Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

io.github.KhiipAI/khiip

PYPI · KHIIP · SCANNED SEP 20

Capture the web, keep your copy as plain Markdown, and recall it by meaning. Local-first daemon.

Available components

0 this week 71 Trust /100

Deprecated

This server is marked deprecated in the MCP registry.

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security82
  • No malware found by supply-chain analysis.Pass
  • CVE check failed: a known high-severity CVE affects cryptography 49.0.0, a direct dependency. A fixed version is available. View diagnostics → Fail
  • Runs hatchling.build at install time, a recognised native-build step with no shell scripting around it. View diagnostics → Pass
  • 12 of 106 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency32
Schema Quality & AI Usability66
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 1531 tokens (~255/item across 6 items; 6 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management87
  • Stability observed for 26 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage71
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 0% of tool parameters carry a description.Fail
  • Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 6 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 7 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

How do I install the io.github.KhiipAI/khiip MCP server?

io.github.KhiipAI/khiip runs locally as a PyPI package, launched with uvx khiip. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

pypi · khiip

# add to Claude Code
claude mcp add khiipai-khiip -- uvx khiip
// .cursor/mcp.json
{
  "mcpServers": {
    "khiipai-khiip": {
      "command": "uvx",
      "args": [
        "khiip"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "khiipai-khiip": {
      "command": "uvx",
      "args": [
        "khiip"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add khiipai-khiip -- uvx khiip
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "khiipai-khiip": {
      "type": "local",
      "command": [
        "uvx",
        "khiip"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add khiipai-khiip --command uvx --arg khiip
# ~/.hermes/config.yaml
mcp_servers:
  khiipai-khiip:
    command: "uvx"
    args: ["khiip"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "khiipai-khiip": {
      "Transport": "stdio",
      "Command": "uvx",
      "Arguments": [
        "khiip"
      ]
    }
  }
}
# add to Vellum
assistant mcp add khiipai-khiip -t stdio -c uvx -a khiip
// mcp.json
{
  "mcpServers": {
    "khiipai-khiip": {
      "command": "uvx",
      "args": [
        "khiip"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 20 Sept 26 +16
    • Malware scan: unverified → pass security
    • Security disclosure: unverified → fail functional
  • 19 Sept 26 0
    • Security disclosure: fail → unverified functional
  • 18 Sept 26 −18
    • Malware scan: pass → unverified security
    • Stability: pass → 0.80 functional
  • 17 Sept 26 +1
    • Stability: 0.97 → pass security
  • 16 Sept 26 +15
    • Malware scan: unverified → pass security
  • 15 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.

  • 14 Sept 26 −15
    • Malware scan: pass → unverified security
  • 13 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Sept 2026 · Analysed pypi/khiip@0.2.4

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem pypi

Background: How many MCP packages publish verified provenance →

Install scripts 1 script
Hook Tier Command
build_backend allowlisted hatchling.build

Background: Why install scripts are a supply-chain risk →

Vulnerabilities 2 findings
ID CVE Severity Vector Fix available
GHSA-g6cj-pr64-35w5 CVE-2026-69247 high yes
PYSEC-2026-3552 CVE-2026-69247 none yes

Background: What a vulnerability scan can and cannot prove →

Dependencies 106 packages
Packages resolved 106
Stale 10
No linked repository 2
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 6 exposed · ~1,439 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
capture_url ~225

Capture a URL into the Khiip substrate. Dispatches to the appropriate extractor (X, Reddit, web article, Wikipedia, YouTube, PDF). Stores raw source bytes at Source-tier plus a typed payload in the vault. Submits to Wayback Machine unless disabled. Idempotent by default (dedup by URL hash). Runs as a daemon-side capture job polled to completion, forwarding per-stage progress (extract → enrich → media → preserve → wayback → render → write → embed; media reports item counts) as MCP progress notifications when the client requested them. Args: url: The URL to capture. force_new: If True, skip dedup-by-url and force creation of a new capture (overrides the existing capture's `superseded_by` pointer). Defaults to False. Returns: Capture record (id, source, vault_path, payload, archive_urls, etc.) on success; structured error dict on failure.

NameTypeReqDescription
force_newboolean
urlstringyes

Structured output declared, but exposes no named fields.

No examples provided.

daemon_status ~120

Combined daemon health + metadata. Aggregates GET /health (extractor + wayback liveness) and GET /api/v1/meta (version, configured extractors, embedder model + dimension). Useful as a first call when an agent connects, to confirm the daemon is reachable and to learn what sources + capabilities are available. Returns: On success: `{"health": {...}, "meta": {...}, "mcp_server_version": "<khiip package version>"}`. On daemon-unreachable: structured error dict.

Input schema present but exposes no named parameters.

Structured output declared, but exposes no named fields.

