# io.github.Doucs91/hivelore (npm · @hivelore/mcp)

Deterministic gate: blocks any commit whose diff reintroduces a documented team mistake.

- Trust score: 65/100 (medium)
- Change this week: +16
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `@hivelore/mcp`: 65/100 (this document), [markdown](https://verifymcp.io/servers/doucs91-hivelore/hivelore-mcp.md), [page](https://verifymcp.io/servers/doucs91-hivelore/hivelore-mcp)

## Channel facts

- Registry: `npm`
- Package: `@hivelore/mcp`
- Version: `0.53.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (122 of 126), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (122 of 126), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (Apache-2.0).
  - Actively maintained (last published 5 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 53/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (fair).
  - Context-footprint check failed: tool/resource definitions use about 6146 tokens (~472/item across 13 items; 13 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 99/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 98% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add doucs91-hivelore -- npx -y @hivelore/mcp
```

### Codex

```bash
codex mcp add doucs91-hivelore -- npx -y @hivelore/mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "doucs91-hivelore": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@hivelore/mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add doucs91-hivelore --command npx --arg -y --arg @hivelore/mcp
```

### Hermes

```yaml
mcp_servers:
  doucs91-hivelore:
    command: "npx"
    args: ["-y", "@hivelore/mcp"]
```

### Other

```json
{
  "mcpServers": {
    "doucs91-hivelore": {
      "command": "npx",
      "args": [
        "-y",
        "@hivelore/mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 65, +4)

- [functional improvement] Stability: unverified → 0.27

### 2026-08-02 (score 61, +15)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] License: unverified → pass
- [functional] Licence: Apache-2.0

### 2026-07-31 (score 46, +36)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 10, −64)

- [security regression] Provenance: fail → unverified
- [security regression] Known CVEs: partial → unverified
- [security regression] Malware scan: pass → unverified
- [security regression] Install scripts: pass → unverified
- [functional regression] License: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Schema quality: 100 → unverified
- [functional regression] Maintenance: pass → unverified
- [functional] Licence: Apache-2.0

### 2026-07-29 (score 74, +48)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [functional regression] Security disclosure: unverified → fail
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] License: unverified → pass
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] Schema quality: unverified → fair
- [functional improvement] Schema quality: unverified → 100
- [functional] Licence: Apache-2.0

### 2026-07-28 (score 26, −23)

- [functional regression] Schema quality: 100 → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Security disclosure: fail → unverified
- [functional improvement] Dependency health: unverified → partial

### 2026-07-27 (score 49)

First indexed and scored.

## MCP tools (13)

### `mem_save` (~613 tokens)

Save a piece of knowledge as a persistent memory that survives across AI sessions.

USE THIS WHEN you discover something worth remembering for future sessions:
  \- A project convention (how things are done here)
  \- An architectural decision and its rationale
  \- A gotcha or non-obvious behavior that surprised you
  \- A domain term and what it means in this codebase

DO NOT USE for failed approaches → use mem_tried instead (better structure).
For reactive code discoveries during exploration, prefer a compact gotcha via mem_save.

PARAMETERS:
  type     — convention | decision | gotcha | architecture | glossary | attempt
  slug     — short kebab-case id (e.g. 'flyway-no-modify-existing')
  body     — Markdown content with the full knowledge
  scope    — team (shared with all devs) | personal (private) | module (component-scoped)
  paths    — anchor to source files for staleness detection (STRONGLY recommended)
  topic    — stable key for upsert: if a memory with same topic+scope exists, update it in-place

RETURNS: { id, scope, file_path, action: 'created'|'updated', warning?, invalid_paths? }
WARNING: if paths point to non-existent files, they will be immediately stale after hivelore sync.
DEDUP: identical body content within the same scope is rejected — use mem_update to modify.

