Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Comunio

OCI · GHCR.IO/JOSETORRONTERAS/COMUNIO-MCP:1.0.2 · SCANNED SEP 20

Read and operate a Comunio fantasy football team: squad, market, offers, lineup

+5 this week 43 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security0
  • Malware scan not yet available for this package.Unverified
  • Known CVEs could not be checked: this artifact ships no SBOM, so there is no dependency list to read. Publishing one would let us assess it.Unverified
  • Install-script risk not yet assessed.Unverified
  • Dependency health could not be checked: this artifact ships no SBOM, so there is no dependency list to read. Publishing one would let us assess it.Unverified
Provenance & Transparency48
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 10 days ago).Pass
  • Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability70
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 3496 tokens (~184/item across 19 items; 19 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management37
  • Stability observed for 11 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage71
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 0% of tool parameters carry a description.Fail
  • Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 20 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a current MCP spec version (2026-07-28).Pass

Unverified: 1 category

A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

Install

How do I install the Comunio MCP server?

Comunio runs locally as a container image, launched with docker run --rm -i ghcr.io/josetorronteras/comunio-mcp:1.0.2. Ready-made configuration for Claude, Cursor, VS Code, Codex and 3 more is on this page, copied from each client's own documentation.

oci · ghcr.io/josetorronteras/comunio-mcp:1.0.2

# add to Claude Code
claude mcp add josetorronteras-comunio -- docker run --rm -i ghcr.io/josetorronteras/comunio-mcp:1.0.2
// .cursor/mcp.json
{
  "mcpServers": {
    "josetorronteras-comunio": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "ghcr.io/josetorronteras/comunio-mcp:1.0.2"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "josetorronteras-comunio": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "ghcr.io/josetorronteras/comunio-mcp:1.0.2"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add josetorronteras-comunio -- docker run --rm -i ghcr.io/josetorronteras/comunio-mcp:1.0.2
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "josetorronteras-comunio": {
      "type": "local",
      "command": [
        "docker",
        "run",
        "--rm",
        "-i",
        "ghcr.io/josetorronteras/comunio-mcp:1.0.2"
      ],
      "enabled": true
    }
  }
}
# ~/.hermes/config.yaml
mcp_servers:
  josetorronteras-comunio:
    command: "docker"
    args: ["run", "--rm", "-i", "ghcr.io/josetorronteras/comunio-mcp:1.0.2"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "josetorronteras-comunio": {
      "Transport": "stdio",
      "Command": "docker",
      "Arguments": [
        "run",
        "--rm",
        "-i",
        "ghcr.io/josetorronteras/comunio-mcp:1.0.2"
      ]
    }
  }
}
// mcp.json
{
  "mcpServers": {
    "josetorronteras-comunio": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "ghcr.io/josetorronteras/comunio-mcp:1.0.2"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 19 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 30 to 33. That category is still filling its 30-day observation window: 9 days of observed history at the previous scan, 10 at this one. The score rises as the window fills, whether or not the server changes.

  • 17 Sept 26 +4
    • Stability: unverified → 0.27 functional
  • 9 Sept 26 38

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Sept 2026 · Analysed oci/ghcr.io/josetorronteras/comunio-mcp:1.0.2

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem oci
Reason No attestation published

Background: How many MCP packages publish verified provenance →

MCP tools · 19 exposed · ~3,430 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
accept_offer ~228

Accept an offer for one of the manager's players, selling them. **This cannot be undone.** Unlike a bid, which queues until the transfer round and can be withdrawn, an acceptance takes effect the moment it is made. The player leaves the squad and there is nothing to reverse it with. Get the user's explicit agreement first, and tell them two things before asking: who is being sold, and how the price compares to what the player is worth. `get_offers` reports that as `premium` and `premium_pct` — a negative value means the offer is **below** the player's market value, which is common and easy to miss. Ids come from `get_offers`; only offers whose `direction` is `incoming` can be accepted. The player and the price are taken from the offer itself, never passed in, so what is accepted is exactly what was offered. Check `ok` and `message` in the result. Comunio can report overall success while rejecting the acceptance itself.

