GhostPaw Questlog
NPM · @GHOSTPAW/QUESTLOG
Local tasks, calendar commitments, and recurring work.
Available components
Last scanned (10 hours ago)
Scores higher than 29% of npm servers
Category Productivity and Notes
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security13
- Malware scan not yet available for this package.Unverified
- Known CVEs could not be checked: the version this server declares is not published in its registry.Unverified
- No install/post-install scripts declared.Pass
- Dependency health could not be checked: the version this server declares is not published in its registry.Unverified
Provenance & Transparency71
- Repository check failed: the declared repository URL redirects; it must resolve directly. See how to fix → View diagnostics → Fail
- Cryptographically verified build provenance (signed, bound to GhostPawJS/questlog). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 0 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability61
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 2185 tokens (~182/item across 12 items; 12 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage98
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 93% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 12 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 13 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 24 Oct 26 47
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 24 Oct 2026 · Analysed npm/@ghostpaw/questlog@0.6.2
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | GhostPawJS/questlog |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/GhostPawJS/questlog/.github/workflows/publish.yml@refs/tags/v0.6.2 |
| Rekor log index | 3441024965 |
| Predicate type | SLSA build provenance https://slsa.dev/provenance/v1 |
| Subject digest | sha512:88f6b9c08292d6520e3b11e199b44ae8959227c78e5b3234556d5fede55e3860625bc08f2342fd55406d15e0043bfb829ad0b751fd2c2f35f5cef3083 |
Background: How many MCP packages publish verified provenance →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
capture_rumor ~128
Capture uncertain incoming work as a rumor so it can be triaged later without prematurely turning it into committed execution. Use when: Use this when something matters enough to record but is not yet ready to become a quest or questline. Not for: Do not use this for already-committed work that should be created directly as a quest or questline.
| Name | Type | Req | Description |
|---|---|---|---|
| details | string | – | Optional supporting context that explains why the rumor might matter. |
| now | integer | – | Optional creation timestamp for the rumor. |
| title | string | yes | Short rumor title describing the incoming signal or possible work. |
No output schema declared.
No examples provided.
inspect_questlog_item ~122
Inspect one specific questlog item in depth and return its richer structured detail and important related refs. Use when: Use this when you already know the target item id and want either compact or full detail for one rumor, quest, questline, or repeatable quest. Not for: Do not use this to discover items when the exact target is not known yet.
| Name | Type | Req | Description |
|---|---|---|---|
| detailLevel | string | – | How much detail to return. |
| now | integer | – | Optional evaluation timestamp for time-sensitive detail. |
| target | object | yes | The specific item to inspect. |
No output schema declared.
No examples provided.
manage_repeatable ~312
Manage recurring work definitions by creating, updating, previewing, spawning, or archiving repeatable quests. Use when: Use this when the work is a repeatable template or when due recurring anchors need to be previewed or materialized. Not for: Do not use this for one-off concrete quest execution, for inspecting an existing concrete quest, or for hiding a repeatable quest. Use `retire_work` for hiding.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform. |
| allDay | boolean | – | Whether future schedules are all-day. |
| anchorAt | integer | – | Optional new recurrence anchor timestamp. |
| archivedAt | integer | – | Optional archive timestamp. |
| dueOffsetSeconds | integer | – | Optional new due offset in seconds. |
| estimateSeconds | integer | – | Optional new effort estimate. |
| notBeforeOffsetSeconds | integer | – | Optional new not-before offset in seconds. |
| now | integer | – | Evaluation or update timestamp. |
| objective | string | – | Optional new objective for the update action. |
| questlineId | integer | – | Optional new questline id. |
| repeatableQuest | object | – | – |
| repeatableQuestId | integer | – | Repeatable quest to archive or update. |
| rrule | string | – | Optional new RRULE. |
| scheduledEndOffsetSeconds | integer | – | Optional new scheduled-end offset in seconds. |
| scheduledStartOffsetSeconds | integer | – | Optional new scheduled-start offset in seconds. |
| title | string | – | Optional new title for the update action. |
No output schema declared.
