# GhostPaw Questlog (npm · @ghostpaw/questlog)

Local tasks, calendar commitments, and recurring work.

- Trust score: 47/100 (low)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-10-24

## Components

- npm · `@ghostpaw/questlog`: 47/100 (this document), [markdown](https://verifymcp.io/servers/ghostpawjs-questlog/ghostpaw-questlog.md), [page](https://verifymcp.io/servers/ghostpawjs-questlog/ghostpaw-questlog)

## Channel facts

- Registry: `npm`
- Package: `@ghostpaw/questlog`
- Version: `0.6.2`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-10-24.

- **Supply Chain Security**: 13/100
  - Malware scan not yet available for this package.
  - Known CVEs could not be checked: the version this server declares is not published in its registry.
  - No install/post-install scripts declared.
  - Dependency health could not be checked: the version this server declares is not published in its registry.
- **Provenance & Transparency**: 71/100
  - Repository check failed: the declared repository URL redirects; it must resolve directly.
  - Cryptographically verified build provenance (signed, bound to GhostPawJS/questlog).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 0 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 61/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 2185 tokens (~182/item across 12 items; 12 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 98/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 93% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 12 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 13 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### How do I install the GhostPaw Questlog MCP server?

GhostPaw Questlog runs locally as an npm package, launched with npx -y @ghostpaw/questlog. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add ghostpawjs-questlog -- npx -y @ghostpaw/questlog
```

### Cursor

```json
{
  "mcpServers": {
    "ghostpawjs-questlog": {
      "command": "npx",
      "args": [
        "-y",
        "@ghostpaw/questlog"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "ghostpawjs-questlog": {
      "command": "npx",
      "args": [
        "-y",
        "@ghostpaw/questlog"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add ghostpawjs-questlog -- npx -y @ghostpaw/questlog
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "ghostpawjs-questlog": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@ghostpaw/questlog"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add ghostpawjs-questlog --command npx --arg -y --arg @ghostpaw/questlog
```

### Hermes

```yaml
mcp_servers:
  ghostpawjs-questlog:
    command: "npx"
    args: ["-y", "@ghostpaw/questlog"]
```

### Netclaw

```json
{
  "McpServers": {
    "ghostpawjs-questlog": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "@ghostpaw/questlog"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add ghostpawjs-questlog -t stdio -c npx -a -y @ghostpaw/questlog
```

### Other

```json
{
  "mcpServers": {
    "ghostpawjs-questlog": {
      "command": "npx",
      "args": [
        "-y",
        "@ghostpaw/questlog"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-24 (score 47)

First indexed and scored.

## MCP tools (12)

### `search_questlog` (~136 tokens)

Search quests and rumors by text when you need to find an existing item before inspecting or changing it.

Use when: Use this first when the exact quest, rumor, or id is not already known.
Not for: Do not use this when you already know the exact item id and want its full detail.

Input parameters:

- `kinds` (array): Optional entity kinds to search.
- `limit` (integer): Maximum number of matches to return.
- `mode` (string): Whether to browse results normally or ask for clarification when several matches are found.
- `query` (string, required): Text to search for in rumor and quest titles and body text.

### `review_questlog` (~114 tokens)

Review one operational questlog surface such as available quests, open rumors, blocked work, or due repeatable anchors.

Use when: Use this when you want a dashboard-style list view instead of inspecting one specific item.
Not for: Do not use this when you already know the exact item you want to inspect in depth.

Input parameters:

- `filters` (object): Optional filters for supported review surfaces.
- `now` (integer): Optional evaluation timestamp for time-sensitive views.
- `view` (string, required): Which operational review surface to return.

### `inspect_questlog_item` (~122 tokens)

Inspect one specific questlog item in depth and return its richer structured detail and important related refs.

Use when: Use this when you already know the target item id and want either compact or full detail for one rumor, quest, questline, or repeatable quest.
Not for: Do not use this to discover items when the exact target is not known yet.

Input parameters:

- `detailLevel` (string): How much detail to return.
- `now` (integer): Optional evaluation timestamp for time-sensitive detail.
- `target` (object, required): The specific item to inspect.

### `capture_rumor` (~128 tokens)

Capture uncertain incoming work as a rumor so it can be triaged later without prematurely turning it into committed execution.

Use when: Use this when something matters enough to record but is not yet ready to become a quest or questline.
Not for: Do not use this for already-committed work that should be created directly as a quest or questline.

