Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, email [email protected] and we’ll put it right.

Index9

NPM · @INDEX9/MCP · SCANNED AUG 4

Discover, shortlist, compare, cost-model, and live-test 300+ AI models from your editor

Available components

+39 this week 65 Trust /100
Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security83
  • No malware found by supply-chain analysis.Pass
  • CVE check failed: a known medium-severity CVE affects hono 4.12.33, reached via @modelcontextprotocol/sdk > hono. A fixed version is available. View diagnostics → Fail
  • No install/post-install scripts declared.Pass
  • Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency45
Schema Quality & AI Usability58
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 5167 tokens (~1033/item across 5 items; 5 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management30
  • Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
  • Structured output schemas are declared (80% of tools); any adoption earns full credit.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · @index9/mcp

# add to Claude Code
claude mcp add index9-org-mcp -- npx -y @index9/mcp
# add to Codex CLI
codex mcp add index9-org-mcp -- npx -y @index9/mcp
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "index9-org-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@index9/mcp"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add index9-org-mcp --command npx --arg -y --arg @index9/mcp
# ~/.hermes/config.yaml
mcp_servers:
  index9-org-mcp:
    command: "npx"
    args: ["-y", "@index9/mcp"]
// mcp.json
{
  "mcpServers": {
    "index9-org-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@index9/mcp"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 4 Aug 26 0
    • CVE-2026-69207 affects this package: medium security
    • Known CVEs: partial → fail security
  • 2 Aug 26 +25
    • Install scripts: pass → unverified security
    • Provenance: fail → unverified security
    • Known CVEs: unverified → partial security
    • Malware scan: unverified → pass security
    • Maintenance: pass → unverified functional
    • License: pass → unverified functional
    • Dependency health: unverified → partial functional
    • Stability: unverified → 0.23 functional
    • Licence: MIT functional
  • 1 Aug 26 +27
    • Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
    • MCP protocol: unverified → pass functional
    • Tool coverage: unverified → 100 functional
  • 31 Jul 26 −2
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 30 Jul 26 −60
    • Known CVEs: partial → unverified security
    • Malware scan: pass → unverified security
    • Tool coverage: 100 → unverified functional
    • Dependency health: partial → unverified functional
  • 29 Jul 26 +49
    • Provenance: unverified → fail security
    • Known CVEs: unverified → partial security
    • Install scripts: unverified → pass security
    • Maintenance: unverified → pass functional
    • License: unverified → pass functional
    • Tool coverage: unverified → 100 functional
    • Schema quality: unverified → excellent functional
    • Licence: MIT functional
  • 28 Jul 26 −14
    • Tool coverage: 100 → unverified functional
    • Dependency health: unverified → partial functional
    • First check of Schema quality: unverified functional
  • 27 Jul 26 40

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 4 Aug 2026 · Analysed npm/@index9/[email protected]

Provenance none

Ecosystem: npm · Outcome: none

Vulnerabilities 1 finding
ID CVE Severity Vector Fix available
GHSA-8j4g-w8fx-2239 CVE-2026-69207 medium CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L yes
Dependencies 94 packages

94 packages in the resolved dependency tree · 94 deprecated · 29 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 5 exposed · ~4,178 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens
compare_models ~558

Compare 2-10 models side-by-side. Returns each model's full metadata plus a diff matrix highlighting which fields are equal and which differ. Use this when the user asks "which is cheaper / has more context / supports X" across multiple specific models. Faster than calling get_models and diffing yourself. Response: { models: ModelResponse[], diff: { contextLength, maxOutputTokens, promptPricePerMillion, completionPricePerMillion, tokenizer, inputModalities, outputModalities, capabilities, supportedParameters }, cheapestForPromptPerMillion, largestContext, missingIds, resolvedAliases?, ambiguousAliases?, suggestions?: Record<unknownId, Array<{id, name, created}>> (newest-first), missingDiagnostics? }. Each numeric/string diff field has { allEqual: boolean, values: Record<id, value|null> }. Capability/parameter diffs have { commonAll: string[], uniquePerModel: Record<id, string[]> }. cheapestForPromptPerMillion / largestContext are convenience picks across the supplied models — null when the field is missing on every model. Optional: pass `expectedPromptTokens` AND `expectedCompletionTokens` to also receive `workloadCosts` and `cheapestForRealisticWorkload` — the actual cheapest given the user's expected token mix. Each `workloadCosts[i]` carries `tokenCostUsd` (token-only), `requestCostUsd` (per-request fee), `totalCostUsd` (sum, includes request fees), and `pricingBasis` ("exact_per_token" | "rounded_per_million" | "unavailable"). This matters when prompt:completion price ratios diverge across models, or when a model has a per-request fee. Accepts the same alias formats as get_models. Unknown ids are returned in missingIds (with `suggestions[id]` as newest-first `{id, name, created}` entries when partial matches exist, plus `missingDiagnostics` carrying a machine-readable reason per id). When fewer than 2 ids resolve, this returns 400 with the diagnostics so you can retry with `suggestions[id][0].id` for each missing id.

