# io.github.garlicKim21/ratatosk-mcp (oci · ghcr.io/garlickim21/ratatosk-mcp:0.6.2)

CNCF release intelligence: typed facts from release notes; check_stack compares versions locally.

- Trust score: 34/100 (low)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- oci · `ghcr.io/garlickim21/ratatosk-mcp:0.6.2`: 34/100 (this document), [markdown](https://verifymcp.io/servers/garlickim21-ratatosk-mcp/ghcr-io-garlickim21-ratatosk-mcp-0-6-2.md), [page](https://verifymcp.io/servers/garlickim21-ratatosk-mcp/ghcr-io-garlickim21-ratatosk-mcp-0-6-2)

## Channel facts

- Registry: `oci`
- Package: `ghcr.io/garlickim21/ratatosk-mcp:0.6.2`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 0/100
  - Malware scan not yet available for this package.
  - CVE data not yet available for this package.
  - Install-script risk not yet assessed.
  - Dependency-health data not yet available.
- **Provenance & Transparency**: 32/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - License check failed: no license is declared.
  - Actively maintained (last published 2 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 61/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1550 tokens (~258/item across 6 items; 6 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

**Unverified: 2 categories.** Categories scored 0 because we could not verify them: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add garlickim21-ratatosk-mcp -- docker run --rm -i ghcr.io/garlickim21/ratatosk-mcp:0.6.2
```

### Codex

```bash
codex mcp add garlickim21-ratatosk-mcp -- docker run --rm -i ghcr.io/garlickim21/ratatosk-mcp:0.6.2
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "garlickim21-ratatosk-mcp": {
      "type": "local",
      "command": [
        "docker",
        "run",
        "--rm",
        "-i",
        "ghcr.io/garlickim21/ratatosk-mcp:0.6.2"
      ],
      "enabled": true
    }
  }
}
```

### Hermes

```yaml
mcp_servers:
  garlickim21-ratatosk-mcp:
    command: "docker"
    args: ["run", "--rm", "-i", "ghcr.io/garlickim21/ratatosk-mcp:0.6.2"]
```

### Other

```json
{
  "mcpServers": {
    "garlickim21-ratatosk-mcp": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "ghcr.io/garlickim21/ratatosk-mcp:0.6.2"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-01 (score 34, +28)

- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Tool coverage: unverified → 100
- [functional] First check of Tool coverage: 100
- [functional] First check of Schema quality: fail
- [functional] First check of Schema quality: excellent
- [functional] First check of Schema quality: fail

### 2026-07-31 (score 6)

First indexed and scored.

## MCP tools (6)

### `check_stack` (~464 tokens)

Check the user's running component versions against known facts. Versions are compared INSIDE THIS SERVER PROCESS — only project slugs are sent upstream, and this tool never calls the server-side /v1/upgrade endpoint. Run the server yourself and running versions never leave your infrastructure; on the hosted endpoint they transit server memory only and are not logged. Returns, per component, the facts from releases NEWER than the running version (the upgrade path). Default is a briefing: summary counts, then critical/high facts split by whether the caller still has to check something — action_required applies to everyone, check_config applies only if its applies_if holds against the running configuration (resolve it before recommending; an unmet condition is not a reason to upgrade, it is a precondition for later — fixed_in is the minimum version to be on before enabling that feature). One line each for the rest, and the same advisory fixed on several release branches collapsed into one entry (shown at the advisory's group-maximum severity). Pass version_source per component (where you read the version — e.g. a daemonset image tag, or that the user stated it): it is echoed back as an audit trail. This server cannot see your environment, so it cannot verify a version or its source; a running version older than every release on record is flagged in note, which is the only cross-check available here. Use detail:"full" for every fact verbatim (capped at 50 per component with relevant_facts_omitted — narrow with severity_min or target_version), target_version to limit to one upgrade hop, severity_min to filter. Components with zero facts carry tracked:true|false — tracked:false means the project is NOT covered by ratatosk, so the absence of facts is no-coverage, not safety. In brief mode, facts sharing one quoted sentence are merged with their ids listed together. Drill down with get_release or facts_by_entity.

Input parameters:

- `components` (null|array, required): the running stack to check
- `detail` (string): brief (default): summary + critical/high facts + one-liners for the rest; full: every fact verbatim
- `severity_min` (string): only facts at or above this severity: info|low|medium|high|critical

### `facts_by_entity` (~139 tokens)

Reverse index: every fact touching one exact identifier — a CVE id, CRD, feature gate, flag, metric, config field, or dependency. Case-insensitive. Call this when you have a specific identifier (e.g. from a manifest or advisory) and want to know what changed around it.

