Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Index9

NPM · @INDEX9/MCP · SCANNED SEP 20

Discover, shortlist, compare, cost-model, and live-test 300+ AI models from your editor

Available components

0 this week 80 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security98
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • 31 of 95 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
Schema Quality & AI Usability58
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 5167 tokens (~1033/item across 5 items; 5 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management93
  • Stability observed for 28 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
  • Structured output schemas are declared (80% of tools); any adoption earns full credit.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 5 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 6 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

How do I install the Index9 MCP server?

Index9 runs locally as an npm package, launched with npx -y @index9/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · @index9/mcp

# add to Claude Code
claude mcp add index9-org-mcp -- npx -y @index9/mcp
// .cursor/mcp.json
{
  "mcpServers": {
    "index9-org-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@index9/mcp"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "index9-org-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@index9/mcp"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add index9-org-mcp -- npx -y @index9/mcp
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "index9-org-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@index9/mcp"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add index9-org-mcp --command npx --arg -y --arg @index9/mcp
# ~/.hermes/config.yaml
mcp_servers:
  index9-org-mcp:
    command: "npx"
    args: ["-y", "@index9/mcp"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "index9-org-mcp": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "@index9/mcp"
      ]
    }
  }
}
# add to Vellum
assistant mcp add index9-org-mcp -t stdio -c npx -a -y @index9/mcp
// mcp.json
{
  "mcpServers": {
    "index9-org-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@index9/mcp"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 20 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.

  • 18 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.

  • 17 Sept 26 0
    • Security disclosure: unverified → fail functional
  • 16 Sept 26 −3
    • Security disclosure: fail → unverified functional
    • Stability: pass → 0.80 functional
  • 15 Sept 26 +1
    • Stability: 0.97 → pass security
  • 13 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.

  • 11 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.

  • 9 Sept 26 −3
    • Stability: pass → 0.80 functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Sept 2026 · Analysed npm/@index9/mcp@6.5.2

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Dependencies 95 packages
Packages resolved 95
Stale 31
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 5 exposed · ~4,178 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
compare_models ~558

Compare 2-10 models side-by-side. Returns each model's full metadata plus a diff matrix highlighting which fields are equal and which differ. Use this when the user asks "which is cheaper / has more context / supports X" across multiple specific models. Faster than calling get_models and diffing yourself. Response: { models: ModelResponse[], diff: { contextLength, maxOutputTokens, promptPricePerMillion, completionPricePerMillion, tokenizer, inputModalities, outputModalities, capabilities, supportedParameters }, cheapestForPromptPerMillion, largestContext, missingIds, resolvedAliases?, ambiguousAliases?, suggestions?: Record<unknownId, Array<{id, name, created}>> (newest-first), missingDiagnostics? }. Each numeric/string diff field has { allEqual: boolean, values: Record<id, value|null> }. Capability/parameter diffs have { commonAll: string[], uniquePerModel: Record<id, string[]> }. cheapestForPromptPerMillion / largestContext are convenience picks across the supplied models — null when the field is missing on every model. Optional: pass `expectedPromptTokens` AND `expectedCompletionTokens` to also receive `workloadCosts` and `cheapestForRealisticWorkload` — the actual cheapest given the user's expected token mix. Each `workloadCosts[i]` carries `tokenCostUsd` (token-only), `requestCostUsd` (per-request fee), `totalCostUsd` (sum, includes request fees), and `pricingBasis` ("exact_per_token" | "rounded_per_million" | "unavailable"). This matters when prompt:completion price ratios diverge across models, or when a model has a per-request fee. Accepts the same alias formats as get_models. Unknown ids are returned in missingIds (with `suggestions[id]` as newest-first `{id, name, created}` entries when partial matches exist, plus `missingDiagnostics` carrying a machine-readable reason per id). When fewer than 2 ids resolve, this returns 400 with the diagnostics so you can retry with `suggestions[id][0].id` for each missing id.

