joLink
PYPI · JOLINK-RUNTIME · SCANNED SEP 24
A lightweight Java IDE for AI agents: incremental builds, fast tests, HotSwap and live debugging.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs setuptools.build_meta at install time, a recognised native-build step with no shell scripting around it. View diagnostics → Pass
- 0 of 31 dependencies flagged as unhealthy. View diagnostics → Pass
Provenance & Transparency32
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- License check failed: no license is declared. See how to fix → Fail
- Actively maintained (last published 0 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability57
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2128 tokens (~532/item across 4 items; 4 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 4 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 5 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
How do I install the joLink MCP server?
joLink runs locally as a PyPI package, launched with uvx jolink-runtime. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · jolink-runtime
claude mcp add l1ch404-jolink-runtime -- uvx jolink-runtime
{
"mcpServers": {
"l1ch404-jolink-runtime": {
"command": "uvx",
"args": [
"jolink-runtime"
]
}
}
} {
"servers": {
"l1ch404-jolink-runtime": {
"command": "uvx",
"args": [
"jolink-runtime"
]
}
}
} codex mcp add l1ch404-jolink-runtime -- uvx jolink-runtime
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"l1ch404-jolink-runtime": {
"type": "local",
"command": [
"uvx",
"jolink-runtime"
],
"enabled": true
}
}
} openclaw mcp add l1ch404-jolink-runtime --command uvx --arg jolink-runtime
mcp_servers:
l1ch404-jolink-runtime:
command: "uvx"
args: ["jolink-runtime"] {
"McpServers": {
"l1ch404-jolink-runtime": {
"Transport": "stdio",
"Command": "uvx",
"Arguments": [
"jolink-runtime"
]
}
}
} assistant mcp add l1ch404-jolink-runtime -t stdio -c uvx -a jolink-runtime
{
"mcpServers": {
"l1ch404-jolink-runtime": {
"command": "uvx",
"args": [
"jolink-runtime"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 23 Sept 26 65
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 24 Sept 2026 · Analysed pypi/jolink-runtime@0.1.0a7
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | pypi |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | setuptools.build_meta |
Background: Why install scripts are a supply-chain risk →
Dependencies 31 packages
| Packages resolved | 31 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
java_application ~704
Launch, attach, restart, stop, or detach Java applications. For Maven/Gradle, use project_path plus main_class without IDEA, or select an IDEA launch. Use java_fast_test to run tests without launching an application. Launch and restart wait up to timeout (at most 30 seconds), returning the result if finished or the original background task if still running. After editing a managed Maven/Gradle project, use restart: it detects changed sources, incrementally compiles them, and prefers HotSwap (hotswap=true by default). Incompatible changes use the same compiled outputs to restart the JVM. Set hotswap=false for a real process restart and application reinitialization. apply_method reports hotswap or restart; HotSwap does not refresh framework state or count as a JVM startup. previous_startup_ms reports the prior successful startup duration saved locally for this launch, or null if unavailable. It survives MCP restarts and excludes compilation. A pending restart returns reload_id; observe active_operation and last_reload using java_status. Direct JAR/classpath launches restart their existing artifact without source compilation.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Runtime operation to perform. |
| app_args | array | – | Application arguments for launch/restart. Replaces imported or current arguments; [] clears them. |
| build_system | string | – | Optional authoritative build system for project launch; specify maven or gradle when both exist. |
| classpath | string | – | Classpath for direct launch/restart with main_class; omit with project_path. |
| host | string | – | Debug connection host; localhost only. |
| hotswap | boolean | – | For restart, default true: incrementally compile edits and prefer HotSwap; if changes cannot be hot-swapped, restart the JVM with those compiled outputs. False forces a JVM restart after compilation.… |
| jar_path | string | – | Executable JAR for direct launch/restart; omit with project_path. |
| java_home | string | – | Application JDK home directory for project_path launch. |
| jdwp_port | integer | – | Local Java debug port for launch or attach. |
| launch_name | string | – | Optional exact case-sensitive IDEA launch configuration name; requires project_path. With main_class and no launch_name, no IDEA launch configuration is required. Explicit main_class, java_home, app_… |
| main_class | string | – | Fully qualified application entry class. With project_path, launch without requiring IDEA configuration; otherwise uses classpath. |
| pid | integer | – | Local Java PID required by attach. |
| project_path | string | – | Maven or Gradle project directory. Supply main_class for an IDEA-independent launch, or import an IDEA launch configuration (launch_name selects one). Compiles changed sources before starting the app… |
| ready_port | integer | – | Local application TCP port for launch/restart readiness; must differ from jdwp_port. |
| timeout | number | – | Seconds to wait for the launch/restart result in this call. Defaults to 30; values above 30 wait only 30 seconds without error. Zero returns immediately after submission. On expiry the same task cont… |
| vm_args | array | – | JVM arguments for launch/restart. Replaces imported or current arguments; [] clears them. |
No output schema declared.
