# io.github.kvdm-co-pilot/cmp-inspector (npm · @create-cmp/inspector)

Compose Multiplatform UI as structured JSON for agents: trees, tokens, previews, diffs. No pixels.

- Trust score: 81/100 (high trust)
- Change this week: 0
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-10-01

## Components

- npm · `@create-cmp/inspector`: 81/100 (this document), [markdown](https://verifymcp.io/servers/kvdm-co-pilot-cmp-inspector/create-cmp-inspector.md), [page](https://verifymcp.io/servers/kvdm-co-pilot-cmp-inspector/create-cmp-inspector)

## Channel facts

- Registry: `npm`
- Package: `@create-cmp/inspector`
- Version: `0.9.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-10-01.

- **Supply Chain Security**: 98/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 31 of 93 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 5 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 65/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 4291 tokens (~286/item across 15 items; 15 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 90/100
  - Stability observed for 27 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 15 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 15 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the io.github.kvdm-co-pilot/cmp-inspector MCP server?

io.github.kvdm-co-pilot/cmp-inspector runs locally as an npm package, launched with npx -y @create-cmp/inspector. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add kvdm-co-pilot-cmp-inspector -- npx -y @create-cmp/inspector
```

### Cursor

```json
{
  "mcpServers": {
    "kvdm-co-pilot-cmp-inspector": {
      "command": "npx",
      "args": [
        "-y",
        "@create-cmp/inspector"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "kvdm-co-pilot-cmp-inspector": {
      "command": "npx",
      "args": [
        "-y",
        "@create-cmp/inspector"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add kvdm-co-pilot-cmp-inspector -- npx -y @create-cmp/inspector
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "kvdm-co-pilot-cmp-inspector": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@create-cmp/inspector"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add kvdm-co-pilot-cmp-inspector --command npx --arg -y --arg @create-cmp/inspector
```

### Hermes

```yaml
mcp_servers:
  kvdm-co-pilot-cmp-inspector:
    command: "npx"
    args: ["-y", "@create-cmp/inspector"]
```

### Netclaw

```json
{
  "McpServers": {
    "kvdm-co-pilot-cmp-inspector": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "@create-cmp/inspector"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add kvdm-co-pilot-cmp-inspector -t stdio -c npx -a -y @create-cmp/inspector
```

### Other

```json
{
  "mcpServers": {
    "kvdm-co-pilot-cmp-inspector": {
      "command": "npx",
      "args": [
        "-y",
        "@create-cmp/inspector"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-01 (score 81, +1)

No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-29 (score 80, +1)

No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-28 (score 79, −3)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-09-27 (score 82, 0)

- [security] Stability: 0.97 → pass

### 2026-09-26 (score 82, +1)

- [functional] Package version: 0.6.2 → 0.9.1

### 2026-09-25 (score 81, 0)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-09-24 (score 81, +1)

No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-22 (score 80, +1)

No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.

## MCP tools (15)

### `inspect_tree` (~451 tokens)

Inspect Compose tree

Load the enriched Compose semantics tree (hierarchy + geometry + resolved design tokens) as JSON, plus a compact summary { nodeCount, taggedCount, tokenizedCount }. With source {kind:'live'} this reads the RUNNING app's current screen (real data + nav state) on every call. Options: `testTag` returns only that node's subtree; format:'wireframe' returns the (sub)tree as a deterministic SVG wireframe instead of raw JSON (footprint nodes as rects, tokenized nodes highlighted with a resolved-values chip, clickable nodes with a distinct outline, testTags as mono labels — SVG is structured text, safe for model context; a11yOverlay:true marks accessibility violations, `out` also writes the file); includeLayoutGaps:true adds `layoutGaps` — the spacing between each pair of consecutive TAGGED siblings ({parentPath, a, b, gaps:{gapX,gapY,dxLeft,dyTop}}).