NameTypeReqDescription
expectedCompletionTokensintegerOptional. Pair with expectedPromptTokens to surface workloadCosts and cheapestForRealisticWorkload. Both must be set to enable workload costing.
expectedPromptTokensintegerOptional. When set with expectedCompletionTokens, computes total per-call cost for each model and picks cheapestForRealisticWorkload — closes the gap where promptPerMillion alone misleads when prompt…
idsarrayyesModel identifiers or aliases to compare (2-10). Same alias formats as get_models.
NameTypeReqDescription
_index9objectyes
ambiguousAliasesobject
cheapestForPromptPerMillionstring|nullyes
cheapestForRealisticWorkloadstring|null
diffobjectyes
largestContextstring|nullyes
missingDiagnosticsobject
missingIdsarrayyes
modelsarrayyes
resolvedAliasesobject
suggestionsobject
workloadCostsarray

No examples provided.

find_models ~1,532

Filter 300+ AI models by structured constraints (capabilities, price, context, modality, provider). The semantic `q` is a soft tiebreaker on top of filters — trust filters first; weak `q`-only queries surface as `meta.confidence: "low"` with a hint to drop `q` and use `sortBy=created` or `sortBy=price` instead. Call this after list_facets (or directly when you already know the filters). Always include one call with sortBy=created (no q) when recommending models to the user — your training-data list of "good" models is likely stale, and sorting purely by price surfaces old tiny models and misses this month's cheap frontier. Extract filters from user queries. Numeric and categorical constraints MUST go in structured filters; `q` is for semantic flavor. Shorthand: 1K=1000, 1M=1000000. Prices are USD per million input tokens. Examples: - "1M context under $1" → q="model", minContext=1000000, maxPrice=1 - "cheap vision model from openai" → q="cheap vision model", capabilitiesAll=["vision"], provider="openai" - "function calling under $0.50 with 128K" → q="function calling", capabilitiesAll=["function_calling"], maxPrice=0.5, minContext=128000 - "cheapest paid model" → sortBy="price", sortOrder="asc", excludeFree=true - "best coding model" → q="best coding model" - "what's new" → sortBy="created" (no q needed) Valid capabilities: function_calling, structured_output, reasoning, web_search, vision, audio_input, file_input, image_generation, audio_output. Each result: id, name, description, created (unix seconds), createdAt (ISO 8601), contextLength, maxOutputTokens, pricing.{promptPerMillion, completionPerMillion} (rounded display $/M), pricing.{promptPerToken, completionPerToken, requestUsd} (exact, use for cost math), inputModalities[] / outputModalities[], capabilities[], score. With sortBy=price, results also expose pricing.effectivePromptPerMillion and pageInfo.priceSortBasis — sort order may diverge from displayed promptPerMillion for models with per-request fee…

NameTypeReqDescription
capabilitiesAllarrayArray of capabilities that must ALL be present on the model (AND logic). Valid values: function_calling, structured_output, reasoning, web_search, vision, audio_input, file_input, image_generation, a…
capabilitiesAnyarrayArray of capabilities where at least ONE must be present (OR logic). Valid values: function_calling, structured_output, reasoning, web_search, vision, audio_input, file_input, image_generation, audio…
createdAfterstringLower bound for model created timestamp.
createdBeforestringUpper bound for model created timestamp.
cursorstringOpaque pagination cursor from a previous response's `nextCursor` field. IMPORTANT: cursors are bound to the exact query text, filters, and sort order that produced them. Reuse the same query+filters+…
excludeFreebooleanWhen true, exclude models with id ending in ':free'. Useful for sortBy=price (which would otherwise be dominated by free-tier preview models) and when you want a paid SLA. Default false.
limitintegerPage size (1-100, default 20).
maxPricenumberMaximum effective prompt price in USD per million tokens. Matches the basis exposed in `pricing.effectivePromptPerMillion` and `pageInfo.priceSortBasis` — token price plus per-request fees scaled to…
minContextintegerMinimum context window in tokens.
minPricenumberMinimum effective prompt price in USD per million tokens. Matches the basis exposed in `pricing.effectivePromptPerMillion` and `pageInfo.priceSortBasis` — token price plus per-request fees scaled to…
modalitystringRequired output modality. Filters on the model's output modalities, not input capabilities. For example, "image" finds image-generation models, while capabilitiesAll=["vision"] finds models that acce…
providerarrayProvider prefix filter. Array of provider slugs — a model matches if its ID starts with any of them (e.g., ['openai'] matches 'openai/gpt-4o'; ['openai','anthropic'] matches both). Pass a single-elem…
qstringNatural language search query describing desired model characteristics (e.g., 'fast cheap coding model'). Uses semantic search with fuzzy matching. Must be at least 2 characters when provided. Option…
requireKeywordMatchbooleanWhen true, suppress weak vector-only results from semantic queries. If no candidate has a BM25 keyword hit, returns an empty page with meta.confidence='low' and meta.lowConfidenceReason — instead of…
sortBystringSort order for results. Options: 'relevance' (best semantic match, default), 'created' (newest models), 'price' (cheapest/most expensive, with sortOrder). Defaults to 'relevance'.
sortOrderstringSort order. Defaults by sortBy.
NameTypeReqDescription
_index9objectyes
metaobjectyes
nextCursorstring|nullyes
pageInfoobjectyes
resultsarrayyes