Input parameters:

- `details` (string): Optional supporting context that explains why the rumor might matter.
- `now` (integer): Optional creation timestamp for the rumor.
- `title` (string, required): Short rumor title describing the incoming signal or possible work.

### `shape_work` (~293 tokens)

Create a quest (with timing, tags, and objective in one call), create a questline, settle a rumor into concrete work, or manage quest-questline membership. Use create_quest for clear commitments — include tags and timing directly to avoid follow-up calls.

Use when: Use this when deciding what real work exists and how it should be grouped before or around execution. Prefer a single create_quest call with all fields over separate create + plan_quest + tag_work calls.
Not for: Do not use this for quest execution steps like starting, finishing, abandoning, or logging effort.

Input parameters:

- `action` (string, required): Action to perform.
- `details` (string): New or enriched context text for the update_rumor action.
- `dismissedAt` (integer): Optional dismissal timestamp.
- `now` (integer): Optional timestamp for membership, reopen, or rumor update.
- `quest` (object)
- `questId` (integer): Quest to attach or detach.
- `questline` (object)
- `questlineId` (integer): Questline that should receive the quest.
- `quests` (array): Quests to create during rumor settlement. Include timing and tags directly.
- `rumorId` (integer): Rumor to settle, dismiss, or reopen.
- `settledAt` (integer): Optional settlement timestamp.
- `title` (string): New title for the update_rumor action.

### `plan_quest` (~211 tokens)

Refine a quest by revising its objective before actual start or by changing its temporal planning fields.

Use when: Use this when you need to sharpen what the quest means or how it is timed without starting or resolving it.
Not for: Do not use this for lifecycle execution such as start, finish, abandon, or effort logging.

Input parameters:

- `action` (string, required): Action to perform.
- `allDay` (boolean): Whether the planned schedule window is all-day.
- `dueAt` (integer): Optional latest acceptable completion timestamp.
- `estimateSeconds` (integer): Optional active-effort estimate in seconds.
- `notBeforeAt` (integer): Optional earliest actionable timestamp.
- `now` (integer): Optional update timestamp.
- `objective` (string): The new quest objective text. Required for revise_objective.
- `questId` (integer, required): The quest to refine.
- `scheduledEndAt` (integer): Optional planned schedule window end.
- `scheduledStartAt` (integer): Optional planned schedule window start.

### `run_quest` (~219 tokens)

Run quest lifecycle actions such as starting, logging effort, finishing, abandoning, or abandoning and spawning follow-up quests atomically.

Use when: Use this for actual execution lifecycle steps after the quest already exists.
Not for: Do not use this for work shaping, planning-only edits, tagging, or rewards.

Input parameters:

- `action` (string, required): Action to perform.
- `effortSeconds` (integer): Positive active-effort increment in seconds. Required for log_effort.
- `followups` (array): Follow-up quests to create atomically. Required for abandon_and_spawn_followups.
- `force` (boolean): Start despite unmet unlock prerequisites. Defaults to false.
- `now` (integer): Optional effort-log timestamp.
- `outcome` (string): Terminal outcome text. Required for finish, abandon, and abandon_and_spawn_followups.
- `questId` (integer, required): Quest whose execution state should change.
- `resolvedAt` (integer): Optional resolved timestamp for finish or abandon actions.
- `startedAt` (integer): Optional start timestamp for the start action.

### `organize_work` (~206 tokens)

Organize grouping and dependency structure by updating questlines or changing hard unlock prerequisites between concrete quests.

Use when: Use this when work structure or gating logic should change without changing quest execution state.
Not for: Do not use this for quest execution, planning-only edits, intake capture, or tag-like classification.

Input parameters:

- `action` (string, required): Action to perform.
- `archivedAt` (integer): Optional archive timestamp.
- `description` (string): Optional new questline description.
- `dueAt` (integer): Optional questline due timestamp.
- `fromQuestId` (integer): Prerequisite quest id.
- `fromQuestIds` (array): Full prerequisite quest id set.
- `now` (integer): Optional timestamp.
- `questlineId` (integer): Questline to update or archive.
- `startsAt` (integer): Optional questline start timestamp.
- `title` (string): Optional new questline title.
- `toQuestId` (integer): Quest whose blockers should change.

### `manage_repeatable` (~312 tokens)

Manage recurring work definitions by creating, updating, previewing, spawning, or archiving repeatable quests.

Use when: Use this when the work is a repeatable template or when due recurring anchors need to be previewed or materialized.
Not for: Do not use this for one-off concrete quest execution, for inspecting an existing concrete quest, or for hiding a repeatable quest. Use `retire_work` for hiding.