Input parameters:

- `a11yOverlay` (boolean): wireframe only: overlay accessibility-audit violations in a danger style.
- `format` (string): Default 'json'. 'wireframe' renders the (sub)tree as a deterministic SVG wireframe.
- `includeLayoutGaps` (boolean): Add `layoutGaps`: spacing between consecutive tagged siblings, tree-wide.
- `maxDepth` (integer): wireframe only: only draw nodes up to this depth (root = 0).
- `out` (string): wireframe only: also write the SVG to this path.
- `scale` (number): wireframe only: explicit px scale (default fits width to ~740).
- `source`: Where the tree comes from. Omit to use (in order): legacy treePath, the connect_live session default, $CMP_INSPECTOR_LIVE (host:port), $CMP_INSPECTOR_TREE (file).
- `testTag` (string): Return only the subtree rooted at the node with this testTag.
- `treePath` (string): LEGACY (kept for compatibility): path to a tree JSON produced by the inspector harness. Prefer `source`. Defaults to $CMP_INSPECTOR_TREE.

### `connect_live` (~458 tokens)

Connect to a running app's live inspector (self-healing)

Tier 1 handshake, SELF-HEALING: ensures a device/emulator is attached, ensures the `adb forward tcp:<port> tcp:<port>` exists (creating it — the debug-only inspector server binds loopback on the device), then GETs /inspect/health. If health is dead it LAUNCHES the debug app (applicationId parsed from the project — composeApp/build.gradle.kts / create-cmp.json — never hardcoded; pass `projectDir` when the server's cwd is not the app repo, or `appId` to skip resolution) and re-polls with bounded backoff. On a `device offline`-class adb error (a stale adb server transport — the client says offline while `adb devices` says device) it resets the adb server (kill-server / start-server / wait-for-device) once and retries the whole sequence once. {relaunch:true} forces a VERIFIED restart from a known state (adb force-stop → optional `pm clear` via clearState → launch → health's processStartedAtMs proven to move forward). Every failure names the stage that failed and the one command to run next — never a bare timeout. On success, sets the session default source to {kind:'live', port} so subsequent tool calls can omit `source`; the result's `healed` lists what it had to fix (app-launched, adb-transport-reset, relaunched). Requires a create-cmp DEBUG build installed on the device (the inspector is structurally absent from release builds). This tool never starts emulators.

Input parameters:

- `appId` (string): Explicit applicationId (skips resolution from the project).
- `clearState` (boolean): With relaunch: also `pm clear` — pristine app data (Room DBs, prefs, first-run state).
- `port` (integer): Inspector port (default 9500).
- `projectDir` (string): App repo root, for applicationId resolution when the app must be launched (default: cwd).
- `relaunch` (boolean): Force a verified relaunch (force-stop + launch, proven by processStartedAtMs advancing).
- `serial` (string): adb device serial (when several devices are attached).

### `navigate_and_inspect` (~313 tokens)

Tap the running app and re-inspect (the navigation primitive)

Drive the LIVE app one tap at a time, no pixels needed: resolves the tap point from the live tree (center of `testTag`'s bounds — or pass explicit root-relative `x`/`y` read from bounds), delivers it via the inspector's POST /inspect/tap (HTTP, not adb), waits `settleMs` for the UI to settle, then re-fetches the tree. Returns { tapped:{x,y,testTag?}, before:{tags,textSample,nodeCount}, after:{tags,textSample,nodeCount}, changed, route? } — assert the navigation structurally (old screen's tags gone, new content present). `route:{before,after}` (each a currentRoute string) is included ONLY when the running app exposes GET /inspect/nav — omitted entirely for older apps that predate it, never reported as null/failed. Requires connect_live (or a reachable forward).

Input parameters:

- `port` (integer): Inspector port (default: the connect_live session port, else 9500).
- `settleMs` (integer): How long to wait after the tap before re-fetching the tree (default 1500ms).
- `testTag` (string): Tap the center of this node's bounds (resolved from the live tree).
- `x` (number): Explicit tap x in root-relative px (with `y`, instead of testTag).
- `y` (number): Explicit tap y in root-relative px (with `x`, instead of testTag).