Input parameters:

- `activation` (object): Only for type='skill'. Progressive-disclosure triggers: the skill is surfaced ONLY when a keyword matches the task or a glob matches the edited files (or always=true). Omit to keep the skill always-e…
- `author` (string): Author handle or email
- `body` (string, required): Markdown body of the memory
- `commit` (string): Anchor commit SHA (for staleness detection later)
- `domain` (string): Domain (e.g. transactions, billing)
- `module` (string): Module name (required when scope=module)
- `paths` (array): Anchor paths (file paths this memory references)
- `scope` (string): Visibility scope: personal | team | module. When omitted, falls back to defaultScope in haive.config.json (default: personal).
- `slug` (string, required): Short human-readable identifier — becomes part of the filename
- `symbols` (array): Anchor symbols (function/class names this memory references)
- `tags` (array): Tags for filtering
- `topic` (string): Stable key for this memory. If a memory with the same topic already exists in this scope, it is updated in-place (revision_count++). Use for knowledge that evolves over time.
- `type` (string, required): Kind of memory being saved. Use 'skill' for reusable procedures/playbooks agents should follow for recurring tasks (feedforward harness guide). Use 'attempt' for failed approaches (auto-validated). U…

### `mem_tried` (~395 tokens)

Record a FAILED approach so future agents don't repeat the same mistake.

USE THIS IMMEDIATELY when you try something and it doesn't work. This is the
most valuable type of negative knowledge — it saves hours of debugging for
future agents working on the same codebase.

Auto-validated (no approval cycle). Surfaced FIRST in future get_briefing calls
so it's impossible to miss.

PARAMETERS:
  what       — short title of what you tried (e.g. 'importing X with ESM dynamic import')
  why_failed — the exact error or reason it failed
  instead    — what to do instead (the correct approach)
  scope      — team (default) | personal
  paths      — source files where the issue lives

RETURNS: { id, file_path, action: 'created' }

Input parameters:

- `author` (string): Author handle or email
- `instead` (string): What to use or do instead (recommended alternative)
- `module` (string): Module name (required when scope=module)
- `paths` (array): Anchor file paths this applies to
- `scope` (string): Visibility scope. Defaults to personal — EXCEPT when a one-shot `sensor` is attached: an enforced lesson is team truth (the sensor must travel to every machine and CI), so it defaults to team. Pass s…
- `sensor` (object): ONE-SHOT loop close: validate and attach a sensor in the same call (equivalent to a follow-up propose_sensor). Validated against HEAD — silent on current code, fires on the bad example. If rejected,…
- `tags` (array): Tags for filtering
- `what` (string, required): Brief description of the approach that was tried
- `why_failed` (string, required): Why it failed or why it should NOT be used

### `propose_sensor` (~1002 tokens)

Propose a discriminating sensor for a gotcha/attempt — YOU write the pattern (you understand the
code), Hivelore validates it before trusting it to block. This is how a captured lesson becomes a
RELIABLE block instead of an advisory note.

USE THIS right after mem_tried / mem_save on a gotcha whose mistake is detectable in code, to
upgrade the auto-suggested (warn) sensor into a precise, promotable one.

Write a pattern that matches the FAULTY usage, and — crucially — an `absent` regex for the
CORRECT-usage marker so it fires on the bug only, not every call (e.g. pattern=the API call,
absent=the required option).

VALIDATION (a `block` proposal is accepted ONLY if): the pattern is not brittle, stays SILENT on
the current (correct) anchored code, and FIRES on the bad example. A rejected proposal is NOT
written — the returned `reason`/`guidance` tells you how to revise; then call propose_sensor again.

PARAMETERS:
  memory_id  — the gotcha/attempt to protect
  pattern    — regex matching the faulty usage
  absent     — regex for the correct-usage marker (makes it discriminate) — strongly recommended
  bad_example— a snippet that SHOULD match (else examples are read from the lesson)
  severity   — 'block' (default) | 'warn'

RETURNS: { accepted, reason?, guidance?, self_check, file_path? }

Input parameters:

- `absent` (string): Regex for the CORRECT-usage marker (e.g. 'idempotencyKey'). When it appears in the window around a match, the catch is suppressed — this is what makes the sensor discriminate the faulty call from the…
- `bad_example` (string): A code snippet that SHOULD match — proves the sensor catches the mistake. If omitted, examples are read from the lesson body.
- `command` (string): kind=shell|test: command to execute (e.g. 'npx vitest run tests/payments/refund.spec.ts'). Non-zero exit = the lesson fires.
- `flags` (string): Optional regex flags (e.g. 'i' for case-insensitive).
- `incident` (string): Provenance: the real incident this sensor guards — a ticket/prod ref ('prod #442', 'INC-1029', '2026-06 refund overcharge'). Turns 'a test failed' into 'this reproduces the incident the test exists t…
- `kind` (string): regex = pattern matched on added diff lines (default). ast = an ast-grep STRUCTURAL pattern (e.g. 'stripe.paymentIntents.create($$$)') matched on the AST of changed files — comments and strings can n…
- `language` (string): kind=ast: explicit built-in/dynamic language name for non-standard file extensions.
- `memory_id` (string, required): Id of the gotcha/attempt memory this sensor protects.
- `message` (string): LLM-facing fix message shown when it fires. Defaults to one derived from the lesson.
- `paths` (array): Override scope paths. Defaults to the memory's anchor paths.
- `pattern` (string): kind=regex: regex matching the faulty usage; kind=ast: optional structural pattern (may be combined with `rule`).
- `red_ref` (string): kind=shell|test: prove the oracle actually catches the incident. A git ref (commit/branch) of the PRE-FIX state; validation replays it in a scratch worktree and requires the command to FAIL there (RE…
- `rule` (object): kind=ast: full ast-grep Rule object (kind/inside/has/not/all/any/etc.). May be used alone or combined with pattern.
- `severity` (string): block = hard-fail the gate (accepted ONLY if it passes self-validation). warn = advisory.
- `timeout_ms` (integer): kind=shell|test: max runtime before the executor kills the command (default 120000).

### `scaffold_test` (~511 tokens)

Generate a PENDING post-incident test from a lesson (attempt/gotcha) — the on-ramp to a command
sensor. A command sensor routes YOUR test as its oracle, but someone has to write it; this writes
the skeleton so you only fill in the assertion.

USE THIS right after mem_tried when the mistake is behavioural (a regex can't express it): it
writes a stub carrying the incident's provenance and returns the exact `sensors propose --kind
test` command to arm it.

It DOES NOT arm a sensor — propose_sensor stays the sole validated writer, and the stub is left
PENDING (todo/skip) so the suite stays green until you write the assertion. Monorepo-aware: the
framework and location come from the package that owns the lesson's anchor paths.

PARAMETERS:
  memory_id — the attempt/gotcha to scaffold from
  framework — vitest | jest | pytest | gotest (auto-detected when omitted)
  out_path  — override the test file path (repo-relative)
  write     — write the file (default true); false returns the content for preview

RETURNS: { ok, path, run_command, propose_command, content, written, already_exists, notice }

Input parameters:

- `framework` (string): Test framework. Auto-detected from the package that owns the lesson's anchor paths when omitted.
- `memory_id` (string, required): Id of the attempt/gotcha lesson to scaffold a post-incident test from.
- `out_path` (string): Override the generated test file path (repo-relative).
- `red_ref` (string): Pre-fix incident commit/ref. When set, the scaffold names the symbols the fix (<red_ref>..HEAD) touched within the lesson's anchor scope and pre-fills the example around them, so the assertion is a t…
- `reference` (string): Required for style='differential': import specifier of the reference implementation to compare against.
- `style` (string): Test shape (default 'example'): 'property' states the invariant once and checks it over many generated inputs (fast-check/Hypothesis); 'differential' asserts the subject agrees with a `reference` imp…
- `write` (boolean): Write the file to disk (default). false = return the content for preview without writing.

### `mem_session_end` (~366 tokens)

Save an end-of-session recap so the NEXT session starts with fresh context.

CALL THIS before closing any significant working session. In autopilot mode,
the MCP server saves a minimal recap automatically on exit — but calling this
manually produces a richer, more useful recap.

HOW IT WORKS: uses topic-upsert — one recap per scope is kept and updated
in-place (revision_count increments). get_briefing surfaces the latest recap
at the very top of the next session's briefing, before project context.

PARAMETERS:
  goal         — what you were trying to accomplish (1–2 sentences)
  accomplished — what was actually done (bullet list recommended)
  discoveries  — bugs, surprises, missing knowledge found during this session
  files_touched — key files read or modified (used as anchor for staleness)
  next_steps   — what should happen in the next session or for a teammate
  scope        — personal (default) | team

RETURNS: { id, scope, action: 'created'|'updated', revision_count }

Input parameters:

- `accomplished` (string, required): What was actually done — bullet list recommended
- `discoveries` (string): Any bugs, inconsistencies, surprises, or missing knowledge found during this session. Empty if nothing surprising was found.
- `files_touched` (array): Key files that were read or modified — used as anchor paths
- `goal` (string, required): What you were trying to accomplish this session (1–2 sentences)
- `module` (string): Module name (required when scope=module)
- `next_steps` (string): What should happen next (for the next session or a teammate)
- `scope` (string): Visibility: personal = private to you, team = shared with the team

### `get_briefing` (~1107 tokens)

⭐ DEFAULT-FIRST for coding agents on any repo where `hivelore init` ran: call this BEFORE
changing source or project config for the current goal (unless the developer explicitly opts out).
One-shot onboarding: everything relevant in a single call under a token budget.

