# index365 MCP (npm · @index365/mcp)

Start index365 scans and read prioritized findings your coding agent can use.

- Trust score: 63/100 (medium)
- Change this week: +19
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `@index365/mcp`: 63/100 (this document), [markdown](https://verifymcp.io/servers/index365usa-index365/index365-mcp.md), [page](https://verifymcp.io/servers/index365usa-index365/index365-mcp)

## Channel facts

- Registry: `npm`
- Package: `@index365/mcp`
- Version: `1.0.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 83/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known medium-severity CVE affects @hono/node-server 1.19.17, reached via @modelcontextprotocol/sdk > @hono/node-server. A fixed version is available.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 19/100
  - Repository check failed: no source repository is declared.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 0 days ago).
  - Security-disclosure policy not yet verified: we couldn't inspect the source repository.
- **Schema Quality & AI Usability**: 79/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 2308 tokens (~209/item across 11 items; 11 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 95/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 85% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add index365usa-index365 -- npx -y @index365/mcp
```

### Codex

```bash
codex mcp add index365usa-index365 -- npx -y @index365/mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "index365usa-index365": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@index365/mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add index365usa-index365 --command npx --arg -y --arg @index365/mcp
```

### Hermes

```yaml
mcp_servers:
  index365usa-index365:
    command: "npx"
    args: ["-y", "@index365/mcp"]
```

### Other

```json
{
  "mcpServers": {
    "index365usa-index365": {
      "command": "npx",
      "args": [
        "-y",
        "@index365/mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 63, +24)

- [security regression] GHSA-frvp-7c67-39w9 affects this package: medium
- [security regression] Known CVEs: unverified → fail
- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] License: unverified → pass
- [functional improvement] Stability: unverified → 0.27
- [functional improvement] Schema quality: unverified → excellent
- [functional] Licence: MIT

### 2026-08-01 (score 39, +20)

- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] MCP protocol: unverified → pass

### 2026-07-31 (score 19, −7)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 26, +8)

- [security regression] Malware scan: pass → unverified
- [functional improvement] Schema quality: unverified → 100
- [functional improvement] Tool coverage: unverified → 100

### 2026-07-28 (score 18, −26)

- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Schema quality: 100 → unverified

### 2026-07-27 (score 44)

First indexed and scored.

## MCP tools (11)

### `index365_list_projects` (~179 tokens)

List projects

List the organization's projects (domain-anchored workspaces). Omitted status excludes archived projects; pass active, paused, archived, or all. Paginated: pass cursor from the previous page (default 20, max 50). Best for: resolving a projectId before a scan, or finding an archived project to restore. Not for: run history or scores. Common mistake: guessing a projectId instead of listing first. Example: index365_list_projects({ status: 'active' }). Next: index365_start_scan with the projectId, or index365_create_project if the domain is not listed.

Input parameters:

- `cursor` (string): pagination.nextCursor from the previous page
- `limit` (integer): Page size (default 20, max 50)
- `status` (string): Lifecycle filter. Omit to exclude archived projects.

### `index365_create_project` (~157 tokens)

Create a project

Create a domain-anchored project in the organization. Requires the projects:write scope. Idempotent by domain: creating an existing domain returns that same project (no duplicate), so a retry is safe. Best for: registering a new site before its first scan. Not for: reactivating an archived project (use index365_restore_project). Common mistake: calling index365_start_scan before the project exists. Example: index365_create_project({ domain: 'acme.com', name: 'Acme' }). Next: index365_start_scan with the returned projectId.

Input parameters:

- `domain` (string, required): Domain to scan, e.g. acme.com
- `name` (string): Display name (defaults to the domain)

### `index365_archive_project` (~164 tokens)

Archive a project

Reversibly archive a project so it leaves active lists and cannot start new scans. Scan history and API keys remain available, and index365_restore_project reactivates the same row. Requires projects:delete. Safe to retry. Best for: retiring a domain you no longer scan. Not for: permanent deletion, which this is not. Common mistake: omitting confirmDomain, which must echo the project's exact domain. Example: index365_archive_project({ projectId: '<uuid>', confirmDomain: 'acme.com' }). Next: index365_list_projects with status archived to verify.

Input parameters:

- `confirmDomain` (string, required): The project's exact domain, echoed to authorize the archive
- `projectId` (string, required): Project id to archive (from index365_list_projects)

### `index365_restore_project` (~125 tokens)

Restore a project

Restore an archived project to active status without changing its id, history, or keys. Requires projects:write. Safe to retry; an active project remains active. Best for: reactivating a domain you archived. Not for: creating a new domain (use index365_create_project). Common mistake: looking for archived ids in the default listing; pass status archived to index365_list_projects. Example: index365_restore_project({ projectId: '<uuid>' }). Next: index365_start_scan for fresh findings.

Input parameters:

- `projectId` (string, required): Archived project id to restore

### `index365_start_scan` (~408 tokens)

Start a scan and wait for the result

Start a paid scan and wait for the result. product: ai_readiness (default; how well AI agents and AI search read the site), marketing_signal (find, trust, act, measure), or website_security (not available over MCP yet). Scans ONE URL: pass url for a same-domain page like '/pricing', or omit it for the project homepage. Spends 10 org credits (flat) and needs the runs:write scope. This call BLOCKS: it polls internally and returns the final status, score, severity counts, and dashboard link (scans typically take 2-5 minutes). If the wait cap expires it returns a non-error still-running payload; recover with index365_get_scan_status, never by starting again. Always pass idempotencyKey: a retry with the same key attaches to the same run. Best for: the one golden-path call that produces findings. Not for: reading an existing run (index365_get_scan_status) or a finished report (index365_get_report). Common mistake: retrying after a timeout without the same idempotencyKey, which double-spends credits. Example: index365_start_scan({ projectId: '<uuid>', product: 'marketing_signal', url: '/pricing', idempotencyKey: 'fix-loop-1' }). Next: index365_get_report with the returned runId.

