Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

ARNO

MCPB · ARNO-MCP_V0.0.17.MCPB · 2 COMPONENTS

The IDE for agents: read by symbol, edit against a revision, validate with your own build, revert.

−2 this week 47 Trust /100

Last scanned (8 hours ago)

Scores higher than 77% of MCPB servers

Category Developer Tools

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security0
  • No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.Unverified
  • Known CVEs could not be checked: we found no dependency list to check in this bundle: either it runs a compiled binary, whose bundled manifests we do not read, or none of the package.json, requirements.txt, pyproject.toml or uv.lock files it ships for its runtime declares a dependency we can read (a requirements.txt that only points at a setup.py project, a local path, or a nested requirements file we cannot follow counts as none).Unverified
  • Install-script risk not yet assessed.Unverified
  • Dependency health could not be checked: we found no dependency list to check in this bundle: either it runs a compiled binary, whose bundled manifests we do not read, or none of the package.json, requirements.txt, pyproject.toml or uv.lock files it ships for its runtime declares a dependency we can read (a requirements.txt that only points at a setup.py project, a local path, or a nested requirements file we cannot follow counts as none).Unverified
Provenance & Transparency48
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
  • Clear OSI-approved license (Apache-2.0).Pass
  • Actively maintained (last published 30 days ago).Pass
  • Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability63
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 2737 tokens (~228/item across 12 items; 12 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management77
  • Stability observed for 23 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 13 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities20
  • Spec-recency check failed: implements MCP spec 2024-11-05; the latest is 2026-07-28. See how to fix → Fail

Unverified: 1 category

A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 5 Nov 26 −3
    • Stability: pass → 0.77 functional
  • 30 Oct 26 +1
    • Stability: 0.97 → pass security
  • 28 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.

  • 26 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.

  • 23 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 73 to 77. That category is still filling its 30-day observation window: 22 days of observed history at the previous scan, 23 at this one. The score rises as the window fills, whether or not the server changes.

  • 21 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 67 to 70. That category is still filling its 30-day observation window: 20 days of observed history at the previous scan, 21 at this one. The score rises as the window fills, whether or not the server changes.

  • 19 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 60 to 63. That category is still filling its 30-day observation window: 18 days of observed history at the previous scan, 19 at this one. The score rises as the window fills, whether or not the server changes.

  • 17 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 53 to 57. That category is still filling its 30-day observation window: 16 days of observed history at the previous scan, 17 at this one. The score rises as the window fills, whether or not the server changes.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Analysed mcpb/https://github.com/julianbei/ARNO/releases/download/v0.0.17/arno-mcp_v0.0.17.mcpb

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem mcpb
Reason No attestation published

Background: How many MCP packages publish verified provenance →

MCP tools · 12 exposed · ~2,545 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
arno.apply ~181

Apply several edits as one atomic unit: all land or none do. Ops: replace_text, replace_range, replace_symbol, delete_symbol, insert. Anchors are validated before anything is written, touched files are formatted, and one validation runs at the end instead of one per edit. Prefer this over several single edits when changing more than one site.

NameTypeReqDescription
checkstring–Run one validation after all edits: build, typecheck, tests (the edited files' tests), or impact (those plus tests of callers of touched declarations).
editsarrayyesEdits to apply in order.
expectedRevisionstring–Revision expected before editing.
formatboolean–Format touched files afterwards (default true).
rootstring–Worktree for this call. Default: the one set with workspace, else the start tree.

No output schema declared.

No examples provided.

arno.check ~253

Run a validation command on demand and wait for the verdict: kind build (default), typecheck or tests. Uses the repository's own Makefile target, npm script or cargo command when present. Waits by default and returns pass/fail directly. Every result names the command that ran; dryRun names it without running anything. In a repository with several projects, pass target to check one; with no command at the root, the answer lists the projects.

NameTypeReqDescription
dryRunboolean–Name the command that would run, without running it.
kindstring–build (default), typecheck, tests, lint or codegen. lint and codegen run the declared commands of that kind; lint with none declared runs typecheck.
rootstring–Worktree for this call. Default: the one set with workspace, else the start tree.
targetstring–Project directory inside the workspace to check, e.g. services/api. Omit for the workspace root.
timeoutSecondsinteger–Bound on the wait (default 90, max 300).
waitboolean–Wait for the result (default true). False returns a job ID to poll.

No output schema declared.

No examples provided.

arno.create_file ~85

Create a brand-new file, and any missing parent directories. Refuses to overwrite an existing one — use replace_text or apply to modify existing content.

NameTypeReqDescription
contentstringyesFile content.
pathstringyesFile path to create.
rootstring–Worktree for this call. Default: the one set with workspace, else the start tree.

No output schema declared.

