Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

io.github.hermitsh-ai/shrimp

NPM · @HERMITSH/SHRIMP-MCP · SCANNED SEP 20

Task manager for AI agents. Zero setup, nested trees, batch ops, local-first storage.

0 this week 75 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security98
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • 31 of 96 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency6
Schema Quality & AI Usability75
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 2832 tokens (~149/item across 19 items; 19 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management90
  • Stability observed for 27 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 19 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

How do I install the io.github.hermitsh-ai/shrimp MCP server?

io.github.hermitsh-ai/shrimp runs locally as an npm package, launched with npx -y @hermitsh/shrimp-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · @hermitsh/shrimp-mcp

# add to Claude Code
claude mcp add hermitsh-ai-shrimp -- npx -y @hermitsh/shrimp-mcp
// .cursor/mcp.json
{
  "mcpServers": {
    "hermitsh-ai-shrimp": {
      "command": "npx",
      "args": [
        "-y",
        "@hermitsh/shrimp-mcp"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "hermitsh-ai-shrimp": {
      "command": "npx",
      "args": [
        "-y",
        "@hermitsh/shrimp-mcp"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add hermitsh-ai-shrimp -- npx -y @hermitsh/shrimp-mcp
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "hermitsh-ai-shrimp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@hermitsh/shrimp-mcp"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add hermitsh-ai-shrimp --command npx --arg -y --arg @hermitsh/shrimp-mcp
# ~/.hermes/config.yaml
mcp_servers:
  hermitsh-ai-shrimp:
    command: "npx"
    args: ["-y", "@hermitsh/shrimp-mcp"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "hermitsh-ai-shrimp": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "@hermitsh/shrimp-mcp"
      ]
    }
  }
}
# add to Vellum
assistant mcp add hermitsh-ai-shrimp -t stdio -c npx -a -y @hermitsh/shrimp-mcp
// mcp.json
{
  "mcpServers": {
    "hermitsh-ai-shrimp": {
      "command": "npx",
      "args": [
        "-y",
        "@hermitsh/shrimp-mcp"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 20 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.

  • 18 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.

  • 17 Sept 26 −3
    • Stability: pass → 0.80 functional
  • 16 Sept 26 0
    • Stability: 0.97 → pass security
  • 15 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.

  • 13 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.

  • 11 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.

  • 10 Sept 26 −3
    • Stability: pass → 0.80 functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Sept 2026 · Analysed npm/@hermitsh/shrimp-mcp@1.0.7

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Dependencies 96 packages
Packages resolved 96
Stale 31
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 19 exposed · ~2,832 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
shrimp_add_task ~320

Create a new task in SHrimp. You can nest tasks at any depth by specifying a parentID. Use insertBefore to control ordering among siblings. Args: - title (string, required): Task title. - notes (string, optional): Additional notes or details. - parentID (string, optional): UUID of parent task. Omit for a root-level task. - dueDate (string, optional): ISO 8601 date (e.g. "2026-04-15"). - category (string, optional): One of home, work, errands, health, people, money, travel, projects. - insertBefore (string, optional): UUID of sibling task to insert before. Returns: { ok: true, opID: string, version: number } Tips: - Use shrimp_batch for creating multiple tasks at once (up to 50 ops). - UUIDs must be hex-only (0-9, a-f). Non-hex characters will be rejected.

NameTypeReqDescription
categorystringCategory: home, work, errands, health, people, money, travel, projects
dueDatestringISO 8601 date string (e.g. 2026-04-15)
insertBeforestringUUID of sibling task to insert before
notesstringAdditional notes or details
parentIDstringUUID of parent task (omit for root-level task)
titlestringyesTask title

No output schema declared.

No examples provided.

shrimp_archive_task ~87

Archive a task and all its children. Archived tasks are hidden from the main view but not deleted. Use shrimp_restore_task to bring them back. Args: - taskID (string, required): UUID of the task to archive. Returns: { ok: true, opID: string, version: number }

NameTypeReqDescription
taskIDstringyesUUID of the task to archive

No output schema declared.

No examples provided.

shrimp_batch ~270

Execute multiple task operations in a single request. Much more efficient than individual calls when making several changes at once. Max 50 ops per batch. All ops are validated upfront before any are applied — if one has an invalid UUID, the entire batch is rejected. Each op must have a "type" field. Required fields depend on the type: - create: title (required), notes, parentID, dueDate, category, insertBefore - update: taskID (required), title, notes, dueDate, category - complete: taskID (required) - archive: taskID (required) - restore: taskID (required) - move: taskID (required), parentID, insertBefore - delete: taskID (required) Args: - ops (array): Array of operation objects (max 50). Returns: { ok: true, opIDs: string[], version: number } Tips: - Use this to build entire project plans in one call. - Create ops are processed in order, so you can create a parent then nest children under it in the same batch. - All UUIDs must be hex-only (0-9, a-f).