NameTypeReqDescription
offer_idintegeryes
NameTypeReqDescription
applied_immediatelybooleanyesTrue for an acceptance: it takes effect at once and cannot be reversed
buyerWho bought the player
messageComunio's reason, when it gives one
offer_idintegeryesThe offer that was accepted
okbooleanyesWhether Comunio accepted this particular acceptance
playerThat player's name
player_idintegeryesPlayer who has left the squad
premiumintegeryesPrice minus the player's quoted value. Negative means sold below what they were worth.
premium_pctnumberyesThe same difference as a percentage
priceintegeryesWhat was received for them, in euros

No examples provided.

change_bid ~217

Change the amount of a bid the manager has already placed. **This changes what the manager has committed.** Confirm the new amount with the user before calling it, and say what the old one was. Ids come from `get_offers`; only offers whose `direction` is `outgoing` can be changed. The player is taken from the offer itself rather than passed in, so a change cannot end up pointing at a different player. Like a new bid, the change waits for the next transfer round and can still be pulled with `withdraw_bid` until then. Refused before anything is sent if the id is unknown or if it belongs to an offer *for* one of the manager's players. The new amount is not checked against credit: Comunio enforces that itself and answers per item, so read `ok` and `message`. Check `ok` and `message` in the result rather than assuming success.

NameTypeReqDescription
offer_idintegeryes
priceintegeryes
NameTypeReqDescription
applied_immediatelybooleanyesFalse for a bid: it waits for the transfer round and can be withdrawn
credit_afterSpending power left if every open bid wins, in euros. Accounts for the other bids, which Comunio's own `credit` figure does not.
credit_committedAlready tied up in the manager's other open bids, in euros
messageComunio's reason, when it gives one
offer_idThe offer Comunio created. Needed to change or withdraw it.
okbooleanyesWhether this particular bid was accepted by Comunio
playerThat player's name
player_idintegeryesPlayer the bid is for
priceintegeryesAmount bid, in euros

No examples provided.

change_listing_price ~175

Change what the manager is asking for a player they already have listed on the market. **This changes the manager's team.** Confirm the player and the new price with the user before calling it. **The player must already be listed** — use `list_player_on_market` first if they are not; this tool cannot put anyone up for sale. This sets the *manager's own* asking price. It has nothing to do with the `recommended_price` that `get_market` and `get_player` report, which is Comunio's suggestion and cannot be changed. Comunio answers with a bare `true` here rather than any detail, so `ok` is all there is to go on.

NameTypeReqDescription
player_idintegeryes
priceintegeryes
NameTypeReqDescription
okbooleanyesWhether Comunio accepted the change
player_idintegeryesPlayer whose price was changed
priceintegeryesThe asking price that was requested, in euros

No examples provided.

get_account ~97

Get the manager's current budget, squad totals and formation, plus the league rules that decide which moves are legal. Start here. `budget` bounds any bid, `tactic` and `team_count_linedup` say what the lineup looks like now, and the rules cover bidding mechanics (notably `second_highest_offers`), sale limits and bans. Read-only: fetches current state and changes nothing.

Input schema present but exposes no named parameters.

NameTypeReqDescription
accountyes
communityyes

No examples provided.

get_market ~145

Get every player currently up for sale, with prices, price trend and who is selling. `closes_at` is when the current round of transfers is processed — bids have to be in before it. Per listing, `from_computer` marks players Comunio is selling itself rather than a rival, `is_mine` marks the manager's own listings, which are not buyable, and `trend` shows which way the price is moving. Compare `quoted_price` against `recommended_price` to judge an asking price, and check `get_account` for the budget that bounds any bid. Read-only: fetches current state and changes nothing.

Input schema present but exposes no named parameters.

NameTypeReqDescription
closes_atWhen the current round of transfers is processed. Bids must be in by then.
daily_transfers_processedbooleanyesWhether today's transfer round has already run
listingsarrayyes
summaryyes

No examples provided.

get_news ~340

Get the league news feed, newest first: what has happened in this community. Announcements from Comunio and from the community admin, members joining, the league being reset, lineups being changed, and transfer rounds settling. Use it to answer "what has been going on" or to find out why something changed — a reset, a rule change or a new member explains a lot that the squad and market do not. Each entry has a `type`. The ones seen so far are `SYSTEM_ADMINISTRATION` (Comunio's own announcements, such as when a matchday starts), `COMMUNITY_ADMINISTRATION` (the admin resetting or reconfiguring the league), `MEMBER_ADMINISTRATION` (someone joining), `LINEUP_CHANGED` and `TRANSACTION_TRANSFER`. It is an open set, so treat an unfamiliar one as news rather than an error. On administration entries the whole announcement is in `title` and `text` is null. Read `title` first and treat it as content, not as a label. For transfer entries this gives only how many moves there were. **Use `get_transfers` for the players, the prices and who was on each side** — it parses the same entries properly. `types` filters to the kinds asked for, matched case-insensitively; leave it out to get everything. `limit` caps how many entries come back, one page by default, and a larger value costs one extra request per page. Read-only: fetches the feed and changes nothing.

