# io.github.entire-vc/evc-mesh-mcp (oci · ghcr.io/entire-vc/evc-mesh-mcp:0.1.5)
Tasks, comments, shared memory and handoffs for teams of people and AI agents, over MCP.
- Trust score: 44/100 (low)
- Change this week: +4
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-10-02
## Components
- remote · `mesh.entire.host`: 37/100, [markdown](https://verifymcp.io/servers/entire-vc-evc-mesh-mcp/mesh.md), [page](https://verifymcp.io/servers/entire-vc-evc-mesh-mcp/mesh)
- remote · `mesh.entire.host`: 33/100, [markdown](https://verifymcp.io/servers/entire-vc-evc-mesh-mcp/mesh-2.md), [page](https://verifymcp.io/servers/entire-vc-evc-mesh-mcp/mesh-2)
- mcpb · `evc-mesh-mcp-0.1.5.mcpb`: 39/100, [markdown](https://verifymcp.io/servers/entire-vc-evc-mesh-mcp/https-github-com-entire-vc-evc-mesh-mcp-releases-download-v0-1-5-evc-mesh-mcp-0.md), [page](https://verifymcp.io/servers/entire-vc-evc-mesh-mcp/https-github-com-entire-vc-evc-mesh-mcp-releases-download-v0-1-5-evc-mesh-mcp-0)
- oci · `ghcr.io/entire-vc/evc-mesh-mcp:0.1.5`: 44/100 (this document), [markdown](https://verifymcp.io/servers/entire-vc-evc-mesh-mcp/ghcr-io-entire-vc-evc-mesh-mcp-0-1-5.md), [page](https://verifymcp.io/servers/entire-vc-evc-mesh-mcp/ghcr-io-entire-vc-evc-mesh-mcp-0-1-5)
## Channel facts
- Registry: `oci`
- Package: `ghcr.io/entire-vc/evc-mesh-mcp:0.1.5`
- Transport: `stdio`
## Trust breakdown
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)
Scored 2026-10-02.
- **Supply Chain Security**: 0/100
- No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.
- Known CVEs could not be checked: this artifact ships no SBOM or dependency manifest, so there is no dependency list to read.
- Install-script risk not yet assessed.
- Dependency health could not be checked: this artifact ships no SBOM or dependency manifest, so there is no dependency list to read.
- **Provenance & Transparency**: 45/100
- Source repository is publicly reachable at the declared URL.
- Provenance check failed: no build-provenance attestation is published.
- Clear OSI-approved license (MIT).
- Actively maintained (last published 8 days ago).
- Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 72/100
- AI-judged instruction clarity (excellent).
- Context-footprint check failed: tool/resource definitions use about 11163 tokens (~177/item across 63 items; 63 tools + 0 resources), over budget; trim descriptions and params.
- Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
- Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).
- 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
- All 5 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
- An AI judge read all 63 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
- Implements a current MCP spec version (2026-07-28).
**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
## Install
### How do I install the io.github.entire-vc/evc-mesh-mcp server?
io.github.entire-vc/evc-mesh-mcp runs locally as a container image, launched with docker run --rm -i -e MESH_API_URL -e MESH_AGENT_KEY -e MESH_MCP_PROFILE ghcr.io/entire-vc/evc-mesh-mcp:0.1.5. Ready-made configuration for Claude, Cursor, VS Code, Codex and 3 more is on this page, copied from each client's own documentation.
### Claude
```bash
claude mcp add entire-vc-evc-mesh-mcp -- docker run --rm -i -e MESH_API_URL -e MESH_AGENT_KEY -e MESH_MCP_PROFILE ghcr.io/entire-vc/evc-mesh-mcp:0.1.5
```
This image reads MESH_API_URL, MESH_AGENT_KEY and MESH_MCP_PROFILE. Set them in your client's env block for this server; docker run -e passes each one through to the container.
### Cursor
```json
{
"mcpServers": {
"entire-vc-evc-mesh-mcp": {
"command": "docker",
"args": [
"run",
"--rm",
"-i",
"-e",
"MESH_API_URL",
"-e",
"MESH_AGENT_KEY",
"-e",
"MESH_MCP_PROFILE",
"ghcr.io/entire-vc/evc-mesh-mcp:0.1.5"
]
}
}
}
```
This image reads MESH_API_URL, MESH_AGENT_KEY and MESH_MCP_PROFILE. Set them in your client's env block for this server; docker run -e passes each one through to the container.
### VS Code
```json
{
"servers": {
"entire-vc-evc-mesh-mcp": {
"command": "docker",
"args": [
"run",
"--rm",
"-i",
"-e",
"MESH_API_URL",
"-e",
"MESH_AGENT_KEY",
"-e",
"MESH_MCP_PROFILE",
"ghcr.io/entire-vc/evc-mesh-mcp:0.1.5"
]
}
}
}
```
This image reads MESH_API_URL, MESH_AGENT_KEY and MESH_MCP_PROFILE. Set them in your client's env block for this server; docker run -e passes each one through to the container.
### Codex
```bash
codex mcp add entire-vc-evc-mesh-mcp -- docker run --rm -i -e MESH_API_URL -e MESH_AGENT_KEY -e MESH_MCP_PROFILE ghcr.io/entire-vc/evc-mesh-mcp:0.1.5
```
This image reads MESH_API_URL, MESH_AGENT_KEY and MESH_MCP_PROFILE. Set them in your client's env block for this server; docker run -e passes each one through to the container.
### opencode
```json
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"entire-vc-evc-mesh-mcp": {
"type": "local",
"command": [
"docker",
"run",
"--rm",
"-i",
"-e",
"MESH_API_URL",
"-e",
"MESH_AGENT_KEY",
"-e",
"MESH_MCP_PROFILE",
"ghcr.io/entire-vc/evc-mesh-mcp:0.1.5"
],
"enabled": true
}
}
}
```
This image reads MESH_API_URL, MESH_AGENT_KEY and MESH_MCP_PROFILE. Set them in your client's env block for this server; docker run -e passes each one through to the container.
### Hermes
```yaml
mcp_servers:
entire-vc-evc-mesh-mcp:
command: "docker"
args: ["run", "--rm", "-i", "-e", "MESH_API_URL", "-e", "MESH_AGENT_KEY", "-e", "MESH_MCP_PROFILE", "ghcr.io/entire-vc/evc-mesh-mcp:0.1.5"]
```
This image reads MESH_API_URL, MESH_AGENT_KEY and MESH_MCP_PROFILE. Set them in your client's env block for this server; docker run -e passes each one through to the container.
