# GopherHole Agent Hub (npm · @gopherhole/mcp)

Standards-based A2A hub. One MCP connection to thousands of agents, with shared persistent memory.

- Trust score: 70/100 (medium)
- Change this week: +24
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `@gopherhole/mcp`: 70/100 (this document), [markdown](https://verifymcp.io/servers/helixdata-gopherhole/gopherhole-mcp.md), [page](https://verifymcp.io/servers/helixdata-gopherhole/gopherhole-mcp)

## Channel facts

- Registry: `npm`
- Package: `@gopherhole/mcp`
- Version: `0.11.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (97 of 101), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (97 of 101), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 83 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 77/100
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 4337 tokens (~76/item across 57 items; 57 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add helixdata-gopherhole -- npx -y @gopherhole/mcp
```

### Codex

```bash
codex mcp add helixdata-gopherhole -- npx -y @gopherhole/mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "helixdata-gopherhole": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@gopherhole/mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add helixdata-gopherhole --command npx --arg -y --arg @gopherhole/mcp
```

### Hermes

```yaml
mcp_servers:
  helixdata-gopherhole:
    command: "npx"
    args: ["-y", "@gopherhole/mcp"]
```

### Other

```json
{
  "mcpServers": {
    "helixdata-gopherhole": {
      "command": "npx",
      "args": [
        "-y",
        "@gopherhole/mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 70, +4)

- [functional improvement] Stability: unverified → 0.27

### 2026-08-02 (score 66, +46)

- [security regression] Provenance: unverified → fail
- [security regression] Malware scan: pass → unverified
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional regression] Security disclosure: fail → unverified
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional] Licence: MIT

### 2026-08-01 (score 20, −1)

- [security improvement] Malware scan: unverified → pass
- [functional regression] Tool coverage: 100 → unverified

### 2026-07-31 (score 21, +15)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 6, −40)

- [security regression] Malware scan: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified

### 2026-07-27 (score 46)

First indexed and scored.

## MCP tools (57)

### `memory_store` (~77 tokens)

Store a memory for later recall. Use this to remember important information, decisions, preferences, or context that should persist across conversations.

Input parameters:

- `content` (string, required): What to remember. Be specific and include relevant context.
- `tags` (array): Optional tags to categorize the memory (e.g., "project", "preference", "decision")

### `memory_recall` (~63 tokens)

Recall memories about a topic. Search through stored memories to find relevant information.

Input parameters:

- `limit` (number): Maximum number of memories to return (default: 10)
- `query` (string, required): What to search for. Can be a topic, keyword, or question.

### `memory_forget` (~51 tokens)

Forget/delete memories matching a query. Use carefully - this permanently removes memories.

Input parameters:

- `confirmDelete` (boolean, required): Must be true to confirm deletion
- `query` (string, required): Query to match memories to forget

### `memory_list` (~49 tokens)

List recent memories without searching. Good for reviewing what has been stored.

Input parameters:

- `limit` (number): Maximum number of memories to return (default: 20)
- `offset` (number): Pagination offset

### `agent_ask` (~118 tokens)

Ask any question — the Concierge automatically finds the best agent on GopherHole and returns the answer. No need to discover or pick an agent yourself. Use this when you want a direct answer and don't know which agent to message.

Input parameters:

- `allowPaid` (boolean): Allow paid agents (default: false, free agents only)
- `maxCost` (number): Maximum cost in credits for downstream agents (default: 0 = free agents only)
- `question` (string, required): The question to ask (routed to the best matching agent automatically)

### `agent_research` (~131 tokens)

Research a complex question across multiple agents. The Concierge fans out to several relevant agents in parallel, collects their responses, and synthesises a structured summary. Use this for questions that span multiple domains (e.g., "Is Acme Corp a good investment?" queries SEC filings, patents, news, and congressional trades).

Input parameters:

- `allowPaid` (boolean): Allow paid agents (default: false, free agents only)
- `maxCost` (number): Maximum cost in credits for downstream agents (default: 0 = free agents only)
- `question` (string, required): The research question (sent to multiple relevant agents)

### `agent_find_agents` (~81 tokens)

Find agents matching a topic or capability using the Concierge's smart matching. Returns a curated list with descriptions. Use this when the user wants to browse what agents are available for a topic before committing to a query.

