GhostPaw Affinity
NPM · @GHOSTPAW/AFFINITY
Local relationship model and social CRM for contacts, relationships, evidence, and commitments.
Available components
Last scanned (12 hours ago)
Scores higher than 36% of npm servers
Category CRM and Sales
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security50
- Malware scan not yet available for this package.Unverified
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency71
- Repository check failed: the declared repository URL redirects; it must resolve directly. See how to fix → View diagnostics → Fail
- Cryptographically verified build provenance (signed, bound to GhostPawJS/affinity). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 0 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability62
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 2344 tokens (~195/item across 12 items; 12 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 13 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 24 Oct 26 58
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 24 Oct 2026 · Analysed npm/@ghostpaw/affinity@0.3.0
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | GhostPawJS/affinity |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/GhostPawJS/affinity/.github/workflows/publish.yml@refs/tags/v0.3.0 |
| Rekor log index | 3440911753 |
| Predicate type | SLSA build provenance https://slsa.dev/provenance/v1 |
| Subject digest | sha512:01eb834a93abf252ad945cbcbbb7ba27415c6644866c3505e186a8fbab32d39cc10523641ee9124ed4831111cc531efd5f1da1351bd0d0f25bfad5069 |
Background: How many MCP packages publish verified provenance →
Dependencies 0 packages
| Packages resolved | 0 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
inspect_affinity_item ~145
Inspect one exact affinity item such as the owner profile, a contact profile, or one link detail. Use when: Use this when you already know the exact item you want to inspect in depth. Not for: Do not use this for search-style discovery or dashboard-like list reviews.
| Name | Type | Req | Description |
|---|---|---|---|
| contact | object | – | Target contact. Required when kind=contact_profile. Provide contactId or identity. |
| kind | string | yes | What to inspect. |
| link | object | – | Target link. Required when kind=link. Provide linkId or endpoints. |
| recentEventsLimit | integer | – | Optional recent-events cap. |
| topLinksLimit | integer | – | Optional top-links cap. |
No output schema declared.
No examples provided.
manage_attribute ~179
Set, unset, or replace custom metadata attributes on contacts and links. For emails, phones, handles, and URLs use manage_identity instead — those are routing keys, not attributes. Use when: Use this for metadata such as tags, notes, or small labeled facts attached to a contact or link. Not for: Do not use this for core contact fields, identities, or direct relationship mechanics.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Operation to perform. |
| entries | array | – | Key-value map to replace all attributes. Required when action=replace. |
| name | string | – | Attribute name. Required when action=set or unset. |
| removedAt | integer | – | Removal timestamp. Optional for action=unset. |
| target | object | – | Attribute target. Always required. |
| value | – | – | Attribute value. Required when action=set. Null for presence/tag semantics. |
No output schema declared.
No examples provided.
manage_commitment ~139
Record or resolve one commitment such as a promise or agreement. The owner contact is auto-injected into participants if missing. Use when: Use this when the work is specifically about a commitment lifecycle rather than a general event. Not for: Do not use this for ordinary interactions or direct relationship state changes.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Operation to perform. |
| commitmentEventId | integer | – | Commitment event id. Required when action=resolve. |
| input | object | – | Commitment payload. Required when action=record. |
| options | object | – | Optional metadata. |
| resolution | string | – | How the commitment was resolved. Required when action=resolve. |
No output schema declared.
No examples provided.
manage_contact ~164
Create a contact, revise one contact's core fields, or change lifecycle state. ALWAYS search_affinity first before creating — duplicates corrupt the graph. Use when: Use this for contact creation and lifecycle-safe contact maintenance. Not for: Do not use this for identities, links, attributes, or merges.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Operation to perform. |
| contact | object | – | Target contact. Required when action=revise or set_lifecycle. Provide contactId or identity. |
| input | object | – | New contact payload. Required when action=create. |
| lifecycleState | string | – | Target lifecycle state. Required when action=set_lifecycle. |
| options | object | – | Optional lifecycle metadata. |
| patch | object | – | Allowed contact patch. Required when action=revise. |
No output schema declared.