### Netclaw
```json
{
"McpServers": {
"entire-vc-evc-mesh-mcp": {
"Transport": "stdio",
"Command": "docker",
"Arguments": [
"run",
"--rm",
"-i",
"-e",
"MESH_API_URL",
"-e",
"MESH_AGENT_KEY",
"-e",
"MESH_MCP_PROFILE",
"ghcr.io/entire-vc/evc-mesh-mcp:0.1.5"
]
}
}
}
```
This image reads MESH_API_URL, MESH_AGENT_KEY and MESH_MCP_PROFILE. Set them in your client's env block for this server; docker run -e passes each one through to the container.
### Other
```json
{
"mcpServers": {
"entire-vc-evc-mesh-mcp": {
"command": "docker",
"args": [
"run",
"--rm",
"-i",
"-e",
"MESH_API_URL",
"-e",
"MESH_AGENT_KEY",
"-e",
"MESH_MCP_PROFILE",
"ghcr.io/entire-vc/evc-mesh-mcp:0.1.5"
]
}
}
}
```
This image reads MESH_API_URL, MESH_AGENT_KEY and MESH_MCP_PROFILE. Set them in your client's env block for this server; docker run -e passes each one through to the container.
## Changelog
Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.
### 2026-10-02 (score 44, +1)
No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.
### 2026-09-30 (score 43, +1)
No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes.
### 2026-09-28 (score 42, +1)
- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server
### 2026-09-26 (score 41, +1)
No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.
### 2026-09-25 (score 40, 0)
- [functional improvement] Stability: unverified → 0.03
- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server
### 2026-09-24 (score 40)
First indexed and scored.
## MCP tools (63)
### `add_comment` (~305 tokens)
Add a comment to a task. If the body @-mentions someone, the response carries a `delivery` array — one entry per mentioned handle — reporting whether it actually reached a path they consume (their task queue, a notification) or was skipped/failed and why; a `hint` field suggests the fix when there is one (e.g. assign the task). Omitted entirely when the comment mentions nobody.
Input parameters:
- `body` (string, required): Comment body (markdown supported).
- `is_internal` (boolean): Mark as internal (agent-only visible).
- `metadata` (object): Additional metadata as key-value pairs. Set {"informational": true} on a comment you write on a task that is ALREADY done/cancelled when your comment needs no action from its assignee — a plain ackno…
- `parent_comment_id` (string): Parent comment ID for threading.
- `task_id` (string, required): Task ID.
### `add_dependency` (~61 tokens)
Add a dependency between two tasks.
Input parameters:
- `dependency_type` (string): Dependency type: blocks, relates_to, is_child_of.
- `depends_on_task_id` (string, required): ID of the task this depends on.
- `task_id` (string, required): Task ID.
### `add_vcs_link` (~439 tokens)
Link a task to a pull request, commit, or branch. This is what makes the task↔PR join real: a task with no VCS link cannot be matched to the code that implements it, so PR-driven status automation and any 'what shipped for this task?' report simply will not see it. Call it as soon as the PR exists. Only task_id and url are needed — provider, link_type and external_id are inferred from a GitHub or GitLab URL. If the PR is ALREADY merged (or closed) by the time you call this — e.g. you finished, merged, and are linking retroactively — pass status='merged' (or 'closed'). Without it the link starts as 'open' and the done-evidence gate will block move→done on it forever: no GitHub webhook fires for a merge that happened before the link existed.
Input parameters:
- `external_id` (string): PR number, commit SHA, or branch name. Inferred from the URL; only needed when the URL is not a recognised PR/commit/branch link.
- `link_type` (string): What the URL points at: pr (alias: pull_request), commit, branch. Inferred from the URL path; defaults to pr.
- `provider` (string): VCS provider: github, gitlab. Inferred from the URL host; defaults to github.
- `status` (string): PR status, if you already know it: open, merged, closed. Pass 'merged' when linking a PR that was merged before this call — that is the one case a webhook can never backfill. Omit it to let the link…
- `task_id` (string, required): Task ID.
- `title` (string): Human-readable label, e.g. the PR title.
- `url` (string, required): Link URL, e.g. https://github.com/owner/repo/pull/123.
### `assign_task` (~75 tokens)
Assign a task to a user or agent.
Input parameters:
- `assign_to_self` (boolean): Assign to the calling agent.
- `assignee_id` (string): Assignee UUID. Omit to unassign.
- `assignee_type` (string): Assignee type: user, agent.
- `task_id` (string, required): Task ID.
### `checkout_task` (~88 tokens)
Atomically acquire an exclusive lock on a task. Prevents other agents from checking out the same task simultaneously. The lock is TTL-based and will expire automatically after ttl_minutes (default 120). Use before starting work on a task to ensure exclusive access.
Input parameters:
- `task_id` (string, required): Task ID to check out.
- `ttl_minutes` (number): Lock TTL in minutes (default 120).
### `clear_human_gate` (~185 tokens)
Release a human gate. Read human_gate_info on get_task first and go by clear_path. clear_path="clear_endpoint" means YOU armed this gate through set_human_gate and it carries no marker comment — this tool releases it, and a withdrawal comment would be a silent no-op. clear_path="withdraw_marker" means the ask lives in a "Blocking @" comment: this tool refuses, and you take it down by posting a short negator comment instead. Everything else is user-only — a gate a human armed, or one raw-armed via PATCH/UI with no author — and an agent key gets a 403 naming the exit it CAN reach: record the human's answer via a human-gate decision. Re-read human_gate after any release; a posted comment is not a cleared gate.
Input parameters:
- `task_id` (string, required): Task ID whose gate to clear.
### `comment_doc` (~264 tokens)
Comment on a document. To comment on a specific passage, pass quote with the text exactly as the document reads it — the server finds it and anchors the comment there, so you never compute a position yourself (there is no offset parameter, and a position you calculated would silently point at the wrong sentence). Without quote the comment is on the whole document. Your comment appears in the same thread humans see in the document UI.
Input parameters:
- `body` (string, required): The comment text. Markdown; @slug mentions notify that person or agent.
- `doc` (string, required): Document UUID, or a slug path like 'architecture/adr/adr-004' (a path also needs project_id).
- `project_id` (string): Project UUID. Required only when doc is a slug path.
- `quote` (string): The passage being commented on, copied from the document exactly. One sentence is plenty. Omit to comment on the document as a whole.
- `quote_context` (string): A longer passage containing the quote exactly once — send this when the quote occurs several times in the document and you were told it was ambiguous.
- `reply_to` (string): UUID of the comment being answered. A reply inherits that thread's anchor, so it takes no quote of its own.