No examples provided.

get_models ~527

Get full specs for one or more models by id or alias. Accepts up to 100 ids per call — use this for batch comparison. Call after find_models to inspect candidates, or directly when the user names a model (format: 'provider/model-name'). Response: { results: (Model | null)[], missingIds: string[], resolvedAliases?: Record<alias, canonicalId>, ambiguousAliases?: Record<alias, candidateIds[]>, suggestions?: Record<unknownId, Array<{id, name, created}>> }. Each non-null result has: - id, canonicalSlug, name, description - created (unix seconds), createdAt (ISO 8601), knowledgeCutoff (ISO date or null) - contextLength (tokens), maxOutputTokens, isModerated - pricing: { promptPerMillion, completionPerMillion, promptPerToken, completionPerToken, requestUsd, imageUsd } — *PerMillion is rounded display, *PerToken is exact (use for cost math). request/image are flat per-unit fees. - architecture: { inputModalities[], outputModalities[], tokenizer, instructType } - capabilities[]: normalized capability flags (same values as find_models and capabilitiesAll/Any) - supportedParameters[]: OpenRouter parameters the model accepts (e.g., "temperature", "tools", "response_format") Entries in results are null when the id is unknown; those ids appear in missingIds. Ambiguous aliases appear in ambiguousAliases with candidate canonical ids — pass a canonical id to disambiguate. Unknown ids that partially match (e.g. "sonnet" → all Claude Sonnet variants) appear in `suggestions` as up to 5 `{id, name, created}` entries **sorted newest-first** — pick `suggestions[id][0].id` for the most current replacement without a second lookup. When token-overlap finds nothing but the id is shaped like `provider/<unknown>` and the provider exists, suggestions falls back to the 5 newest models from that provider (real created timestamps, no hardcoded "popular" list). `missingDiagnostics` (when present) gives a machine-readable reason per missing id: `unknown_provider` (the prefix before / isn't in th…

NameTypeReqDescription
idsarrayyesModel identifiers or aliases. Up to 100.
maxDescriptionCharsintegerTruncate descriptions to this many characters.
NameTypeReqDescription
_index9objectyes
ambiguousAliasesobject
missingDiagnosticsobject
missingIdsarrayyes
resolvedAliasesobject
resultsarrayyes
suggestionsobject

No examples provided.

list_facets ~128

Return the live vocabulary derived from the current model cache: providers (id-prefixes with model counts), capability flags (with counts), input/output modalities, and tokenizers. Use this once at the start of a session to learn what filter values find_models will accept, instead of trial-and-error against find_models. Response: { providers: { id, modelCount }[], capabilities: { id, modelCount }[], modalities: { input: string[], output: string[] }, tokenizers: string[], totalModels: number, updatedAt: string (ISO 8601) }. No inputs.

Input schema present but exposes no named parameters.