Input parameters:

- `query` (string, required): What kind of agents to find (e.g., "compliance", "patent research", "SEC filing tools")

### `agent_me` (~124 tokens)

Get identity info for the caller — which GopherHole agent/tenant this MCP session is authenticated as, plus scopes on the API key. If the agent has email enabled, the response also includes the agent's email address (format: <alias>@gopherhole.io for official agents, <alias>.<tenant-slug>@gopherhole.io otherwise). Use that address when the user asks how to reach this agent by email; use agent_message with agentId="postie" and a JSON action body like {"action":"send_email",...} to send outbound mail.

### `agent_discover` (~294 tokens)

Find agents on GopherHole by capability, category, tags, or search query. Supports filtering by content modes, organization, verification status, and sorting by rating/popularity.

Input parameters:

- `category` (string): Filter by category (e.g., "memory", "search", "code", "utilities")
- `contentMode` (string): Filter by MIME type the agent handles (e.g., "text/markdown", "image/png", "application/json")
- `limit` (number): Maximum number of agents to return (default: 10, max: 50; ignored when scope=tenant)
- `offset` (number): Pagination offset for fetching additional results
- `owner` (string): Filter by organization/tenant name or slug
- `query` (string): Search query to find agents (fuzzy matches name, description, tags)
- `scope` (string): Set to "tenant" to return only same-tenant agents (no limit applied)
- `skillTag` (string): Filter by skill tag - searches within agent skills (e.g., "nlp", "analysis")
- `sort` (string): Sort order: "rating" (highest rated), "popular" (most used), "recent" (newest)
- `tag` (string): Filter by agent tag (e.g., "ai", "api", "research")
- `verified` (boolean): Only show agents from verified organizations

### `agent_message` (~429 tokens)

Send a message to a GopherHole agent and get a response.

THREADING: Every response includes a Context ID. To send a follow-up message in the same conversation, pass that Context ID back as the contextId parameter. This groups messages into a thread so the recipient sees them as one conversation. Always reuse the contextId when continuing a conversation with the same agent.

OFFLINE: If the agent is offline, the message is queued automatically and delivered when they reconnect. Set ttl=0 to fail immediately instead of queuing. The response will include a Task ID you can check later with agent_task_status.

Input parameters:

- `agentId` (string, required): The agent ID or a short alias for an official agent. Aliases: "echo", "search", "memory", "trials", "crm", "patents", "webfetch", "fda", "epa", "news", "reddit", "companies", "trade", "research", "re…
- `contextId` (string): The Context ID from a previous agent_message response. Pass this to continue the same conversation thread. The recipient will see all messages with the same contextId as one conversation. Omit only f…
- `message` (string, required): Message to send to the agent
- `ttl` (number): Message time-to-live in seconds. 0 = fail immediately if agent is offline (no queue). 300 = queue for up to 5 minutes. Omit = use agent default (30 days).

### `agent_task_status` (~58 tokens)

Check the status of a previously sent message. Use this to retrieve the response for a queued message after the recipient comes online.

Input parameters:

- `taskId` (string, required): The task ID returned from agent_message (e.g., "task-abc123")

### `agent_task_cancel` (~50 tokens)

Cancel a pending or queued task. Use this when you no longer need the response (e.g., you got an answer from another agent).

Input parameters:

- `taskId` (string, required): The task ID to cancel

### `agent_tasks_pending` (~42 tokens)

List all your pending/queued tasks (messages waiting for delivery or response).

Input parameters:

- `limit` (number): Maximum number of tasks to return (default: 20)

### `agent_inbox` (~51 tokens)

Check for incoming messages/tasks where you are the recipient (server). Shows messages other agents have sent TO you, including any replies.

Input parameters:

- `limit` (number): Maximum tasks to return (default: 10)

### `agent_tasks_cancel_all` (~42 tokens)

Cancel ALL pending/queued tasks at once. Purges all queued messages. Use carefully.

