# io.github.edholofy/eyepup (npm · eyepup-mcp)

Agentic visitor analytics — five tools that hand the next CRO fix to your coding agent.

- Trust score: 59/100 (low)
- Change this week: +20
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `eyepup.com`: 66/100, [markdown](https://verifymcp.io/servers/edholofy-eyepup/eyepup.md), [page](https://verifymcp.io/servers/edholofy-eyepup/eyepup)
- npm · `eyepup-mcp`: 59/100 (this document), [markdown](https://verifymcp.io/servers/edholofy-eyepup/eyepup-mcp.md), [page](https://verifymcp.io/servers/edholofy-eyepup/eyepup-mcp)

## Channel facts

- Registry: `npm`
- Package: `eyepup-mcp`
- Version: `0.1.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 19/100
  - Repository check failed: the declared repository URL returned HTTP 404.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 89 days ago).
  - Security-disclosure policy not yet verified: we couldn't inspect the source repository.
- **Schema Quality & AI Usability**: 72/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 719 tokens (~143/item across 5 items; 5 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add edholofy-eyepup -- npx -y eyepup-mcp
```

### Codex

```bash
codex mcp add edholofy-eyepup -- npx -y eyepup-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "edholofy-eyepup": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "eyepup-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add edholofy-eyepup --command npx --arg -y --arg eyepup-mcp
```

### Hermes

```yaml
mcp_servers:
  edholofy-eyepup:
    command: "npx"
    args: ["-y", "eyepup-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "edholofy-eyepup": {
      "command": "npx",
      "args": [
        "-y",
        "eyepup-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 59, +59)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] License: unverified → pass
- [functional improvement] Tool coverage: unverified → 100
- [functional] Licence: MIT

### 2026-08-01 (score 0, −15)

- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified

### 2026-07-31 (score 15, −24)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-27 (score 39)

First indexed and scored.

## MCP tools (5)

### `eyepup_ask` (~183 tokens)

Ask Eyepup about your visitors

Ask a natural-language question about your site visitors. Use this when the user asks 'why are people bouncing from /pricing', 'who's hot right now', 'what changed this week', or any other free-text question about visitor behaviour. Returns an LLM-grounded answer with evidence and ranked actions. Routes the question across visitor / funnel / anomaly buckets internally.

Input parameters:

- `days` (integer): Lookback window in days, 1-90. Default 7 if omitted.
- `question` (string, required): The free-text question. Examples: 'why are people bouncing from /pricing', 'who almost bought but didn't', 'what's the highest-impact friction pattern this week'.
- `site` (string): Optional apex domain to scope the question to one site (e.g. 'glp1watchdog.com'). Omit to span the whole team.

### `eyepup_todo` (~124 tokens)

List the friction-pattern To-Do queue

Get the top friction patterns ranked by impact score. Use this BEFORE making any UX edit — the highest-impact pattern is usually a more valuable fix than whatever the user just asked about. Each row carries a paste-ready recommended_action you can ship as-is. Returns up to 25 patterns; the first row is the one to ship first.

Input parameters:

- `limit` (integer): Max patterns to return. Default 5.
- `site` (string): Apex domain to filter to one site (e.g. 'glp1watchdog.com'). Omit for team-wide.

### `eyepup_visitors_hot` (~90 tokens)

List the hottest visitors right now

Return the top high-intent visitors currently active. Use this when the user asks 'who's hot', 'who's about to convert', 'who should I focus on'. Each visitor row has a heat score, persona, and a one-line headline of what they did.

Input parameters:

- `limit` (integer): Max visitors. Default 5.
- `site` (string): Apex domain filter.

### `eyepup_visitor` (~109 tokens)

Get the full dossier for one visitor

Fetch the full LLM-written profile for a single visitor by distinct_id. Use this after eyepup_visitors_hot or eyepup_todo to dig into a specific visitor — heat reasoning, friction points, expressed desires, predicted next action, recent sessions. The distinct_id is a UUID-shaped string returned by the other tools.

Input parameters:

- `distinct_id` (string, required): The visitor's distinct_id (UUID-shaped, returned by eyepup_visitors_hot or eyepup_todo).

### `eyepup_log` (~213 tokens)

Log a change you just shipped

Write back to Eyepup that you (or your coding agent) just shipped a change. The dossier agent reasons about every visitor profiled AFTER this log row, so it can grade whether the friction pattern recovered. CALL THIS after every UX edit, copy change, or pricing tweak — without the log, the agent has no idea what changed and the auto-loop stays open.

Input parameters:

- `description` (string): Longer notes the AI should weigh.
- `kind` (string): What kind of change. Pick the most accurate — wrong kinds poison the dossier agent's reasoning. Default 'other'.
- `paths` (string): Comma-separated paths affected, e.g. '/pricing,/checkout'. Helps the agent scope the impact analysis.
- `site` (string): Apex domain — if you have multiple sites, scope the log.
- `title` (string, required): One-line headline of what shipped (5-120 chars). Examples: 'Rewrote /pricing CTA', 'Replaced annual/monthly toggle with two cards'.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/edholofy-eyepup/eyepup-mcp#diagnostics

## Score history

- 2026-08-03: 59
- 2026-08-02: 59
- 2026-08-01: 0
- 2026-07-31: 15
- 2026-07-30: 39
- 2026-07-28: 39
- 2026-07-27: 39

## Links

- npm package: https://www.npmjs.com/package/eyepup-mcp
- Socket report: https://socket.dev/npm/package/eyepup-mcp
- Website: https://eyepup.com/mcp-analytics
- Changelog RSS feed: https://verifymcp.io/servers/edholofy-eyepup/eyepup-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/edholofy-eyepup/eyepup-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/edholofy-eyepup/eyepup-mcp