Index9
NPM · @INDEX9/MCP · SCANNED SEP 20
Discover, shortlist, compare, cost-model, and live-test 300+ AI models from your editor
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 95 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 116 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability58
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 5167 tokens (~1033/item across 5 items; 5 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management93
- Stability observed for 28 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (80% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 5 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 6 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the Index9 MCP server?
Index9 runs locally as an npm package, launched with npx -y @index9/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @index9/mcp
claude mcp add index9-org-mcp -- npx -y @index9/mcp
{
"mcpServers": {
"index9-org-mcp": {
"command": "npx",
"args": [
"-y",
"@index9/mcp"
]
}
}
} {
"servers": {
"index9-org-mcp": {
"command": "npx",
"args": [
"-y",
"@index9/mcp"
]
}
}
} codex mcp add index9-org-mcp -- npx -y @index9/mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"index9-org-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"@index9/mcp"
],
"enabled": true
}
}
} openclaw mcp add index9-org-mcp --command npx --arg -y --arg @index9/mcp
mcp_servers:
index9-org-mcp:
command: "npx"
args: ["-y", "@index9/mcp"] {
"McpServers": {
"index9-org-mcp": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@index9/mcp"
]
}
}
} assistant mcp add index9-org-mcp -t stdio -c npx -a -y @index9/mcp
{
"mcpServers": {
"index9-org-mcp": {
"command": "npx",
"args": [
"-y",
"@index9/mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 18 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 17 Sept 26 0
- Security disclosure: unverified → fail ▼ functional
- 16 Sept 26 −3
- Security disclosure: fail → unverified ▼ functional
- Stability: pass → 0.80 functional
- 15 Sept 26 +1
- Stability: 0.97 → pass security
- 13 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 11 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 9 Sept 26 −3
- Stability: pass → 0.80 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/@index9/mcp@6.5.2
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 95 packages
| Packages resolved | 95 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
compare_models Compare AI models side-by-side ~558
Compare 2-10 models side-by-side. Returns each model's full metadata plus a diff matrix highlighting which fields are equal and which differ. Use this when the user asks "which is cheaper / has more context / supports X" across multiple specific models. Faster than calling get_models and diffing yourself. Response: { models: ModelResponse[], diff: { contextLength, maxOutputTokens, promptPricePerMillion, completionPricePerMillion, tokenizer, inputModalities, outputModalities, capabilities, supportedParameters }, cheapestForPromptPerMillion, largestContext, missingIds, resolvedAliases?, ambiguousAliases?, suggestions?: Record<unknownId, Array<{id, name, created}>> (newest-first), missingDiagnostics? }. Each numeric/string diff field has { allEqual: boolean, values: Record<id, value|null> }. Capability/parameter diffs have { commonAll: string[], uniquePerModel: Record<id, string[]> }. cheapestForPromptPerMillion / largestContext are convenience picks across the supplied models — null when the field is missing on every model. Optional: pass `expectedPromptTokens` AND `expectedCompletionTokens` to also receive `workloadCosts` and `cheapestForRealisticWorkload` — the actual cheapest given the user's expected token mix. Each `workloadCosts[i]` carries `tokenCostUsd` (token-only), `requestCostUsd` (per-request fee), `totalCostUsd` (sum, includes request fees), and `pricingBasis` ("exact_per_token" | "rounded_per_million" | "unavailable"). This matters when prompt:completion price ratios diverge across models, or when a model has a per-request fee. Accepts the same alias formats as get_models. Unknown ids are returned in missingIds (with `suggestions[id]` as newest-first `{id, name, created}` entries when partial matches exist, plus `missingDiagnostics` carrying a machine-readable reason per id). When fewer than 2 ids resolve, this returns 400 with the diagnostics so you can retry with `suggestions[id][0].id` for each missing id.
| Name | Type | Req | Description |
|---|---|---|---|
| expectedCompletionTokens | integer | – | Optional. Pair with expectedPromptTokens to surface workloadCosts and cheapestForRealisticWorkload. Both must be set to enable workload costing. |
| expectedPromptTokens | integer | – | Optional. When set with expectedCompletionTokens, computes total per-call cost for each model and picks cheapestForRealisticWorkload — closes the gap where promptPerMillion alone misleads when prompt… |
| ids | array | yes | Model identifiers or aliases to compare (2-10). Same alias formats as get_models. |
| Name | Type | Req | Description |
|---|---|---|---|
| _index9 | object | yes | – |
| ambiguousAliases | object | – | – |
| cheapestForPromptPerMillion | string|null | yes | – |
| cheapestForRealisticWorkload | string|null | – | – |
| diff | object | yes | – |
| largestContext | string|null | yes | – |
| missingDiagnostics | object | – | – |
| missingIds | array | yes | – |
| models | array | yes | – |
| resolvedAliases | object | – | – |
| suggestions | object | – | – |
| workloadCosts | array | – | – |
No examples provided.