NameTypeReqDescription
expectedCompletionTokensintegerOptional. Pair with expectedPromptTokens to surface workloadCosts and cheapestForRealisticWorkload. Both must be set to enable workload costing.
expectedPromptTokensintegerOptional. When set with expectedCompletionTokens, computes total per-call cost for each model and picks cheapestForRealisticWorkload — closes the gap where promptPerMillion alone misleads when prompt…
idsarrayyesModel identifiers or aliases to compare (2-10). Same alias formats as get_models.
NameTypeReqDescription
_index9objectyes
ambiguousAliasesobject
cheapestForPromptPerMillionyes
cheapestForRealisticWorkload
diffobjectyes
largestContextyes
missingDiagnosticsobject
missingIdsarrayyes
modelsarrayyes
resolvedAliasesobject
suggestionsobject
workloadCostsarray

No examples provided.

find_models ~1,532

Filter 300+ AI models by structured constraints (capabilities, price, context, modality, provider). The semantic `q` is a soft tiebreaker on top of filters — trust filters first; weak `q`-only queries surface as `meta.confidence: "low"` with a hint to drop `q` and use `sortBy=created` or `sortBy=price` instead. Call this after list_facets (or directly when you already know the filters). Always include one call with sortBy=created (no q) when recommending models to the user — your training-data list of "good" models is likely stale, and sorting purely by price surfaces old tiny models and misses this month's cheap frontier. Extract filters from user queries. Numeric and categorical constraints MUST go in structured filters; `q` is for semantic flavor. Shorthand: 1K=1000, 1M=1000000. Prices are USD per million input tokens. Examples: - "1M context under $1" → q="model", minContext=1000000, maxPrice=1 - "cheap vision model from openai" → q="cheap vision model", capabilitiesAll=["vision"], provider="openai" - "function calling under $0.50 with 128K" → q="function calling", capabilitiesAll=["function_calling"], maxPrice=0.5, minContext=128000 - "cheapest paid model" → sortBy="price", sortOrder="asc", excludeFree=true - "best coding model" → q="best coding model" - "what's new" → sortBy="created" (no q needed) Valid capabilities: function_calling, structured_output, reasoning, web_search, vision, audio_input, file_input, image_generation, audio_output. Each result: id, name, description, created (unix seconds), createdAt (ISO 8601), contextLength, maxOutputTokens, pricing.{promptPerMillion, completionPerMillion} (rounded display $/M), pricing.{promptPerToken, completionPerToken, requestUsd} (exact, use for cost math), inputModalities[] / outputModalities[], capabilities[], score. With sortBy=price, results also expose pricing.effectivePromptPerMillion and pageInfo.priceSortBasis — sort order may diverge from displayed promptPerMillion for models with per-request fee…

