# Silica Core (pypi · silica-core)

Retrieval over the folder the session opened: files, search, read, code_pack, write_note.

- Trust score: 88/100 (high trust)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-10-16

## Components

- pypi · `silica-core`: 88/100 (this document), [markdown](https://verifymcp.io/servers/kiycoh-silica-core/silica-core.md), [page](https://verifymcp.io/servers/kiycoh-silica-core/silica-core)

## Channel facts

- Registry: `pypi`
- Package: `silica-core`
- Version: `0.11.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-10-16.

- **Supply Chain Security**: 100/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - Runs setuptools.build_meta at install time, a recognised build step with no custom scripting around it.
  - 2 of 28 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 100/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to kiycoh/silica-core).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 1 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 60/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1944 tokens (~388/item across 5 items; 5 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 67/100
  - Stability observed for 20 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 5 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 6 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the Silica Core MCP server?

Silica Core runs locally as a PyPI package, launched with uvx silica-core. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add kiycoh-silica-core -- uvx silica-core
```

### Cursor

```json
{
  "mcpServers": {
    "kiycoh-silica-core": {
      "command": "uvx",
      "args": [
        "silica-core"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "kiycoh-silica-core": {
      "command": "uvx",
      "args": [
        "silica-core"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add kiycoh-silica-core -- uvx silica-core
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "kiycoh-silica-core": {
      "type": "local",
      "command": [
        "uvx",
        "silica-core"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add kiycoh-silica-core --command uvx --arg silica-core
```

### Hermes

```yaml
mcp_servers:
  kiycoh-silica-core:
    command: "uvx"
    args: ["silica-core"]
```

### Netclaw

```json
{
  "McpServers": {
    "kiycoh-silica-core": {
      "Transport": "stdio",
      "Command": "uvx",
      "Arguments": [
        "silica-core"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add kiycoh-silica-core -t stdio -c uvx -a silica-core
```

### Other

```json
{
  "mcpServers": {
    "kiycoh-silica-core": {
      "command": "uvx",
      "args": [
        "silica-core"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-15 (score 88, +38)

- [security improvement] Injection markers: unverified → pass
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] Stability: unverified → 0.63
- [functional improvement] MCP protocol: unverified → pass

### 2026-10-14 (score 50, 0)

- [functional] Package version: 0.10.2 → 0.11.0

### 2026-10-13 (score 50, +15)

- [security improvement] Malware scan: unverified → pass
- [functional] Package version: 0.9.0 → 0.10.2

### 2026-10-12 (score 35, 0)

- [functional] Package version: 0.10.1 → 0.10.2

### 2026-10-10 (score 35, −50)

- [security regression] Stability: 0.37 → unverified
- [security regression] Malware scan: pass → unverified
- [security regression] Tool safety: pass → unverified
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional] Schema quality: Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [functional] Package version: 0.9.0 → 0.10.1

### 2026-10-07 (score 85, +2)

No change was recorded against any check on this day. Stability & Change Management went from 27 to 37. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-03 (score 83, +4)

- [functional improvement] Stability: unverified → 0.23

### 2026-09-30 (score 79, +15)

- [security improvement] Malware scan: unverified → pass

## MCP tools (5)

### `silica_files` (~293 tokens)

Ask what the index could see before trusting a search or calling
absence. Inventory of the root and what the index did with each file: `indexed`
(in the index, matches disk), `changed` (differs from the index),
\`excluded` (an ignore rule or a type the index does not read; `reason`
says which), `failed` (read or conversion error), `unconverted` (a PDF
whose text layer the index could not read, or an office file with no
extracted `.md` beside it; `reason` says which). A PDF is indexed from
its own text layer, one section per page, unless a `.md` sits beside it —
that sidecar is indexed instead, and both rows carry `source_state`:
\`stale` means the original changed after the conversion, `unverifiable`
that the sidecar records no hash of it or its original is not under the
root. `index.state` is `cold` when nothing was
ever indexed: an empty listing there is not "no files".

Input parameters:

- `cursor` (string): `next_cursor` from the previous page
- `folder` (string): Root-relative folder to list; empty = the whole root
- `limit` (integer): Max entries per page
- `status` (string): Only this status: indexed, changed, excluded, failed, unconverted

### `silica_search` (~401 tokens)

For a question that names no identifier (what a behaviour is, where
it is decided, why), call this before any grep (a Grep tool, or
grep or rg in a shell), Glob or Read: it ranks
passages and, in a source tree, the functions, methods, classes and
constants themselves, by the question's words and their vectors.
Do not grep for the words of a question; grep
for an exact string or a symbol name you already know. Each hit carries
its densest `width`-char window and line; a PDF's section is a page, so
on a PDF hit widen `width` (1200-1500) rather than reading the page.
\`matched_terms` are the query terms in the hit; `coverage` is the share
of the query's idf mass they carry (near 1 = every rare term matched,
near 0 = only the common words); `terms_absent` are query terms found
nowhere in the corpus. No boolean "no answer" exists: read coverage and
matched_terms and decide to stop or rephrase. A hit the dense leg alone
found carries `dense` and coverage 0. In a source tree a hit's `section`
is the symbol, `span` its lines, and `silica_read(path,
section=<symbol>)` serves its body.