Input parameters:

- `idempotencyKey` (string): Retry-safety key. A retry with the same key attaches to the same run.
- `product` (string): Scan product (default ai_readiness). website_security is not available over MCP yet.
- `projectId` (string, required): Project to scan (from index365_list_projects)
- `url` (string): The single page to scan on the project's own domain (its apex or any subdomain, e.g. staging.example.com). Absolute URL or root-relative path like '/pricing'. Omit to scan the project homepage. A cro…

### `index365_get_scan_status` (~148 tokens)

Get scan status

Status and summary for one run: progress while running; score, severity counts, and links once completed. Adds pollAfterSeconds and, while running, a rough etaSeconds. Scans typically take 2-5 minutes. Best for: recovering when a blocking index365_start_scan call was cut off client-side, or checking an older run. Not for: findings (index365_get_report first, then index365_list_findings). Common mistake: starting a new scan while this one is still running. Example: index365_get_scan_status({ runId: '<uuid>' }). Next: index365_get_report once status is completed.

Input parameters:

- `runId` (string, required): Run id

### `index365_get_report` (~276 tokens)

Get the compact report

Compact, product-aware report for a completed scan. Pass EXACTLY ONE of runId or projectId. runId reads that run's report. projectId reads the project's latest completed report: add product marketing_signal for the marketing report, otherwise the newest completed AI-Readiness run is used. Discriminate on the product field: AI-Readiness serves score, severity mix, and foundation files; Marketing Signal serves score, the five stage scores (find, trust, act, measure, improve), and source coverage. Best for: the FIRST read after a scan completes, before paging findings. Not for: per-finding detail (index365_get_finding) or starting scans (index365_start_scan). Common mistake: passing both runId and projectId, or dumping every finding into context without reading this first. Example: index365_get_report({ projectId: '<uuid>', product: 'marketing_signal' }). Next: index365_list_findings with the runId for the prioritized list.

Input parameters:

- `product` (string): With projectId only: which product's latest report (default ai_readiness).
- `projectId` (string): Project id for the latest completed report (pass this OR runId, not both)
- `runId` (string): Run id (pass this OR projectId, not both)

### `index365_list_findings` (~191 tokens)

List findings

Paginated findings for a completed run of either product (contract v2: stable findingId, category, severity, evidence, remediation; Marketing Signal findings also carry a stage). Best for: triaging by severity, category, or stage. Not for: full detail of one finding (index365_get_finding) or first orientation (index365_get_report first). Common mistake: requesting a huge limit; it is capped at 50, so page with cursor. Example: index365_list_findings({ runId: '<uuid>', severity: 'critical' }). Next: index365_get_finding with a findingId for the exact fix.

Input parameters:

- `category` (string)
- `cursor` (string)
- `limit` (integer)
- `runId` (string, required): Completed run id
- `severity` (string)
- `stage` (string): Marketing Signal funnel stage filter

### `index365_get_finding` (~169 tokens)

Get one finding

Full detail for one finding by its stable id (from index365_list_findings): evidence, affected URLs, remediation, machine-readable agentActions, and a composed copy-pasteable fixPrompt. Best for: pulling the exact fix instruction before editing a repo. Not for: discovery (call index365_list_findings first to get the findingId). Common mistake: re-deriving a fix when fixPrompt and agentActions already specify it. Example: index365_get_finding({ runId: '<uuid>', findingId: 'f_ab12cd34' }). Next: apply the fix, then index365_start_scan to confirm it is resolved.

Input parameters:

- `findingId` (string, required): Stable finding id (f_...)
- `runId` (string, required): Run the finding belongs to

### `index365_list_integrations` (~118 tokens)

List connected-signal integrations

Provider registry plus per-project connection status for connected signals (GA4, Search Console, Tag Manager, ads, CRM). Best for: checking what a project can connect and each provider's phase. Not for: imported signal data (index365_list_connected_signals). Common mistake: expecting live connections; providers report phase planned until hosted connections launch. Example: index365_list_integrations({ projectId: '<uuid>' }). Next: index365_list_connected_signals for the imported rows.

Input parameters:

- `projectId` (string, required): Project id

### `index365_list_connected_signals` (~116 tokens)

List connected-source signals

Normalized signal rows imported from a project's connected sources. Best for: reading the evidence base behind Marketing Signal measure-stage findings. Not for: provider availability (index365_list_integrations). Common mistake: treating an empty list as an error; it stays empty with sourceCoverage public_only until integrations launch. Example: index365_list_connected_signals({ projectId: '<uuid>' }). Next: index365_start_scan with product marketing_signal to score the site against these signals.

Input parameters:

- `projectId` (string, required): Project id

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/index365usa-index365/index365-mcp#diagnostics

## Score history

- 2026-08-03: 63
- 2026-08-02: 39
- 2026-08-01: 39
- 2026-07-31: 19
- 2026-07-30: 26
- 2026-07-28: 18
- 2026-07-27: 44

## Links

- npm package: https://www.npmjs.com/package/@index365/mcp
- Socket report: https://socket.dev/npm/package/@index365/mcp
- Website: https://index365.co/docs/developers/mcp
- Changelog RSS feed: https://verifymcp.io/servers/index365usa-index365/index365-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/index365usa-index365/index365-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/index365usa-index365/index365-mcp