NameTypeReqDescription
capabilitiesAllarrayArray of capabilities that must ALL be present on the model (AND logic). Valid values: function_calling, structured_output, reasoning, web_search, vision, audio_input, file_input, image_generation, a…
capabilitiesAnyarrayArray of capabilities where at least ONE must be present (OR logic). Valid values: function_calling, structured_output, reasoning, web_search, vision, audio_input, file_input, image_generation, audio…
createdAfterstringLower bound for model created timestamp.
createdBeforestringUpper bound for model created timestamp.
cursorstringOpaque pagination cursor from a previous response's `nextCursor` field. IMPORTANT: cursors are bound to the exact query text, filters, and sort order that produced them. Reuse the same query+filters+…
excludeFreebooleanWhen true, exclude models with id ending in ':free'. Useful for sortBy=price (which would otherwise be dominated by free-tier preview models) and when you want a paid SLA. Default false.
limitintegerPage size (1-100, default 20).
maxPricenumberMaximum effective prompt price in USD per million tokens. Matches the basis exposed in `pricing.effectivePromptPerMillion` and `pageInfo.priceSortBasis` — token price plus per-request fees scaled to…
minContextintegerMinimum context window in tokens.
minPricenumberMinimum effective prompt price in USD per million tokens. Matches the basis exposed in `pricing.effectivePromptPerMillion` and `pageInfo.priceSortBasis` — token price plus per-request fees scaled to…
modalitystringRequired output modality. Filters on the model's output modalities, not input capabilities. For example, "image" finds image-generation models, while capabilitiesAll=["vision"] finds models that acce…
providerarrayProvider prefix filter. Array of provider slugs — a model matches if its ID starts with any of them (e.g., ['openai'] matches 'openai/gpt-4o'; ['openai','anthropic'] matches both). Pass a single-elem…
qstringNatural language search query describing desired model characteristics (e.g., 'fast cheap coding model'). Uses semantic search with fuzzy matching. Must be at least 2 characters when provided. Option…
requireKeywordMatchbooleanWhen true, suppress weak vector-only results from semantic queries. If no candidate has a BM25 keyword hit, returns an empty page with meta.confidence='low' and meta.lowConfidenceReason — instead of…
sortBystringSort order for results. Options: 'relevance' (best semantic match, default), 'created' (newest models), 'price' (cheapest/most expensive, with sortOrder). Defaults to 'relevance'.
sortOrderstringSort order. Defaults by sortBy.
NameTypeReqDescription
_index9objectyes
metaobjectyes
nextCursoryes
pageInfoobjectyes
resultsarrayyes

No examples provided.

get_models ~527

Get full specs for one or more models by id or alias. Accepts up to 100 ids per call — use this for batch comparison. Call after find_models to inspect candidates, or directly when the user names a model (format: 'provider/model-name'). Response: { results: (Model | null)[], missingIds: string[], resolvedAliases?: Record<alias, canonicalId>, ambiguousAliases?: Record<alias, candidateIds[]>, suggestions?: Record<unknownId, Array<{id, name, created}>> }. Each non-null result has: - id, canonicalSlug, name, description - created (unix seconds), createdAt (ISO 8601), knowledgeCutoff (ISO date or null) - contextLength (tokens), maxOutputTokens, isModerated - pricing: { promptPerMillion, completionPerMillion, promptPerToken, completionPerToken, requestUsd, imageUsd } — *PerMillion is rounded display, *PerToken is exact (use for cost math). request/image are flat per-unit fees. - architecture: { inputModalities[], outputModalities[], tokenizer, instructType } - capabilities[]: normalized capability flags (same values as find_models and capabilitiesAll/Any) - supportedParameters[]: OpenRouter parameters the model accepts (e.g., "temperature", "tools", "response_format") Entries in results are null when the id is unknown; those ids appear in missingIds. Ambiguous aliases appear in ambiguousAliases with candidate canonical ids — pass a canonical id to disambiguate. Unknown ids that partially match (e.g. "sonnet" → all Claude Sonnet variants) appear in `suggestions` as up to 5 `{id, name, created}` entries **sorted newest-first** — pick `suggestions[id][0].id` for the most current replacement without a second lookup. When token-overlap finds nothing but the id is shaped like `provider/<unknown>` and the provider exists, suggestions falls back to the 5 newest models from that provider (real created timestamps, no hardcoded "popular" list). `missingDiagnostics` (when present) gives a machine-readable reason per missing id: `unknown_provider` (the prefix before / isn't in th…

NameTypeReqDescription
idsarrayyesModel identifiers or aliases. Up to 100.
maxDescriptionCharsintegerTruncate descriptions to this many characters.
NameTypeReqDescription
_index9objectyes
ambiguousAliasesobject
missingDiagnosticsobject
missingIdsarrayyes
resolvedAliasesobject
resultsarrayyes
suggestionsobject

No examples provided.

list_facets ~128

Return the live vocabulary derived from the current model cache: providers (id-prefixes with model counts), capability flags (with counts), input/output modalities, and tokenizers. Use this once at the start of a session to learn what filter values find_models will accept, instead of trial-and-error against find_models. Response: { providers: { id, modelCount }[], capabilities: { id, modelCount }[], modalities: { input: string[], output: string[] }, tokenizers: string[], totalModels: number, updatedAt: string (ISO 8601) }. No inputs.