NameTypeReqDescription
opsarrayyesArray of operations to execute

No output schema declared.

No examples provided.

shrimp_complete_task ~80

Toggle a task's completion status. If incomplete, marks it done. If already done, marks it incomplete. Args: - taskID (string, required): UUID of the task. Returns: { ok: true, opID: string, version: number }

NameTypeReqDescription
taskIDstringyesUUID of the task to complete/uncomplete

No output schema declared.

No examples provided.

shrimp_delete_task ~88

Permanently delete a task and all its children. This cannot be undone. Prefer shrimp_archive_task if you're unsure — archived tasks can always be restored. Args: - taskID (string, required): UUID of the task to delete. Returns: { ok: true, opID: string, version: number }

NameTypeReqDescription
taskIDstringyesUUID of the task to delete

No output schema declared.

No examples provided.

shrimp_feedback ~55

Send feedback to the SHrimp developer on behalf of the user. Works in both local and paired mode. Rate limit: 5 feedback messages per hour.

NameTypeReqDescription
messagestringyesFeedback message (max 2000 chars)

No output schema declared.

No examples provided.

shrimp_get_prompt ~150

Read the current prompt sections that control the in-app AI behavior. SHrimp's AI system prompt is modular — split into 6 editable sections that shape how the AI processes user requests. Sections: - intro: Identity and role definition - rules: Behavioral rules and constraints - thoroughness: How thorough/detailed the AI should be - categories: Life categories for task organization (home, work, errands, health, people, money, travel, projects) - schema: The JSON response schema the AI must follow - terminal: Additional instructions for the terminal/chat interface Requires the SHrimp iOS app (paired mode). Not available in local mode.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

shrimp_get_provider ~36

Read the current AI provider and model configuration. Requires the SHrimp iOS app (paired mode). Not available in local mode.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

shrimp_get_tasks ~313

Read the user's task tree from SHrimp. Returns all tasks as a nested hierarchy. Each task has: id, title, notes, dueDate, category, isCompleted, isArchived, and children[]. Filters (all optional): - category: one of home, work, errands, health, people, money, travel, projects - completed: "true" or "false" — filter by completion status - archived: "true" or "false" — default is active only (false) - subtree: a task ID — returns only that task and its descendants - flat: "true" — returns a flat array with parentID instead of nesting The response includes a version number. Cache this to detect changes efficiently. Returns: { version: number, updatedAt: string, tasks: TaskItem[] } TaskItem shape: { id: string, title: string, notes?: string, dueDate?: string, category?: string, isCompleted: boolean, isArchived: boolean, children: TaskItem[] }

NameTypeReqDescription
archivedstringFilter by archive status (default: active only)
categorystringFilter by category: home, work, errands, health, people, money, travel, projects
completedstringFilter by completion status
flatstringReturn flat list with parentID instead of nested tree
subtreestringTask ID — return only this task and its descendants

No output schema declared.

No examples provided.

shrimp_inbox ~103

Read the SHrimp terminal inbox. Requires the SHrimp iOS app (paired mode). Not available in local mode. Item sources: email, shareExtension, siri, github, clipboard, composer Item statuses: pending, processing, processed, failed

NameTypeReqDescription
limitnumberMax items to return (default 50, max 100)
sourcestringFilter by item source
statusstringFilter by item status

No output schema declared.

No examples provided.

shrimp_move_task ~187

Move a task to a different position in the tree. Can reparent under a new task or reorder among siblings. Args: - taskID (string, required): UUID of the task to move. - parentID (string, optional): UUID of new parent. Omit or null to move to root level. - insertBefore (string, optional): UUID of sibling to insert before. Omit to append at end. Returns: { ok: true, opID: string, version: number } Tips: - Moving a task also moves all its children. - You cannot move a task under itself (circular reference).

NameTypeReqDescription
insertBeforestringUUID of sibling to insert before
parentIDstringUUID of new parent (omit to move to root)
taskIDstringyesUUID of the task to move

No output schema declared.

No examples provided.

shrimp_pair ~262

Connect this agent to a SHrimp account using a 6-digit pairing code. The user must open the SHrimp app on their phone → Settings → Agents → Pair New Agent to generate a code. The code expires after 5 minutes. After pairing, this agent switches from local mode to cloud mode — tasks sync to the phone in real-time. Any tasks created in local mode remain in ~/.shrimp/tasks.json but are not automatically migrated. Args: - code (string): The 6-digit numeric code from the SHrimp app. - agentName (string): Display name for this agent in the app (default: "Claude"). Returns on success: { paired: true, email: string, agentName: string, scopes: string[], configPath: string } Returns on failure: { paired: false, error: string } Common errors: - "Invalid code" → code is not exactly 6 digits - "Pairing failed" → code expired or wrong. User must generate a new one.