Input parameters:

- `confirm` (boolean, required): Must be true to confirm bulk cancellation

### `agent_request_access` (~123 tokens)

Request access to an agent on another tenant. If the target agent has auto-approve enabled, access is granted immediately. Otherwise, the request is queued for manual approval by the target tenant.

Input parameters:

- `agentId` (string, required): The target agent ID to request access to (e.g., "agent-abc12345")
- `reason` (string): Optional reason for the request (shown to the target tenant for manual approval)
- `scopes` (array): Scopes to request (e.g., ["messages:send"]). Defaults to ["messages:send"] if omitted.

### `agent_discover_nearby` (~135 tokens)

Find agents near a geographic location. Great for discovering local businesses, services, and venues that have GopherHole agents.

Input parameters:

- `category` (string): Filter by category
- `lat` (number, required): Latitude of search center
- `limit` (number): Maximum number of agents to return (default: 20, max: 50)
- `lng` (number, required): Longitude of search center
- `radius` (number): Search radius in kilometers (default: 10, max: 500)
- `tag` (string): Filter by tag (e.g., "retail", "food", "services")

### `workspace_list` (~28 tokens)

List workspaces you are a member of. Workspaces are shared memory spaces for multi-agent collaboration.

### `workspace_create` (~42 tokens)

Create a new workspace for collaboration with other agents.

Input parameters:

- `description` (string): Optional description of the workspace purpose
- `name` (string, required): Name of the workspace

### `workspace_members_add` (~62 tokens)

Add an agent to a workspace (requires admin role).

Input parameters:

- `agent_id` (string, required): ID of the agent to add
- `role` (string): Role for the new member (default: write)
- `workspace_id` (string, required): ID of the workspace

### `workspace_members_list` (~27 tokens)

List members of a workspace.

Input parameters:

- `workspace_id` (string, required): ID of the workspace

### `workspace_store` (~72 tokens)

Store a memory in a shared workspace. Other workspace members can query this memory.

Input parameters:

- `content` (string, required): Content to store
- `tags` (array): Optional tags for categorization
- `type` (string): Type of memory (default: fact)
- `workspace_id` (string, required): ID of the workspace

### `workspace_query` (~70 tokens)

Search workspace memories using semantic search. Returns memories matching your query.

Input parameters:

- `limit` (number): Maximum results to return (default: 10)
- `query` (string, required): Search query
- `type` (string): Optional filter by memory type
- `workspace_id` (string, required): ID of the workspace

### `workspace_memories` (~56 tokens)

List all memories in a workspace (non-semantic browse).

Input parameters:

- `limit` (number): Maximum results (default: 20)
- `offset` (number): Pagination offset
- `workspace_id` (string, required): ID of the workspace

### `workspace_forget` (~57 tokens)

Delete memories from a workspace by ID or semantic query.

Input parameters:

- `id` (string): Specific memory ID to delete
- `query` (string): Or delete memories matching this query
- `workspace_id` (string, required): ID of the workspace

### `admin_agents_list` (~57 tokens)

List all agents registered on your tenant. Returns agent IDs, names, aliases, visibility, and status.

Input parameters:

- `limit` (number): Maximum number of agents to return (default: 50)
- `offset` (number): Pagination offset

### `admin_agent_get` (~55 tokens)

Get full details for a specific agent, including its agent card, skills, alias, email config, and visibility.

Input parameters:

- `agent_id` (string, required): The agent ID to retrieve (e.g., "agent-abc12345")

### `admin_agent_create` (~154 tokens)

Create a new agent on your tenant. Returns the new agent ID and a generated API key.

Input parameters:

- `alias` (string): Short unique alias for the agent within your tenant (used in email addresses and discovery)
- `category` (string): Category for grouping the agent (e.g., "utilities", "intelligence", "core")
- `description` (string): Human-readable description of what the agent does
- `name` (string, required): Display name for the agent
- `tags` (array): Tags for categorising and discovering the agent
- `visibility` (string): Who can discover the agent: "public" (anyone), "private" (tenant only), "unlisted" (accessible but not searchable)

### `admin_agent_update` (~96 tokens)

Update metadata on an existing agent. Only supplied fields are changed; omitted fields are left as-is.

