# Evernode MCP (npm · evernode-mcp)

Evernode/HotPocket dApp helper: templates, non-determinism lint, lease math, live host lookup.

- Trust score: 73/100 (medium)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-10-23

## Components

- npm · `evernode-mcp`: 73/100 (this document), [markdown](https://verifymcp.io/servers/hugegreencandle-evernode-mcp/evernode-mcp.md), [page](https://verifymcp.io/servers/hugegreencandle-evernode-mcp/evernode-mcp)

## Channel facts

- Registry: `npm`
- Package: `evernode-mcp`
- Version: `0.6.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-10-23.

- **Supply Chain Security**: 81/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known high-severity CVE affects @modelcontextprotocol/sdk 1.29.0, a direct dependency. A fixed version is available.
  - No install/post-install scripts declared.
  - 30 of 93 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 22 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 78/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1398 tokens (~116/item across 12 items; 12 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 73/100
  - Stability observed for 22 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 90/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 66% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Tool Safety**: 75/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "generate_deploy_commands" implies "deploy" and declares readOnlyHint instead, contradicting what its own name says it does.
  - An AI judge read all 12 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the Evernode MCP server?

Evernode MCP runs locally as an npm package, launched with npx -y evernode-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add hugegreencandle-evernode-mcp -- npx -y evernode-mcp
```

### Cursor

```json
{
  "mcpServers": {
    "hugegreencandle-evernode-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "evernode-mcp"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "hugegreencandle-evernode-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "evernode-mcp"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add hugegreencandle-evernode-mcp -- npx -y evernode-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "hugegreencandle-evernode-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "evernode-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add hugegreencandle-evernode-mcp --command npx --arg -y --arg evernode-mcp
```

### Hermes

```yaml
mcp_servers:
  hugegreencandle-evernode-mcp:
    command: "npx"
    args: ["-y", "evernode-mcp"]
```

### Netclaw

```json
{
  "McpServers": {
    "hugegreencandle-evernode-mcp": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "evernode-mcp"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add hugegreencandle-evernode-mcp -t stdio -c npx -a -y evernode-mcp
```

### Other

```json
{
  "mcpServers": {
    "hugegreencandle-evernode-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "evernode-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-22 (score 73, +1)

No change was recorded against any check on this day. Stability & Change Management went from 67 to 70. That category is still filling its 30-day observation window: 20 days of observed history at the previous scan, 21 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-21 (score 72, 0)

- [security regression] CVE-2026-111771 affects this package: high
- [security regression] CVE-2026-111768 affects this package: high
- [security regression] CVE-2026-111769 affects this package: high
- [security regression] CVE-2026-111767 affects this package: high

### 2026-10-20 (score 72, +1)

No change was recorded against any check on this day. Stability & Change Management went from 60 to 63. That category is still filling its 30-day observation window: 18 days of observed history at the previous scan, 19 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-18 (score 71, +1)

No change was recorded against any check on this day. Stability & Change Management went from 53 to 57. That category is still filling its 30-day observation window: 16 days of observed history at the previous scan, 17 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-15 (score 70, +1)

No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-13 (score 69, +6)

- [functional regression] Security disclosure: unverified → fail
- [functional improvement] Stability: unverified → 0.40

### 2026-10-11 (score 63, −5)

- [security regression] CVE-2026-104850 affects this package: high
- [security regression] Known CVEs: pass → fail
- [functional regression] Security disclosure: fail → unverified

### 2026-10-01 (score 68)

First indexed and scored.

## MCP tools (12)

### `list_templates` (~50 tokens)

List dApp templates

List the available HotPocket dApp templates (escrow, subscription, game_backend, voting, token_gated, payment_splitter, oracle_consumer, streaming_payment, multisig_treasury, blank).

Output parameters:

- `templates` (array)

### `generate_contract` (~107 tokens)

Generate a HotPocket dApp

Generate a HotPocket dApp file set (contract + state helper + hp.cfg.override + package.json + client) for a template. Templates avoid the known non-determinism sources (no wall-clock, randomness, or network in the contract path; time = ctx.lclSeqNo) and pass check_determinism with no HIGH findings — lint-clean, not proven deterministic.