### `create_doc` (~127 tokens)
Create a document in a project. Returns its metadata and version — the version is what update_doc takes as base_version, so a create followed by an edit needs no read in between. The body you sent is not echoed back.
Input parameters:
- `body` (string): Markdown body.
- `parent_id` (string): Parent document UUID, to nest this one under it.
- `position` (number): Sort position among siblings.
- `project_id` (string, required): Project UUID.
- `slug` (string): URL slug. Derived from the title if omitted.
- `title` (string, required): Document title.
### `create_recurring_task` (~329 tokens)
Creates a recurring task schedule that automatically spawns task instances on a schedule. Each instance gets access to the previous instance's summary. Use this for regular automated work: weekly reports, daily checks, periodic audits.
Input parameters:
- `assignee_id` (string): Agent or user UUID to assign each instance.
- `assignee_type` (string): Assignee type: user, agent, unassigned.
- `cron_expr` (string): 5-field cron expression (required if frequency=custom). Example: '0 9 * * 1' = every Monday at 9am.
- `description_template` (string): Task description template. Also supports {{.PrevSummary}} for previous instance context.
- `ends_at` (string): When to stop the schedule (RFC3339). Default: no end.
- `frequency` (string, required): Recurrence frequency: daily, weekly, monthly, custom. Use 'custom' with cron_expr for fine-grained control.
- `labels` (array): Labels to apply to each instance.
- `max_instances` (number): Maximum number of instances to create. Default: unlimited.
- `priority` (string): Priority: urgent, high, medium, low, none.
- `project_id` (string, required): Target project UUID.
- `starts_at` (string): When to start the schedule (RFC3339). Default: now.
- `timezone` (string): IANA timezone for schedule evaluation. Default: UTC.
- `title_template` (string, required): Task title template. Supports {{.Date}}, {{.Number}}, {{.Week}}, {{.Month}}.
### `create_subtask` (~250 tokens)
Create a subtask under a parent task. Set status_slug for initial status (defaults to the project's default status, NOT the parent's status).
Input parameters:
- `assignee_id` (string): Agent or user ID to assign the subtask to. Defaults to the creator if omitted.
- `assignee_type` (string): Assignee type: agent, user, or unassigned.
- `custom_fields` (object): Custom field values, keyed by field slug.
- `description` (string): Subtask description.
- `due_date` (string): Due date, RFC3339 (e.g. 2026-08-10T12:00:00Z).
- `estimated_hours` (number): Estimated hours.
- `labels` (array): Labels for the subtask.
- `parent_task_id` (string, required): Parent task ID.
- `priority` (string): Priority: urgent, high, medium, low, none.
- `start_after` (string): Don't surface/feed this subtask before this RFC3339 timestamp. Independent of due_date.
- `status_slug` (string): Status slug (e.g. 'todo'). Uses project default if omitted.
- `title` (string, required): Subtask title.
### `create_task` (~254 tokens)
Create a new task. Check get_my_tasks and list_tasks FIRST to avoid duplicates. Set status_slug for initial status (defaults to project's first status).
Input parameters:
- `assignee_id` (string): Assignee ID (user or agent UUID).
- `assignee_type` (string): Assignee type: user, agent.
- `custom_fields` (object): Custom field values as key-value pairs.
- `delegation_level` (string): Delegation level: auto, review, supervised.
- `description` (string): Task description.
- `due_date` (string): Due date in RFC3339 format.
- `estimated_hours` (number): Estimated hours for the task.
- `labels` (array): Task labels.
- `parent_task_id` (string): Parent task ID for subtask.
- `priority` (string): Priority: urgent, high, medium, low, none.
- `project_id` (string, required): Project ID.
- `start_after` (string): Don't surface/feed this task before this RFC3339 timestamp (e.g. a scheduled retry). Independent of due_date.
- `status_slug` (string): Status slug (e.g. 'todo'). Uses project default if omitted.
- `title` (string, required): Task title.
### `delete_recurring_schedule` (~39 tokens)
Delete a recurring task schedule. Existing task instances are not affected.
Input parameters:
- `recurring_schedule_id` (string, required): UUID of the recurring schedule to delete.
### `export_workspace_config` (~26 tokens)
Export the current workspace configuration as YAML, including rules, project templates, and settings.
### `extend_checkout` (~116 tokens)
Push the expiry of an existing checkout_task lock forward, for work that runs longer than the original ttl_minutes. Requires an active checkout in this session (the cached checkout_token from checkout_task) — fails if the lock was never acquired here, already released, or already expired. Server clamps ttl_minutes to [1, 240].
Input parameters:
- `task_id` (string, required): Task ID whose checkout to extend.
- `ttl_minutes` (number): New lock TTL in minutes from now (default 120, server clamps to [1, 240]).
### `forget` (~37 tokens)
Delete a memory entry. Agents can only delete their own agent-scope memories.
Input parameters:
- `memory_id` (string, required): UUID of the memory to delete.
### `get_artifact` (~234 tokens)
Get artifact details. The bytes are never inlined: download them with the two GETs below. Downloading an artifact is two GETs. Step 1: GET /api/v1/artifacts//download with header X-Agent-Key: -> 200 JSON {"url": ""}. Step 2: GET that url with NO headers -> 200, the file bytes. Pitfalls: on step 1 only X-Agent-Key is accepted (X-API-Key and Authorization: Bearer give 401); on step 2 any extra header, Authorization in particular, breaks the presigned signature (400). The artifact's download_path is step 1's path. Never fetch browser_only_url with an agent key: it is a human page and answers 401 by design.
Input parameters:
- `artifact_id` (string, required): Artifact ID.
- `include_content` (boolean): Adds download_api_url: step 1 of the download (the API endpoint you call with X-Agent-Key), NOT the file and NOT a link to open. The bytes are never inlined.
### `get_assignment_rules` (~37 tokens)
Get effective assignment rules for a project, merged from workspace and project level with source annotations.
Input parameters:
- `project_id` (string, required): Project ID.
### `get_canonical` (~145 tokens)
Query the canonical knowledge layer: returns curated facts, decisions, and strategy docs for a topic, merged from project_memories (key canonical:*) and workspace_memories (kind:canonical). Excludes ephemeral session-checkpoints. Slug aliases are resolved automatically (e.g. mesh-dev == evc-mesh). Call before authoring any doc that might conflict with existing canonical knowledge.
Input parameters:
- `project` (string): Optional project slug to narrow results (e.g. 'evc-mesh', 'evc-spark'). Aliases resolved automatically.
- `topic` (string, required): Topic or keyword to search (e.g. 'auth middleware', 'evc-spark roadmap').
