Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

DeepThonk

NPM · DEEPTHONK · SCANNED SEP 20

Provider-neutral OpenDeepThink reasoning server: generate, judge, rank, mutate.

Available components

+1 this week 89 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security98
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • 31 of 100 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to linxule/deepthonk). View diagnostics → Pass
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 5 days ago).Pass
  • Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability65
  • 80% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Partial
  • AI-judged instruction clarity (good).Pass
  • Context-footprint check failed: tool/resource definitions use about 3360 tokens (~186/item across 18 items; 17 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management83
  • Stability observed for 25 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage95
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 82% of tool parameters carry a description.Partial
  • Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety75
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "deepthonk.profile_delete" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
  • An AI judge read all 18 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

How do I install the DeepThonk MCP server?

DeepThonk runs locally as an npm package, launched with npx -y deepthonk. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · deepthonk

# add to Claude Code
claude mcp add linxule-deepthonk -- npx -y deepthonk
// .cursor/mcp.json
{
  "mcpServers": {
    "linxule-deepthonk": {
      "command": "npx",
      "args": [
        "-y",
        "deepthonk"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "linxule-deepthonk": {
      "command": "npx",
      "args": [
        "-y",
        "deepthonk"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add linxule-deepthonk -- npx -y deepthonk
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "linxule-deepthonk": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "deepthonk"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add linxule-deepthonk --command npx --arg -y --arg deepthonk
# ~/.hermes/config.yaml
mcp_servers:
  linxule-deepthonk:
    command: "npx"
    args: ["-y", "deepthonk"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "linxule-deepthonk": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "deepthonk"
      ]
    }
  }
}
# add to Vellum
assistant mcp add linxule-deepthonk -t stdio -c npx -a -y deepthonk
// mcp.json
{
  "mcpServers": {
    "linxule-deepthonk": {
      "command": "npx",
      "args": [
        "-y",
        "deepthonk"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 20 Sept 26 −2
    • Stability: pass → 0.83 functional
  • 19 Sept 26 0
    • Stability: 0.97 → pass security
  • 18 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.

  • 16 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.

  • 15 Sept 26 +26
    • Malware scan: unverified → pass security
    • Known CVEs: unverified → pass security
    • Dependency health: unverified → 0.87 functional
  • 14 Sept 26 −25
    • Stability: 0.80 → unverified security
    • Malware scan: pass → unverified security
    • Known CVEs: pass → unverified security
    • Tool safety: pass → unverified security
    • Capabilities: pass → unverified functional
    • Dependency health: 0.87 → unverified functional
    • Tool coverage: 100 → unverified functional
    • Schema quality: 80 → unverified functional
    • Package version: 0.3.0 → 0.3.1 functional
  • 13 Sept 26 −3
    • Stability: pass → 0.80 functional
  • 12 Sept 26 0
    • Stability: 0.97 → pass security
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Sept 2026 · Analysed npm/deepthonk@0.3.1

Provenance Verified

A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.

Result Verified
Ecosystem npm
Reason Verified
Discovered via Registry attestation endpoint
Source repo linxule/deepthonk
Certificate issuer https://token.actions.githubusercontent.com
Certificate SAN https://github.com/linxule/deepthonk/.github/workflows/publish.yml@refs/tags/v0.3.1
Rekor log index 2830090179
Predicate type https://slsa.dev/provenance/v1
Subject digest sha512:75ef0e63219f429e98f229d6349a6e0fdfa41da23d20db05fd86b9550d1231a803a9e47aad5ecb828ec1aa4950de15ecba27266cb2ebc5ddd333bb657

Background: How many MCP packages publish verified provenance →

Dependencies 100 packages
Packages resolved 100
Stale 31
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 17 exposed · ~3,352 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
deepthonk.cancel ~62

Request cancellation for a running job by writing cancel.json in the run directory.

NameTypeReqDescription
job_idstringJob ID returned by deepthonk.start.
run_dirstringRun directory returned by deepthonk.start or deepthonk.run.
NameTypeReqDescription
cancel_requestedbooleanyes
run_dirstring

No examples provided.

deepthonk.export ~32

Export a run summary or trace.

NameTypeReqDescription
formatstring
run_dirstringyes

Structured output declared, but exposes no named fields.

No examples provided.

deepthonk.lock_inspect ~40

Inspect run.lock and return its exact fingerprint without mutating it.

NameTypeReqDescription
run_dirstringyesRun directory containing the lock to inspect.
NameTypeReqDescription
fingerprintstring
lockobject
run_dirstringyes
sameHostboolean
statestringyes
workerAliveboolean

No examples provided.

deepthonk.lock_reclaim ~59

Reclaim run.lock only when its current bytes match the inspected fingerprint exactly.

NameTypeReqDescription
fingerprintstringyesExact fingerprint returned by deepthonk.lock_inspect.
run_dirstringyesRun directory containing the lock to inspect.
NameTypeReqDescription
fingerprintstringyes
reclaimedbooleanyes
run_dirstringyes

No examples provided.

deepthonk.mutate ~437

Mutate one supplied candidate with critique.

