Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

CodeCartographer

NPM · CODECARTOGRAPHER-PI

Turn an unfamiliar codebase into validated architecture, contracts, and a reimplementation spec.

Available components

0 this week 88 Trust /100

Last scanned (8 hours ago)

Scores higher than 92% of npm servers

Category Developer Tools

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security99
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • 29 of 128 dependencies flagged as unhealthy (1 deprecated). View diagnostics → Partial
Provenance & Transparency100
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to HuginnIndustries/CodeCartographer). View diagnostics → Pass
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 28 days ago).Pass
  • Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability65
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 4691 tokens (~203/item across 23 items; 23 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management73
  • Stability observed for 22 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage94
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 83% of tool parameters carry a description.Partial
Tool Safety75
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "codecarto_publish" implies "publish" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
  • An AI judge read all 23 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a current MCP spec version (2026-07-28).Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 5 Nov 26 −3
    • Stability: pass → 0.73 functional
  • 3 Nov 26 +2
    • CVE-2026-109383 no longer affects this package ▲ security
    • CVE-2026-109932 no longer affects this package ▲ security
    • CVE-2026-87029 no longer affects this package ▲ security
    • CVE-2026-87018 no longer affects this package ▲ security
    • CVE-2026-109924 no longer affects this package ▲ security
    • CVE-2026-109829 no longer affects this package ▲ security
    • CVE-2026-109869 no longer affects this package ▲ security
    • CVE-2026-109841 no longer affects this package ▲ security
    • CVE-2026-118764 no longer affects this package ▲ security
    • Known CVEs: fail → pass ▲ security
  • 31 Oct 26 0
    • CVE-2026-118764 affects this package: high ▼ security
  • 30 Oct 26 +1
    • Stability: 0.97 → pass security
  • 29 Oct 26 −1
    • Stability: pass → 0.97 functional
  • 28 Oct 26 0
    • CVE-2026-109829 affects this package: high ▼ security
    • CVE-2026-109383 affects this package: high ▼ security
    • CVE-2026-87029 affects this package: high ▼ security
    • CVE-2026-87018 affects this package: high ▼ security
    • CVE-2026-109932 affects this package: high ▼ security
  • 27 Oct 26 +5
    • Source repository: unverified → pass ▲ security
  • 26 Oct 26 −5
    • Provenance: pass → unverified ▼ security
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Analysed npm/codecartographer-pi@0.27.0

Provenance Verified

A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.

Result Verified
Ecosystem npm
Reason Verified
Discovered via Registry attestation endpoint
Source repo HuginnIndustries/CodeCartographer
Certificate issuer https://token.actions.githubusercontent.com
Certificate SAN https://github.com/HuginnIndustries/CodeCartographer/.github/workflows/release.yml@refs/tags/v0.27.0
Rekor log index 3135389587
Predicate type SLSA build provenance https://slsa.dev/provenance/v1
Subject digest sha512:a26a495b4298829c63eef0f3ed6e36a82206e880a3e7c7806a57f5ed2e1c0b602029338e241e80ee0f264c1153fa824e2848d3fd6acaf9f3d94a84efd

Background: How many MCP packages publish verified provenance →

Dependencies 128 packages
Packages resolved 128
Deprecated 1
Stale 27
No linked repository 1
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 23 exposed · ~4,691 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
codecarto_amend ~146

Apply a post-pipeline amendment from .codecarto/scratch/amendments/<name>.yaml to workflow/status.yaml: close open questions resolved on evidence after the pipeline completed and retire finished post-pipeline backlog items, under the same lock completion uses. Writes an amendment closeout and THREAD_LOG entry. Refused while the pipeline is incomplete — mid-pipeline resolutions belong in the phase handoff. Idempotent: ids that no longer match are reported, not fatal.

NameTypeReqDescription
cwdstringyesAbsolute path to the target repository.
namestringyesAmendment file slug under .codecarto/scratch/amendments/ (with or without .yaml).

No output schema declared.