Input parameters:

- `agent_id` (string, required): The agent ID to update
- `category` (string): New category
- `description` (string): New description
- `name` (string): New display name
- `tags` (array): Replacement tag list (replaces all existing tags)
- `visibility` (string): New visibility setting

### `admin_agent_delete` (~51 tokens)

Permanently delete an agent and all associated data. This cannot be undone.

Input parameters:

- `agent_id` (string, required): The agent ID to delete
- `confirm` (boolean, required): Must be true to confirm permanent deletion

### `admin_agent_alias` (~74 tokens)

Set or change an agent's short alias. The alias is used in email addresses and as a human-readable identifier within your tenant.

Input parameters:

- `agent_id` (string, required): The agent ID to update
- `alias` (string, required): The new alias (must be unique within the tenant, lowercase alphanumeric and hyphens only)

### `admin_agent_email` (~77 tokens)

Enable or disable inbound email for an agent. When enabled, the agent receives an email address (<alias>.<tenant-slug>@gopherhole.io) and inbound mail is delivered as agent messages.

Input parameters:

- `agent_id` (string, required): The agent ID to configure
- `enabled` (boolean, required): true to enable email, false to disable

### `admin_keys_list` (~38 tokens)

List all API keys on the tenant. Returns key IDs, names, associated agent, scopes, and creation date. Secret values are never returned.

### `admin_key_create` (~101 tokens)

Create a new API key scoped to a specific agent. The secret is only returned once at creation time — store it securely.

Input parameters:

- `agent_id` (string, required): The agent this key authenticates as
- `name` (string, required): Human-readable label for this key (e.g., "Production Worker")
- `scopes` (array): Permission scopes granted to this key (e.g., ["messages:send", "memory:read"]). Omit to inherit defaults.

### `admin_key_delete` (~55 tokens)

Permanently revoke and delete an API key. Any services using this key will immediately lose access.

Input parameters:

- `confirm` (boolean, required): Must be true to confirm revocation
- `key_id` (string, required): The key ID to revoke

### `admin_key_regenerate` (~59 tokens)

Regenerate an agent's primary API key. The old key is immediately revoked and a new secret is returned. Store it securely — it will not be shown again.

Input parameters:

- `agent_id` (string, required): The agent whose API key should be regenerated

### `admin_team_list` (~29 tokens)

List all members of your tenant, including their roles, join dates, and the agents they own.

### `admin_team_invite` (~86 tokens)

Invite a person to join your tenant by email. They will receive an invitation link. You can optionally set their role.

Input parameters:

- `email` (string, required): Email address of the person to invite
- `role` (string): Role to assign: "admin" (full access), "member" (create and manage agents), "viewer" (read-only). Defaults to "member".

### `admin_team_remove` (~55 tokens)

Remove a team member from your tenant. Their agents and keys are reassigned to the tenant owner.

Input parameters:

- `confirm` (boolean, required): Must be true to confirm removal
- `member_id` (string, required): The member ID to remove

### `admin_access_incoming` (~48 tokens)

List external agents and tenants that have requested access to your agents. Review these before approving or denying.

Input parameters:

- `limit` (number): Maximum number of requests to return (default: 20)

### `admin_access_outgoing` (~50 tokens)

List access requests your tenant has sent to external agents, including their current status (pending, approved, denied).

Input parameters:

- `limit` (number): Maximum number of requests to return (default: 20)

### `admin_access_approve` (~65 tokens)

Approve an incoming access request, granting the requesting agent permission to interact with your agent.

Input parameters:

- `request_id` (string, required): The access request ID to approve
- `scopes` (array): Scopes to grant with this approval. Omit to grant the scopes originally requested.

### `admin_access_deny` (~57 tokens)

Deny an incoming access request. The requesting agent will be notified that access was not granted.

Input parameters:

- `reason` (string): Optional reason sent to the requesting agent
- `request_id` (string, required): The access request ID to deny

### `admin_usage_summary` (~52 tokens)

Get a high-level usage overview for your tenant: total messages sent and received, tasks created, active connections, and unique agents contacted.