No examples provided.
java_debugger ~589
Observe executed paths and runtime state with breakpoints, exception events, stacks, and variables. Always resume or clean up every suspension.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Runtime operation to perform. |
| allow_broad_caught | boolean | – | Allow noisy broad caught-exception watches. |
| bp_action | string | – | Breakpoint operation. |
| breakpoint_id | string | – | Breakpoint identifier returned by set/list. |
| caught | boolean | – | Watch caught exceptions. |
| class_pattern | string | – | Class name/pattern for breakpoint set or removal. |
| exception_action | string | – | Exception-watch operation. |
| exception_class | string | – | Exception class in Java name, JVM path, or signature form. |
| frame_index | integer | – | Frame index for variables. |
| host | string | – | Debug connection host; localhost only. |
| http_trigger | object | – | Optional loopback request started only after event waiting is armed. Use with blocking for one-call arm/trigger/await, or with arm when work must occur before a later await. It is rejected while conf… |
| include_generated | boolean | – | Allow generated classes in breakpoint matching. |
| include_proxy | boolean | – | Allow proxy classes in breakpoint matching. |
| include_this | boolean | – | Include this in variables. |
| item_limit | integer | – | Maximum list/set/array items. |
| jdwp_port | integer | – | Local Java debug port for launch or attach. |
| line | integer | – | Source line for breakpoint set/removal. |
| map_entry_limit | integer | – | Maximum map entries. |
| max_frames | integer | – | Maximum stack frames. |
| max_value_depth | integer | – | Object expansion depth. |
| request_id | integer | – | Exception-watch identifier returned by set/list. |
| semantic_collections | boolean | – | Render supported Java collections logically. |
| suspension_id | string | – | Active suspension id returned by wait_event/status. Pass it to stack, variables, and resume so stale observations are rejected; stack/variables use its event-hit thread when thread_name is omitted. |
| thread_name | string | – | Optional fallback selector for stack/variables. Omit it to use the active suspension's event-hit thread. Exact names are preferred; otherwise a unique prefix or substring must identify one JVM thread… |
| timeout | number | – | Seconds to wait for an event. |
| uncaught | boolean | – | Watch uncaught exceptions. |
| wait_handle | string | – | Active observation handle returned by arm or a nonterminal blocking result. |
| wait_mode | string | – | blocking waits directly; with http_trigger it performs arm, trigger, and await in one call. Use arm then await with its wait_handle when an external action is needed after event waiting is armed. Res… |
No output schema declared.
No examples provided.
java_fast_test ~447
Run selected Java tests in Maven or Gradle projects, incrementally compiling changed sources. Supports JUnit 4/5 and TestNG. No application launch is required, and an existing application is left running. Provide project_path and tests (Class or Class#method); action defaults to run. First-time preparation and compilation can take minutes; subsequent calls reuse unchanged results. Waits up to timeout (maximum 30 seconds); unfinished work returns its test_run_id and continues in the background. Observe it with java_status or cancel it here using action='cancel' and the same test_run_id. If compilation fails before run returns, it includes compiler diagnostics directly. java_status stays compact; use action='result' with test_run_id for background error diagnostics and failed-test details without rerunning tests. This is not the complete Maven/Gradle verification or packaging lifecycle.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | Omit or use run to execute tests; use result with test_run_id to read diagnostics and failure details without rerunning; use cancel to stop that test run. |
| build_system | string | – | Optional authoritative build system for tests; specify maven or gradle when both exist. |
| project_path | string | – | Maven project or Gradle Wrapper project directory containing the selected tests. No IDEA launch configuration or running application is required. |
| source_files | array | – | Optional changed Java source paths relative to project_path, including module prefixes. May include added, edited, or deleted main/test files. Normally omit: changes are detected automatically. |
| test_run_id | string | – | Test run ID returned by java_fast_test; required for action='cancel' or 'result'. Results are retained for the active and most recently finished run in this MCP session. |
| tests | array | – | Explicit Fast Test selectors as fully qualified Class or Class#method. Fast Test v1 supports JUnit 4/5 and TestNG. |
| timeout | number | – | Seconds to wait for this test result: default 30, values above 30 wait only 30, zero submits immediately. Expiry leaves the same task running. This controls how long the call waits, not the test exec… |
No output schema declared.
No examples provided.
java_status ~224
Discover local Java processes, inspect a compact application/build overview with status, or request current launch/restart details with status and details=true. Use logs with source=application (default) or source=build for log text. status omits build-log text and detailed launch/restart results. It includes only a Fast Test summary; read test details with java_fast_test(action='result', test_run_id=...).
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | status returns a compact overview; use details=true for launch/restart details; logs reads a bounded log tail. |
| details | boolean | – | For status: include current launch/restart diagnostics, configuration and detailed results. Does not rerun work; use logs for log text. |
| filter | string | – | Optional case-insensitive process filter. |
| full | boolean | – | Include JVM arguments; slower and more verbose. |
| source | string | – | For logs: application output (default), or the current project launch's build log. |
| tail | integer | – | Lines from the selected application/build log tail. Returns truncation and scan metadata. |
No output schema declared.
No examples provided.
What is the joLink MCP server?
joLink is an MCP server listed in the public MCP registry as io.github.L1ch404/jolink-runtime. A lightweight Java IDE for AI agents: incremental builds, fast tests, HotSwap and live debugging. This page covers its PyPI package (jolink-runtime).
Is the joLink MCP server safe to use?
joLink scores 65 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 24 September 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the joLink MCP server expose?
joLink exposes 4 tools: java_application, java_fast_test, java_status, java_debugger. Their descriptions and schemas cost roughly 1,964 tokens of context every time the server is loaded.
Is the joLink MCP server still maintained?
joLink is still listed as active in the MCP registry. We last reached this channel on 24 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.