# CodeCartographer (npm · codecartographer-pi)

Evidence-backed reverse engineering and human-gated software planning for Pi and MCP coding agents.

- Trust score: 78/100 (medium)
- Change this week: −12
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `codecartographer-pi`: 78/100 (this document), [markdown](https://verifymcp.io/servers/huginnindustries-codecartographer/codecartographer-pi.md), [page](https://verifymcp.io/servers/huginnindustries-codecartographer/codecartographer-pi)

## Channel facts

- Registry: `npm`
- Package: `codecartographer-pi`
- Version: `0.12.3`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 86/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 97/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to HuginnIndustries/CodeCartographer).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 10 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 77/100
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 1048 tokens (~104/item across 10 items; 10 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 85/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 56% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add huginnindustries-codecartographer -- npx -y codecartographer-pi
```

### Codex

```bash
codex mcp add huginnindustries-codecartographer -- npx -y codecartographer-pi
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "huginnindustries-codecartographer": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "codecartographer-pi"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add huginnindustries-codecartographer --command npx --arg -y --arg codecartographer-pi
```

### Hermes

```yaml
mcp_servers:
  huginnindustries-codecartographer:
    command: "npx"
    args: ["-y", "codecartographer-pi"]
```

### Other

```json
{
  "mcpServers": {
    "huginnindustries-codecartographer": {
      "command": "npx",
      "args": [
        "-y",
        "codecartographer-pi"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 78, +44)

- [security improvement] Known CVEs: unverified → partial
- [security improvement] Provenance: unverified → pass
- [security improvement] Install scripts: unverified → pass
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [security] The attested source repository moved: HuginnIndustries/CodeCartographer
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Stability: unverified → 0.23
- [functional improvement] License: unverified → pass
- [functional] Licence: MIT

### 2026-08-01 (score 34, +29)

- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] MCP protocol: unverified → pass

### 2026-07-31 (score 5, −33)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 38, −52)

- [security regression] Install scripts: pass → unverified
- [security regression] Malware scan: pass → unverified
- [security regression] Provenance: pass → unverified
- [security regression] Known CVEs: partial → unverified
- [security] The attested source repository moved: HuginnIndustries/CodeCartographer
- [functional regression] Maintenance: pass → unverified
- [functional regression] Dependency health: partial → unverified
- [functional regression] License: pass → unverified
- [functional] Licence: MIT

### 2026-07-27 (score 90, +48)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-26 (score 42)

First indexed and scored.

## MCP tools (10)

### `codecarto_init` (~113 tokens)

Initialize a CodeCartographer workspace (.codecarto/) in a target repository. Copies the packaged framework template and writes a fresh status.yaml for the chosen pipeline. Errors if .codecarto/ already exists unless force is true.

Input parameters:

- `cwd` (string, required): Absolute path to the target repository.
- `force` (boolean): Overwrite an existing .codecarto/ directory if present (default false).
- `pipeline` (string): Pipeline alias or workflow/*.yaml path. Defaults to the framework's default pipeline.

### `codecarto_status` (~41 tokens)

Show the current CodeCartographer phase, active pipeline, and progress for a target repository.

Input parameters:

- `cwd` (string, required): Absolute path to the target repository.

### `codecarto_next` (~53 tokens)

Return the prompt text for the next eligible CodeCartographer phase. The host should feed this prompt back to the agent or display it to the user.

Input parameters:

- `cwd` (string, required): Absolute path to the target repository.

### `codecarto_phase` (~70 tokens)

Return the prompt text for a specific CodeCartographer phase, even if it is not the next eligible phase. Used to revisit a phase or to bypass DAG order intentionally.

Input parameters:

- `cwd` (string, required): Absolute path to the target repository.
- `phase` (string, required): Phase id from the active pipeline.

### `codecarto_validate` (~78 tokens)

Validate a phase's primary output against the validation block in the produced markdown. Returns overall PASS/PASS WITH GAPS/FAIL/MISSING plus the parsed criteria rows. If phase is omitted, validates the next eligible phase.