No examples provided.

codecarto_broadside ~1,402

Broad-Side: fire a cheap batch reconnaissance scan at a repository via the OpenRouter Batch API. Six lenses (architecture, api, security, defect, conventions, porting) run as asynchronous single-turn prompts with structured JSON schemas; results land in .codecarto/broadside/<run>/ as JSON plus markdown, with an optional cross-lens synthesis report. Works on any git repository — no CodeCartographer workspace required. Requires an OpenRouter API key (api_key param, OPENROUTER_API_KEY env var, or .codecarto/broadside/config.yaml). Findings are unverified scouting signals from a batch model, not validated claims — they tell the interactive pipeline where to look. Actions: submit (fire batches, returns batch ids and cost estimate), collect (poll to completion, save results, optionally synthesize), status (show recorded runs), models (list batch-capable models with pricing, context, output caps, structured-output support, and optional coding benchmarks).

NameTypeReqDescription
actionstringyessubmit fires all lens batches and returns batch ids; collect polls submitted batches, saves results, and optionally runs the synthesis and triage passes — built from verified.json when a verify pass…
api_keystring–OpenRouter API key. A value passed here is recorded wherever the host logs tool calls; prefer the OPENROUTER_API_KEY environment variable of the server process. (api_key in .codecarto/broadside/confi…
cwdstringyesAbsolute path to the target repository.
forceboolean–Submit even when the cost estimate exceeds max_cost (default false).
include_benchmarksboolean–For action 'models': annotate each model with its Artificial Analysis coding index (extra API call; default false).
include_synthesisboolean–Run the cross-lens synthesis pass once all lens batches complete. Falls back to include_synthesis in .codecarto/broadside/config.yaml (default true).
include_triageboolean–Run the triage pass once all lens batches complete: turns the findings into a prioritized work order (impact × difficulty, P0-P3, effort estimates). Falls back to include_triage in .codecarto/broadsi…
incrementalboolean–Diff against the previous run's git HEAD and scan only the modules whose files changed (falls back to a full scan on a dirty tree or when no prior run exists). Falls back to incremental in .codecarto…
lens_modelsobject–For submit: per-lens model overrides for this run, e.g. {"security": "deepseek/deepseek-v4-pro-0813:batch"}. Keys are lens ids; a lens named here runs on that model, others on `model`. Layered over l…
lensesarray–Lenses to run (submit only). Defaults to all six.
max_costnumber–Approximate run expense limit in USD. The submit action estimates the run cost from slice sizes and the configured model's per-token pricing (live OpenRouter lookup, cached 24h) and refuses to submit…
modelstring–For verify: the sync (non-batch) OpenRouter model to read with; defaults to the run's model without its :batch suffix. For submit: the OpenRouter batch model for this run (an id ending in :batch, as…
regenerate_post_passesboolean–collect only: reset the run's settled synthesis and triage passes and run them again, so a verify pass's verdicts (verified.json) are built into the executive report and the work order — confirmed fi…
retry_truncatedboolean–Re-submit lens results that came back truncated at the output token limit, once, with a doubled output cap. Falls back to retry_truncated in .codecarto/broadside/config.yaml (default true).
run_idstring–For collect and verify: the run to act on, as listed by the status action. Defaults to the most recent run; pass this to collect an older run that is still in flight after a newer submit.
topinteger–For verify: how many findings to read, most severe first (default 10). Each costs one sync call; max_cost caps the pass as a running total.
wait_secondsnumber–For submit: after submitting, poll up to this many seconds before returning. For collect: poll up to this many seconds before returning with partial state. 0 polls each in-flight batch once and retur…

No output schema declared.

No examples provided.

codecarto_change ~569

EXPERIMENTAL. Record and inspect an engineering change: its brief, its plan, the attempt lifecycle (start_attempt captures the baseline, capture_candidate the candidate — both read from the workspace by this server, never supplied by the caller), proofs of checks a host ran, a review bound to the captured candidate (record_review), and the acceptance gate. request_acceptance ASKS the person through the client's own elicitation form; it never grants. This surface records what a host did — it never runs anything, and it cannot approve work.