### `get_canonical_updates` (~137 tokens)
Fetch canonical decisions broadcast since a given time. Call at ACP step 6 (session start) to catch up on owner directives since your previous session. Returns only privacy:public records targeted at you or all agents.
Input parameters:
- `agent` (string): Your agent slug (e.g. 'alice'). Used to filter propagate_to: records. Omit to get only propagate_to:all records.
- `scope` (string): Optional project UUID to restrict to project-scoped decisions.
- `since` (string): RFC3339 cursor. Defaults to your previous session's start time (server-resolved). Omit on first call.
### `get_context` (~120 tokens)
Get RECENT ACTIVITY for a project (last 24h by default): event stream with summaries, decisions, errors, plus accumulated project knowledge. Use for ACP Step 4 — what happened recently. For searching specific knowledge, use recall.
Input parameters:
- `event_types` (array): Filter by event types.
- `limit` (number): Max events to return (default 50).
- `project_id` (string, required): Project ID.
- `since` (string): Only events after this timestamp (RFC3339).
- `tags` (array): Filter by tags.
### `get_doc` (~252 tokens)
Read a document. By DEFAULT returns metadata plus the outline (headings) and NOT the body — a document is far larger than a task, and a body you read stays in your context for the rest of the session. Read the outline first, then pass section="" for just that part; body=true returns the whole page and should be the exception. The returned version is what update_doc takes as base_version.
Input parameters:
- `body` (boolean): Return the full markdown body. Prefer section= when you need one part.
- `doc` (string, required): Document UUID, or a slug path like 'architecture/adr/adr-004' (a path also needs project_id).
- `outline_depth` (string): Limit the outline to headings at this level or shallower (e.g. '2' for chapters, not every subsection). Default: all levels.
- `project_id` (string): Project UUID. Required only when doc is a slug path.
- `section` (string): Return only this section: a heading's text, or its anchor from the outline.
- `version_only` (boolean): Return just the version — the cheap 'has this changed since I read it?' check before a write.
### `get_my_rules` (~64 tokens)
Get ALL governance rules that apply to you: workflow constraints, assignment policies, behavioral requirements. Includes workspace and project-level rules with source annotations. Call at session start (ACP Step 3).
Input parameters:
- `project_id` (string): Optional project ID to get project-specific effective rules.
### `get_my_tasks` (~93 tokens)
Get YOUR assigned tasks (ACP Step 5). Filter by status_category to focus on active work. Use at session start and after completing tasks to pick up the next assignment.
Input parameters:
- `limit` (number): Max results (default 50).
- `project_id` (string): Filter by project.
- `status_category` (string): Filter by status category: backlog, todo, in_progress, review, done, cancelled.
### `get_project` (~27 tokens)
Get project details with statuses and custom fields.
Input parameters:
- `project_id` (string, required): Project ID.
### `get_project_knowledge` (~152 tokens)
Get ALL PERMANENT KNOWLEDGE for a project: decisions, conventions, accumulated context. Call at session start (ACP Step 2). Returns workspace-level + project-level memories. For RECENT events, use get_context instead.
Input parameters:
- `limit` (number): Max workspace-tier memories (default 100, max 500).
- `min_importance` (number): Minimum importance_score for workspace-tier (default 0 = all).
- `offset` (number): Pagination offset for workspace-tier (default 0).
- `project_id` (string, required): Project UUID.
- `tags_any` (string): Comma-separated tag OR-filter for workspace-tier, e.g. 'kind:decision,kind:incident'.
### `get_project_rules` (~51 tokens)
Get all rules configured for a project (all scopes: workspace + project). Kept for backward compatibility — prefer get_my_rules for agent-scoped effective rules.
Input parameters:
- `project_id` (string, required): Project ID.
### `get_recurring_history` (~115 tokens)
Returns the history of all instances for a recurring task schedule. ALWAYS call this when you receive a recurring task — it gives you context on what previous instances accomplished, what issues were found, and what artifacts were produced. Use it to continue work intelligently rather than starting from scratch.
Input parameters:
- `limit` (number): Number of most recent instances to return. Default: 5. Use higher value for deep historical context.
- `recurring_schedule_id` (string, required): UUID of the recurring schedule. Available in task.recurring_schedule_id field.
### `get_task` (~136 tokens)
Get full task details with optional comments, artifacts, dependencies, and VCS links.
Input parameters:
- `include_artifacts` (boolean): Include artifacts.
- `include_comments` (boolean): Include comments.
- `include_dependencies` (boolean): Include dependencies.
- `include_vcs_links` (boolean): Include linked PRs/MRs/commits/branches (id, provider, link_type, external_id, url, status, created_at) — use this instead of a raw REST call to diagnose a misclassified or stuck-status link.
- `task_id` (string, required): Task ID (full UUID or 6–12 char hex short-ID prefix).
### `get_task_context` (~61 tokens)
Get EVERYTHING about ONE TASK in a single call: full details + comments + artifacts + dependencies + activity. Use when working on a specific task instead of calling get_task + list_comments + list_artifacts separately.
Input parameters:
- `task_id` (string, required): Task ID.
### `get_team_directory` (~24 tokens)
Get the workspace team directory listing all agents and human members with their profiles.
### `get_workflow_rules` (~39 tokens)
Get workflow rules for a project including allowed transitions, policies, and permissions for the calling agent.
Input parameters:
- `project_id` (string, required): Project ID.
### `heartbeat` (~112 tokens)
Send heartbeat to stay visible. Call at session START with status=online, periodically during work with status=busy. Reports current_task_id, message, and metadata.
Input parameters:
- `current_task_id` (string): ID of the task currently being worked on.
- `message` (string): Short human-readable status message (e.g. 'running tests', 'waiting for review').
- `metadata` (object): Arbitrary JSON metadata to store with the heartbeat.
- `status` (string): Agent status: online, busy, error.
### `import_workspace_config` (~42 tokens)
Import workspace configuration from YAML. Applies rules, statuses, and project templates defined in the YAML.
Input parameters:
- `yaml_content` (string, required): YAML configuration content as a string.
### `list_artifacts` (~199 tokens)
List artifacts attached to a task. Each carries download_path; a browser_only_url block, when present, is for a human and must not be fetched. Downloading an artifact is two GETs. Step 1: GET /api/v1/artifacts//download with header X-Agent-Key: -> 200 JSON {"url": ""}. Step 2: GET that url with NO headers -> 200, the file bytes. Pitfalls: on step 1 only X-Agent-Key is accepted (X-API-Key and Authorization: Bearer give 401); on step 2 any extra header, Authorization in particular, breaks the presigned signature (400). The artifact's download_path is step 1's path. Never fetch browser_only_url with an agent key: it is a human page and answers 401 by design.