No examples provided.
organize_work ~206
Organize grouping and dependency structure by updating questlines or changing hard unlock prerequisites between concrete quests. Use when: Use this when work structure or gating logic should change without changing quest execution state. Not for: Do not use this for quest execution, planning-only edits, intake capture, or tag-like classification.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform. |
| archivedAt | integer | – | Optional archive timestamp. |
| description | string | – | Optional new questline description. |
| dueAt | integer | – | Optional questline due timestamp. |
| fromQuestId | integer | – | Prerequisite quest id. |
| fromQuestIds | array | – | Full prerequisite quest id set. |
| now | integer | – | Optional timestamp. |
| questlineId | integer | – | Questline to update or archive. |
| startsAt | integer | – | Optional questline start timestamp. |
| title | string | – | Optional new questline title. |
| toQuestId | integer | – | Quest whose blockers should change. |
No output schema declared.
No examples provided.
plan_quest ~211
Refine a quest by revising its objective before actual start or by changing its temporal planning fields. Use when: Use this when you need to sharpen what the quest means or how it is timed without starting or resolving it. Not for: Do not use this for lifecycle execution such as start, finish, abandon, or effort logging.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform. |
| allDay | boolean | – | Whether the planned schedule window is all-day. |
| dueAt | integer | – | Optional latest acceptable completion timestamp. |
| estimateSeconds | integer | – | Optional active-effort estimate in seconds. |
| notBeforeAt | integer | – | Optional earliest actionable timestamp. |
| now | integer | – | Optional update timestamp. |
| objective | string | – | The new quest objective text. Required for revise_objective. |
| questId | integer | yes | The quest to refine. |
| scheduledEndAt | integer | – | Optional planned schedule window end. |
| scheduledStartAt | integer | – | Optional planned schedule window start. |
No output schema declared.
No examples provided.
retire_work ~119
Hide an item from normal active operation without rewriting history by soft-deleting a rumor, quest, questline, or repeatable quest. Use when: Use this when work should disappear from active reads while preserving historical truth. Not for: Do not use this when you mean to archive a questline or repeatable quest while keeping it visible as retired structure.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | The retirement action to perform. |
| deletedAt | integer | – | Optional timestamp to record when the item became hidden. |
| target | object | yes | The target to hide. |
No output schema declared.
No examples provided.
review_questlog ~114
Review one operational questlog surface such as available quests, open rumors, blocked work, or due repeatable anchors. Use when: Use this when you want a dashboard-style list view instead of inspecting one specific item. Not for: Do not use this when you already know the exact item you want to inspect in depth.
| Name | Type | Req | Description |
|---|---|---|---|
| filters | object | – | Optional filters for supported review surfaces. |
| now | integer | – | Optional evaluation timestamp for time-sensitive views. |
| view | string | yes | Which operational review surface to return. |
No output schema declared.
No examples provided.
reward_work ~142
Manage rewards by adding, updating, removing, or claiming quest rewards, or by replacing future reward templates on repeatable quests. Use when: Use this when a completed or recurring piece of work should grant or update reward information. Not for: Do not use this to finish quests themselves or to model dependencies, classification, or scheduling.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform. |
| claimedAt | integer | – | Optional claim timestamp. |
| now | integer | – | Optional timestamp for removal or template replacement. |
| reward | object | – | – |
| rewards | array | – | Full future reward template set. Required for replace_repeatable_template. |
| target | object | yes | – |
No output schema declared.