NameTypeReqDescription
acceptance_scenariosarray–[{ id, kind: behavior|preserved|non-functional, description }] (plan with slices).
actionstringyesThe operation to perform.
attempt_idstring–Attempt to capture a candidate for (capture_candidate), review (record_review), evaluate (gate), ask acceptance for (request_acceptance), or ingest host observations for (ingest_observations).
baseline_commitstring–Full commit hash the change is based on (create). Without it the baseline is recorded as having no VCS, because HEAD alone never identifies a candidate.
change_idstring–Change record id, for actions that address one.
cwdstringyesWorkspace directory.
inputsobject–{ references } the attempt starts from (start_attempt). brief_digest and plan_digest are derived by the server from the stored brief.md/plan.md; if supplied they must equal what plan returned.
modestring–Change mode (create); defaults to feature.
outcomestring–The outcome being requested (create).
parent_attempt_idstring–The attempt this one retries or continues (start_attempt).
plan_markdownstring–The plan text stored as plan.md (plan with slices); a listing of the slices when omitted.
proofobject–A proof of a check the HOST ran (record_proof).
request_idstring–Caller-chosen id making create retry-safe.
reviewobject–{ reviewer, objections, summary } (record_review). The candidate and input digests are bound from the stored attempt, never supplied.
revisionnumber–Compare-and-swap revision the caller last read (update, plan with slices).
slice_idstring–Slice the attempt works on (start_attempt).
slicesarray–Slices to record (plan): [{ title, deliverable, scenario_ids, proof_obligations: [{ id, scenario_id, check_kind, description, minimum_collector }], permitted_scope: { paths }, depends_on? }]. Omit fo…
titlestring–Short change title (create).

No output schema declared.

No examples provided.

codecarto_complete ~148

Mark a phase complete. Requires the phase output's validation to be PASS or PASS WITH GAPS and applies the phase handoff at scratch/handoffs/<phase>.yaml. Atomically updates status.yaml under a file lock, appends one THREAD_LOG.md entry, and writes the phase's closeout: the handoff's closeout_content (plus its decisions) overwrites the canonical <date>-<phase>.md when supplied; otherwise a stub is copied from the template only if no closeout exists yet. If phase is omitted, completes the next eligible phase.

NameTypeReqDescription
cwdstringyesAbsolute path to the target repository.
phasestring–Phase id (optional).

No output schema declared.

No examples provided.

codecarto_config ~77

Show the effective merged CodeCartographer configuration (library.path, library.namespace, publish_confirm, llm_steer_next_phase) and whether the library marker was found. Pass cwd to include workspace-level config in the merge.

NameTypeReqDescription
cwdstring–Absolute path to a repository with a .codecarto/ workspace (optional).

No output schema declared.

No examples provided.

codecarto_dashboard ~37

Regenerate .codecarto/dashboard.html from the current workspace state.

NameTypeReqDescription
cwdstringyesAbsolute path to the target repository.

No output schema declared.

No examples provided.

codecarto_guide ~88

Return the instructions for driving this server: the status/next/execute/validate/complete loop, the phase-handoff contract, pipeline selection, executor choice, and recovery. Call this first when you have not run a CodeCartographer pipeline before. Takes no workspace.

NameTypeReqDescription
topicstring–Guide topic. Omit for the overview; other topics are listed in every response.

No output schema declared.

No examples provided.

codecarto_init ~163

Initialize a CodeCartographer workspace (.codecarto/) in a target repository. Copies the packaged framework template and writes a fresh status.yaml for the chosen pipeline. If .codecarto/ already exists, pass force: true to back up the existing workspace to .codecarto-backup-TIMESTAMP/ and create a fresh one. Warning: backing up moves all existing findings, handoffs, usage data, closeouts, and phase progress to the backup directory.

NameTypeReqDescription
cwdstringyesAbsolute path to the target repository.
forceboolean–Back up and overwrite an existing .codecarto/ directory if present (default false).
pipelinestring–Pipeline alias or workflow/*.yaml path. Defaults to the framework's default pipeline.

No output schema declared.

No examples provided.

codecarto_library_init ~118

Initialize a CodeCartographer library at the given path: create the directory, write the .codecarto-library marker, and write the library.path into the user-global config. Idempotent — safe to re-run on an existing library. Pass a namespace to create a namespaced (shared) library.

NameTypeReqDescription
library_pathstringyesAbsolute path for the library directory.
namestring–Library name (defaults to the directory basename).
namespacestring–Default namespace for a namespaced (shared) library.

No output schema declared.

No examples provided.

codecarto_library_list ~120

List entries in a CodeCartographer library, optionally filtered by namespace, tag, slug, or source_repo. The library is identified by library_path (absolute) or by cwd's config.yaml. Flags entries whose versions disagree about source_repo (merged by a slug collision before publish refused cross-project appends); repair is manual.

NameTypeReqDescription
cwdstring––
library_pathstring––
namespacestring––
slugstring––
source_repostring––
tagstring––

No output schema declared.