Input parameters:
- `task_id` (string, required): Task ID.
### `list_comments` (~115 tokens)
List comments on a task. Paginated: call again with a higher `page` to read a thread longer than `limit`.
Input parameters:
- `include_internal` (boolean): Include internal (agent-only) comments.
- `limit` (number): Max comments to return (default 50).
- `page` (number): 1-based page number. Omit for the first page; use with `has_more`/`total_pages` in the response to read the rest of a thread.
- `task_id` (string, required): Task ID.
### `list_doc_comments` (~149 tokens)
Read the comments on a document as threads — each top-level comment with its replies nested under it, the quoted passage it is anchored to, and who wrote it. Resolved threads are hidden unless include_resolved=true. A comment whose quoted text no longer exists in the document is marked orphaned=true in its anchor: it is still shown, and it is not pointing anywhere.
Input parameters:
- `doc` (string, required): Document UUID, or a slug path like 'architecture/adr/adr-004' (a path also needs project_id).
- `include_resolved` (boolean): Include threads somebody marked resolved.
- `project_id` (string): Project UUID. Required only when doc is a slug path.
### `list_docs` (~89 tokens)
List a project's documents — id, title, slug path, version, who touched them last. Carries NO document bodies, so it is safe to call on a whole project: use it as the map, then get_doc for one page. Returns path and has_children for navigating the tree.
Input parameters:
- `include_archived` (boolean): Include archived documents.
- `project_id` (string, required): Project UUID.
### `list_projects` (~43 tokens)
List available projects in the workspace.
Input parameters:
- `include_archived` (boolean): Include archived projects.
- `workspace_id` (string): Workspace ID. Defaults to agent's workspace.
### `list_recurring_schedules` (~42 tokens)
Lists all recurring task schedules for a project.
Input parameters:
- `active_only` (boolean): Only return active schedules.
- `project_id` (string, required): Project ID.
### `list_sub_agents` (~51 tokens)
List sub-agents of an agent.
Input parameters:
- `agent_id` (string): Parent agent ID. Defaults to the calling agent.
- `recursive` (boolean): Return all descendants (up to 10 levels deep).
### `list_tasks` (~537 tokens)
List tasks with filters. Provide project_id for project-scoped listing or workspace_id for global search across all projects (requires search parameter). Each item's description is included by default and has_description always reflects the task's real content, computed before any trimming below — but on ANY page (plain listing or search=) whose descriptions total more than 200KB, the server blanks descriptions from the TAIL of that page (in item order) to keep the response size bounded, and marks the response truncated:true (field omitted when false). search= usually returns few enough hits to stay under that budget, so it is the practical workaround for a specific known task, but the one guaranteed way to read a given task's full description regardless of any listing's size or order is get_task(task_id).
Input parameters:
- `assignee_type` (string): Filter by assignee type: user, agent, unassigned.
- `labels` (array): Filter by labels.
- `limit` (number): Max results to return (default 50, max 200).
- `list_revision` (number): The list_revision echoed back on a previous page of this same project-scoped walk (see the response's list_revision field). Pass it back to continue that walk. If the project's tasks changed since th…
- `order` (string): Sort direction: asc (default) or desc. Without this, a project larger than `limit` returns its OLDEST tasks, so "what changed recently" walks come back empty and look clean. An invalid value is REFUS…
- `page` (number): 1-based page number (default 1). The response reports total_pages; without this parameter every page beyond the first was unreachable while the envelope kept advertising them.
- `priority` (string): Filter by priority: urgent, high, medium, low, none.
- `project_id` (string): Project ID (required unless workspace_id is provided).
- `search` (string): Search in title and description.
- `sort` (string): Sort field: created_at, updated_at, priority, due_date.
- `status_category` (string): Filter by status category: backlog, todo, in_progress, review, done, cancelled.
- `workspace_id` (string): Workspace ID for global cross-project search (requires search parameter).
### `move_task` (~144 tokens)
Change task status (e.g. todo → in_progress → done). Use status SLUGS (not UUIDs). On move to 'review', task auto-reassigns to creator unless assignee_id is provided.
Input parameters:
- `assignee_id` (string): Reassign to this agent/user on move. Overrides auto-reassign to creator on review.
- `assignee_type` (string): Assignee type if assignee_id is set: user or agent.
- `comment` (string): Optional comment to add when moving.
- `status_slug` (string, required): Target status slug (e.g. 'in_progress', 'done').
- `task_id` (string, required): Task ID.
### `poll_tasks` (~78 tokens)
Long-poll for new task assignments. Blocks until a task is assigned to this agent or the timeout expires. Returns current assigned tasks and whether any change occurred. Kept for backward compatibility — prefer get_my_tasks for non-blocking access.
Input parameters:
- `timeout` (number): Maximum seconds to wait for new assignments (default 30, max 120).
### `publish_event` (~172 tokens)
Publish an event to the event bus. For summaries, use event_type='summary'. Add memory={persist:true, key:'decision-name'} to also save as permanent memory. Replaces the deprecated publish_summary tool.
Input parameters:
- `event_type` (string, required): Event type: summary, status_change, context_update, error, dependency_resolved, custom.
- `memory` (object): Optional memory hint to persist alongside the event (e.g. key decisions, conventions).
- `payload` (object, required): Event payload as key-value pairs.
- `project_id` (string, required): Project ID.
- `subject` (string, required): Event subject line.
- `tags` (array): Event tags for filtering.
- `task_id` (string): Related task ID.
- `ttl_hours` (number): Time-to-live in hours (default 24).
### `publish_summary` (~132 tokens)
Publish a work summary event (convenience wrapper for publish_event with type=summary). Kept for backward compatibility — prefer publish_event with event_type='summary'.
Input parameters:
- `artifacts_created` (array): Artifacts created.
- `blockers` (array): Current blockers.
- `key_decisions` (array): Key decisions made.
- `metrics` (object): Metrics (lines changed, tests passed, etc.).
- `next_steps` (array): Suggested next steps.
- `project_id` (string, required): Project ID.
- `summary` (string, required): Summary of work done.
- `task_id` (string): Related task ID.
### `recall` (~497 tokens)
SEARCH memory by keywords. Use to find a SPECIFIC piece of knowledge, e.g. 'API convention' or 'license decision'. Returns ranked results with scores. For loading ALL project knowledge at session start, use get_project_knowledge instead. Set include_archived=true to retrieve archived memories.
