io.github.hermitsh-ai/shrimp
NPM · @HERMITSH/SHRIMP-MCP · SCANNED SEP 20
Task manager for AI agents. Zero setup, nested trees, batch ops, local-first storage.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 96 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency6
- Repository check failed: the declared repository URL returned HTTP 404. See how to fix → View diagnostics → Fail
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- License check failed: the license (UNLICENSED) isn't a recognized OSI-approved license. See how to fix → Fail
- Actively maintained (last published 165 days ago).Pass
- Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability75
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2832 tokens (~149/item across 19 items; 19 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management90
- Stability observed for 27 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 19 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the io.github.hermitsh-ai/shrimp MCP server?
io.github.hermitsh-ai/shrimp runs locally as an npm package, launched with npx -y @hermitsh/shrimp-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @hermitsh/shrimp-mcp
claude mcp add hermitsh-ai-shrimp -- npx -y @hermitsh/shrimp-mcp
{
"mcpServers": {
"hermitsh-ai-shrimp": {
"command": "npx",
"args": [
"-y",
"@hermitsh/shrimp-mcp"
]
}
}
} {
"servers": {
"hermitsh-ai-shrimp": {
"command": "npx",
"args": [
"-y",
"@hermitsh/shrimp-mcp"
]
}
}
} codex mcp add hermitsh-ai-shrimp -- npx -y @hermitsh/shrimp-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"hermitsh-ai-shrimp": {
"type": "local",
"command": [
"npx",
"-y",
"@hermitsh/shrimp-mcp"
],
"enabled": true
}
}
} openclaw mcp add hermitsh-ai-shrimp --command npx --arg -y --arg @hermitsh/shrimp-mcp
mcp_servers:
hermitsh-ai-shrimp:
command: "npx"
args: ["-y", "@hermitsh/shrimp-mcp"] {
"McpServers": {
"hermitsh-ai-shrimp": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@hermitsh/shrimp-mcp"
]
}
}
} assistant mcp add hermitsh-ai-shrimp -t stdio -c npx -a -y @hermitsh/shrimp-mcp
{
"mcpServers": {
"hermitsh-ai-shrimp": {
"command": "npx",
"args": [
"-y",
"@hermitsh/shrimp-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
- 18 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 17 Sept 26 −3
- Stability: pass → 0.80 functional
- 16 Sept 26 0
- Stability: 0.97 → pass security
- 15 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
- 11 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 10 Sept 26 −3
- Stability: pass → 0.80 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/@hermitsh/shrimp-mcp@1.0.7
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 96 packages
| Packages resolved | 96 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
shrimp_add_task Create Task ~320
Create a new task in SHrimp. You can nest tasks at any depth by specifying a parentID. Use insertBefore to control ordering among siblings. Args: - title (string, required): Task title. - notes (string, optional): Additional notes or details. - parentID (string, optional): UUID of parent task. Omit for a root-level task. - dueDate (string, optional): ISO 8601 date (e.g. "2026-04-15"). - category (string, optional): One of home, work, errands, health, people, money, travel, projects. - insertBefore (string, optional): UUID of sibling task to insert before. Returns: { ok: true, opID: string, version: number } Tips: - Use shrimp_batch for creating multiple tasks at once (up to 50 ops). - UUIDs must be hex-only (0-9, a-f). Non-hex characters will be rejected.
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | Category: home, work, errands, health, people, money, travel, projects |
| dueDate | string | – | ISO 8601 date string (e.g. 2026-04-15) |
| insertBefore | string | – | UUID of sibling task to insert before |
| notes | string | – | Additional notes or details |
| parentID | string | – | UUID of parent task (omit for root-level task) |
| title | string | yes | Task title |
No output schema declared.
No examples provided.
shrimp_archive_task Archive Task ~87
Archive a task and all its children. Archived tasks are hidden from the main view but not deleted. Use shrimp_restore_task to bring them back. Args: - taskID (string, required): UUID of the task to archive. Returns: { ok: true, opID: string, version: number }
| Name | Type | Req | Description |
|---|---|---|---|
| taskID | string | yes | UUID of the task to archive |
No output schema declared.
No examples provided.
shrimp_batch Batch Operations ~270
Execute multiple task operations in a single request. Much more efficient than individual calls when making several changes at once. Max 50 ops per batch. All ops are validated upfront before any are applied — if one has an invalid UUID, the entire batch is rejected. Each op must have a "type" field. Required fields depend on the type: - create: title (required), notes, parentID, dueDate, category, insertBefore - update: taskID (required), title, notes, dueDate, category - complete: taskID (required) - archive: taskID (required) - restore: taskID (required) - move: taskID (required), parentID, insertBefore - delete: taskID (required) Args: - ops (array): Array of operation objects (max 50). Returns: { ok: true, opIDs: string[], version: number } Tips: - Use this to build entire project plans in one call. - Create ops are processed in order, so you can create a parent then nest children under it in the same batch. - All UUIDs must be hex-only (0-9, a-f).
| Name | Type | Req | Description |
|---|---|---|---|
| ops | array | yes | Array of operations to execute |
No output schema declared.