Input parameters:

- `folder` (string): Only documents under this root-relative folder
- `k` (integer): Max hits
- `per_doc` (integer): Max sections per document
- `queries` (array): More query groups, each ranked on its own and fused with `query` by rank: the concept in one, its identifiers in another
- `query` (string, required): Concise question or description of the concept or behavior to find; preserve known names and identifiers
- `width` (integer): Characters in each hit's window

### `silica_read` (~464 tokens)

Read a located slice before citing it: lines `start..end`, one
\`section` by heading, a PDF page, or the whole file when it fits
\`max_chars`, always with the outline and a `version`;
\`truncated` and `next_start` say how to continue. A PDF is served from
its own text layer, page by page: `section="p. 8"` serves one page —
the whole page, ~1.2k tokens (measured 2026-09-09), so ask for it to cite
a passage a search located, and widen the search's `width` to explore —
\`pages` counts them, `page_map` gives the pages the slice covers, and
\`extract_path` is that text on disk, for grep and the harness's own
reader (a cache, rebuilt when the PDF changes, under no `version`
guard). A PDF or office file with a `.md` extracted beside it is served
from that instead, and `source_state` says whether the original still
hashes to what the conversion recorded: `stale` means the PDF changed
and the `.md` did not, `unverifiable` that the sidecar records no hash or
its original is gone. Reading the `.md` itself, the path a search hit
carries, reports the same `source` and `source_state`.
Either way `source` names the original, and a PDF
with no readable text layer is `error.unconverted`. Carry
\`version` forward as `expect_version` to be refused instead of reading
different bytes under an old citation; `version` is the served text's,
never the original's.

Input parameters:

- `end` (integer): Last line; 0 = to the end, under max_chars
- `expect_version` (string): Refuse with error.changed when the file's version differs
- `max_chars` (integer): Cap on the served text
- `path` (string, required): Root-relative file path (from silica_files or a search hit)
- `section` (string): Serve this heading's section instead (exact title or unique prefix)
- `start` (integer): First line, 1-based

### `silica_code_pack` (~224 tokens)

Use before editing or explaining a source file, or when a traceback or
a diff names `file:line`: one call serves the file, a `#Class.member`, or
the symbol at `#L<line>`, with its supertypes, extenders, callers, the
signatures it names, external dependencies and importers, inside a
character budget. Static AST only, same repo state, same bytes. Check
\`truncated` before treating the target as complete; `dropped` names what
did not fit. `languages` lists the parsers this install has.

Input parameters:

- `budget_chars` (integer): Character budget for the whole pack; the target is always served
- `sections` (array): Sections besides the target: any of 'hierarchy', 'callers', 'neighborhood', 'external', 'importers'. Empty = all
- `target` (string, required): Root-relative source path, optionally narrowed with '#Class', '#Class.member' or '#L<line>' (the symbol whose declaration spans that line)

### `silica_write_note` (~178 tokens)

Write one note atomically, as given, then lint it: `lint` lists
structural violations and unresolved wikilinks. Refuses to overwrite
when `expect_version` does not match or when `create_only` is set and
the file exists. Undo is git; the core keeps no journal.

Input parameters:

- `body` (string, required): Markdown body, written as given; a body escaped twice (no real newline, \n in their place) is decoded first
- `create_only` (boolean): Refuse when the file already exists
- `expect_version` (string): Refuse with error.changed unless the existing file has this version
- `frontmatter` (object): Optional YAML frontmatter, serialised on top of the body
- `path` (string, required): Root-relative path of the note (.md added when missing)

## Diagnostics

Captured diagnostic sections: Provenance, Install scripts, Dependencies. The full working is on the page: https://verifymcp.io/servers/kiycoh-silica-core/silica-core#diagnostics

## Score history

- 2026-10-16: 88
- 2026-10-15: 88
- 2026-10-14: 50
- 2026-10-13: 50
- 2026-10-12: 35
- 2026-10-10: 35
- 2026-10-07: 85
- 2026-10-04: 83
- 2026-10-03: 83
- 2026-10-02: 79
- 2026-10-01: 79
- 2026-09-30: 79
- 2026-09-29: 64
- 2026-09-28: 79
- 2026-09-27: 54
- 2026-09-26: 54
- 2026-09-25: 22
- 2026-09-24: 22
- 2026-09-23: 22
- 2026-09-22: 22
- 2026-09-21: 22
- 2026-09-20: 22
- 2026-09-19: 22
- 2026-09-18: 22
- 2026-09-17: 22
- 2026-09-16: 22
- 2026-09-15: 22
- 2026-09-14: 37
- 2026-09-13: 22
- 2026-09-12: 22

## Common questions

### What is the Silica Core MCP server?

Silica Core is an MCP server listed in the public MCP registry as io.github.kiycoh/silica-core. Retrieval over the folder the session opened: files, search, read, code_pack, write_note. This page covers its PyPI package (silica-core).

### Is the Silica Core MCP server safe to use?

Silica Core scores 88 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 16 October 2026. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Silica Core MCP server expose?

Silica Core exposes 5 tools: silica_files, silica_search, silica_read, silica_code_pack, silica_write_note. Their descriptions and schemas cost roughly 1,560 tokens of context every time the server is loaded.

### Is the Silica Core MCP server still maintained?

Silica Core is still listed as active in the MCP registry. We last reached this channel on 16 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the Silica Core MCP server under?

Silica Core declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- PyPI project: https://pypi.org/project/silica-core/
- Socket report: https://socket.dev/pypi/package/silica-core
- Repository: https://github.com/kiycoh/silica-core
- Changelog RSS feed: https://verifymcp.io/servers/kiycoh-silica-core/silica-core.xml
- Changelog JSON feed: https://verifymcp.io/servers/kiycoh-silica-core/silica-core.json
- HTML version of this page: https://verifymcp.io/servers/kiycoh-silica-core/silica-core