No examples provided.
manage_date_anchor ~165
Add, revise, or remove recurring date anchors on contacts or links. Use this for birthdays, anniversaries, and yearly events — not manage_attribute. Use when: Use this for birthdays, anniversaries, renewals, memorials, and other recurring anchors. Not for: Do not use this for one-off events or relationship state changes.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Operation to perform. |
| anchorEventId | integer | – | Anchor event id. Required when action=revise or remove. |
| input | object | – | Date anchor payload. Required when action=add. |
| options | object | – | Optional metadata. |
| patch | object | – | Anchor patch. Required when action=revise. |
| removedAt | integer | – | Removal timestamp. Optional for action=remove. |
No output schema declared.
No examples provided.
manage_duplicate_dismissal ~129
Dismiss or un-dismiss a duplicate candidate pair so it does not resurface in listDuplicateCandidates. Use when: Use dismiss after confirming two contacts are different people (not duplicates). Use undismiss to re-surface a pair for re-evaluation. Not for: Do not use this to merge contacts — use merge_contacts for confirmed duplicates.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform. |
| left | object | yes | Left contact. Provide contactId or identity. |
| reason | – | – | Optional reason for the dismissal. |
| right | object | yes | Right contact. Provide contactId or identity. |
No output schema declared.
No examples provided.
manage_identity ~206
Add, revise, verify, or remove one routing identity on a contact. Use this for emails, phone numbers, social handles, and URLs — anything that could locate a person. Do not use manage_attribute for these. Use when: Use this for contact identity management such as email, handle, or phone routing keys. Not for: Do not use this for contact core fields, links, or attributes.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Operation to perform. |
| contact | object | – | Target contact. Required when action=add. Provide contactId or identity. |
| identityId | integer | – | Identity id. Required when action=revise, verify, or remove. |
| input | object | – | New identity payload. Required when action=add. |
| patch | object | – | Identity patch. Required when action=revise. |
| removedAt | integer | – | Removal timestamp. Optional for action=remove. |
| verifiedAt | integer | – | Verification timestamp. Optional for action=verify. |
No output schema declared.
No examples provided.
manage_relationship ~391
Seed social links, revise bond and state, and manage structural ties. Seed a link as soon as a relationship is mentioned — do not wait for repeated evidence. Use when: Use this for direct relationship modeling and link-state changes. Not for: Do not use this for recording social evidence or resolving commitments.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Operation to perform. |
| bond | – | – | Bond text. Required when action=revise_bond. Null to clear. |
| from | object | – | Source contact. Required when action=seed_social_link or set_structural_tie. Provide contactId or identity. |
| input | object | – | Full payload for seed_social_link or set_structural_tie. Alternative to top-level kind/role. |
| kind | string | – | Link kind. Required for seed_social_link and set_structural_tie. Can be passed here or inside input. For seed_social_link: personal, family, professional, romantic, care, service, observed, other_rel… |
| link | object | – | Target link. Required when action=revise_bond, override_state, or remove_structural_tie. Provide linkId or endpoints. |
| options | object | – | Optional metadata. |
| removedAt | integer | – | Removal timestamp. Optional for action=remove_structural_tie. |
| role | string | – | Optional role for seed_social_link or set_structural_tie. Can be passed here or inside input. |
| state | string | – | Link state. Required when action=override_state. |
| to | object | – | Target contact. Required when action=seed_social_link or set_structural_tie. Provide contactId or identity. |
No output schema declared.
No examples provided.
merge_contacts ~108
Merge one loser contact into one winner contact using explicit contact locators. Use when: Use this only when two contacts are confirmed duplicates and the system should consolidate them. Not for: Do not use this for routine contact edits or identity cleanup.
| Name | Type | Req | Description |
|---|---|---|---|
| loser | object | yes | Loser contact. Provide contactId or identity. |
| now | integer | – | Optional merge timestamp. |
| reasonSummary | string | – | Optional merge reason. |
| winner | object | yes | Winner contact. Provide contactId or identity. |
No output schema declared.