No examples provided.
shrimp_complete_task Toggle Task Completion ~80
Toggle a task's completion status. If incomplete, marks it done. If already done, marks it incomplete. Args: - taskID (string, required): UUID of the task. Returns: { ok: true, opID: string, version: number }
| Name | Type | Req | Description |
|---|---|---|---|
| taskID | string | yes | UUID of the task to complete/uncomplete |
No output schema declared.
No examples provided.
shrimp_delete_task Delete Task ~88
Permanently delete a task and all its children. This cannot be undone. Prefer shrimp_archive_task if you're unsure — archived tasks can always be restored. Args: - taskID (string, required): UUID of the task to delete. Returns: { ok: true, opID: string, version: number }
| Name | Type | Req | Description |
|---|---|---|---|
| taskID | string | yes | UUID of the task to delete |
No output schema declared.
No examples provided.
shrimp_feedback Send Feedback ~55
Send feedback to the SHrimp developer on behalf of the user. Works in both local and paired mode. Rate limit: 5 feedback messages per hour.
| Name | Type | Req | Description |
|---|---|---|---|
| message | string | yes | Feedback message (max 2000 chars) |
No output schema declared.
No examples provided.
shrimp_get_prompt Read Prompt Sections ~150
Read the current prompt sections that control the in-app AI behavior. SHrimp's AI system prompt is modular — split into 6 editable sections that shape how the AI processes user requests. Sections: - intro: Identity and role definition - rules: Behavioral rules and constraints - thoroughness: How thorough/detailed the AI should be - categories: Life categories for task organization (home, work, errands, health, people, money, travel, projects) - schema: The JSON response schema the AI must follow - terminal: Additional instructions for the terminal/chat interface Requires the SHrimp iOS app (paired mode). Not available in local mode.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
shrimp_get_provider Read AI Provider/Model ~36
Read the current AI provider and model configuration. Requires the SHrimp iOS app (paired mode). Not available in local mode.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
shrimp_get_tasks Get Task Tree ~313
Read the user's task tree from SHrimp. Returns all tasks as a nested hierarchy. Each task has: id, title, notes, dueDate, category, isCompleted, isArchived, and children[]. Filters (all optional): - category: one of home, work, errands, health, people, money, travel, projects - completed: "true" or "false" — filter by completion status - archived: "true" or "false" — default is active only (false) - subtree: a task ID — returns only that task and its descendants - flat: "true" — returns a flat array with parentID instead of nesting The response includes a version number. Cache this to detect changes efficiently. Returns: { version: number, updatedAt: string, tasks: TaskItem[] } TaskItem shape: { id: string, title: string, notes?: string, dueDate?: string, category?: string, isCompleted: boolean, isArchived: boolean, children: TaskItem[] }
| Name | Type | Req | Description |
|---|---|---|---|
| archived | string | – | Filter by archive status (default: active only) |
| category | string | – | Filter by category: home, work, errands, health, people, money, travel, projects |
| completed | string | – | Filter by completion status |
| flat | string | – | Return flat list with parentID instead of nested tree |
| subtree | string | – | Task ID — return only this task and its descendants |
No output schema declared.
No examples provided.
shrimp_inbox Read Inbox ~103
Read the SHrimp terminal inbox. Requires the SHrimp iOS app (paired mode). Not available in local mode. Item sources: email, shareExtension, siri, github, clipboard, composer Item statuses: pending, processing, processed, failed
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | Max items to return (default 50, max 100) |
| source | string | – | Filter by item source |
| status | string | – | Filter by item status |
No output schema declared.
No examples provided.
shrimp_move_task Move Task ~187
Move a task to a different position in the tree. Can reparent under a new task or reorder among siblings. Args: - taskID (string, required): UUID of the task to move. - parentID (string, optional): UUID of new parent. Omit or null to move to root level. - insertBefore (string, optional): UUID of sibling to insert before. Omit to append at end. Returns: { ok: true, opID: string, version: number } Tips: - Moving a task also moves all its children. - You cannot move a task under itself (circular reference).
| Name | Type | Req | Description |
|---|---|---|---|
| insertBefore | string | – | UUID of sibling to insert before |
| parentID | string | – | UUID of new parent (omit to move to root) |
| taskID | string | yes | UUID of the task to move |
No output schema declared.
No examples provided.
shrimp_pair Pair with SHrimp ~262
Connect this agent to a SHrimp account using a 6-digit pairing code. The user must open the SHrimp app on their phone → Settings → Agents → Pair New Agent to generate a code. The code expires after 5 minutes. After pairing, this agent switches from local mode to cloud mode — tasks sync to the phone in real-time. Any tasks created in local mode remain in ~/.shrimp/tasks.json but are not automatically migrated. Args: - code (string): The 6-digit numeric code from the SHrimp app. - agentName (string): Display name for this agent in the app (default: "Claude"). Returns on success: { paired: true, email: string, agentName: string, scopes: string[], configPath: string } Returns on failure: { paired: false, error: string } Common errors: - "Invalid code" → code is not exactly 6 digits - "Pairing failed" → code expired or wrong. User must generate a new one.
| Name | Type | Req | Description |
|---|---|---|---|
| agentName | string | – | Display name for this agent connection (shown in the SHrimp app) |
| code | string | yes | The 6-digit pairing code from the SHrimp app |
No output schema declared.