NameTypeReqDescription
_index9objectyes
capabilitiesarrayyes
modalitiesobjectyes
providersarrayyes
tokenizersarrayyes
totalModelsintegeryes
updatedAtstringyes

No examples provided.

test_model ~1,433

Run model tests on 1-10 models. Use dryRun=true to estimate token usage/cost, or dryRun=false (default) to run live OpenRouter inference. When dryRun=true: - No OpenRouter API key required - No inference call is made - Either `prompt` OR `expectedPromptTokens` is required (use the latter for capacity planning at sizes you don't want to paste in full) - expectedCompletionTokens defaults to 256 when omitted Parameters: - models: 1-10 model IDs to test (all receive identical prompts) - prompt: Prompt text (required for dryRun unless expectedPromptTokens is set; required for live unless userContent provided) - dryRun: If true, return cost estimates only - expectedPromptTokens: Estimated prompt-token count for dryRun cost estimation; overrides the prompt-string heuristic. Use to model "what would N-token requests cost?" without pasting N tokens. - expectedCompletionTokens: Optional completion token estimate used by dryRun - maxTokens, systemPrompt, temperature, topP, seed, responseFormat, enforceJson, retries: Live-testing controls (ignored when dryRun=true) - stream: Use OpenRouter's SSE streaming so capacity/refusal errors surface in ~1s instead of waiting the full per-model timeout for an empty 200. Defaults to false. - firstTokenTimeoutMs: Streaming-only deadline for the first delta. Defaults to 10s. If the upstream sends no token within this window, the request aborts and returns failureReason="timeout". Ignored when stream=false. - providerSort: "throughput" | "price" | "latency" — opt-in OpenRouter provider routing. Defaults to OpenRouter's load-balanced choice. - providerOrder: ordered list of provider slugs (up to 8). Try these providers first before falling back. Useful for steering around an overloaded provider for a single model. - fallbackModels: ordered list of model ids (up to 5). OpenRouter automatically retries the request against the next id when the primary is unavailable. Use sparingly — a benchmark should usually test the model you asked for, not…

NameTypeReqDescription
debugbooleanWhen true, include upstream finish_reason, provider, error, refusal, and usage.
dryRunbooleanWhen true, returns estimated token usage and cost without calling OpenRouter (no API key required).
enforceJsonbooleanWhen true, output must parse as JSON.
expectedCompletionTokensintegerExpected number of completion tokens for cost estimation (default: 256). Typical ranges: 100-500 for quick tests, 1000-2000 for code generation, 4000+ for long-form content. This is a heuristic — act…
expectedPromptTokensintegerExpected number of prompt tokens for dryRun cost estimation. When set, overrides the heuristic that counts characters from the literal `prompt` string — use this for capacity planning ("what would 60…
fallbackModelsarrayFallback model IDs OpenRouter may try if the primary is unavailable. Up to 5.
firstTokenTimeoutMsintegerStreaming-only first-token deadline in ms. Defaults to 10000.
maxTokensintegerCompletion token cap. For reasoning-capable models, set ≥ 2000 (or omit) — reasoning tokens count against this before visible output, and too-low caps cause finish_reason=length.
modelsarrayyesModel IDs to evaluate (1-10).
promptstringPrompt sent to each model.
providerOrderarrayProvider slugs to try first, in order. Up to 8.
providerSortstringOpenRouter provider routing sort: "throughput", "price", or "latency".
responseFormatobjectStructured output shape request forwarded to OpenRouter (e.g., { type: 'json_object' }).
retriesintegerRetries for transient failures.
seedintegerSeed for repeatable outputs.
streambooleanUse OpenRouter SSE streaming so capacity/refusal errors surface quickly. Defaults to false.
systemPromptstringSystem instruction prepended to prompt.
temperaturenumberSampling temperature (0-2).
timeoutMsintegerPer-model timeout in ms (default 15000, max 60000).
topPnumberNucleus sampling (0-1].
userContentarrayMultimodal user content. At least one of prompt or userContent required.

No output schema declared.

No examples provided.

Common questions

What is the Index9 MCP server?

Index9 is an MCP server listed in the public MCP registry as io.github.index9-org/mcp. Discover, shortlist, compare, cost-model, and live-test 300+ AI models from your editor. This page covers its npm package (@index9/mcp).

Is the Index9 MCP server safe to use?

Index9 scores 80 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Index9 MCP server expose?

Index9 exposes 5 tools: find_models, get_models, compare_models, list_facets, test_model. Their descriptions and schemas cost roughly 4,178 tokens of context every time the server is loaded.

Is the Index9 MCP server still maintained?

Index9 is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the Index9 MCP server under?

Index9 declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.