PROGRESSIVE DISCLOSURE — after this, drill down only if needed:
  mem_relevant_to / mem_search (compact lists) → mem_get (full body + anchors).

RETURNS (in order of priority):
  0\. action_required — ⚠️ HANDLE THIS FIRST if non-empty (see protocol below)
  1\. last_session   — recap of the previous session (goal, what was done, next steps)
  2\. project_context — .ai/project-context.md (auto-generated from code-map if template)
  3\. module_contexts — relevant .ai/modules/<name>/context.md based on files being edited
  4\. memories        — ranked team memories relevant to your task
  5\. symbol_locations — file:line:kind for any requested symbols (no grep needed)
  6\. setup_warnings  — actionable warnings if setup is incomplete
  7\. decay_warnings  — memories not read in >90 days (consider reviewing)

⚠️ ACTION_REQUIRED PROTOCOL — MANDATORY:
  If action_required[] is non-empty, STOP and for each item:
  1\. Show the developer the exact developer_message field verbatim
  2\. Wait for explicit human confirmation ('yes', 'go ahead', 'oui', etc.)
  3\. Only then proceed with any code changes
  NEVER act autonomously on cross-repo breaking changes, dep bumps, or contract diffs.

KEY PARAMETERS:
  task    — what you are about to do (1–2 sentences) — ALWAYS provide this
  files   — files you are about to edit — surfaces anchored memories
  symbols — symbol names to look up in the code-map (e.g. ['PaymentService'])
  format  — 'full' (default) | 'compact' (1-line) | 'actions' (bullet-first excerpts)
  budget_preset — 'quick' | 'balanced' | 'deep' — scales max_tokens/memories/module contexts

EXAMPLE USAGE:
  get_briefing({ task: 'add a Stripe payment integration', files: ['src/payments/'], symbols: ['PaymentService…

Input parameters:

- `budget_preset` (string): Shortcut token budget: 'quick' minimizes tokens/skip module CONTEXT slices; 'balanced' mirrors historical defaults; 'deep' uses a larger briefing. When set, overrides max_tokens, max_memories, and in…
- `dedupe_project_context` (boolean): Token saver (default ON): skip re-emitting the project-context body if an identical copy was already sent within the last few minutes this session (the agent still has it). Set false to always includ…
- `deterministic` (boolean): Ignore machine-local usage/impact signals so repeated evaluations rank the shared corpus reproducibly.
- `files` (array): Project-relative file paths the agent is currently looking at or about to edit
- `format` (string): Output format: 'full' returns memory bodies (honors token budget via truncation); 'compact' returns a 1-line summary per memory (call mem_get for detail); 'actions' squeezes bodies to actionable bull…
- `include_module_contexts` (boolean)
- `include_project_context` (boolean)
- `include_stale` (boolean): Include stale memories (excluded by default — they may be outdated)
- `max_memories` (integer): Cap on memories surfaced regardless of token budget
- `max_tokens` (integer): Approximate token budget for the entire briefing. Each section is allocated a share and truncated to fit.
- `memory_scopes` (array): Restrict the candidate corpus to selected scopes. Omit to include every scope.
- `min_semantic_score` (number): Drop semantic-only memory hits whose cosine score is below this threshold. Useful to avoid weakly-related noise when the task is short or the corpus is broad. Has no effect on memories matched via an…
- `semantic` (boolean): Use semantic ranking when a task is provided (requires `hivelore embeddings index`).
- `symbols` (array): Symbol names to look up in the code-map (e.g. ['PaymentService', 'TenantFilter']). Returns the file(s) exporting each symbol so agents don't need to grep. Requires `hivelore index code` to have been…
- `task` (string): What you are about to do, in 1–2 sentences. Used to rank relevant memories semantically.
- `track` (boolean): Increment read_count on returned memories

### `mem_search` (~520 tokens)

Search memories by keyword or semantic similarity.

USE WHEN you need to find a specific memory and don't know its id.
For session onboarding, use get_briefing instead (richer, ranked, budgeted).