### `runtime_crashes` (~191 tokens)

Fetch persisted crashes from the running app, with cause attribution

GET /inspect/crashes on the running app (current boot + previous ones; the on-device handler chains to whatever handler was installed before it — it never swallows the crash). Each crash is attributed: its stack frames are intersected with recently-edited files (git status + git diff in `projectDir`, default cwd) to produce a verdict — 'likely-caused-by-recent-edit' (with the matching frame(s) as evidence) or 'no-recent-edit-implicated'. Returns { crashes:[{timestamp,exception,message,frames,attribution}], changedFilesConsidered }. Requires connect_live.

Input parameters:

- `port` (integer): Inspector port (default: the connect_live session port, else 9500).
- `projectDir` (string): App repo root for git-based attribution (default: cwd).
- `since` (string): ISO timestamp — only crashes at/after this instant.

### `runtime_logs` (~240 tokens)

Fetch recent device logs for the running app (adb logcat)

Shells `adb shell pidof <appId>` (appId resolved from the live inspector's GET /inspect/health) then `adb logcat -v threadtime --pid=<pid> -d` and returns STRUCTURED, BOUNDED entries — never a log firehose: default limit 200, max 2000, newest-first tail. Optional `level` keeps that severity and above (adb's own ordering); `since` (ISO timestamp) keeps entries at/after it. No on-device log capture — v1 is adb-only, so it needs a device/emulator attached and adb on PATH; errors are actionable (no device, no process running, adb missing).

Input parameters:

- `level` (string): Minimum severity (that level and above).
- `limit` (integer): Max entries returned, newest-first (default 200, max 2000).
- `port` (integer): Inspector port (default: the connect_live session port, else 9500).
- `serial` (string): adb device serial (when several devices are attached).
- `since` (string): ISO timestamp — only entries at/after this instant.

### `db_query` (~186 tokens)

Read rows from one SQLite table (read-only, bounded)

GET /inspect/db?table=<name>&limit=<n> on the running app — assert PERSISTED state in the live tier. `table` must be a real table name (the app's Room schema JSONs and @Entity classes are in-repo) — the device validates it strictly against `sqlite_master` before ever touching a query, so an unknown name 404s rather than running arbitrary SQL. Rows are capped by `limit` (device-side default/max apply regardless of what's requested). Returns { table, columns, rows, rowCount }. Requires connect_live.

Input parameters:

- `limit` (integer): Row cap (device-side default/max still apply).
- `port` (integer): Inspector port (default: the connect_live session port, else 9500).
- `table` (string, required): Exact table name (see the app's Room schema JSONs / @Entity classes).

### `render_screen` (~447 tokens)

Render the screen as pixels (path-only, for the human)

Pixel preview with a PATH-ONLY contract: returns { path, width, height, sizeBytes, displayHint } parsed from the PNG header — NEVER the image bytes/base64 (pixels flow to the human, structure flows to the AI). Sources: `projectDir` (+ optional `screen` id, default 'shell') renders a REAL screen of a create-cmp app headlessly — through the resident preview daemon when one is running (~1s warm) else via its generated `:composeApp:renderScreens` task — no device/emulator — and also returns `treePath` (the structural twin), `previewsDir`, and `via` ('daemon'|'gradle'); `source:{kind:'live',port?}` fetches the RUNNING app's current screen from GET /inspect/screenshot and writes it to `out` (or a temp file); `pngPath` points at a PNG a harness already produced; `harness:true` runs the create-cmp checkout's demo harness (bundled SampleScreen — use `projectDir` for real apps). Pair it with inspect_tree (format:'wireframe') for the structural twin.