Input parameters:

- `name` (string): project/contract name (default: mycontract)
- `template` (string, required)

Output parameters:

- `files` (object)
- `notes` (array)
- `template` (string)

### `check_determinism` (~113 tokens)

Check contract determinism

Heuristic linter for HotPocket contract source: flags known non-deterministic patterns that can break cluster consensus (wall-clock, randomness, network I/O, env/host reads, timers/races, filesystem outside the state file, unordered iteration/serialization, locale/ICU, floating-point literals). HIGH findings are likely consensus breakers. A clean result means none of these patterns were found — it does not prove the contract is deterministic.

Input parameters:

- `source` (string, required): the contract JS/TS source to scan

Output parameters:

- `findings` (array)
- `summary` (string)

### `check_contract_api` (~126 tokens)

Check HotPocket contract API usage

Heuristic static check that a HotPocket Node.js contract uses the contract API correctly: an hpc.init(...) entry point, reading ctx (users / lclSeqNo), persisting ONLY through the consensused state mechanism (no arbitrary fs writes to non-state paths), handling ctx.users I/O, using ctx.lclSeqNo for time (not Date.now), and awaiting async consensus ops. Severity-rated with fix + why. Sibling to check_determinism — guidance, NOT a proof.

Input parameters:

- `source` (string, required): the HotPocket contract JS/TS source to check

Output parameters:

- `findings` (array)
- `summary` (string)

### `recommend_pattern` (~54 tokens)

Recommend a HotPocket pattern

Given a plain-English use-case, recommend the HotPocket pattern (node count, state model, oracle/NPL usage, Xahau settlement) with the determinism caveats that matter.

Input parameters:

- `use_case` (string, required)

Output parameters:

- `nodes` (string)
- `notes` (array)
- `pattern` (string)

### `check_hook_compat` (~119 tokens)

Xahau Hook settlement workflow

Returns the recommended workflow (no analysis is performed) for a dApp that settles value on Xahau through a Hook-guarded account: build/lint the Hook with xahc, simulate it with xahau-mcp, prove the spend invariant with xahc-prover, then install via an unsigned SetHook.

Input parameters:

- `involves_hook` (boolean, required): does the dApp's Xahau account run a Hook?
- `what` (string): what the hook should enforce, e.g. 'per-tx spend limit'

Output parameters:

- `involvesHook` (boolean)
- `repos` (object)
- `workflow` (array)

### `generate_settlement` (~214 tokens)

Generate Xahau settlement bundle

For a value-moving dApp, generate the cluster-side Xahau payout code (a starting point; multisig aggregation is left to you) + an unsigned `xahc install-tx` command for the agent_guardrail Hook (per-tx LIM spend cap + optional DST lock) on the cluster account + the `xahc prove` command to check it. Emits commands only — no safety verdict. While that Hook is installed it makes the ledger reject outgoing Payments over LIM or to a non-allowed DST; it fires on Payment only, so it does not stop the account's signers from removing it with SetHook or moving value with other transaction types.

Input parameters:

- `cluster_account` (string): the cluster's Xahau (multisig) account r-address
- `dest` (string): optional r-address to LOCK payouts to (the DST hook param)
- `limit_drops` (integer, required): per-tx spend cap in drops (the LIM hook param)
- `template` (string, required)

Output parameters:

- `files` (object)
- `install` (string)
- `limitDrops` (number)
- `notes` (array)
- `prove` (string)
- `template` (string)

### `estimate_lease_cost` (~106 tokens)

Estimate EVR lease cost

Estimate tenant EVR lease cost = evrPerMoment × moments × nodes. Rates are host-set (no network standard); registration fees are host-side, not included.

Input parameters:

- `evr_per_moment` (number, required): host's per-Moment lease rate in EVR (from its offer)
- `moment_minutes` (number): Moment window in minutes (default 60)
- `moments` (number, required): number of Moments to lease
- `nodes` (number, required): cluster size

Output parameters:

- `approxDurationHours` (number)
- `inputs` (object)
- `notes` (array)
- `perNodeEVR` (number)
- `totalEVR` (number)

### `recommend_hosts` (~203 tokens)

Recommend Evernode hosts (live)

Fetch + rank live Evernode hosts from the public OnLedger API (api.onledger.net, which indexes the Evernode registry on Xahau) by cheap | capacity | reputation; the filters (min_reputation, min_slots, country, min_ram_mb, limit) are passed to that live query. Or pass your own `hosts` list to rank it (filters are not applied to a supplied list; top 10 returned). Real data only — never invents hosts.