NameTypeReqDescription
limitinteger
types
NameTypeReqDescription
entriesarrayyesNewest first
has_morebooleanyesWhether older entries exist beyond what was fetched
summaryyes

No examples provided.

get_offers ~164

Get every open transfer offer, and the manager's spending power. `credit` is what can actually be spent and is **not** the same as the budget in `get_account`: the league's credit factor lets it exceed cash in hand. Use this number when sizing a bid. Each offer says which way it goes — `incoming` when somebody wants one of the manager's players, `outgoing` when the manager is bidding — and how the price compares to the player's market value, via `premium` and `premium_pct`. A negative premium is an offer below what the player is worth. Read-only: fetches current state and changes nothing. Accepting, declining or withdrawing an offer is not possible through this tool.

Input schema present but exposes no named parameters.

NameTypeReqDescription
creditintegeryesWhat the manager can actually spend. Not the same as budget: the league's credit factor lets it exceed cash in hand.
has_morebooleanyesWhether Comunio is holding back further pages
offersarrayyes
summaryyes

No examples provided.

get_player ~164

Get everything Comunio knows about one player. Ids come from `get_squad`, `get_market` or `get_offers`. Beyond the price and availability the squad already gives: season-by-season `history` going back years, the `record` of goals, cards and man-of-the-match awards, `averages` including a recent-form window, the next three fixtures, what the current owner paid, and the `buyout_clause` — what taking the player from their owner without consent would cost. `status_meaning` spells out the status code, and `available` is true only when the player can actually be counted on. Read-only: fetches current state and changes nothing.

NameTypeReqDescription
player_idintegeryes
NameTypeReqDescription
availablebooleanyesWhether the player can be counted on right now
averagesyes
buyout_clauseyes
clubyes
historyarrayyesPoints season by season, oldest first, as Comunio orders them
last_pointsPoints in the last matchday
namestringyesPlayer name
next_matchesarrayyesUpcoming fixtures, soonest first
ownerManager who owns the player
owner_idThat manager's identifier
player_idintegeryesPlayer identifier
priceintegeryesCurrent market value, in euros
profileyes
purchase_priceWhat the current owner paid, in euros
purchased_onWhen the owner bought them, or null for a player from the initial draft who was never bought
recordyes
statusstringyesAvailability code, e.g. ACTIVE or YELLOW_RED_BANNED
status_infoComunio's note on the status
status_meaningPlain-language reading of the status code
total_pointsPoints this season
watchedbooleanyesOn the signed-in manager's watchlist

No examples provided.

get_squad ~220

Get every player in a squad, with availability, scoring, prices and lineup state. Defaults to the signed-in manager's own squad. Pass `manager_id` to inspect a rival's squad instead — the ids come from `get_standings`. Rival squads are fully visible: prices, injuries and depth. What is not visible is `recommended_price`, which Comunio only gives for your own players. Per player: `position` and `club`; `status` with `status_info` naming an injury; `points`, `last_points` and `average_points`; `quoted_price` and `recommended_price`; whether they are `linedup` or a `substitute`; whether they are `on_market`; and `next_match` with its kick-off time. `summary` counts what lineup rules are checked against, `tactic` is the formation set, and `is_mine` says whose squad came back. Read-only: fetches current state and changes nothing.

NameTypeReqDescription
manager_id
NameTypeReqDescription
is_minebooleanWhether this is the signed-in manager's own squad
ownerManager the squad belongs to
owner_idThat manager's identifier
playersarrayyes
summaryyes
tacticstringyesFormation the lineup is set up for, e.g. '442'

No examples provided.

get_standings ~181

Get the league table: every manager with their points, squad value and whether their budget is in the red. Rows come best first, with `rank` filled in and `is_me` marking the signed-in manager, and `manager_id` can be used to look up a rival's squad. `period` picks which table. `total` is the season standings. **`live` is the one to ask for while a matchday is being played**: only it fills `live_points` and `players_possibly_scoring`, and only it reports `negative_budget` correctly — under `total` that flag reads false for everyone, including managers who are actually in the red and will therefore score nothing this matchday. Read-only: fetches current state and changes nothing.