Input parameters:

- `harness` (boolean): Run the create-cmp checkout's DEMO harness (bundled SampleScreen) to produce the PNG first.
- `harnessDir` (string): Harness project directory (default: the create-cmp checkout's inspector/harness).
- `out` (string): Where to write a live capture (default: a temp file). Ignored for pngPath/harness.
- `pngPath` (string): Path to an existing PNG (e.g. the harness's out/screen.png).
- `projectDir` (string): Root of a create-cmp app: runs its generated `:composeApp:renderScreens` task (tier 0, real screens from inspector/PreviewRegistry.kt) and reads the PNG + tree it wrote.
- `screen` (string): Registry id to render with projectDir (default 'shell'; e.g. 'home', a tab slug).
- `source` (object): Tier 1: capture the RUNNING app's screen via GET /inspect/screenshot.

### `preview` (~372 tokens)

Start the live preview gallery (watch + render + serve)

AI-native previews of a create-cmp app's REAL screens with NO device, emulator, or manual Gradle: starts (or reuses) a resident service that renders every screen in inspector/PreviewRegistry.kt headlessly, serves a LIVE gallery for the human at a local URL (pixels + wireframe + a11y per screen; the page reloads itself via SSE after every re-render), and watches composeApp/src so every save re-renders automatically. Returns { url, screens:[{id, nodes, tokenized, tagged, a11yPass, tree, png}], version, changedLastRender } — give the human the url (open it for them if you can); assert on the returned structure or the per-screen tree paths yourself. After edits use preview_status { waitForRender: true } (blocks until the render/compile outcome) and preview_diff { screen } (one-call verified change). The console runs as a detached RESIDENT process (it survives this session; reconnecting the MCP adopts it), and is auto-ensured at session start inside a create-cmp app; preview_stop stops it only if this session started it. First render includes a Gradle compile (tens of seconds); subsequent saves re-render warm in a few seconds.

Input parameters:

- `hot` (boolean): Phase 2 (default true): boot the resident preview daemon under Compose Hot Reload (hotRunDesktop --mainClass=<pkg>.inspector.PreviewDaemonKt --auto) so warm saves re-render in seconds; falls back to…
- `port` (integer): First port to try for the gallery server (default 9600, probes upward).
- `projectDir` (string, required): Root of the create-cmp app (the directory containing composeApp/).

### `preview_stop` (~42 tokens)

Stop the live preview gallery

Stops the resident preview service started by `preview` (file watcher + gallery server). Returns the final status. The Gradle daemon it used stays warm (that's desirable).

### `preview_status` (~307 tokens)

Preview status — optionally WAIT for the next render

The agent's post-edit feedback call. Without arguments: returns the preview service's current status (mode, version, rendering, lastError/lastErrorSource, lastActivity, changedLastRender, per-screen summaries incl. lastChangedVersion, and `renderer` — the render PIPELINE's own health: {lastOutcome:'ok'|'failed'|'never', lastSuccessAt, lastAttemptAt, consecutiveFailures}, tracked independently of lastError so a later, unrelated compile message can never mask a dead renderer. renderer.lastOutcome:'failed' means every render since lastSuccessAt has failed outright (Gradle/daemon call itself threw) — the screens below are stale pixels, not a fresh 'no changes' result; this is different from lastErrorSource:'compile' (the user's edit didn't build). With waitForRender:true it BLOCKS until the next render cycle completes (success or failure) or a hot-recompile failure is detected, then returns the same status plus `timedOut` — so the edit loop is: edit → preview_status{waitForRender:true} → read changedLastRender (empty = the edit reached no screen) and lastError (source 'compile' = the edit didn't even build). No polling, no sleeps.

Input parameters:

- `timeoutMs` (integer): waitForRender timeout (default 120000; result carries timedOut:true on expiry).
- `waitForRender` (boolean): Block until the next render/compile outcome instead of returning immediately.