No examples provided.

arno.declare_command ~176

Declare a named command in .arno/commands.json — a reproduction, a benchmark — to run with run_command in this and later sessions; the file is reviewed like any change. Declaring an existing name replaces it; do not redeclare one just to run it.

NameTypeReqDescription
descriptionstring–Optional note on what the command is for.
kindstring–Optional: lint or codegen; check with that kind runs it.
namestringyesCommand name: lowercase letters, digits, ':', '_' or '-'.
removeboolean–Delete the named command instead of declaring it.
rootstring–Worktree for this call. Default: the one set with workspace, else the start tree.
runstring–Shell command to run from the workspace root.

No output schema declared.

No examples provided.

arno.delete_file ~80

Delete a file, not a directory; fails if it does not exist. Reverting to an earlier checkpoint recreates it. To edit content use replace_text or apply.

NameTypeReqDescription
pathstringyesFile path to delete.
rootstring–Worktree for this call. Default: the one set with workspace, else the start tree.

No output schema declared.

No examples provided.

arno.find ~288

Locate declarations by name AND return their source in one call — the fused search-and-read that replaces `grep -n 'func X' -A 30`. Exact name matches win over substring ones. Use this instead of outline and read_range when you have not located the symbol yet. Pass queries to find several names in one call.

NameTypeReqDescription
budgetinteger–Size of the answer in tokens. Cut at whole declarations; the rest is behind continue=<handle>.
continuestring–Handle from a cut answer: its next page.
dependencystring–Look in this dependency's source instead of the workspace, read-only: a crate, Go module, npm or Python package name.
kindstring–Narrow by kind. func/function, type/struct/class/interface, method, const, var — spellings within a family are equivalent. Empty matches any.
limitinteger–Maximum declarations to return (default 5). Prefer budget.
maxLinesinteger–Maximum lines of each body (default 40). Prefer budget.
queriesarray–Several symbol names in one call, instead of query. Each is answered as query would be.
querystring–Symbol name, exact or partial.
rootstring–Worktree for this call. Default: the one set with workspace, else the start tree.

No output schema declared.

No examples provided.

arno.grep ~382

Literal or regex text search across the workspace, returning path:line matches with optional trailing context — the replacement for `grep -rn`. Use this for anything that is not a declaration name: struct fields, string literals, error messages, config keys, or any search needing a path filter. Use find instead when you want a declaration and its body. Pass queries to search several patterns in one call.

NameTypeReqDescription
budgetinteger–Size of the answer in tokens. Cut at whole matches; the rest is behind continue=<handle>.
contextinteger–Trailing lines to show per match, like grep -A (max 40).
continuestring–Handle from a cut answer: its next page. Other arguments except budget are ignored.
dependencystring–Search this dependency's source instead of the workspace, read-only, at the version the project locks: a crate, Go module, npm or Python package name. Matches read as dep:<name>/<path>, which read_ra…
excludestring–Skip paths containing this substring, e.g. testdata.
globstring–Restrict by path, e.g. *.go or internal/code/*.
ignoreCaseboolean–Case-insensitive match.
limitinteger–Maximum matches returned (default 40). The true total is always reported. Prefer budget.
queriesarray–Several patterns in one call, instead of query. Each is answered as query would be, with the same filters.
querystring–Text to find.
regexboolean–Treat query as a regular expression. grep-style \| alternation and \( \) groups work as in grep.
rootstring–Worktree for this call. Default: the one set with workspace, else the start tree.

No output schema declared.

No examples provided.

arno.insert ~251

Add text to a file without replacing anything — a new function, a new section, an extra case. Use this for additive work instead of rewriting a surrounding symbol. With no anchor it appends to the end of the file; with one it places the text before or after that anchor, refusing if the anchor is absent or matches more than once. Several additions or edits at once belong in apply.

NameTypeReqDescription
anchorstring–Optional. Exact, unique text to place the insertion beside. Omit to append to the end of the file.
expectedDigeststring–Optional. The digest from the read this edit is based on; the edit is refused if the file changed since, by anyone.
expectedRevisionstring–Optional. Revision expected before editing; the edit is rejected if the workspace has moved on. Omit for no precondition.
pathstringyesFile to add to.
positionstring–Optional. "before" or "after" the anchor. Defaults to after.
rootstring–Worktree for this call. Default: the one set with workspace, else the start tree.
textstringyesText to insert.

No output schema declared.

No examples provided.

arno.read_range ~299

Read a file verbatim, whole or by line range — the replacement for `cat` and `sed -n`. Omit both line numbers to read the whole file, which is how to read go.mod, a Makefile, or any JSON/YAML/TOML config that has no symbols to address. An end line past the end of the file reads to the end. A dependency's source reads as dep:<name>/<path>, read-only. Several ranges, in one file or many, go in one call: {"ranges": [{"path": "a.go", "lines": "280-400"}, {"path": "b.go", "lines": "700-760"}]}.