No examples provided.
run_quest ~219
Run quest lifecycle actions such as starting, logging effort, finishing, abandoning, or abandoning and spawning follow-up quests atomically. Use when: Use this for actual execution lifecycle steps after the quest already exists. Not for: Do not use this for work shaping, planning-only edits, tagging, or rewards.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform. |
| effortSeconds | integer | – | Positive active-effort increment in seconds. Required for log_effort. |
| followups | array | – | Follow-up quests to create atomically. Required for abandon_and_spawn_followups. |
| force | boolean | – | Start despite unmet unlock prerequisites. Defaults to false. |
| now | integer | – | Optional effort-log timestamp. |
| outcome | string | – | Terminal outcome text. Required for finish, abandon, and abandon_and_spawn_followups. |
| questId | integer | yes | Quest whose execution state should change. |
| resolvedAt | integer | – | Optional resolved timestamp for finish or abandon actions. |
| startedAt | integer | – | Optional start timestamp for the start action. |
No output schema declared.
No examples provided.
search_questlog ~136
Search quests and rumors by text when you need to find an existing item before inspecting or changing it. Use when: Use this first when the exact quest, rumor, or id is not already known. Not for: Do not use this when you already know the exact item id and want its full detail.
| Name | Type | Req | Description |
|---|---|---|---|
| kinds | array | – | Optional entity kinds to search. |
| limit | integer | – | Maximum number of matches to return. |
| mode | string | – | Whether to browse results normally or ask for clarification when several matches are found. |
| query | string | yes | Text to search for in rumor and quest titles and body text. |
No output schema declared.
No examples provided.
shape_work ~293
Create a quest (with timing, tags, and objective in one call), create a questline, settle a rumor into concrete work, or manage quest-questline membership. Use create_quest for clear commitments — include tags and timing directly to avoid follow-up calls. Use when: Use this when deciding what real work exists and how it should be grouped before or around execution. Prefer a single create_quest call with all fields over separate create + plan_quest + tag_work calls. Not for: Do not use this for quest execution steps like starting, finishing, abandoning, or logging effort.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform. |
| details | string | – | New or enriched context text for the update_rumor action. |
| dismissedAt | integer | – | Optional dismissal timestamp. |
| now | integer | – | Optional timestamp for membership, reopen, or rumor update. |
| quest | object | – | – |
| questId | integer | – | Quest to attach or detach. |
| questline | object | – | – |
| questlineId | integer | – | Questline that should receive the quest. |
| quests | array | – | Quests to create during rumor settlement. Include timing and tags directly. |
| rumorId | integer | – | Rumor to settle, dismiss, or reopen. |
| settledAt | integer | – | Optional settlement timestamp. |
| title | string | – | New title for the update_rumor action. |
No output schema declared.
No examples provided.
tag_work ~122
Classify work by adding, removing, or replacing tags on quests and by replacing the future tag template set on repeatable quests. Use when: Use this when you want classification, reporting, or saved-filter semantics rather than lifecycle or dependency semantics. Not for: Do not use tags to model status, time planning, or hard prerequisites.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform. |
| now | integer | – | Optional timestamp for the tag mutation. |
| tagNames | array | yes | Tag names to add, remove, or replace. |
| target | object | yes | – |
No output schema declared.
No examples provided.
How do I install the GhostPaw Questlog MCP server?
GhostPaw Questlog runs locally as an npm package, launched with npx -y @ghostpaw/questlog. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @ghostpaw/questlog
claude mcp add ghostpawjs-questlog -- npx -y @ghostpaw/questlog
What is the GhostPaw Questlog MCP server?
GhostPaw Questlog is an MCP server listed in the public MCP registry as io.github.GhostPawJS/questlog. Local tasks, calendar commitments, and recurring work. This page covers its npm package (@ghostpaw/questlog).
Is the GhostPaw Questlog MCP server safe to use?
GhostPaw Questlog scores 47 out of 100 on VerifyMCP. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the GhostPaw Questlog MCP server expose?
GhostPaw Questlog exposes 12 tools: search_questlog, review_questlog, inspect_questlog_item, capture_rumor, shape_work, and 7 more. Their descriptions and schemas cost roughly 2,124 tokens of context every time the server is loaded.
Is the GhostPaw Questlog MCP server still maintained?
GhostPaw Questlog is still listed as active in the MCP registry. We last reached this channel on 24 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the GhostPaw Questlog MCP server under?
GhostPaw Questlog declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.