No examples provided.

get_capture ~180

Fetch a single capture by id, in the requested format. Prefer `json` for comment-heavy sources (Reddit, YouTube) — the typed JSON payload measures about half the size of the markdown render there. Args: capture_id: The capture ULID. format: One of `json` (default; typed payload as JSON), `markdown` (full vault file — frontmatter + body), `legacy-markdown` (body only, no frontmatter). YouTube captures also accept `srt` / `vtt` (transcript export). Returns: On success: payload in the requested format wrapped in a `{"format": ..., "body": ...}` envelope. On failure: structured error dict.

NameTypeReqDescription
capture_idstringyes
formatstring

Structured output declared, but exposes no named fields.

No examples provided.

list_captures ~166

List captures, newest first. Returns LEAN rows — flat {id, url, source, title, author, recorded_at, vault_path, excerpt, excerpt_from, payload_chars, description}; use get_capture(id) for a full record and `payload_chars` to budget that call. Args: source: Optional filter by source name (x, reddit, web, wikipedia, youtube, pdf). When None, returns all sources. limit: Page size (1-500; default 50). offset: Pagination offset. Returns: On success: {"captures": [lean rows], "count": int}. On failure: structured error dict.

NameTypeReqDescription
limitinteger
offsetinteger
source

Structured output declared, but exposes no named fields.

No examples provided.

recall ~353

Semantic recall over captured payloads by natural-language query. Ranks captures by cosine similarity over typed-payload embed-text composition (per ADR-0009 §C7). Returns top-k LEAN hits — flat rows {id, url, source, title, author, recorded_at, vault_path, score, excerpt, excerpt_from, payload_chars, description}. Lean hits are the contract; the drill-down for a full record is get_capture(id). Prefer get_capture(..., format="json") for comment-heavy sources (Reddit, YouTube) — the JSON payload measures about half the size of the markdown render there. `payload_chars` is the exact character count of that format="json" body, so you know what you're in for before fetching. `excerpt` is the head (up to 500 chars) of the source's primary text; `description` is the source's own summary when it has one. Args: query: Natural-language recall query. limit: Maximum number of results to return (1-100; default 10). min_score: Optional cosine-similarity floor in [-1.0, 1.0]. Hits scoring below it are dropped. Scores are raw cosine: negative / near-zero means unrelated; roughly 0.3+ is practically relevant for the default MiniLM embedder. Default None = no filtering (all top-k returned). Returns: Recall response with `query`, `embedder_model`, `embedder_dimension`, and `results` (list of lean hits).

NameTypeReqDescription
limitinteger
min_score
querystringyes

Structured output declared, but exposes no named fields.

No examples provided.

refetch_capture ~395

Refetch one dimension of an existing capture. Dimensions, per ADR-0010 commitment 6 + ADR-0009 §C2 replay (S42): - `extraction` (default): NETWORK re-fetch → new capture, old marked superseded (can observe a changed/deleted post). - `re-extract`: OFFLINE — re-derive the typed payload from the preserved source bytes with the current extractor (recovers under-extracted fields; survives source deletion). In place; same capture id. - `re-render`: OFFLINE — re-render the markdown body from the existing typed payload (apply an improved renderer / skin). In place. - `media`: re-walk MediaFetcherRegistry on existing payload; updates `Media[].download_status` in place; same capture id. - `wayback`: re-submit canonical URL to Wayback Save Page Now; updates `archive_urls['wayback']` in place; same capture id. Args: capture_id: The capture ULID to refetch. dimension: Which dimension to refetch (extraction | re-extract | re-render | media | wayback). Defaults to `extraction`. force: Overwrite the vault note even if it was modified since khiip last wrote it (the daemon otherwise refuses in-place rewrites with a 409 to protect hand edits); for dimension=media also re-fetches already-successful items. Defaults to False. When a refetch returns a `daemon-409` error, report its `detail` to the user and ask before retrying with force=True — forcing discards their edits. Returns: Updated capture record on success; structured error dict on failure.

NameTypeReqDescription
capture_idstringyes
dimensionstring
forceboolean

Structured output declared, but exposes no named fields.

No examples provided.

Common questions

What is the io.github.KhiipAI/khiip MCP server?

io.github.KhiipAI/khiip is an MCP server listed in the public MCP registry as io.github.KhiipAI/khiip. Capture the web, keep your copy as plain Markdown, and recall it by meaning. Local-first daemon. This page covers its PyPI package (khiip).

Is the io.github.KhiipAI/khiip MCP server safe to use?

io.github.KhiipAI/khiip scores 71 out of 100 on VerifyMCP. We recorded 2 known advisories against it as of 20 September 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the io.github.KhiipAI/khiip MCP server expose?

io.github.KhiipAI/khiip exposes 6 tools: capture_url, recall, list_captures, get_capture, refetch_capture, daemon_status. Their descriptions and schemas cost roughly 1,439 tokens of context every time the server is loaded.

Is the io.github.KhiipAI/khiip MCP server still maintained?

io.github.KhiipAI/khiip is marked deprecated in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.