SEARCH MODES:
  Literal (default): AND search across id, tags, and body — all tokens must match.
  Falls back to OR automatically if no AND results (partial match).
  Lexical rank (lexical_rank: true, semantic: false): Okapi-BM25-style scoring on the
  filtered corpus — good for phrase-like queries without embeddings.
  Semantic (semantic: true): embedding-based similarity — finds related memories
  even with different wording. Requires hivelore embeddings index to be built.

PARAMETERS:
  query    — search terms or natural language question
  scope    — filter by personal | team | module
  type     — filter by convention | decision | gotcha | architecture | glossary
  semantic — true for embedding-based search (requires @hivelore/embeddings)
  lexical_rank — BM25-style ranking (ignored when semantic is true)
  limit    — max results (default 10)

RETURNS: array of { id, type, scope, status, confidence, body, match_quality }

Input parameters:

- `exclude_rejected` (boolean): When true, exclude memories with status=rejected from results.
- `include_session_recap` (boolean): Include session_recap memories in search results (excluded by default — they surface in get_briefing as last_session).
- `lexical_rank` (boolean): When true (and semantic is false), rank the filtered corpus with Okapi-BM25-style lexical scoring instead of literal AND/OR. Helps phrase-like queries without embeddings.
- `limit` (integer): Max results
- `min_score` (number): Minimum cosine similarity (semantic mode only)
- `module` (string): Restrict results to a module
- `query` (string, required): Substring matched against id, tags, and body
- `scope` (string): Restrict results to a single scope
- `semantic` (boolean): Use semantic similarity from the embeddings index (requires `hivelore embeddings index`).
- `status` (string): Filter by a single status. Omit to return all statuses.
- `track` (boolean): Increment read_count on returned memories (used for passive validation)
- `type` (string): Restrict results to a memory type. session_recap is excluded by default — use type='session_recap' to include them.

### `mem_get` (~122 tokens)

Fetch a single memory by its full id with all details.

USE WHEN get_briefing / mem_relevant_to / mem_search returned a compact hit and you need
the full body, or when you know the exact id of a memory.

PARAMETERS:
  id — full memory id (e.g. '2026-04-28-gotcha-flyway-strict-no-ddl')

RETURNS: { id, type, scope, status, confidence, body, anchor, tags, usage }

Input parameters:

- `id` (string, required): Memory id to fetch

### `code_map` (~315 tokens)

Look up where symbols (classes, functions, interfaces) are defined in the codebase.

USE INSTEAD OF grepping when you need to find where something lives.
Requires hivelore index code to have been run (done automatically in autopilot mode).

TIP: include symbols in get_briefing directly for auto-lookup at session start.

PARAMETERS:
  symbol   — name or partial name to search (e.g. 'PaymentService')
  file     — filter by file path substring
  max_files — cap on results (default 40)

RETURNS: { available: bool, files: [{ path, exports: [{ name, kind, line, description }] }] }
If available: false → run hivelore index code first.

Input parameters:

- `file` (string): Filter to files whose path contains this substring
- `max_files` (integer): Cap on returned files (hard limit, applied after token budget)
- `max_tokens` (integer): Approximate token budget for the response. When the matching set exceeds it, files are ranked by export density (exports per LOC) and the highest-signal ones are kept first. Omit to disable budgeting…
- `paths` (array): Filter to files under any of these path prefixes (e.g. ['packages/mcp/src/tools/', 'src/auth/']). OR-joined with `file` substring; useful to get a focused view of one module.
- `symbol` (string): Filter to files exporting a symbol whose name contains this substring

### `mem_verify` (~189 tokens)

Check whether memory anchor paths and symbols still exist in the current code.

USE WHEN you want to know if a specific memory is still valid after a refactor,
or to check all memories for staleness (hivelore sync does this automatically).

PARAMETERS:
  id     — check a single memory (omit to check all)
  update — write 'stale' or 'validated' status back to disk

RETURNS: { results: [{ id, status: 'fresh'|'stale'|'anchorless', reason? }] }
Stale means the anchored file/symbol no longer exists at that path.
Anchorless means the memory has no paths/symbols — staleness is undetectable.

Input parameters:

- `id` (string): If set, verify only this memory id
- `update` (boolean): Write the resulting status back to disk (status=stale or validated)

### `mem_relevant_to` (~312 tokens)

One-shot ranked memories for a task — use instead of get_briefing when
project context is already loaded and you only want the relevant memory layer.

Second step in progressive disclosure (after get_briefing): narrow here, then mem_get for full text.