### `approval_status` (~332 tokens)

Governed-artifact approval status — optionally WAIT for a decision

The human-approval half of the console (VERIFICATION-LAYER-DESIGN.md §4): every governed artifact's live status (design system, architecture+structure, exemplar feature, exemplar spec, per-feature specs — the same §1 ordered walk the Approvals tab shows), via the PROJECT'S OWN qa/lib/approvals.mjs (never forked here). Structure only — no HTML; the tab is for the human, this tool is for you. Without waitForDecision: the current snapshot {available, statuses:[{id,label,status,hash,storedHash,approvedAt,fileCount,missing,resolvable}]}. With waitForDecision:true: BLOCKS — same shape as preview_status's waitForRender — until ANY governed artifact's status changes (a console Approve click, or `node qa/approve.mjs <artifact>` run in a terminal), then returns {timedOut, available, changed:[artifactIds], statuses}. {available:false} in a project with no approvals library (an older, pre-approvals-wave scaffold) — resolves immediately, there is nothing to wait for. Typical use: propose a change, tell the human to review it in the console, then approval_status{waitForDecision:true} instead of polling. Requires a running preview service (call preview{projectDir} first) — that's where the project root comes from.

Input parameters:

- `timeoutMs` (integer): waitForDecision timeout (default 120000; result carries timedOut:true on expiry).
- `waitForDecision` (boolean): Block until any governed artifact's approval status changes instead of returning immediately.

### `review_comments` (~327 tokens)

Console comment ledger — optionally WAIT for a new comment

The human-comment half of the console (VERIFICATION-LAYER-DESIGN.md §7.3: 'pixels flow to the human, structure flows to the AI, judgment flows back through comments'): the full comment ledger, via the PROJECT'S OWN qa/lib/comments.mjs (never forked here) — target (screen/element/spec-line/design-system/architecture/general, rendered readably in the console's Comments tab), text, author, createdAt, status, resolution. Without waitForComment: the current snapshot {available, schema, comments}. With waitForComment:true: BLOCKS — same shape as approval_status's waitForDecision — until a NEW comment lands (a 💬 submitted in the console), then returns {timedOut, available, added:[newComments], comments}. A resolve does NOT wake this wait — only a fresh comment does. {available:false} in a project with no comments library (an older, pre-comments-wave scaffold) — resolves immediately, there is nothing to wait for. Loop of record: propose a change, tell the human to review it in the console, review_comments{waitForComment:true} instead of polling, act on `added`, then resolve_comment with what you did. Requires a running preview service (call preview{projectDir} first).

Input parameters:

- `status` (string): Filter the snapshot to one status.
- `timeoutMs` (integer): waitForComment timeout (default 120000; result carries timedOut:true on expiry).
- `waitForComment` (boolean): Block until a new comment lands instead of returning immediately.

### `resolve_comment` (~155 tokens)

Resolve a console comment (the agent closes the loop)

Marks a comment resolved via the project's own qa/lib/comments.mjs, recording author 'agent' and `note` (what you actually did about it — update the spec/plan/code FIRST, then resolve; the console never edits code itself, per §4's principle, so this is the only way a comment closes). Returns {ok:true, comment} or {ok:false, reason} — the library's refusal verbatim (unknown id, already resolved). The console's Comments tab then shows the resolution + note. Requires a running preview service (call preview{projectDir} first).

Input parameters:

- `id` (string, required): Comment id (see review_comments).
- `note` (string, required): What you did in response to the comment.

### `snapshot_variant` (~256 tokens)

Stash the current renders as a named design-language candidate

GENESIS-FLOW-DESIGN.md §2 'Design-language candidates (variants)': copies the CURRENT preview render (every screen's screen.png from the last completed render) plus design-system.json into composeApp/build/previews/variants/<name>/, REPLACING that variant if one with the same name already exists. Returns { name, screens, designSystemStashed, dir }. `name` must match [a-z0-9-]+ (lowercase letters, digits, hyphens) — anything else is refused, not sanitized. Typical loop: edit Tokens.kt, preview_status{waitForRender:true}, snapshot_variant{name:'warmer'}, repeat per candidate token set, then tell the human to compare them side by side in the Design System tab's candidates strip and click Pick — observed via review_comments{waitForComment:true} as a `pick:<name>` comment targeting design-system; apply the chosen tokens, resolve_comment with a note, then approve. Requires a running preview service (call preview{projectDir} first) with at least one completed render.