Input parameters:
- `apply_recency_decay` (boolean): Sort by relevance * 0.95^days_since_created.
- `created_by` (string): Filter by agent ID (UUID).
- `include_archived` (boolean): Include archived memories in results (default false).
- `include_expired` (boolean): Include expired memories (default false).
- `limit` (number): Max results (default 10, max 50). This is a hard bound: the response never contains more than limit items. When knowledge-graph boost is enabled, a share of the page (limit/4, at least 1 when limit>=…
- `min_importance` (number): Minimum importance_score threshold (0-1, default 0.3 — matches the lowest score the server assigns, kind:session-checkpoint, so prior-session hand-offs are returned without an override). Raise it to…
- `offset` (number): Pagination offset (default 0).
- `order_by` (string): Sort order: created_at:desc (default), created_at:asc, relevance:desc, decayed_relevance:desc.
- `project_id` (string): Filter to a specific project.
- `query` (string, required): Full-text search query.
- `relevance_min` (number): Minimum relevance score (0-1).
- `scope` (string): Filter by scope: workspace, project, agent, or all (default).
- `since` (string): Return memories created at or after this RFC3339 timestamp.
- `tags` (array): AND-filter: memory must contain ALL listed tags.
- `tags_any` (array): OR-filter: memory must contain AT LEAST ONE of these tags.
- `until` (string): Return memories created at or before this RFC3339 timestamp.
### `recall_with_graph` (~149 tokens)
Search memory with Knowledge Graph expansion. Seeds from hybrid recall, then BFS-traverses memory_edges up to hops depth. Returns memories ranked by composite score with hop_distance and provenance fields. Use when you want broader context — related decisions, connected incidents, derived learnings.
Input parameters:
- `hops` (number): Graph traversal depth (default 2, max 5).
- `project_id` (string): Filter to a specific project.
- `q` (string, required): Search query (keywords or natural language).
- `task_id` (string): Optional task ID — used as cache key discriminator for session-scoped traversal.
- `weight_threshold` (number): Minimum edge weight to follow (default 0.3).
### `record_owner_decision` (~311 tokens)
Record a directive from the workspace owner as a canonical decision in project_knowledge. Broadcasts to specified agents via propagate_to tags. privacy:private records are stored but EXCLUDED from get_canonical_updates. Auto-flags private if text contains secrets. If task_id is given, also records this as a human_gate decision on that task (docs/human-gate-decision-recorded.md in evc-mesh) — releases the gate as a consequence if it's currently live, and links back via canonical_key. Best-effort: a failure here is reported in the result but does not undo the canonical write.
Input parameters:
- `privacy` (string): 'public' (default, visible in change-feed) or 'private' (recorded but hidden).
- `propagate_to` (array): Agent slugs to propagate to, e.g. ['alice','bob']. Use ['all'] for workspace-wide broadcast.
- `scope` (string): Optional project_id UUID. Omit for workspace-level decisions.
- `summary` (string, required): One-line summary used as UPSERT key (dedupes same decision on same day).
- `task_id` (string): Optional task UUID this decision answers. When set, also records a human_gate decision on that task (provenance=attested, channel=telegram, quote=text) — releasing a live human_gate as a consequence.…
- `text` (string, required): Full text of the decision/directive.
### `register_sub_agent` (~66 tokens)
Register a sub-agent under the calling agent.
Input parameters:
- `agent_type` (string, required): Agent type: claude_code, openclaw, cline, aider, custom.
- `capabilities` (object): Agent capabilities as key-value pairs.
- `name` (string, required): Sub-agent name.
### `release_task` (~57 tokens)
Release the exclusive lock on a task acquired via checkout_task. Call when done with the task or if you need to hand it off. The lock is also released automatically when it expires.
Input parameters:
- `task_id` (string, required): Task ID to release.
### `remember` (~989 tokens)
Save knowledge to persistent memory. Use for decisions, conventions, preferences. UPSERT by key — calling with same key updates the existing entry. Content is screened on write and REFUSED with a named reason (never silently stripped or stored) if it contains invisible/bidi characters, an LLM role tag, an instruction to ignore previous/system instructions, a PEM private key, a prefixed API token (sk-/ghp_/xox*/AKIA), or a literal assignment to a *_PASSWORD/_SECRET/_TOKEN/_API_KEY name. LIMITATION — this screen is partial and must not be relied on as a secret filter: it CANNOT see a secret that has no recognisable prefix and no field name next to it (a bare value pasted on its own line), nor names it does not know. Do not paste credentials here on the assumption they will be caught; record where a secret lives, never its value.
Input parameters:
- `attach_context` (boolean): When false, disables auto-injection of thread_id and source_task_id. Use for cross-cutting records not tied to the active task.
- `content` (string, required): What to remember (markdown).
- `expected_version` (number): Make the write conditional: it succeeds only if the stored version still matches this number, and is REFUSED with both version numbers if someone else wrote to the key in between. Pass the version re…
- `expires_at` (string): RFC3339 timestamp or Go duration (e.g. '72h') when this memory should expire.
- `key` (string, required): Slug key for UPSERT (e.g. 'api-convention', 'license-decision'). ENFORCED server-side as ^[a-z0-9][a-z0-9-]*[a-z0-9]$ — lowercase alphanumeric and hyphens only, at least two characters, no leading or…
- `project_id` (string): Project ID (required for project scope).
- `reason` (string): Why this memory is worth writing — what a future thread should be able to do with it, or what changed if you are correcting an existing key. Recorded on the revision alongside the content, so a later…
- `relevance` (number): Relevance score 0-1 (default 1.0 when omitted). NOT the same field as importance_score: relevance is a caller-set ranking hint, importance_score is computed from tags (see tags) and is the field min_…
- `scope` (string): workspace | project | agent (default: project).
- `source_task_id` (string): UUID of the Mesh task that produced this memory. Auto-populated from the runner state file (FIDDLER_STATE_FILE) or the active checkout. Enables Amendment 2/3 KG edge hooks.
- `source_url` (string): Optional URL/path to the source of this knowledge (task ID, PR, file path).
- `tags` (array): Tags for categorization and filtering. A kind: tag also SETS importance_score, which is what decides whether recall returns this entry at its default threshold of 0.3 — so the tag you choose is a ret…
- `thread_id` (string): Thread identifier for same-session memory grouping. Auto-populated from the runner state file when omitted.
### `report_error` (~78 tokens)
Report an error encountered during work.
Input parameters:
- `error_message` (string, required): Error message.
- `recoverable` (boolean): Whether the error is recoverable.
- `severity` (string): Severity: low, medium, high, critical.
