Orca MCP Server

NPM · @ORCALANG/ORCA-MCP-SERVER · SCANNED AUG 3

Go from natural language to verified finite state machines — topology bugs caught before code runs.

Available components

+18 this week 71 71 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security87

No malware found by supply-chain analysis.Pass
Only part of the dependency tree could be resolved (99 of 103), so this covers what we could see, not the whole tree.Partial
No install/post-install scripts declared.Pass
Only part of the dependency tree could be resolved (99 of 103), so this covers what we could see, not the whole tree. View diagnostics → Partial

Provenance & Transparency45

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
Clear OSI-approved license (Apache-2.0).Pass
Actively maintained (last published 61 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability85

100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
AI-judged instruction clarity (excellent).Pass
Tool/resource definitions use about 1597 tokens (~106/item across 15 items; 12 tools + 3 resources), lean.Pass
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management27

Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial

Tool Coverage100

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
100% of tool parameters carry a description.Pass

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · @orcalang/orca-mcp-server

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add jascal-orca-mcp-server -- npx -y @orcalang/orca-mcp-server

# add to Codex CLI

codex mcp add jascal-orca-mcp-server -- npx -y @orcalang/orca-mcp-server

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "jascal-orca-mcp-server": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@orcalang/orca-mcp-server"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add jascal-orca-mcp-server --command npx --arg -y --arg @orcalang/orca-mcp-server

# ~/.hermes/config.yaml

mcp_servers:
  jascal-orca-mcp-server:
    command: "npx"
    args: ["-y", "@orcalang/orca-mcp-server"]

// mcp.json

{
  "mcpServers": {
    "jascal-orca-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@orcalang/orca-mcp-server"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

3 Aug 26 +4
- Stability: unverified → 0.27 ▲ functional
2 Aug 26 +60
- Provenance: unverified → fail ▼ security
- Known CVEs: unverified → partial ▲ security
- Install scripts: unverified → pass ▲ security
- Malware scan: unverified → pass ▲ security
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- Dependency health: partial → unverified ▼ functional
- MCP protocol: unverified → pass ▲ functional
- Maintenance: unverified → pass ▲ functional
- License: unverified → pass ▲ functional
- Schema quality: unverified → excellent ▲ functional
- Tool coverage: unverified → 100 ▲ functional
- Schema quality: unverified → 100 ▲ functional
- Licence: Apache-2.0 functional
1 Aug 26 −28
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
31 Jul 26 −18
- Malware scan: pass → unverified ▼ security
29 Jul 26 +28
- Dependency health: partial → unverified ▼ functional
- Schema quality: unverified → 100 ▲ functional
- Tool coverage: unverified → 100 ▲ functional
28 Jul 26 −28
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: 100 → unverified ▼ functional
- Dependency health: unverified → partial ▲ functional
27 Jul 26 53

First indexed and scored.

Show 4 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/@orcalang/[email protected]

Provenance none

Ecosystem: npm · Outcome: none

Dependencies 99 packages

99 packages in the resolved dependency tree · 97 deprecated · 29 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 12 exposed · ~988 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

compile_decision_table ~70

Compile verified decision table to TypeScript, Python, Go, or Rust evaluator function, or portable JSON. Run verify_decision_table first.

Input Output Examples

Name	Type	Req	Description
source	string	yes	Raw .orca.md content containing a # decision_table heading.
target	string	—	Compilation target (default: typescript)

No output schema declared.

No examples provided.

compile_machine ~108

Compile verified machine to XState v5 TypeScript or Mermaid stateDiagram-v2. Run verify_machine first. target: "xstate" (default) or "mermaid".

Input Output Examples

Name	Type	Req	Description
source	string	yes	Raw .orca.md content. Must start with "# machine Name". States use "## state Name [initial\|final]". Transitions use a markdown table with columns: Source, Event, Guard, Target, Action.
target	string	—	Compilation target (default: xstate)

No output schema declared.

No examples provided.

generate_actions ~148

Generate action scaffold code from verified machine. lang: typescript (default), python, go, or rust. Pass verified .orca.md source. use_llm: true for implementations vs templates. generate_tests: true for test scaffolds.

Input Output Examples

Name	Type	Req	Description
generate_tests	boolean	—	Include test scaffolds in the output (default: false)
lang	string	—	Target language (default: typescript)
source	string	yes	Raw .orca.md content of a valid machine. Actions in the "## actions" table (\| Name \| Signature \|) will have stubs generated.
use_llm	boolean	—	Use LLM to generate implementations instead of templates (default: false)

No output schema declared.

No examples provided.

generate_decision_table ~52

Generate a decision table in .orca.md format from a natural language spec. Always verify_decision_table next. Requires LLM API key.

Input Output Examples

Name	Type	Req	Description
spec	string	yes	Natural language description of the decision logic

No output schema declared.

No examples provided.

generate_machine ~66

Generate draft .orca.md from natural language spec. Returns source + is_multi flag. Always verify_machine next, then refine_machine if errors. Requires LLM API key (ANTHROPIC_API_KEY, etc.).

Input Output Examples

Name	Type	Req	Description
spec	string	yes	Natural language description of the desired state machine

No output schema declared.

No examples provided.

generate_multi_machine ~65

Generate coordinated multi-machine .orca.md from spec (machines separated by ---). Use invoke: ChildMachine in states. Always verify_machine next, then refine_machine if errors. Requires LLM API key.

Input Output Examples

Name	Type	Req	Description
spec	string	yes	Natural language description of the desired multi-machine system

No output schema declared.

No examples provided.

parse_decision_table ~76

Parse decision table from .orca.md source → JSON (conditions, actions, rules). Syntax: # decision_table Name, ## conditions table, ## actions table, ## rules table. Can be standalone or combined with machines in the same file.

Input Output Examples

Name	Type	Req	Description
source	string	yes	Raw .orca.md content containing a # decision_table heading.

No output schema declared.

No examples provided.

parse_machine ~108

Input Output Examples

Name	Type	Req	Description
source	string	yes	Raw .orca.md content. Must start with "# machine Name". States use "## state Name [initial\|final]". Transitions use a markdown table with columns: Source, Event, Guard, Target, Action.

No output schema declared.

No examples provided.

refine_machine ~108

Fix verify_machine errors using LLM. Loops until valid or max_iterations (default: 3). Pass errors array from verify_machine output, or omit to auto-verify first.

Input Output Examples

Name	Type	Req	Description
errors	array	—	Verification errors from verify_machine. If omitted, verification runs automatically.
max_iterations	number	—	Maximum refinement iterations (default: 3)
source	string	yes	Raw .orca.md content with errors. Must use "# machine Name" heading and proper Orca markdown syntax.

No output schema declared.

No examples provided.

server_status ~35

Return MCP server version, active LLM provider/model, and configuration. API keys are never exposed — only whether a key is configured.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

verify_decision_table ~56

Verify decision table: checks completeness (all condition combinations covered), consistency (no contradictory rules), redundancy. Returns structured errors with codes and suggestions.

Input Output Examples

Name	Type	Req	Description
source	string	yes	Raw .orca.md content containing a # decision_table heading.

No output schema declared.

No examples provided.

verify_machine ~96

Verify machine structure: checks [initial] presence (exactly one), reachability, no deadlocks, guard determinism. Returns structured errors with codes and suggestions. Run before compile_machine.

Input Output Examples

Name	Type	Req	Description
source	string	yes	Raw .orca.md content. Must start with "# machine Name". States use "## state Name [initial\|final]". Transitions use a markdown table with columns: Source, Event, Guard, Target, Action.

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

27 Jul 3 Aug