Input parameters:

- `name` (string, required): Candidate name, e.g. 'warmer' or 'rounded-v2' — used as the variant's directory name.

### `preview_diff` (~214 tokens)

Diff a screen across the last two renders (one-call verified edit)

The verified dev loop with ZERO bookkeeping: the preview service already retains the previous generation of every screen's tree, so this diffs a screen's LAST render against its CURRENT one — no pre-edit snapshot needed. Returns { changes, regressions:{drift, driftChecked, a11y}, verdict: 'proven-clean' | 'changed-with-regressions' | 'no-change' } (drift is checked against the previews dir's design-system.json when present). Typical loop: edit → preview_status{waitForRender:true} → preview_diff{screen:<a changed id>}. For a baseline that must survive sessions, the lane's golden trees (qa/golden/, UPDATE_GOLDEN=1) are the durable regression layer.

Input parameters:

- `minTouchTargetPx` (number): a11y touch-target minimum (default 48).
- `screen` (string, required): Registry screen id (see preview_status screens[].id).
- `tolerancePx` (number): Bounds-move tolerance in px (default 1).

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/kvdm-co-pilot-cmp-inspector/create-cmp-inspector#diagnostics

## Score history

- 2026-10-01: 81
- 2026-09-30: 80
- 2026-09-29: 80
- 2026-09-28: 79
- 2026-09-27: 82
- 2026-09-26: 82
- 2026-09-25: 81
- 2026-09-24: 81
- 2026-09-23: 80
- 2026-09-22: 80
- 2026-09-21: 79
- 2026-09-20: 82
- 2026-09-19: 82
- 2026-09-18: 81
- 2026-09-17: 81
- 2026-09-16: 80
- 2026-09-15: 80
- 2026-09-14: 79
- 2026-09-13: 79
- 2026-09-12: 78
- 2026-09-11: 78
- 2026-09-10: 77
- 2026-09-09: 77
- 2026-09-08: 77
- 2026-09-07: 76
- 2026-09-06: 76
- 2026-09-05: 75
- 2026-09-04: 75
- 2026-09-03: 74
- 2026-09-02: 74

## Common questions

### What is the io.github.kvdm-co-pilot/cmp-inspector MCP server?

io.github.kvdm-co-pilot/cmp-inspector is an MCP server listed in the public MCP registry as io.github.kvdm-co-pilot/cmp-inspector. Compose Multiplatform UI as structured JSON for agents: trees, tokens, previews, diffs. No pixels. This page covers its npm package (@create-cmp/inspector).

### Is the io.github.kvdm-co-pilot/cmp-inspector MCP server safe to use?

io.github.kvdm-co-pilot/cmp-inspector scores 81 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 1 October 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the io.github.kvdm-co-pilot/cmp-inspector MCP server expose?

io.github.kvdm-co-pilot/cmp-inspector exposes 15 tools: inspect_tree, connect_live, navigate_and_inspect, runtime_crashes, runtime_logs, and 10 more. Their descriptions and schemas cost roughly 4,291 tokens of context every time the server is loaded.

### Is the io.github.kvdm-co-pilot/cmp-inspector MCP server still maintained?

io.github.kvdm-co-pilot/cmp-inspector is still listed as active in the MCP registry. We last reached this channel on 1 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the io.github.kvdm-co-pilot/cmp-inspector MCP server under?

io.github.kvdm-co-pilot/cmp-inspector declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/@create-cmp/inspector
- Socket report: https://socket.dev/npm/package/@create-cmp/inspector
- Repository: https://github.com/kvdm-co-pilot/create-cmp
- Changelog RSS feed: https://verifymcp.io/servers/kvdm-co-pilot-cmp-inspector/create-cmp-inspector.xml
- Changelog JSON feed: https://verifymcp.io/servers/kvdm-co-pilot-cmp-inspector/create-cmp-inspector.json
- HTML version of this page: https://verifymcp.io/servers/kvdm-co-pilot-cmp-inspector/create-cmp-inspector