find_models Search AI models ~1,532
Filter 300+ AI models by structured constraints (capabilities, price, context, modality, provider). The semantic `q` is a soft tiebreaker on top of filters — trust filters first; weak `q`-only queries surface as `meta.confidence: "low"` with a hint to drop `q` and use `sortBy=created` or `sortBy=price` instead. Call this after list_facets (or directly when you already know the filters). Always include one call with sortBy=created (no q) when recommending models to the user — your training-data list of "good" models is likely stale, and sorting purely by price surfaces old tiny models and misses this month's cheap frontier. Extract filters from user queries. Numeric and categorical constraints MUST go in structured filters; `q` is for semantic flavor. Shorthand: 1K=1000, 1M=1000000. Prices are USD per million input tokens. Examples: - "1M context under $1" → q="model", minContext=1000000, maxPrice=1 - "cheap vision model from openai" → q="cheap vision model", capabilitiesAll=["vision"], provider="openai" - "function calling under $0.50 with 128K" → q="function calling", capabilitiesAll=["function_calling"], maxPrice=0.5, minContext=128000 - "cheapest paid model" → sortBy="price", sortOrder="asc", excludeFree=true - "best coding model" → q="best coding model" - "what's new" → sortBy="created" (no q needed) Valid capabilities: function_calling, structured_output, reasoning, web_search, vision, audio_input, file_input, image_generation, audio_output. Each result: id, name, description, created (unix seconds), createdAt (ISO 8601), contextLength, maxOutputTokens, pricing.{promptPerMillion, completionPerMillion} (rounded display $/M), pricing.{promptPerToken, completionPerToken, requestUsd} (exact, use for cost math), inputModalities[] / outputModalities[], capabilities[], score. With sortBy=price, results also expose pricing.effectivePromptPerMillion and pageInfo.priceSortBasis — sort order may diverge from displayed promptPerMillion for models with per-request fee…
| Name | Type | Req | Description |
|---|---|---|---|
| capabilitiesAll | array | – | Array of capabilities that must ALL be present on the model (AND logic). Valid values: function_calling, structured_output, reasoning, web_search, vision, audio_input, file_input, image_generation, a… |
| capabilitiesAny | array | – | Array of capabilities where at least ONE must be present (OR logic). Valid values: function_calling, structured_output, reasoning, web_search, vision, audio_input, file_input, image_generation, audio… |
| createdAfter | string | – | Lower bound for model created timestamp. |
| createdBefore | string | – | Upper bound for model created timestamp. |
| cursor | string | – | Opaque pagination cursor from a previous response's `nextCursor` field. IMPORTANT: cursors are bound to the exact query text, filters, and sort order that produced them. Reuse the same query+filters+… |
| excludeFree | boolean | – | When true, exclude models with id ending in ':free'. Useful for sortBy=price (which would otherwise be dominated by free-tier preview models) and when you want a paid SLA. Default false. |
| limit | integer | – | Page size (1-100, default 20). |
| maxPrice | number | – | Maximum effective prompt price in USD per million tokens. Matches the basis exposed in `pricing.effectivePromptPerMillion` and `pageInfo.priceSortBasis` — token price plus per-request fees scaled to… |
| minContext | integer | – | Minimum context window in tokens. |
| minPrice | number | – | Minimum effective prompt price in USD per million tokens. Matches the basis exposed in `pricing.effectivePromptPerMillion` and `pageInfo.priceSortBasis` — token price plus per-request fees scaled to… |
| modality | string | – | Required output modality. Filters on the model's output modalities, not input capabilities. For example, "image" finds image-generation models, while capabilitiesAll=["vision"] finds models that acce… |
| provider | array | – | Provider prefix filter. Array of provider slugs — a model matches if its ID starts with any of them (e.g., ['openai'] matches 'openai/gpt-4o'; ['openai','anthropic'] matches both). Pass a single-elem… |
| q | string | – | Natural language search query describing desired model characteristics (e.g., 'fast cheap coding model'). Uses semantic search with fuzzy matching. Must be at least 2 characters when provided. Option… |
| requireKeywordMatch | boolean | – | When true, suppress weak vector-only results from semantic queries. If no candidate has a BM25 keyword hit, returns an empty page with meta.confidence='low' and meta.lowConfidenceReason — instead of… |
| sortBy | string | – | Sort order for results. Options: 'relevance' (best semantic match, default), 'created' (newest models), 'price' (cheapest/most expensive, with sortOrder). Defaults to 'relevance'. |
| sortOrder | string | – | Sort order. Defaults by sortBy. |
| Name | Type | Req | Description |
|---|---|---|---|
| _index9 | object | yes | – |
| meta | object | yes | – |
| nextCursor | string|null | yes | – |
| pageInfo | object | yes | – |
| results | array | yes | – |
No examples provided.