No examples provided.
shrimp_pipeline Read Pipeline Log ~87
Read the processing pipeline log from the user's phone. Requires the SHrimp iOS app (paired mode). Not available in local mode. Pipeline stages: push, fetch, attach, batch, ai, inbox, share, file, retry
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | Max entries to return (default 50, max 200) |
| stage | string | – | Filter by pipeline stage |
No output schema declared.
No examples provided.
shrimp_restore_task Restore Archived Task ~68
Restore an archived task back to the active list. Args: - taskID (string, required): UUID of the task to restore. Returns: { ok: true, opID: string, version: number }
| Name | Type | Req | Description |
|---|---|---|---|
| taskID | string | yes | UUID of the task to restore |
No output schema declared.
No examples provided.
shrimp_search Search Tasks ~156
Search tasks by keyword. Matches against titles and notes (case-insensitive substring match). Returns matching tasks with their full breadcrumb path so you know where they sit in the tree. Args: - q (string): Search query. - limit (number): Max results, 1–50 (default: 20). Returns: { results: SearchResult[], total: number } SearchResult shape: { id: string, title: string, notes?: string, isCompleted: boolean, path: string[], matchField: "title" | "notes" }
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Max results (default 20, max 50) |
| q | string | yes | Search query (case-insensitive substring match) |
No output schema declared.
No examples provided.
shrimp_status Check SHrimp Connection ~102
Check the current SHrimp connection mode. Takes no arguments. Returns one of: { mode: "paired", email: string, agentName: string, scopes: string[] } or { mode: "local", tasksPath: string, hint: string } In local mode, tasks are stored on this machine in ~/.shrimp/tasks.json. All task tools work — just without phone sync. Call shrimp_pair to upgrade to cloud mode.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
shrimp_update_prompt Update Prompt Sections ~147
Update one or more prompt sections that control the in-app AI behavior. Partial updates are supported — only include the sections you want to change. Sections: intro, rules, thoroughness, categories, schema, terminal Requires the SHrimp iOS app (paired mode). Not available in local mode.
| Name | Type | Req | Description |
|---|---|---|---|
| categories | string | – | Life categories for task organization |
| intro | string | – | AI identity and role definition |
| rules | string | – | Behavioral rules and constraints |
| schema | string | – | JSON response schema the AI must follow |
| terminal | string | – | Additional terminal/chat interface instructions |
| thoroughness | string | – | How thorough/detailed the AI should be |
No output schema declared.
No examples provided.
shrimp_update_provider Update AI Provider/Model ~105
Change the AI provider and/or model used by SHrimp. Requires the SHrimp iOS app (paired mode). Not available in local mode.
| Name | Type | Req | Description |
|---|---|---|---|
| modelID | string | – | Model identifier (e.g. "claude-sonnet-4-20250514", "gpt-4o") |
| type | string | – | AI provider type |
| useOpenAIOAuth | boolean | – | Use ChatGPT OAuth instead of API key (OpenAI only) |
No output schema declared.
No examples provided.
shrimp_update_task Update Task ~216
Update an existing task's properties. Only include the fields you want to change — omitted fields are left unchanged. Args: - taskID (string, required): UUID of the task to update. - title (string, optional): New title. - notes (string, optional): New notes (replaces existing notes entirely). - dueDate (string, optional): New due date (ISO 8601). - category (string, optional): New category (home, work, errands, health, people, money, travel, projects). Returns: { ok: true, opID: string, version: number }
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | New category: home, work, errands, health, people, money, travel, projects |
| dueDate | string | – | New due date (ISO 8601) |
| notes | string | – | New notes (replaces existing) |
| taskID | string | yes | UUID of the task to update |
| title | string | – | New title |
No output schema declared.
No examples provided.
What is the io.github.hermitsh-ai/shrimp MCP server?
io.github.hermitsh-ai/shrimp is an MCP server listed in the public MCP registry as io.github.hermitsh-ai/shrimp. Task manager for AI agents. Zero setup, nested trees, batch ops, local-first storage. This page covers its npm package (@hermitsh/shrimp-mcp).
Is the io.github.hermitsh-ai/shrimp MCP server safe to use?
io.github.hermitsh-ai/shrimp scores 75 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.hermitsh-ai/shrimp MCP server expose?
io.github.hermitsh-ai/shrimp exposes 19 tools: shrimp_pair, shrimp_status, shrimp_get_tasks, shrimp_search, shrimp_add_task, and 14 more. Their descriptions and schemas cost roughly 2,832 tokens of context every time the server is loaded.
Is the io.github.hermitsh-ai/shrimp MCP server still maintained?
io.github.hermitsh-ai/shrimp is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.hermitsh-ai/shrimp MCP server under?
io.github.hermitsh-ai/shrimp declares the UNLICENSED licence, which is not on the OSI-approved list. Read the terms before using it at work, and note this covers the source only, not the cost of any service it calls.