No examples provided.

codecarto_library_reindex ~93

Regenerate index.yaml and INDEX.md for a CodeCartographer library from filesystem state. Use after manual edits or to resolve a git merge conflict on index.yaml. Also reports entries whose versions disagree about source_repo (merged by a slug collision before publish refused cross-project appends); the index files are not changed and repair is manual.

NameTypeReqDescription
cwdstring––
library_pathstring––

No output schema declared.

No examples provided.

codecarto_list_skills ~56

List available post-pipeline skills installed in the workspace, plus the Broad-Side reading guide when it is present (that one is not pipeline-gated).

NameTypeReqDescription
cwdstringyesAbsolute path to the target repository.

No output schema declared.

No examples provided.

codecarto_next ~125

Return the prompt text for the next eligible CodeCartographer phase. The host should feed this prompt back to the agent or display it to the user.

NameTypeReqDescription
cwdstringyesAbsolute path to the target repository.
unattendedboolean–Set when no user is in the loop to answer the prompt's questions (an autonomous run). The reimplementation-spec prompt then defaults to the language-agnostic variant and records selection: auto-defau…

No output schema declared.

No examples provided.

codecarto_open ~41

Activate an existing CodeCartographer workspace without resetting state. Returns the current pipeline and phase.

NameTypeReqDescription
cwdstringyesAbsolute path to the target repository.

No output schema declared.

No examples provided.

codecarto_phase ~102

Return the prompt text for a specific CodeCartographer phase, even if it is not the next eligible phase. Used to revisit a phase or to bypass DAG order intentionally.

NameTypeReqDescription
cwdstringyesAbsolute path to the target repository.
phasestringyesPhase id from the active pipeline.
unattendedboolean–As for codecarto_next: no user is in the loop, so interactive hooks default and record their choice instead of asking.

No output schema declared.

No examples provided.

codecarto_publish ~705

Publish a reimplementation-spec to a CodeCartographer library. Identified by library_path (absolute) or cwd's config.yaml. Content-hash idempotent — re-publishing identical spec bytes updates metadata in place rather than bumping the version. Required: source_repo, headline, and either spec (inline) or spec_path (absolute file). Slug derives from source_repo if not provided. If the library is namespaced, namespace is required (or pass cwd to inherit from config). Generation context (agent, model, vendor, reasoning) is passed via model_metadata so the host can record provenance; omitted fields default to 'unknown'. When library.publish_confirm is set in config, a call without confirm: true is refused with a preview of what would be published (nothing is written); re-invoke with confirm: true to publish.

NameTypeReqDescription
allow_confidentiality_mismatchboolean–Permit publishing when the entry's confidentiality is more restricted than the library's visibility (internal < shared < public: an internal entry into a shared or public library, a shared entry into…
allow_source_repo_changeboolean–Permit publishing when the target entry already records a different source_repo. Off by default, because a mismatch usually means two projects derived the same slug and the spec would land in the wro…
analyzed_atstring–ISO 8601 UTC timestamp. Defaults to now.
capabilitiesarray––
confidentialitystring–Classification of the entry. Defaults to internal. Ordered internal < shared < public; publish refuses an entry more restricted than the library's visibility unless allow_confidentiality_mismatch is…
confirmboolean–Acknowledge the publish_confirm gate. When library.publish_confirm is set in config (user-global ~/.codecarto/config.yaml, or the workspace's .codecarto/workflow/config.yaml when cwd is passed), a ca…
cwdstring–Absolute path to a workspace. Used to read defaults from config.yaml and status.yaml.
force_new_versionboolean––
headlinestringyes–
library_pathstring–Absolute path to the library directory.
model_metadataobject––
namespacestring–Namespace under entries/. Required for namespaced libraries.
pipelinestring–Pipeline used. Inherited from cwd's status.yaml if available.
slugstring–Entry slug. Derived from source_repo if omitted.
source_branchstring––
source_commitstring––
source_dirtyboolean––
source_repostringyesURL or path to the analyzed repository.
specstring–Inline spec markdown content (mutually exclusive with spec_path).
spec_pathstring–Absolute path to a file containing the spec markdown (mutually exclusive with spec).
tagsarray––

No output schema declared.