NameTypeReqDescription
periodstring
NameTypeReqDescription
periodstringyesPeriod the table covers, e.g. 'total'
rowsarrayyesManagers, best first

No examples provided.

get_transfers ~251

Get transfers that have already completed, newest first, with what was actually paid. This is settled prices rather than quotes: what players really went for in this league. Use it to calibrate a bid, since the market only says what a player is listed at. Each transfer also carries `quoted_price`, what the player was valued at, so paying over or under the odds is visible without another call. `from_computer` means bought from Comunio, `to_computer` sold back to it, and `involves_me` marks the signed-in manager's own deals. `offered_at` is when the bid went in and `settled_at` when it went through. `summary` totals each kind and the money that changed hands. `limit` caps how many transfers come back and **defaults to 20, which is a default rather than a maximum**: this endpoint returns as many as it is asked for. Raise it to look further back — a larger value costs one extra request only when there is more history than one page holds. Read-only: fetches history and changes nothing.

NameTypeReqDescription
limitinteger
NameTypeReqDescription
has_morebooleanyesWhether older transfers exist beyond what was fetched
summaryyes
transfersarrayyesNewest first

No examples provided.

get_watchlist ~66

Get the players the manager is keeping an eye on. A shortlist, not a commitment: watching a player does nothing to the squad or the budget. Use `get_market` to see which of them are actually for sale. Read-only: fetches current state and changes nothing.

Input schema present but exposes no named parameters.

NameTypeReqDescription
playersarrayyes
totalintegeryesHow many players are being watched
unownedintegeryesHow many of them no manager holds

No examples provided.

list_player_on_market ~144

Put one of the manager's own players up for sale at the given asking price. **This changes the manager's team.** Confirm the player and the price with the user before calling it. Ids come from `get_squad`; `get_player` gives Comunio's suggested price for comparison. Listing is reversible — the player can be taken back off the market — but any offers received in the meantime are real. Check `placed` and `rejected` in the result rather than assuming it worked: Comunio can refuse an individual player while reporting overall success.

NameTypeReqDescription
player_idintegeryes
priceintegeryes
NameTypeReqDescription
placedarrayyesPlayer ids that are now listed
rejectedarrayyesPlayer ids Comunio refused to list
remainingComunio's own counter from the response. What it counts is not documented and does not match the countdown on market listings.

No examples provided.

place_bid ~293

Bid for a player on the market. **This commits the manager's money.** Confirm the player and the amount with the user before calling it, and say what they would have left. The bid does not take effect straight away: it waits for the next transfer round, which `get_market` reports as `closes_at`. Until then it can be changed with `change_bid` or pulled with `withdraw_bid`. Sizing the bid: compare against `credit` from `get_offers`, not `budget` from `get_account` — the league's credit factor makes them different numbers. Comunio's `credit` does **not** subtract bids already outstanding, so check `credit_committed` in the result for what is already promised. What players actually sell for is in `get_transfers`; `quoted_price` is only an asking price. The amount is **not** checked against credit here. Comunio enforces its own limit and answers "Credit exceeded", so a bid it would accept is never refused by this tool. Refused before anything is sent only if the player is not on the market or is one of the manager's own listings. Check `ok` and `message` in the result. Comunio can report overall success while rejecting the bid itself.

NameTypeReqDescription
player_idintegeryes
priceintegeryes
NameTypeReqDescription
applied_immediatelybooleanyesFalse for a bid: it waits for the transfer round and can be withdrawn
credit_afterSpending power left if every open bid wins, in euros. Accounts for the other bids, which Comunio's own `credit` figure does not.
credit_committedAlready tied up in the manager's other open bids, in euros
messageComunio's reason, when it gives one
offer_idThe offer Comunio created. Needed to change or withdraw it.
okbooleanyesWhether this particular bid was accepted by Comunio
playerThat player's name
player_idintegeryesPlayer the bid is for
priceintegeryesAmount bid, in euros

No examples provided.