NameTypeReqDescription
agentNamestringDisplay name for this agent connection (shown in the SHrimp app)
codestringyesThe 6-digit pairing code from the SHrimp app

No output schema declared.

No examples provided.

shrimp_pipeline ~87

Read the processing pipeline log from the user's phone. Requires the SHrimp iOS app (paired mode). Not available in local mode. Pipeline stages: push, fetch, attach, batch, ai, inbox, share, file, retry

NameTypeReqDescription
limitnumberMax entries to return (default 50, max 200)
stagestringFilter by pipeline stage

No output schema declared.

No examples provided.

shrimp_restore_task ~68

Restore an archived task back to the active list. Args: - taskID (string, required): UUID of the task to restore. Returns: { ok: true, opID: string, version: number }

NameTypeReqDescription
taskIDstringyesUUID of the task to restore

No output schema declared.

No examples provided.

shrimp_search ~156

Search tasks by keyword. Matches against titles and notes (case-insensitive substring match). Returns matching tasks with their full breadcrumb path so you know where they sit in the tree. Args: - q (string): Search query. - limit (number): Max results, 1–50 (default: 20). Returns: { results: SearchResult[], total: number } SearchResult shape: { id: string, title: string, notes?: string, isCompleted: boolean, path: string[], matchField: "title" | "notes" }

NameTypeReqDescription
limitintegerMax results (default 20, max 50)
qstringyesSearch query (case-insensitive substring match)

No output schema declared.

No examples provided.

shrimp_status ~102

Check the current SHrimp connection mode. Takes no arguments. Returns one of: { mode: "paired", email: string, agentName: string, scopes: string[] } or { mode: "local", tasksPath: string, hint: string } In local mode, tasks are stored on this machine in ~/.shrimp/tasks.json. All task tools work — just without phone sync. Call shrimp_pair to upgrade to cloud mode.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

shrimp_update_prompt ~147

Update one or more prompt sections that control the in-app AI behavior. Partial updates are supported — only include the sections you want to change. Sections: intro, rules, thoroughness, categories, schema, terminal Requires the SHrimp iOS app (paired mode). Not available in local mode.

NameTypeReqDescription
categoriesstringLife categories for task organization
introstringAI identity and role definition
rulesstringBehavioral rules and constraints
schemastringJSON response schema the AI must follow
terminalstringAdditional terminal/chat interface instructions
thoroughnessstringHow thorough/detailed the AI should be

No output schema declared.

No examples provided.

shrimp_update_provider ~105

Change the AI provider and/or model used by SHrimp. Requires the SHrimp iOS app (paired mode). Not available in local mode.

NameTypeReqDescription
modelIDstringModel identifier (e.g. "claude-sonnet-4-20250514", "gpt-4o")
typestringAI provider type
useOpenAIOAuthbooleanUse ChatGPT OAuth instead of API key (OpenAI only)

No output schema declared.

No examples provided.

shrimp_update_task ~216

Update an existing task's properties. Only include the fields you want to change — omitted fields are left unchanged. Args: - taskID (string, required): UUID of the task to update. - title (string, optional): New title. - notes (string, optional): New notes (replaces existing notes entirely). - dueDate (string, optional): New due date (ISO 8601). - category (string, optional): New category (home, work, errands, health, people, money, travel, projects). Returns: { ok: true, opID: string, version: number }

NameTypeReqDescription
categorystringNew category: home, work, errands, health, people, money, travel, projects
dueDatestringNew due date (ISO 8601)
notesstringNew notes (replaces existing)
taskIDstringyesUUID of the task to update
titlestringNew title

No output schema declared.

No examples provided.

Common questions

What is the io.github.hermitsh-ai/shrimp MCP server?

io.github.hermitsh-ai/shrimp is an MCP server listed in the public MCP registry as io.github.hermitsh-ai/shrimp. Task manager for AI agents. Zero setup, nested trees, batch ops, local-first storage. This page covers its npm package (@hermitsh/shrimp-mcp).

Is the io.github.hermitsh-ai/shrimp MCP server safe to use?

io.github.hermitsh-ai/shrimp scores 75 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the io.github.hermitsh-ai/shrimp MCP server expose?

io.github.hermitsh-ai/shrimp exposes 19 tools: shrimp_pair, shrimp_status, shrimp_get_tasks, shrimp_search, shrimp_add_task, and 14 more. Their descriptions and schemas cost roughly 2,832 tokens of context every time the server is loaded.

Is the io.github.hermitsh-ai/shrimp MCP server still maintained?

io.github.hermitsh-ai/shrimp is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the io.github.hermitsh-ai/shrimp MCP server under?

io.github.hermitsh-ai/shrimp declares the UNLICENSED licence, which is not on the OSI-approved list. Read the terms before using it at work, and note this covers the source only, not the cost of any service it calls.