No examples provided.

codecarto_refresh_scaffold ~148

Refresh a workspace's framework-owned files (GUIDE.md, templates/, workflow pipelines and VALIDATE.md, skills/, findings SKILL and README stubs) from the packaged template — the action every scaffold-staleness warning instructs. Never touches project state (status.yaml), user config (workflow/config.yaml, usage log), findings outputs, scratch/, closeouts/, or the orchestrator files (CONVENTIONS.md, DECISIONS.md, BACKLOG.md, THREAD_LOG.md). Appends one THREAD_LOG entry naming the version transition. Unlike codecarto_init force:true, nothing is backed up or lost.

NameTypeReqDescription
cwdstringyesAbsolute path to the target repository.

No output schema declared.

No examples provided.

codecarto_skill ~130

Return the prompt text for a post-pipeline skill (only callable after all phases are complete). Use codecarto_status to confirm completion first. One name is exempt from the completion gate: "broadside" returns the reading guide for a Broad-Side batch reconnaissance run, which is meant to be read before or during the pipeline and works without a workspace.

NameTypeReqDescription
cwdstringyesAbsolute path to the target repository.
namestringyesSkill name (a directory under .codecarto/skills/), or "broadside" for the Broad-Side reading guide.

No output schema declared.

No examples provided.

codecarto_status ~41

Show the current CodeCartographer phase, active pipeline, and progress for a target repository.

NameTypeReqDescription
cwdstringyesAbsolute path to the target repository.

No output schema declared.

No examples provided.

codecarto_switch_pipeline ~123

Switch the active pipeline in-place without losing findings, handoffs, usage data, or phase progress. Phases that exist in both the old and new pipelines preserve their completion status. Phases unique to the new pipeline start as pending. Pass a pipeline alias (e.g. lite, full, synthesis) or a workflow/*.yaml path.

NameTypeReqDescription
cwdstringyesAbsolute path to the target repository.
pipelinestringyesPipeline alias (e.g. lite, full, synthesis, architecture-only, defect-scan) or workflow/*.yaml path.

No output schema declared.

No examples provided.

codecarto_usage ~35

Show cumulative and per-phase token usage from local phase runs.

NameTypeReqDescription
cwdstringyesAbsolute path to the target repository.

No output schema declared.

No examples provided.

codecarto_validate ~117

Read the ## Validation table a phase wrote at the end of its primary output — the phase's own PASS/PARTIAL/FAIL per completion criterion — apply two cross-checks (findings evidence/action pairing; declared secondary outputs present), and return PASS/PASS WITH GAPS/FAIL/MISSING plus the parsed rows. It does not judge the criteria itself. If phase is omitted, validates the next eligible phase.

NameTypeReqDescription
cwdstringyesAbsolute path to the target repository.
phasestring–Phase id (optional).

No output schema declared.

No examples provided.

codecarto_vision ~107

Generate a structured vision brief from raw product text using the guided interview skill. Returns a prompt the host should feed to its agent to write inputs/vision.md. Requires a synthesis workspace (run codecarto_init with the synthesis pipeline first).

NameTypeReqDescription
cwdstringyesAbsolute path to the target repository with a .codecarto/ synthesis workspace.
raw_textstringyesThe user's raw product text — audience, problem, desired outcomes, constraints, non-goals.

No output schema declared.

No examples provided.

Install

How do I install the CodeCartographer MCP server?

CodeCartographer runs locally as an npm package, launched with npx -y codecartographer-pi. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · codecartographer-pi

# add to Claude Code
claude mcp add huginnindustries-codecartographer -- npx -y codecartographer-pi
Common questions

What is the CodeCartographer MCP server?

CodeCartographer is an MCP server listed in the public MCP registry as io.github.HuginnIndustries/codecartographer. Turn an unfamiliar codebase into validated architecture, contracts, and a reimplementation spec. This page covers its npm package (codecartographer-pi).

Is the CodeCartographer MCP server safe to use?

CodeCartographer scores 88 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the CodeCartographer MCP server expose?

CodeCartographer exposes 23 tools: codecarto_init, codecarto_switch_pipeline, codecarto_status, codecarto_next, codecarto_phase, and 18 more. Their descriptions and schemas cost roughly 4,691 tokens of context every time the server is loaded.

Is the CodeCartographer MCP server still maintained?

CodeCartographer is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the CodeCartographer MCP server under?

CodeCartographer declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.