Input parameters:

- `cwd` (string, required): Absolute path to the target repository.
- `phase` (string): Phase id (optional).

### `codecarto_complete` (~98 tokens)

Mark a phase complete. Requires the phase output's validation to be PASS or PASS WITH GAPS. Atomically updates status.yaml under a file lock, appends to THREAD_LOG.md, and creates a closeout stub from the template if one does not yet exist. If phase is omitted, completes the next eligible phase.

Input parameters:

- `cwd` (string, required): Absolute path to the target repository.
- `phase` (string): Phase id (optional).

### `codecarto_skill` (~72 tokens)

Return the prompt text for a post-pipeline skill (only callable after all phases are complete). Use codecarto_status to confirm completion first.

Input parameters:

- `cwd` (string, required): Absolute path to the target repository.
- `name` (string, required): Skill name (a directory under .codecarto/skills/).

### `codecarto_publish` (~370 tokens)

Publish a reimplementation-spec to a CodeCartographer library. Identified by library_path (absolute) or cwd's config.yaml. Content-hash idempotent — re-publishing identical spec bytes updates metadata in place rather than bumping the version. Required: source_repo, headline, and either spec (inline) or spec_path (absolute file). Slug derives from source_repo if not provided. If the library is namespaced, namespace is required (or pass cwd to inherit from config). Generation context (agent, model, vendor, reasoning) is passed via model_metadata so the host can record provenance; omitted fields default to 'unknown'.

Input parameters:

- `analyzed_at` (string): ISO 8601 UTC timestamp. Defaults to now.
- `capabilities` (array)
- `confidentiality` (string)
- `cwd` (string): Absolute path to a workspace. Used to read defaults from config.yaml and status.yaml.
- `force_new_version` (boolean)
- `headline` (string, required)
- `library_path` (string): Absolute path to the library directory.
- `model_metadata` (object)
- `namespace` (string): Namespace under entries/. Required for namespaced libraries.
- `pipeline` (string): Pipeline used. Inherited from cwd's status.yaml if available.
- `slug` (string): Entry slug. Derived from source_repo if omitted.
- `source_branch` (string)
- `source_commit` (string)
- `source_dirty` (boolean)
- `source_repo` (string, required): URL or path to the analyzed repository.
- `spec` (string): Inline spec markdown content (mutually exclusive with spec_path).
- `spec_path` (string): Absolute path to a file containing the spec markdown (mutually exclusive with spec).
- `tags` (array)

### `codecarto_library_list` (~94 tokens)

List entries in a CodeCartographer library, optionally filtered by namespace, tag, slug, or source_repo. The library is identified by library_path (absolute) or by cwd's config.yaml.

Input parameters:

- `cwd` (string)
- `library_path` (string)
- `namespace` (string)
- `slug` (string)
- `source_repo` (string)
- `tag` (string)

### `codecarto_library_reindex` (~59 tokens)

Regenerate index.yaml and INDEX.md for a CodeCartographer library from filesystem state. Use after manual edits or to resolve a git merge conflict on index.yaml.

Input parameters:

- `cwd` (string)
- `library_path` (string)

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/huginnindustries-codecartographer/codecartographer-pi#diagnostics

## Score history

- 2026-08-03: 78
- 2026-08-02: 78
- 2026-08-01: 34
- 2026-07-31: 5
- 2026-07-30: 38
- 2026-07-28: 90
- 2026-07-27: 90
- 2026-07-26: 42

## Links

- npm package: https://www.npmjs.com/package/codecartographer-pi
- Socket report: https://socket.dev/npm/package/codecartographer-pi
- Repository: https://github.com/HuginnIndustries/CodeCartographer
- Website: https://codecarto.dev/
- Changelog RSS feed: https://verifymcp.io/servers/huginnindustries-codecartographer/codecartographer-pi/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/huginnindustries-codecartographer/codecartographer-pi/changelog.json
- HTML version of this page: https://verifymcp.io/servers/huginnindustries-codecartographer/codecartographer-pi