Input parameters:

- `kind` (string): optional: api|crd|feature_gate|flag|metric|config_field|extension|dependency|cve|advisory|subsystem
- `name` (string, required): exact identifier to look up: CVE id, CRD, feature gate, flag, metric, config field, dependency

### `get_release` (~202 tokens)

One reviewed release: envelope (coverage, assessment, source URL) plus all its facts. facts=[] with coverage=full_reviewed means the release was read and is routine — auditable silence. Omit version for the latest reviewed release of the project. version is accepted with or without the leading 'v' (projects disagree on the spelling); a wrong tag returns an error listing the project's recent reviewed tags — retry with one of those. Set include_raw for the original release note body (raw_notes); when the review is not the full story (coverage insufficient, or zero facts) raw_notes is included automatically.

Input parameters:

- `include_raw` (boolean): also return the original release note body as raw_notes — judge from the source instead of the extracted facts
- `project` (string, required): project slug, e.g. envoy
- `version` (string): release tag exactly as published, e.g. v1.38.3; omit for the latest reviewed release

### `list_facts` (~320 tokens)

Incremental SYNC feed of release facts (typed, entity-level changes: security fixes, removals, deprecations, renames, defaults) for CNCF/cloud-native projects. Ordered by fact_id ascending — OLDEST analyzed first, so a single page is NOT the newest data; page through with since=<returned next_since> until next_since comes back null. Built for keeping a local copy up to date. For 'what is the latest release of X' or 'recent releases of X', use get_release (omit version for the newest) instead. Optionally filter by project/type/severity. Facts citing an upstream security advisory carry advisory_group_key (the official notice id, e.g. GHSA-… on GitHub; facts citing only CVE ids get a cve:… key) and group_severity — the maximum severity across all releases sharing that key — the group-maximum reading, with per-release severity as the per-release evidence.

Input parameters:

- `limit` (integer): page size, default 50, max 200
- `project` (string): project slug filter, e.g. envoy, istio, cilium
- `severity` (string): info|low|medium|high|critical
- `since` (integer): cursor: return facts with fact_id greater than this
- `type` (string): fact_type filter: security_fix|dependency_bump|capability_removed|capability_deprecated|api_version_changed|identifier_renamed|validation_tightened|default_changed|behavior_changed

### `list_projects` (~194 tokens)

Every project ratatosk tracks: slug (the canonical id all other tools take), name, tier (graduated|incubating), category, analyzed_releases; image_aliases where a project runs under other names in clusters (an image or workload matching an alias belongs to that project at the version its tag says), and cluster_core:true on the cluster substrate (control plane, datastore, DNS, runtime, CNI/dataplane) — every cluster_core project present in a cluster belongs in its check_stack call. Some cluster_core entries carry a visibility hint (how the component is observed and where it can legitimately be unreadable — e.g. etcd may live outside the k8s API): an unreadable one is reported as unchecked, never guessed. Small response, no arguments — call this FIRST when you are unsure of a slug instead of guessing (a wrong slug shows up as tracked:false in check_stack).

### `list_releases` (~146 tokens)

The newest N reviewed releases of one project, as light summaries (version, date, coverage, fact counts by severity, max advisory-group severity). THE tool for 'recent releases of X' / 'what changed in X lately' — newest first, unlike the list_facts sync feed which returns oldest-analyzed first. facts_total=0 with coverage=full_reviewed means the release was read and is routine (auditable silence). Drill into a row with get_release(project, version) for the full facts.

Input parameters:

- `limit` (integer): how many recent releases, default 5, max 20
- `project` (string, required): project slug, e.g. istio

## Diagnostics

Captured diagnostic sections: Provenance. The full working is on the page: https://verifymcp.io/servers/garlickim21-ratatosk-mcp/ghcr-io-garlickim21-ratatosk-mcp-0-6-2#diagnostics

## Score history

- 2026-08-03: 34
- 2026-08-02: 34
- 2026-08-01: 34
- 2026-07-31: 6

## Links

- Repository: https://github.com/garlicKim21/ratatosk-mcp
- Website: https://ratatosk.io/
- Changelog RSS feed: https://verifymcp.io/servers/garlickim21-ratatosk-mcp/ghcr-io-garlickim21-ratatosk-mcp-0-6-2/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/garlickim21-ratatosk-mcp/ghcr-io-garlickim21-ratatosk-mcp-0-6-2/changelog.json
- HTML version of this page: https://verifymcp.io/servers/garlickim21-ratatosk-mcp/ghcr-io-garlickim21-ratatosk-mcp-0-6-2