get_models Inspect AI models ~527
Get full specs for one or more models by id or alias. Accepts up to 100 ids per call — use this for batch comparison. Call after find_models to inspect candidates, or directly when the user names a model (format: 'provider/model-name'). Response: { results: (Model | null)[], missingIds: string[], resolvedAliases?: Record<alias, canonicalId>, ambiguousAliases?: Record<alias, candidateIds[]>, suggestions?: Record<unknownId, Array<{id, name, created}>> }. Each non-null result has: - id, canonicalSlug, name, description - created (unix seconds), createdAt (ISO 8601), knowledgeCutoff (ISO date or null) - contextLength (tokens), maxOutputTokens, isModerated - pricing: { promptPerMillion, completionPerMillion, promptPerToken, completionPerToken, requestUsd, imageUsd } — *PerMillion is rounded display, *PerToken is exact (use for cost math). request/image are flat per-unit fees. - architecture: { inputModalities[], outputModalities[], tokenizer, instructType } - capabilities[]: normalized capability flags (same values as find_models and capabilitiesAll/Any) - supportedParameters[]: OpenRouter parameters the model accepts (e.g., "temperature", "tools", "response_format") Entries in results are null when the id is unknown; those ids appear in missingIds. Ambiguous aliases appear in ambiguousAliases with candidate canonical ids — pass a canonical id to disambiguate. Unknown ids that partially match (e.g. "sonnet" → all Claude Sonnet variants) appear in `suggestions` as up to 5 `{id, name, created}` entries **sorted newest-first** — pick `suggestions[id][0].id` for the most current replacement without a second lookup. When token-overlap finds nothing but the id is shaped like `provider/<unknown>` and the provider exists, suggestions falls back to the 5 newest models from that provider (real created timestamps, no hardcoded "popular" list). `missingDiagnostics` (when present) gives a machine-readable reason per missing id: `unknown_provider` (the prefix before / isn't in th…
| Name | Type | Req | Description |
|---|---|---|---|
| ids | array | yes | Model identifiers or aliases. Up to 100. |
| maxDescriptionChars | integer | – | Truncate descriptions to this many characters. |
| Name | Type | Req | Description |
|---|---|---|---|
| _index9 | object | yes | – |
| ambiguousAliases | object | – | – |
| missingDiagnostics | object | – | – |
| missingIds | array | yes | – |
| resolvedAliases | object | – | – |
| results | array | yes | – |
| suggestions | object | – | – |
No examples provided.
list_facets List filter vocabulary ~128
Return the live vocabulary derived from the current model cache: providers (id-prefixes with model counts), capability flags (with counts), input/output modalities, and tokenizers. Use this once at the start of a session to learn what filter values find_models will accept, instead of trial-and-error against find_models. Response: { providers: { id, modelCount }[], capabilities: { id, modelCount }[], modalities: { input: string[], output: string[] }, tokenizers: string[], totalModels: number, updatedAt: string (ISO 8601) }. No inputs.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| _index9 | object | yes | – |
| capabilities | array | yes | – |
| modalities | object | yes | – |
| providers | array | yes | – |
| tokenizers | array | yes | – |
| totalModels | integer | yes | – |
| updatedAt | string | yes | – |
No examples provided.