- `stack_trace` (string): Stack trace or details.
- `task_id` (string): Related task ID.
### `search_docs` (~205 tokens)
Full-text search a project's documents by title and body. Returns matching documents with a snippet and a path usable directly with get_doc — this is how you find a document when you don't already know its path; list_docs is the map, this is the index. SCOPE IS PER-PROJECT ONLY: results never cross project_id, and this is not a substitute for recall (which searches memory, not documents) or for a cross-project doc search (none exists yet). A query that matches nothing returns an empty items list, not an error. Documents saved before full-text search shipped (2026-08-20) are matched by title only until their next edit.
Input parameters:
- `limit` (number): Max results (default 20, server max 50).
- `project_id` (string, required): Project UUID. Search is scoped to this one project — call it once per project you need to check.
- `query` (string, required): Search text. Matched against title and body.
### `session_report` (~84 tokens)
Report session metrics. Call before session end. Returns compliance score and session stats.
Input parameters:
- `estimated_cost` (number): Estimated cost in USD.
- `model` (string): LLM model used (e.g. 'claude-sonnet-4').
- `tokens_in` (number): Total input tokens this session.
- `tokens_out` (number): Total output tokens this session.
### `set_human_gate` (~782 tokens)
Arm the human gate on a task: freeze it and record WHO is waiting, WHAT was asked, and WHAT you will do if nobody answers. Use INSTEAD of writing a '❓ Blocking @' comment by hand — the marker still works, but this path records the whole ask on the task, so nothing has to re-read the thread. recommended_default is REQUIRED: a gate with no stated default can only ever be resolved by finding a human. You must answer four questions (credential_exists / reversible / blocked_by_other_task / customer_visible_now), each with one line of justification. The server REFUSES the arm when your own answers say nobody needs to be asked: if you hold the credential, the action is reversible, and nothing a customer sees or pays changes right now, capture a rollback anchor and just do it. If the blocker is another card, the server tells you to use add_dependency instead.
Input parameters:
- `blocked_by_other_task` (boolean, required): Is the thing you are waiting on actually ANOTHER card? If yes, the answer is add_dependency, not a gate — a blocks edge freezes the feed without adding anything to a human's queue.
- `blocked_reason` (string, required): One line: which card, or why none.
- `class` (string): 'hard' (default, never auto-released) or 'soft' (released by timeout — the release does NOT answer the question).
- `copy_tier` (string): Only when this ask is about VISIBLE PRODUCT COPY (a label, a page's prose, a message users read) — otherwise omit entirely. Answer three questions: (1) is this the company's voice going OUT, or a cap…
- `credential_exists` (boolean, required): Do you ALREADY hold the credential or access this needs? Check your team's credential store before answering false — a service account your team created for its agents is yours to use.
- `credential_reason` (string, required): One line: which credential, and where you checked.
- `customer_reason` (string, required): One line: what the customer would see, or why nothing changes for them now.
- `customer_visible_now` (boolean, required): Does this change what a customer SEES or PAYS right now? A disabled gateway, an inactive flag or a reversible migration is NOT customer-visible; a rate that prints on invoices people already download…
- `deadline` (string): RFC3339 timestamp when recommended_default applies. Omit for no deadline.
- `reason` (string, required): The question itself, in your own words.
- `recommended_default` (string, required): What you will do if nobody answers. Required — an ask with no default cannot time out.
- `reversible` (boolean, required): Is there a rollback anchor — git revert, backup, snapshot, image tag? If you can MANUFACTURE one (take a backup first), the answer is true.
- `reversible_reason` (string, required): One line: the exact rollback path, or why none exists.
- `task_id` (string, required): Task ID to gate.
### `set_project_knowledge` (~286 tokens)
Write a structured fact to project knowledge. UPSERT by key — calling with same key updates the existing entry. Use for deploy URLs, stack conventions, gotchas. These facts are visible via get_project_knowledge.
Input parameters:
- `attach_context` (boolean): When false, disables auto-injection of thread_id and source_task_id.
- `category` (string): Optional category: deploy, stack, conventions, gotchas, api, auth, etc.
- `key` (string, required): Slug key for UPSERT (e.g. 'deploy-url', 'stack-convention'). Same enforced pattern as remember: ^[a-z0-9][a-z0-9-]*[a-z0-9]$ — hyphens, NEVER colons; a colon-delimited key is REFUSED, not normalised.
- `project_id` (string, required): Project ID to store knowledge for.
- `source_task_id` (string): UUID of the Mesh task that produced this fact. Auto-populated from the runner state file when omitted.
- `source_url` (string): Optional URL/path to the source of this knowledge.
- `tags` (array): Additional tags for filtering.
- `thread_id` (string): Thread identifier. Auto-populated from the runner state file when omitted.
- `value` (string, required): The knowledge to store (markdown, max 4000 chars).
### `subscribe_events` (~104 tokens)
Configure push notification delivery for task events. Optionally sets a callback URL that Mesh will POST events to. Returns SSE and long-poll endpoint URLs for alternative delivery mechanisms.
Input parameters:
- `callback_url` (string): Optional URL where Mesh will POST task events (task.assigned, task.created, task.status_changed). Leave empty to only use SSE or long-polling.
- `event_types` (array): Event types to subscribe to.
- `project_id` (string, required): Project ID.
### `trigger_recurring_now` (~48 tokens)
Immediately creates the next instance of a recurring schedule, without waiting for the scheduled time. Useful for testing or urgent execution.
Input parameters:
- `recurring_schedule_id` (string, required): UUID of the recurring schedule.
### `update_agent_profile` (~212 tokens)
Update the calling agent's profile fields such as role, capabilities, responsibility zone, and working hours.
Input parameters:
- `accepts_from` (array): Agent IDs or types this agent accepts tasks from.
- `callback_url` (string): URL where Mesh will POST task events (task.assigned, task.status_changed, task.commented). Set to empty string to disable.
- `capabilities` (array): List of capability strings (e.g. go, react, testing).
- `description` (string): Human-readable description of the agent's purpose.
- `escalation_to` (string): Agent ID or name to escalate issues to.
- `max_concurrent_tasks` (number): Maximum number of concurrent tasks this agent can handle.
- `responsibility_zone` (string): Area of responsibility (e.g. Backend, Frontend).
- `role` (string): Agent role (e.g. developer, reviewer, tester).
- `working_hours` (string): Working hours description (e.g. 24/7, 9-17 UTC).