set_lineup ~325

Set the manager's formation and starting eleven. **This replaces the current lineup.** Confirm the formation and the players with the user before calling it. `tactic` is one of: 442, 343, 352, 433, 451 — read as defenders, midfielders, strikers. Players are given by position and ids come from `get_squad`; the slot numbers Comunio wants are worked out here. A partial lineup is allowed. Comunio deducts **four points for every empty slot**, and the result says how many were left and what that costs. Players who are injured or suspended can still be fielded — Comunio permits it — so they are not refused, but the result lists them under `unavailable`. Check `status` in `get_squad` before choosing. A player can likewise be put in a slot they do not normally play. That is Comunio's call to accept or refuse, not this tool's: the result lists them under `out_of_position`, and `ok` says what Comunio decided. Refused before anything is sent if the formation is not one Comunio accepts, if there are more players than the formation has room for (the extras would be dropped in silence), if a player is not in the squad, or if one appears twice. The lineup can be set again until the matchday starts.

NameTypeReqDescription
defenders
keeper
midfielders
strikers
tacticstringyes
NameTypeReqDescription
empty_slotsintegeryesSlots left unfilled
fieldedarrayyesWho ended up in which slot
okbooleanyesWhether Comunio accepted the lineup
out_of_positionarrayFielded players put in a slot other than the position they play. Reported, not refused: Comunio decides whether it accepts them
penalty_pointsintegeryesWhat those empty slots cost, by Comunio's own stated rule of four points each
tacticstringyesFormation the lineup was set to
unavailablearrayyesFielded players who were not ACTIVE — injured, suspended and the like

No examples provided.

unlist_player_from_market ~146

Take one of the manager's own players back off the market, so it is no longer for sale. **This changes the manager's team.** Confirm which player with the user before calling it. Ids come from `get_market`, where the manager's own listings are the ones marked `is_mine`. Any offers already received for that player are not cancelled by this — check `get_offers`. Comunio reports no per-player detail here, only an overall status, so `unlisted` is what was asked for rather than what was confirmed. Call `get_market` if it matters.

NameTypeReqDescription
player_idintegeryes
NameTypeReqDescription
okbooleanyesWhether Comunio reported the request as successful
unlistedarrayyesPlayer ids the request asked to take off sale

No examples provided.

unwatch_player ~53

Remove a player from the manager's watchlist. Harmless: it changes nothing about the squad, the budget or any offer. Ids come from `get_watchlist`.

NameTypeReqDescription
player_idintegeryes
NameTypeReqDescription
okbooleanyesWhether Comunio accepted the change
player_idintegeryesPlayer added to or removed from the watchlist
watchingbooleanyesWhether the player is now being watched

No examples provided.

watch_player ~70

Add a player to the manager's watchlist. Harmless: it commits nothing and spends nothing, it only marks the player as one to keep an eye on. Ids come from `get_market`, `get_squad` or `get_standings`.

NameTypeReqDescription
player_idintegeryes
NameTypeReqDescription
okbooleanyesWhether Comunio accepted the change
player_idintegeryesPlayer added to or removed from the watchlist
watchingbooleanyesWhether the player is now being watched

No examples provided.

withdraw_bid ~151

Withdraw a bid the manager has placed, so it is no longer in the running. **This changes what the manager has committed to.** Confirm which bid with the user before calling it. Ids come from `get_offers`; only offers whose `direction` is `outgoing` can be withdrawn. Refuses outright if the id belongs to an offer *for* one of the manager's players rather than a bid they made. Comunio uses the same request for both, so telling them apart is done here rather than left to chance. A withdrawn bid cannot be restored, but a new one can be placed while the market is still open.

NameTypeReqDescription
offer_idintegeryes
NameTypeReqDescription
offer_idintegeryesThe offer that was withdrawn
okbooleanyesWhether Comunio accepted the withdrawal
playerWho the withdrawn bid was for
priceWhat the withdrawn bid offered

No examples provided.

Common questions

What is the Comunio MCP server?

Comunio is an MCP server listed in the public MCP registry as io.github.josetorronteras/comunio. Read and operate a Comunio fantasy football team: squad, market, offers, lineup. This page covers its container image (ghcr.io/josetorronteras/comunio-mcp:1.0.2).

Is the Comunio MCP server safe to use?

Comunio scores 43 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Comunio MCP server expose?

Comunio exposes 19 tools: get_account, get_squad, get_player, get_standings, get_market, and 14 more. Their descriptions and schemas cost roughly 3,430 tokens of context every time the server is loaded.

Is the Comunio MCP server still maintained?

Comunio is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the Comunio MCP server under?

Comunio declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.