test_model Test AI models live ~1,433
Run model tests on 1-10 models. Use dryRun=true to estimate token usage/cost, or dryRun=false (default) to run live OpenRouter inference. When dryRun=true: - No OpenRouter API key required - No inference call is made - Either `prompt` OR `expectedPromptTokens` is required (use the latter for capacity planning at sizes you don't want to paste in full) - expectedCompletionTokens defaults to 256 when omitted Parameters: - models: 1-10 model IDs to test (all receive identical prompts) - prompt: Prompt text (required for dryRun unless expectedPromptTokens is set; required for live unless userContent provided) - dryRun: If true, return cost estimates only - expectedPromptTokens: Estimated prompt-token count for dryRun cost estimation; overrides the prompt-string heuristic. Use to model "what would N-token requests cost?" without pasting N tokens. - expectedCompletionTokens: Optional completion token estimate used by dryRun - maxTokens, systemPrompt, temperature, topP, seed, responseFormat, enforceJson, retries: Live-testing controls (ignored when dryRun=true) - stream: Use OpenRouter's SSE streaming so capacity/refusal errors surface in ~1s instead of waiting the full per-model timeout for an empty 200. Defaults to false. - firstTokenTimeoutMs: Streaming-only deadline for the first delta. Defaults to 10s. If the upstream sends no token within this window, the request aborts and returns failureReason="timeout". Ignored when stream=false. - providerSort: "throughput" | "price" | "latency" — opt-in OpenRouter provider routing. Defaults to OpenRouter's load-balanced choice. - providerOrder: ordered list of provider slugs (up to 8). Try these providers first before falling back. Useful for steering around an overloaded provider for a single model. - fallbackModels: ordered list of model ids (up to 5). OpenRouter automatically retries the request against the next id when the primary is unavailable. Use sparingly — a benchmark should usually test the model you asked for, not…
| Name | Type | Req | Description |
|---|---|---|---|
| debug | boolean | – | When true, include upstream finish_reason, provider, error, refusal, and usage. |
| dryRun | boolean | – | When true, returns estimated token usage and cost without calling OpenRouter (no API key required). |
| enforceJson | boolean | – | When true, output must parse as JSON. |
| expectedCompletionTokens | integer | – | Expected number of completion tokens for cost estimation (default: 256). Typical ranges: 100-500 for quick tests, 1000-2000 for code generation, 4000+ for long-form content. This is a heuristic — act… |
| expectedPromptTokens | integer | – | Expected number of prompt tokens for dryRun cost estimation. When set, overrides the heuristic that counts characters from the literal `prompt` string — use this for capacity planning ("what would 60… |
| fallbackModels | array | – | Fallback model IDs OpenRouter may try if the primary is unavailable. Up to 5. |
| firstTokenTimeoutMs | integer | – | Streaming-only first-token deadline in ms. Defaults to 10000. |
| maxTokens | integer | – | Completion token cap. For reasoning-capable models, set ≥ 2000 (or omit) — reasoning tokens count against this before visible output, and too-low caps cause finish_reason=length. |
| models | array | yes | Model IDs to evaluate (1-10). |
| prompt | string | – | Prompt sent to each model. |
| providerOrder | array | – | Provider slugs to try first, in order. Up to 8. |
| providerSort | string | – | OpenRouter provider routing sort: "throughput", "price", or "latency". |
| responseFormat | object | – | Structured output shape request forwarded to OpenRouter (e.g., { type: 'json_object' }). |
| retries | integer | – | Retries for transient failures. |
| seed | integer | – | Seed for repeatable outputs. |
| stream | boolean | – | Use OpenRouter SSE streaming so capacity/refusal errors surface quickly. Defaults to false. |
| systemPrompt | string | – | System instruction prepended to prompt. |
| temperature | number | – | Sampling temperature (0-2). |
| timeoutMs | integer | – | Per-model timeout in ms (default 15000, max 60000). |
| topP | number | – | Nucleus sampling (0-1]. |
| userContent | array | – | Multimodal user content. At least one of prompt or userContent required. |
No output schema declared.
No examples provided.
What is the Index9 MCP server?
Index9 is an MCP server listed in the public MCP registry as io.github.index9-org/mcp. Discover, shortlist, compare, cost-model, and live-test 300+ AI models from your editor. This page covers its npm package (@index9/mcp).
Is the Index9 MCP server safe to use?
Index9 scores 80 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Index9 MCP server expose?
Index9 exposes 5 tools: find_models, get_models, compare_models, list_facets, test_model. Their descriptions and schemas cost roughly 4,178 tokens of context every time the server is loaded.
Is the Index9 MCP server still maintained?
Index9 is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Index9 MCP server under?
Index9 declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.