No examples provided.
record_event ~119
Record one social event such as an interaction, observation, milestone, or transaction. For interactions, milestones, and transactions the owner contact is auto-injected into participants if missing. Observations may omit the owner when recording third-party evidence. Use when: Use this when you are capturing something that happened in the relationship graph. Not for: Do not use this for commitments, date anchors, or direct relationship state overrides.
| Name | Type | Req | Description |
|---|---|---|---|
| input | object | yes | Event payload. Always required. Interaction events also require `type`. |
| kind | string | yes | Event kind. |
No output schema declared.
No examples provided.
review_affinity ~371
Review one affinity surface such as contacts, journals, link queues, commitments, dates, graph state, or merge history. Use when: Use this when you want a dashboard-style list or review view instead of inspecting one exact item. Not for: Do not use this when you already know the exact contact or link you want to inspect in depth.
| Name | Type | Req | Description |
|---|---|---|---|
| commitmentType | string | – | Optional commitment type filter. |
| contact | object | – | Optional target contact locator. |
| contactIds | array | – | Optional contact-id subset. |
| eventTypes | array | – | Optional event-type filter. |
| exactOnly | boolean | – | Whether duplicate review is exact-only. |
| horizonDays | integer | – | Optional horizon-days filter. |
| includeArchived | boolean | – | Whether archived links are included. |
| includeDismissed | boolean | – | Whether dismissed pairs are included in duplicate review (marked with dismissed flag). |
| includeDormant | boolean | – | Whether dormant rows are included. |
| includeObserved | boolean | – | Whether observed links are included. |
| includeOwner | boolean | – | Whether owner contacts are included. |
| kind | string | – | Optional contact kind or link kind filter, depending on the view. |
| lifecycleState | string | – | Optional contact lifecycle-state filter. |
| limit | integer | – | Optional result limit. |
| link | object | – | Optional target link locator. |
| linkState | string | – | Optional link state filter. |
| minScore | number | – | Optional duplicate minimum score. |
| momentKind | string | – | Optional moment kind filter. |
| offset | integer | – | Optional result offset. |
| recurrenceKind | string | – | Optional recurrence-kind filter. |
| since | integer | – | Optional lower timestamp bound. |
| until | integer | – | Optional upper timestamp bound. |
| view | string | yes | Which review surface to return. |
No output schema declared.
No examples provided.
search_affinity ~159
Search contacts by name or identity, including exact natural-key lookups like email-style identifiers. Use when: Use this when you want to find contacts from free text or a known routing identity such as an email or URL-like handle. Not for: Do not use this when you already know the exact contact you want to inspect in depth.
| Name | Type | Req | Description |
|---|---|---|---|
| includeDormant | boolean | – | Whether dormant contacts are included. |
| includeOwner | boolean | – | Whether owner contacts are included. |
| kind | string | – | Optional contact kind filter. |
| lifecycleState | string | – | Optional lifecycle state filter. |
| limit | integer | – | Optional result limit. |
| offset | integer | – | Optional result offset. |
| query | string | yes | Free-text or natural-key query. |
No output schema declared.
No examples provided.
How do I install the GhostPaw Affinity MCP server?
GhostPaw Affinity runs locally as an npm package, launched with npx -y @ghostpaw/affinity. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @ghostpaw/affinity
claude mcp add ghostpawjs-affinity -- npx -y @ghostpaw/affinity
What is the GhostPaw Affinity MCP server?
GhostPaw Affinity is an MCP server listed in the public MCP registry as io.github.GhostPawJS/affinity. Local relationship model and social CRM for contacts, relationships, evidence, and commitments. This page covers its npm package (@ghostpaw/affinity).
Is the GhostPaw Affinity MCP server safe to use?
GhostPaw Affinity scores 58 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 24 October 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the GhostPaw Affinity MCP server expose?
GhostPaw Affinity exposes 12 tools: search_affinity, review_affinity, inspect_affinity_item, manage_contact, merge_contacts, and 7 more. Their descriptions and schemas cost roughly 2,275 tokens of context every time the server is loaded.
Is the GhostPaw Affinity MCP server still maintained?
GhostPaw Affinity is still listed as active in the MCP registry. We last reached this channel on 24 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the GhostPaw Affinity MCP server under?
GhostPaw Affinity declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.