NameTypeReqDescription
budgetinteger–Size of the read in tokens (default 5000). Cut at whole lines; the rest is behind continue=<handle>.
continuestring–Handle from a cut read: the rest of it.
linesstring–Line range: "280-400", "280-" to the end, or "280". Omit to read the whole file.
pathstring–Repository-relative or workspace-relative file path.
rangesarray–Several reads in one call, instead of path. A range that fails reports its error without failing the others.
rootstring–Worktree for this call. Default: the one set with workspace, else the start tree.

No output schema declared.

No examples provided.

arno.replace_text ~198

Replace an exact, unique string in a file. An anchor string does not move when the lines around it do, which is why follow-up edits address text rather than line numbers. Refuses when the anchor is absent or matches more than once — extend it with surrounding context to disambiguate. For several sites, use apply: atomic, one validation, no diagnostics from half-done intermediate states.

NameTypeReqDescription
expectedDigeststring–Optional. The digest from the read this edit is based on; the edit is refused if the file changed since, by anyone.
expectedRevisionstring–Revision expected before editing.
newTextstringyesReplacement text.
oldTextstringyesExact text to replace. Must appear exactly once.
pathstringyesFile path to edit.
rootstring–Worktree for this call. Default: the one set with workspace, else the start tree.

No output schema declared.

No examples provided.

arno.run_command ~149

Run a command the repository declares, by name, and wait for the verdict: pass/fail with the decisive output. Use it instead of a shell for anything check does not cover. No name lists the declared commands. Nothing fits? declare_command it once.

NameTypeReqDescription
namestring–Declared command to run. Omit to list the declared commands.
rootstring–Worktree for this call. Default: the one set with workspace, else the start tree.
timeoutSecondsinteger–Bound on the wait (default 90, max 300).
waitboolean–Wait for the result (default true). False returns a job ID to poll.

No output schema declared.

No examples provided.

arno.run_tests ~203

Rerun a failing test, a test file, or changed files' tests; waits for pass/fail and the first failure. Full suite: check kind tests.

NameTypeReqDescription
filestring–Test file to run, for scope=file (Go: its package). With scope=test, limits the name filter to this file.
rootstring–Worktree for this call. Default: the one set with workspace, else the start tree.
scopestring–all (default), file, test or changed.
teststring–Test name, for scope=test: exact in Go, the runner's name filter elsewhere (jest/vitest -t, ava --match, pytest -k, cargo test <name>).
timeoutSecondsinteger–Bound on the wait (default 90, max 300).
waitboolean–Wait for the result (default true). False returns a job ID to poll.

No output schema declared.

No examples provided.

Install

How do I install the ARNO MCP server?

ARNO ships as an MCPB bundle, a single file you download and open in an MCP host that supports MCPB bundles, such as Claude Desktop. The host reads the launch command from the bundle's own manifest, so there is no command to copy. Before opening it, check the file's SHA-256 matches the one the MCP registry declares for it, b9d6b795413901c7f42c3382f83669b959feaf61af9185c1fe6c4da6c194ed75; the commands to do that are on this page. If it does not match, do not open it.

mcpb · arno-mcp_v0.0.17.mcpb

Download bundle

Check the download matches the SHA-256 the MCP registry declares before you open it. If it does not match, do not open the file.

SHA-256

b9d6b795413901c7f42c3382f83669b959feaf61af9185c1fe6c4da6c194ed75

macOS / Linux

echo "b9d6b795413901c7f42c3382f83669b959feaf61af9185c1fe6c4da6c194ed75  arno-mcp_v0.0.17.mcpb" | shasum -a 256 -c

Windows (PowerShell)

(Get-FileHash -Algorithm SHA256 .\arno-mcp_v0.0.17.mcpb).Hash -eq "b9d6b795413901c7f42c3382f83669b959feaf61af9185c1fe6c4da6c194ed75"

Run it in the folder you saved the bundle to, then open the file with an MCPB-capable host such as Claude Desktop.

Common questions

What is the ARNO MCP server?

ARNO is an MCP server listed in the public MCP registry as io.github.julianbei/arno. The IDE for agents: read by symbol, edit against a revision, validate with your own build, revert. This page covers its MCPB bundle (https://github.com/julianbei/ARNO/releases/download/v0.0.17/arno-mcp_v0.0.17.mcpb).

Is the ARNO MCP server safe to use?

ARNO scores 47 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the ARNO MCP server expose?

ARNO exposes 12 tools: arno.read_range, arno.find, arno.insert, arno.replace_text, arno.create_file, and 7 more. Their descriptions and schemas cost roughly 2,545 tokens of context every time the server is loaded.

What licence is the ARNO MCP server under?

ARNO declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.