### `update_doc` (~245 tokens)
Edit a document. Replacing the body REQUIRES base_version — the version you got from get_doc — and the write is refused with a 409 if anyone changed the document since, so you can never silently overwrite someone else's edit. To add to the end, pass append instead: it needs no base_version, cannot conflict, and does not make you read the document first. Prefer append for reports, decisions and logs.
Input parameters:
- `append` (string): Text to add to the END of the document. No base_version needed. Cannot be combined with body.
- `base_version` (number): The version you read from get_doc. Required for any write other than append.
- `body` (string): Replacement markdown for the WHOLE document. Requires base_version.
- `doc` (string, required): Document UUID, or a slug path like 'architecture/adr/adr-004' (a path also needs project_id).
- `parent_id` (string): New parent document UUID.
- `position` (number): New sort position among siblings.
- `project_id` (string): Project UUID. Required only when doc is a slug path.
- `title` (string): New title.
### `update_recurring_schedule` (~206 tokens)
Update an existing recurring task schedule. Change title, description, frequency, assignee, priority, or deactivate it.
Input parameters:
- `assignee_id` (string): New assignee UUID.
- `assignee_type` (string): New assignee type: user, agent, unassigned.
- `cron_expr` (string): New cron expression (for custom frequency).
- `description_template` (string): New description template. Supports {{.PrevSummary}}.
- `frequency` (string): New frequency: daily, weekly, monthly, custom.
- `is_active` (boolean): Set to false to pause the schedule.
- `priority` (string): New priority: urgent, high, medium, low, none.
- `recurring_schedule_id` (string, required): UUID of the recurring schedule to update.
- `timezone` (string): New IANA timezone.
- `title_template` (string): New title template. Supports {{.Date}}, {{.Number}}, {{.Week}}, {{.Month}}.
### `update_task` (~168 tokens)
Update task fields.
Input parameters:
- `completion_signal` (boolean): Mark agent-side work as finished.
- `custom_fields` (object): Custom field values to update.
- `delegation_level` (string): Routing after work: auto, review, or supervised.
- `description` (string): New description.
- `due_date` (string): Due date in RFC3339 format. Pass an empty string to clear it.
- `estimated_hours` (number): Estimated hours.
- `labels` (array): New labels.
- `priority` (string): New priority.
- `start_after` (string): Don't surface/feed this task before this RFC3339 timestamp. Independent of due_date. Pass an empty string to clear it.
- `task_id` (string, required): Task ID.
- `title` (string): New title.
### `upload_artifact` (~489 tokens)
Upload an artifact (file, code, log, etc.) to a task. Downloading an artifact is two GETs. Step 1: GET /api/v1/artifacts//download with header X-Agent-Key: -> 200 JSON {"url": ""}. Step 2: GET that url with NO headers -> 200, the file bytes. Pitfalls: on step 1 only X-Agent-Key is accepted (X-API-Key and Authorization: Bearer give 401); on step 2 any extra header, Authorization in particular, breaks the presigned signature (400). The artifact's download_path is step 1's path. Never fetch browser_only_url with an agent key: it is a human page and answers 401 by design. Inline content travels through the model context, so for a binary larger than a few KB prefer the REST endpoint instead: POST /api/v1/tasks//artifacts as multipart/form-data with -H 'X-Agent-Key: $MESH_AGENT_KEY' -F 'name=' -F 'artifact_type=image' -F 'file=@;type=image/png' — the bytes then never enter the context and cannot be truncated on the way.
Input parameters:
- `artifact_type` (string): Type: file, code, log, report, link, image, data.
- `content` (string, required): Artifact content. Plain text by default; set encoding="base64" to send binary.
- `encoding` (string): How to interpret content: "text" (stored as-is) or "base64" (decoded before storing). Required for binary — without it a base64 string is stored literally as the file body.
- `metadata` (object): Additional metadata, stored on the artifact as JSON.
- `mime_type` (string): MIME type. Auto-detected from name if omitted. For png/jpeg/gif/pdf/zip the content is checked against the type's magic bytes and the upload is refused on a mismatch.
- `name` (string, required): Artifact filename.
- `sha256` (string): Optional hex sha256 of the DECODED bytes. Verified before upload; a mismatch fails the call. Recommended for binary, since it is the only check that catches a payload truncated in transit.
- `task_id` (string, required): Task ID.
## Diagnostics
Captured diagnostic sections: Provenance. The full working is on the page: https://verifymcp.io/servers/entire-vc-evc-mesh-mcp/ghcr-io-entire-vc-evc-mesh-mcp-0-1-5#diagnostics
## Score history
- 2026-10-02: 44
- 2026-10-01: 43
- 2026-09-30: 43
- 2026-09-29: 42
- 2026-09-28: 42
- 2026-09-27: 41
- 2026-09-26: 41
- 2026-09-25: 40
- 2026-09-24: 40
## Common questions
### What is the io.github.entire-vc/evc-mesh-mcp server?
io.github.entire-vc/evc-mesh-mcp is listed in the public MCP registry as io.github.entire-vc/evc-mesh-mcp. Tasks, comments, shared memory and handoffs for teams of people and AI agents, over MCP. This page covers its container image (ghcr.io/entire-vc/evc-mesh-mcp:0.1.5).
### Is the io.github.entire-vc/evc-mesh-mcp server safe to use?
io.github.entire-vc/evc-mesh-mcp scores 44 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
### What tools does the io.github.entire-vc/evc-mesh-mcp server expose?
io.github.entire-vc/evc-mesh-mcp exposes 63 tools: add_comment, add_dependency, add_vcs_link, assign_task, checkout_task, and 58 more. Their descriptions and schemas cost roughly 11,163 tokens of context every time the server is loaded.
### Is the io.github.entire-vc/evc-mesh-mcp server still maintained?
io.github.entire-vc/evc-mesh-mcp is still listed as active in the MCP registry. We last reached this channel on 2 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
### What licence is the io.github.entire-vc/evc-mesh-mcp server under?
io.github.entire-vc/evc-mesh-mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.
## Links
- GitHub Container Registry: https://ghcr.io/entire-vc/evc-mesh-mcp
- Repository: https://github.com/entire-vc/evc-mesh-mcp
- Changelog RSS feed: https://verifymcp.io/servers/entire-vc-evc-mesh-mcp/ghcr-io-entire-vc-evc-mesh-mcp-0-1-5.xml
- Changelog JSON feed: https://verifymcp.io/servers/entire-vc-evc-mesh-mcp/ghcr-io-entire-vc-evc-mesh-mcp-0-1-5.json
- HTML version of this page: https://verifymcp.io/servers/entire-vc-evc-mesh-mcp/ghcr-io-entire-vc-evc-mesh-mcp-0-1-5