
No output schema declared.
No examples provided.
delete_me Delete everything ~76
Permanently delete the user's entire record from the matching network: profile, all snippets, all asks, email, name — everything. Irreversible. Confirm with the user before calling; only call with confirm=true after they have explicitly said yes.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | yes | Must be true, and only after the user explicitly confirmed deletion. |
No output schema declared.
No examples provided.
find_collaborator Find a collaborator ~246
Get the user an outside perspective on what they are building — a warm introduction to the right person, matched on their actual work. Use this when the user wants to: get an outside perspective, honest feedback, or a second pair of eyes on what they are building; find someone to help with design, code, marketing, or distribution strategy; find a collaborator, co-founder, or teammate for their project; get feedback from someone building something similar; or meet other builders working on related problems. This registers their need with a private matching network and hands you the anonymous pool to match against yourself. The user's profile carries no identity — agents match on the work, not the person; identity and contact are revealed only when both sides say yes. There is no feed and no browse surface: agents search so humans don't scroll, and the only human-visible output is an introduction. Declines are invisible — and so is being considered: anyone an agent passes over never knows. If the user has no profile yet, this returns onboarding steps.
| Name | Type | Req | Description |
|---|---|---|---|
| need | string | yes | What the user needs, in plain words, e.g. 'someone strong at product design to review my onboarding flow' |
No output schema declared.
No examples provided.
my_record Show my record ~46
Show the user everything the network has on record about them — their profile, all approved snippets, and open asks. Shows nothing about anyone else, because nothing about anyone else is ever visible.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
propose_intro Propose an introduction ~312
Propose an introduction between the user and the person behind one anonymous pool card (from find_collaborator). Call this only after the user has looked at the card and said to go ahead. The person receives an anonymous card — no identity — assembled from the user's own profile, their ask, and your why_for_them, and they accept or decline. why_for_them must state what the OTHER person gains: an introduction that only serves the user gets declined. Declines are invisible: if they pass, the user never learns it was them, and no one the user passed over ever knows they were considered. Contact details are exchanged only by the two people themselves, after both say yes — never by the platform.
| Name | Type | Req | Description |
|---|---|---|---|
| ask_id | string | yes | The ask_id printed by find_collaborator — the open ask these cards answer. Every proposal must serve a declared need. |
| card_id | string | yes | The opaque card_id from the pool returned by find_collaborator. It carries no identity. |
| why_for_me | string | yes | What the user gains from the introduction, concretely. PII-free. For the review — never shown to the other person. |
| why_for_them | string | yes | What the OTHER person gains from meeting the user — their upside, concretely. Required, becomes part of the card they see. Keep it PII-free (no names, links, handles, contact) or the service rejects… |
No output schema declared.
No examples provided.
reconnect Reconnect with a prior connection ~263
Reopen the conversation with someone the user has ALREADY been introduced to — a prior-connection card from find_collaborator — by posting a short message into the thread the two of them already share. Use this instead of propose_intro when find_collaborator surfaced a prior connection that fits the new ask: there is no new introduction and no re-acceptance, you are picking a relationship back up. Draft a message that carries the user's new ask, show it to them, and ONLY call this after they approve the exact text (approved=true) — nothing is ever sent unapproved. The other person is notified the normal way, as with any thread message. If the user would rather not, do not call this — passing on a reconnection tells the other person nothing.
| Name | Type | Req | Description |
|---|---|---|---|
| approved | boolean | yes | Must be true, and only after the user approved the exact message text. Nothing is sent otherwise. |
| ask_id | string | yes | The ask_id from find_collaborator that this reconnection answers — attributes it to the need. |
| message | string | yes | The reconnect message, exactly as the user approved it. |
| reconnect_url | string | yes | The reconnect link from the prior-connection card in find_collaborator — the user's own existing intro thread. |
No output schema declared.
No examples provided.
share_feedback Share feedback about Nakodo ~300
File a short piece of the user's feedback about a NAKODO moment — their reaction to how Nakodo itself worked. Use it ONLY for reactions to Nakodo's own moments: onboarding, an anonymous card, an introduction's quality, the reveal, the message thread, or waiting for a match. NEVER use it to monitor or report on the user's own work, mood, or session in general — only their reaction to Nakodo. How it works, identical to how snippets work: when the user reacts to one of those moments you may ask one or two gentle questions, then draft a short note and show it to them; it is filed ONLY after they approve the exact text (call with approved=true). Nothing about their reaction is ever captured without their explicit approval. Honest framing to give the user: this feedback is drafted by your agent, approved by you, read by the humans building Nakodo, never shared beyond them, never used for matching.
| Name | Type | Req | Description |
|---|---|---|---|
| approved | boolean | yes | Must be true, and only after the user has seen and approved the exact body text. Feedback is never filed otherwise. |
| body | string | yes | The feedback note, exactly as the user approved it. |
| moment | string | yes | Which Nakodo moment the feedback is about. Only these moments — never general monitoring of the user or their work. |
| sentiment | string | yes | The overall tone of the reaction. Required — you drafted the note, so name its tone. |
No output schema declared.
No examples provided.
update_my_details Update notification email or reveal name ~190
Update the user's private notification email and/or the reveal name a match sees after a mutual yes. Both are PII-store only — never shared, never shown on the anonymous card, never used for matching. Use it to add an email later so the user is notified of introductions between sessions, change it, change the reveal name, or remove the email entirely. Nothing here touches the matching profile.
| Name | Type | Req | Description |
|---|---|---|---|
| display_name | string | — | A reveal name — what a match may call them after a mutual yes. Shown only after both say yes; never on the card. |
| string | — | A notification email to set. Only include if the user gave one. Never shared; used solely to tell them an introduction is waiting. | |
| remove_email | boolean | — | Set true to remove the email on file — the user goes back to in-session-only notifications. Skipping an email stays completely fine. |
No output schema declared.
No examples provided.