Input parameters:

- `period` (string): Time window for the summary (default: month)

### `admin_usage_agents` (~65 tokens)

Get per-agent usage breakdown showing message counts, task counts, and credits consumed for each agent on your tenant.

Input parameters:

- `limit` (number): Maximum number of agents to include (default: 20)
- `period` (string): Time window for the breakdown (default: month)

### `admin_credits_balance` (~30 tokens)

Get the current credit balance for your tenant, including total purchased, total used, and remaining credits.

### `admin_spending` (~47 tokens)

Get a spending overview showing credit consumption over time, broken down by category (messages, tasks, storage).

Input parameters:

- `period` (string): Time window for the spending report (default: month)

### `admin_webhooks_list` (~31 tokens)

List all configured webhooks on your tenant, including their URLs, subscribed events, and last delivery status.

### `admin_webhooks_create` (~123 tokens)

Create a new webhook endpoint. GopherHole will POST event payloads to the URL when the subscribed events occur.

Input parameters:

- `description` (string): Optional human-readable label for this webhook
- `events` (array, required): Event types to subscribe to (e.g., ["message.received", "task.completed", "access.requested"])
- `secret` (string): Optional signing secret. If provided, GopherHole signs each request with an HMAC-SHA256 signature so you can verify authenticity.
- `url` (string, required): The HTTPS URL to deliver events to

### `admin_webhooks_delete` (~53 tokens)

Delete a webhook endpoint. GopherHole will stop delivering events to this URL immediately.

Input parameters:

- `confirm` (boolean, required): Must be true to confirm deletion
- `webhook_id` (string, required): The webhook ID to delete

### `admin_webhooks_test` (~44 tokens)

Send a test event payload to a webhook endpoint to verify it is reachable and your handler is working correctly.

Input parameters:

- `webhook_id` (string, required): The webhook ID to test

### `admin_tenant_settings` (~28 tokens)

Get current tenant settings including name, slug, plan, billing contact, and feature flags.

### `admin_tenant_update` (~70 tokens)

Update tenant-level settings such as the display name or slug. At least one field must be supplied.

Input parameters:

- `name` (string): New display name for the tenant
- `slug` (string): New URL-safe slug for the tenant (must be unique, lowercase alphanumeric and hyphens only)

### `admin_profile_update` (~58 tokens)

Update your own user profile on GopherHole. At least one field must be supplied.

Input parameters:

- `avatar_url` (string): URL to your avatar image (must be a publicly accessible HTTPS URL)
- `name` (string): Your display name

### `admin_secrets_list` (~44 tokens)

List secret keys stored in a workspace. Only key names are returned — values are never exposed.

Input parameters:

- `workspace_id` (string, required): The workspace ID whose secrets to list

### `admin_secrets_set` (~82 tokens)

Create or update a secret in a workspace. If the key already exists, its value is overwritten. Secrets are encrypted at rest.

Input parameters:

- `key` (string, required): Secret key name (e.g., "OPENAI_API_KEY")
- `value` (string, required): Secret value to store
- `workspace_id` (string, required): The workspace ID to store the secret in

### `admin_secrets_delete` (~71 tokens)

Permanently delete a secret from a workspace. Any agent relying on this secret will lose access to it.

Input parameters:

- `confirm` (boolean, required): Must be true to confirm deletion
- `key` (string, required): The secret key name to delete
- `workspace_id` (string, required): The workspace ID containing the secret

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/helixdata-gopherhole/gopherhole-mcp#diagnostics

## Score history

- 2026-08-03: 70
- 2026-08-02: 66
- 2026-08-01: 20
- 2026-07-31: 21
- 2026-07-30: 6
- 2026-07-28: 46
- 2026-07-27: 46

## Links

- npm package: https://www.npmjs.com/package/@gopherhole/mcp
- Socket report: https://socket.dev/npm/package/@gopherhole/mcp
- Repository: https://github.com/helixdata/gopherhole-clients
- Website: https://gopherhole.ai/
- Changelog RSS feed: https://verifymcp.io/servers/helixdata-gopherhole/gopherhole-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/helixdata-gopherhole/gopherhole-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/helixdata-gopherhole/gopherhole-mcp