Input schema present but exposes no named parameters.

NameTypeReqDescription
_index9objectyes
capabilitiesarrayyes
modalitiesobjectyes
providersarrayyes
tokenizersarrayyes
totalModelsintegeryes
updatedAtstringyes

No examples provided.

test_model ~1,433

Run model tests on 1-10 models. Use dryRun=true to estimate token usage/cost, or dryRun=false (default) to run live OpenRouter inference. When dryRun=true: - No OpenRouter API key required - No inference call is made - Either `prompt` OR `expectedPromptTokens` is required (use the latter for capacity planning at sizes you don't want to paste in full) - expectedCompletionTokens defaults to 256 when omitted Parameters: - models: 1-10 model IDs to test (all receive identical prompts) - prompt: Prompt text (required for dryRun unless expectedPromptTokens is set; required for live unless userContent provided) - dryRun: If true, return cost estimates only - expectedPromptTokens: Estimated prompt-token count for dryRun cost estimation; overrides the prompt-string heuristic. Use to model "what would N-token requests cost?" without pasting N tokens. - expectedCompletionTokens: Optional completion token estimate used by dryRun - maxTokens, systemPrompt, temperature, topP, seed, responseFormat, enforceJson, retries: Live-testing controls (ignored when dryRun=true) - stream: Use OpenRouter's SSE streaming so capacity/refusal errors surface in ~1s instead of waiting the full per-model timeout for an empty 200. Defaults to false. - firstTokenTimeoutMs: Streaming-only deadline for the first delta. Defaults to 10s. If the upstream sends no token within this window, the request aborts and returns failureReason="timeout". Ignored when stream=false. - providerSort: "throughput" | "price" | "latency" — opt-in OpenRouter provider routing. Defaults to OpenRouter's load-balanced choice. - providerOrder: ordered list of provider slugs (up to 8). Try these providers first before falling back. Useful for steering around an overloaded provider for a single model. - fallbackModels: ordered list of model ids (up to 5). OpenRouter automatically retries the request against the next id when the primary is unavailable. Use sparingly — a benchmark should usually test the model you asked for, not…

NameTypeReqDescription
debugbooleanWhen true, include upstream finish_reason, provider, error, refusal, and usage.
dryRunbooleanWhen true, returns estimated token usage and cost without calling OpenRouter (no API key required).
enforceJsonbooleanWhen true, output must parse as JSON.
expectedCompletionTokensintegerExpected number of completion tokens for cost estimation (default: 256). Typical ranges: 100-500 for quick tests, 1000-2000 for code generation, 4000+ for long-form content. This is a heuristic — act…
expectedPromptTokensintegerExpected number of prompt tokens for dryRun cost estimation. When set, overrides the heuristic that counts characters from the literal `prompt` string — use this for capacity planning ("what would 60…
fallbackModelsarrayFallback model IDs OpenRouter may try if the primary is unavailable. Up to 5.
firstTokenTimeoutMsintegerStreaming-only first-token deadline in ms. Defaults to 10000.
maxTokensintegerCompletion token cap. For reasoning-capable models, set ≥ 2000 (or omit) — reasoning tokens count against this before visible output, and too-low caps cause finish_reason=length.
modelsarrayyesModel IDs to evaluate (1-10).
promptstringPrompt sent to each model.
providerOrderarrayProvider slugs to try first, in order. Up to 8.
providerSortstringOpenRouter provider routing sort: "throughput", "price", or "latency".
responseFormatobjectStructured output shape request forwarded to OpenRouter (e.g., { type: 'json_object' }).
retriesintegerRetries for transient failures.
seedintegerSeed for repeatable outputs.
streambooleanUse OpenRouter SSE streaming so capacity/refusal errors surface quickly. Defaults to false.
systemPromptstringSystem instruction prepended to prompt.
temperaturenumberSampling temperature (0-2).
timeoutMsintegerPer-model timeout in ms (default 15000, max 60000).
topPnumberNucleus sampling (0-1].
userContentarrayMultimodal user content. At least one of prompt or userContent required.

No output schema declared.

No examples provided.