Input parameters:

- `country` (string): 2-letter ISO code, e.g. DE, US, JP
- `hosts` (array): optional: rank this supplied list instead of fetching live
- `limit` (number): max hosts (default 10)
- `min_ram_mb` (number)
- `min_reputation` (number): 0–255 host reputation floor
- `min_slots` (number): minimum free instances (default 1)
- `prefer` (string)

Output parameters:

- `mode` (string)
- `note` (string)
- `prefer` (string)
- `query` (string)
- `ranked` (array)
- `source` (string)

### `host_diagnostics` (~172 tokens)

Diagnose an Evernode host (live)

Health view of a single Evernode host by r-address: registration status, reputation, active/total/available instance slots, lease rate (EVR per Moment and/or drops, if the source has them), RAM/disk, and red-flags (flagged in the registry, marked inactive, reputation < 50, zero reputation, full capacity). Fetches live from the public OnLedger API (api.onledger.net) — or pass a `host` object to diagnose it. REAL data only: unknown fields are OMITTED (never invented); honest found:false + note on not-found / fetch failure.

Input parameters:

- `address` (string): the host's Xahau r-address to look up live on OnLedger
- `host` (object): optional: diagnose this supplied host object instead of fetching live

Output parameters:

- `address` (string)
- `found` (boolean)
- `lease` (object)
- `note` (string)
- `redFlags` (array)
- `registration` (object)
- `reputation` (number)
- `slots` (object)
- `source` (string)
- `specs` (object)

### `generate_deploy_commands` (~82 tokens)

Generate deploy commands

Generate the command sequence for: local (hpdevkit dev cluster), single (evdevkit acquire one host), cluster (evdevkit N-node cluster), or cluster-manager (connect to Offledger Cluster Manager).

Input parameters:

- `host` (string)
- `instance_name` (string)
- `mode` (string, required)
- `nodes` (number)

Output parameters:

- `notes` (array)
- `steps` (array)

### `explain_error` (~52 tokens)

Explain an Evernode/HotPocket error

Map a HotPocket/Evernode error message to its likely cause and fix (connection, consensus stall, no hosts, insufficient EVR, lease expiry, docker, Hook rejection).

Input parameters:

- `error_text` (string, required)

Output parameters:

- `explanations` (array)
- `matched` (boolean)
- `message` (string)

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/hugegreencandle-evernode-mcp/evernode-mcp#diagnostics

## Score history

- 2026-10-23: 73
- 2026-10-22: 73
- 2026-10-21: 72
- 2026-10-20: 72
- 2026-10-19: 71
- 2026-10-18: 71
- 2026-10-17: 70
- 2026-10-16: 70
- 2026-10-15: 70
- 2026-10-14: 69
- 2026-10-13: 69
- 2026-10-12: 63
- 2026-10-11: 63
- 2026-10-06: 68
- 2026-10-04: 68
- 2026-10-03: 68
- 2026-10-02: 68
- 2026-10-01: 68

## Common questions

### What is the Evernode MCP server?

Evernode MCP is listed in the public MCP registry as io.github.Hugegreencandle/evernode-mcp. Evernode/HotPocket dApp helper: templates, non-determinism lint, lease math, live host lookup. This page covers its npm package (evernode-mcp).

### Is the Evernode MCP server safe to use?

Evernode MCP scores 73 out of 100 on VerifyMCP. We recorded 5 known advisories against it as of 23 October 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Evernode MCP server expose?

Evernode MCP exposes 12 tools: list_templates, generate_contract, check_determinism, check_contract_api, recommend_pattern, and 7 more. Their descriptions and schemas cost roughly 1,398 tokens of context every time the server is loaded.

### Is the Evernode MCP server still maintained?

Evernode MCP is still listed as active in the MCP registry. We last reached this channel on 23 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the Evernode MCP server under?

Evernode MCP declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/evernode-mcp
- Socket report: https://socket.dev/npm/package/evernode-mcp
- Repository: https://github.com/Hugegreencandle/evernode-mcp
- Changelog RSS feed: https://verifymcp.io/servers/hugegreencandle-evernode-mcp/evernode-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/hugegreencandle-evernode-mcp/evernode-mcp.json
- HTML version of this page: https://verifymcp.io/servers/hugegreencandle-evernode-mcp/evernode-mcp