Reuses the same ranking pipeline (anchor / module / literal / semantic) but
skips project_context, modules, action_required, etc.

PARAMETERS:
  task    — 1–2 sentences describing what you are about to do (required)
  files   — files you'll edit (surfaces anchored memories)
  limit   — cap on returned memories (default 8)
  min_semantic_score — drop weak semantic hits below this cosine (default 0.25)
  format — 'full' | 'compact' | 'actions' (inherits get_briefing memory framing)

RETURNS: { task, search_mode, memories: [...], hints?: [...], empty?: true }

Input parameters:

- `files` (array): Optional: files you are about to edit — surfaces anchored memories.
- `format` (string): 'compact' = id + 1-line summary; 'full' = complete bodies; 'actions' = bullet-first excerpts.
- `limit` (integer): Cap on returned memories.
- `min_semantic_score` (number): Drop weakly-related semantic hits below this cosine threshold.
- `task` (string, required): What you are about to do, in 1–2 sentences. Used to rank relevant memories.

### `code_search` (~251 tokens)

Semantic search over the codebase — finds exported symbols (functions, classes,
interfaces) related to a natural-language query. Replaces blind grep when you
don't know the exact symbol name.

Requires `hivelore index code-search` to have been run (builds embeddings for every
exported symbol from the code-map). Falls back to a notice when index is missing.

PARAMETERS:
  query     — natural language (e.g. 'function that hashes passwords', 'JWT signing')
  k         — number of top hits (default 5)
  min_score — minimum cosine similarity (default 0.2; try 0.3+ for stricter)

RETURNS: { available: bool, hits: [{ file, name, kind, line, description?, score }] }

Input parameters:

- `k` (integer): Number of top hits to return.
- `min_score` (number): Minimum cosine similarity. Hits below this threshold are dropped to avoid noise. Try 0.3+ for stricter matching.
- `query` (string, required): Natural-language description of what you are looking for in the codebase (e.g. 'function that hashes passwords', 'JWT signing logic', 'route registration').

### `pre_commit_check` (~443 tokens)

One-shot 'should I block this commit?' check. Combines three signals:
[Diff-scan layer: the COMBINED check (sensors + anti-patterns + stale). `hivelore enforce check` is the gate that runs this at commit time.]

  1\. anti_patterns_check — known gotchas/attempts that match the diff
  2\. mem_for_files       — conventions/decisions anchored to touched files
  3\. mem_verify          — memories whose anchors are stale (knowledge may be wrong)

USE FROM A GIT HOOK or before finalizing a non-trivial change.

PARAMETERS:
  diff       — raw unified diff text (e.g. `git diff --cached`)
  paths      — affected file paths (project-relative)
  block_on   — 'any' | 'high-confidence' (default) | 'never'
  semantic   — use embeddings in anti_patterns_check (default true)

RETURNS: { should_block, summary, warnings, relevant_memories, stale_anchors }

Input parameters:

- `anchored_blocks` (boolean): When true, ALSO block a high-confidence anti-pattern (attempt/gotcha) that is anchored to a touched file AND corroborated by the diff (literal token overlap, or semantic >= 0.45) — not just very stro…
- `block_on` (string): When to set should_block=true: 'any' = any warning blocks; 'high-confidence' = only warnings from authoritative/trusted memories block; 'never' = report only, never block.
- `diff` (string): Raw unified diff text to scan. If omitted, only `paths` is used. When called from a pre-commit hook, pipe the output of `git diff --cached`.
- `paths` (array): Project-relative paths affected by the change. At least one of `diff` or `paths` should be provided.
- `semantic` (boolean): Enable semantic search in anti_patterns_check (requires embeddings index).

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/doucs91-hivelore/hivelore-mcp#diagnostics

## Score history

- 2026-08-03: 65
- 2026-08-02: 61
- 2026-08-01: 46
- 2026-07-31: 46
- 2026-07-30: 10
- 2026-07-29: 74
- 2026-07-28: 26
- 2026-07-27: 49

## Links

- npm package: https://www.npmjs.com/package/@hivelore/mcp
- Socket report: https://socket.dev/npm/package/@hivelore/mcp
- Repository: https://github.com/Doucs91/hivelore
- Changelog RSS feed: https://verifymcp.io/servers/doucs91-hivelore/hivelore-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/doucs91-hivelore/hivelore-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/doucs91-hivelore/hivelore-mcp