Input parameters:

- `action` (string, required): Action to perform.
- `allDay` (boolean): Whether future schedules are all-day.
- `anchorAt` (integer): Optional new recurrence anchor timestamp.
- `archivedAt` (integer): Optional archive timestamp.
- `dueOffsetSeconds` (integer): Optional new due offset in seconds.
- `estimateSeconds` (integer): Optional new effort estimate.
- `notBeforeOffsetSeconds` (integer): Optional new not-before offset in seconds.
- `now` (integer): Evaluation or update timestamp.
- `objective` (string): Optional new objective for the update action.
- `questlineId` (integer): Optional new questline id.
- `repeatableQuest` (object)
- `repeatableQuestId` (integer): Repeatable quest to archive or update.
- `rrule` (string): Optional new RRULE.
- `scheduledEndOffsetSeconds` (integer): Optional new scheduled-end offset in seconds.
- `scheduledStartOffsetSeconds` (integer): Optional new scheduled-start offset in seconds.
- `title` (string): Optional new title for the update action.

### `tag_work` (~122 tokens)

Classify work by adding, removing, or replacing tags on quests and by replacing the future tag template set on repeatable quests.

Use when: Use this when you want classification, reporting, or saved-filter semantics rather than lifecycle or dependency semantics.
Not for: Do not use tags to model status, time planning, or hard prerequisites.

Input parameters:

- `action` (string, required): Action to perform.
- `now` (integer): Optional timestamp for the tag mutation.
- `tagNames` (array, required): Tag names to add, remove, or replace.
- `target` (object, required)

### `reward_work` (~142 tokens)

Manage rewards by adding, updating, removing, or claiming quest rewards, or by replacing future reward templates on repeatable quests.

Use when: Use this when a completed or recurring piece of work should grant or update reward information.
Not for: Do not use this to finish quests themselves or to model dependencies, classification, or scheduling.

Input parameters:

- `action` (string, required): Action to perform.
- `claimedAt` (integer): Optional claim timestamp.
- `now` (integer): Optional timestamp for removal or template replacement.
- `reward` (object)
- `rewards` (array): Full future reward template set. Required for replace_repeatable_template.
- `target` (object, required)

### `retire_work` (~119 tokens)

Hide an item from normal active operation without rewriting history by soft-deleting a rumor, quest, questline, or repeatable quest.

Use when: Use this when work should disappear from active reads while preserving historical truth.
Not for: Do not use this when you mean to archive a questline or repeatable quest while keeping it visible as retired structure.

Input parameters:

- `action` (string, required): The retirement action to perform.
- `deletedAt` (integer): Optional timestamp to record when the item became hidden.
- `target` (object, required): The target to hide.

## Diagnostics

Captured diagnostic sections: Provenance. The full working is on the page: https://verifymcp.io/servers/ghostpawjs-questlog/ghostpaw-questlog#diagnostics

## Score history

- 2026-10-24: 47

## Common questions

### What is the GhostPaw Questlog MCP server?

GhostPaw Questlog is an MCP server listed in the public MCP registry as io.github.GhostPawJS/questlog. Local tasks, calendar commitments, and recurring work. This page covers its npm package (@ghostpaw/questlog).

### Is the GhostPaw Questlog MCP server safe to use?

GhostPaw Questlog scores 47 out of 100 on VerifyMCP. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the GhostPaw Questlog MCP server expose?

GhostPaw Questlog exposes 12 tools: search_questlog, review_questlog, inspect_questlog_item, capture_rumor, shape_work, and 7 more. Their descriptions and schemas cost roughly 2,124 tokens of context every time the server is loaded.

### Is the GhostPaw Questlog MCP server still maintained?

GhostPaw Questlog is still listed as active in the MCP registry. We last reached this channel on 24 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the GhostPaw Questlog MCP server under?

GhostPaw Questlog declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/@ghostpaw/questlog
- Socket report: https://socket.dev/npm/package/@ghostpaw/questlog
- Website: https://ghostpaw.dev/agent-tasks/
- Changelog RSS feed: https://verifymcp.io/servers/ghostpawjs-questlog/ghostpaw-questlog.xml
- Changelog JSON feed: https://verifymcp.io/servers/ghostpawjs-questlog/ghostpaw-questlog.json
- HTML version of this page: https://verifymcp.io/servers/ghostpawjs-questlog/ghostpaw-questlog