NameTypeReqDescription
api_key_envstringEnvironment variable that contains the API key.
base_urlstringOpenAI-compatible base URL, ending at /v1.
candidatestringyesCandidate text to mutate.
config_pathstringOptional DeepThonk YAML config path.
critiquestringCritique or guidance for mutation.
finalizer_modelstringOptional model used to polish the winning candidate.
generator_modelstringModel used for initial candidate generation.
judge_modelstringModel used for pairwise judging.
model_output_tokensobjectPer-role model output token caps for one-shot operations.
mutate_temperaturenumberTemperature for mutation.
mutator_modelstringModel used for critique-guided mutation.
profilestringProfile used for one-shot defaults.
profile_namestringSaved profile bundle name; loads ~/.config/deepthonk/profiles/<name>.yaml. Mutually exclusive with config_path.
prompt_stylestring
promptsobject
providerstringProvider label. Built-ins include fake, deepseek, openrouter, and openai-compatible; custom labels require base_url.
provider_max_concurrencyintegerProcess-shared maximum concurrent calls to this provider route.
request_timeout_msintegerLogical provider-call deadline in milliseconds.
rubricstringOptional rubric text.
sampling_cost_prioritynumberMCP Sampling model preference for lower cost, from 0 to 1.
sampling_intelligence_prioritynumberMCP Sampling model preference for intelligence, from 0 to 1.
sampling_model_hintsarrayOptional MCP Sampling model hints.
sampling_speed_prioritynumberMCP Sampling model preference for speed, from 0 to 1.
supports_json_modebooleanWhether the base OpenAI-compatible provider supports response_format JSON mode.
taskstringyesTask text the candidate answers.
NameTypeReqDescription
modelstring
mutatedstringyes
providerstring
usageobject

No examples provided.

deepthonk.plan ~103

Estimate model calls for a DeepThonk profile.

NameTypeReqDescription
config_pathstringOptional DeepThonk YAML config path.
kinteger
minteger
ninteger
profilestring
profile_namestringSaved profile bundle name; loads ~/.config/deepthonk/profiles/<name>.yaml. Mutually exclusive with config_path.
tinteger

Structured output declared, but exposes no named fields.

No examples provided.

deepthonk.profile_delete ~24

Delete a saved named profile.

NameTypeReqDescription
namestringyes
NameTypeReqDescription
deletedstringyes

No examples provided.

deepthonk.profile_list ~16

List saved named profiles.

Input schema present but exposes no named parameters.

NameTypeReqDescription
profilesarrayyes

No examples provided.

deepthonk.profile_save ~119

Save a reusable named profile bundle.

NameTypeReqDescription
algorithmobject
api_key_envstring
base_urlstring
budget
concurrency
forceboolean
modelsobject
namestringyes
output
profilestring
prompt_stylestring
promptsobject
providerstring
providersobject
retry
NameTypeReqDescription
pathstringyes

No examples provided.

deepthonk.profile_show ~34

Show a saved named profile; manually edited secret-shaped values are rejected on load.

NameTypeReqDescription
namestringyes
NameTypeReqDescription
profileobjectyes

No examples provided.

deepthonk.rank ~481

Rank supplied candidates with pairwise judging and Bradley-Terry aggregation.

NameTypeReqDescription
api_key_envstringEnvironment variable that contains the API key.
base_urlstringOpenAI-compatible base URL, ending at /v1.
candidatesarrayyesCandidate texts or {id, content} objects.
concurrencyintegerMaximum concurrent pairwise comparisons.
config_pathstringOptional DeepThonk YAML config path.
finalizer_modelstringOptional model used to polish the winning candidate.
generator_modelstringModel used for initial candidate generation.
judge_modelstringModel used for pairwise judging.
judge_temperaturenumberTemperature for pairwise judging.
lambdanumberBradley-Terry L2 regularization.
model_output_tokensobjectPer-role model output token caps for one-shot operations.
mutator_modelstringModel used for critique-guided mutation.
profilestringProfile used for one-shot defaults.
profile_namestringSaved profile bundle name; loads ~/.config/deepthonk/profiles/<name>.yaml. Mutually exclusive with config_path.
prompt_stylestring
promptsobject
providerstringProvider label. Built-ins include fake, deepseek, openrouter, and openai-compatible; custom labels require base_url.
provider_max_concurrencyintegerProcess-shared maximum concurrent calls to this provider route.
rankobjectPair scheduling mode, degree, seed, and logical-call limit.
request_timeout_msintegerLogical provider-call deadline in milliseconds.
rubricstringOptional judging rubric text.
sampling_cost_prioritynumberMCP Sampling model preference for lower cost, from 0 to 1.
sampling_intelligence_prioritynumberMCP Sampling model preference for intelligence, from 0 to 1.
sampling_model_hintsarrayOptional MCP Sampling model hints.
sampling_speed_prioritynumberMCP Sampling model preference for speed, from 0 to 1.
supports_json_modebooleanWhether the base OpenAI-compatible provider supports response_format JSON mode.
taskstringyesTask text the candidates answer.
NameTypeReqDescription
comparisonsarrayyes
scoresarrayyes

No examples provided.

deepthonk.repair_budget ~42

Replace only legacy [redacted] numeric budget fields with explicit original values.

NameTypeReqDescription
replacementsobjectyes
run_dirstringyes
NameTypeReqDescription
repairedarrayyes
run_dirstringyes

No examples provided.

deepthonk.result ~60

Return final summary/resource URIs when a background job is complete.

NameTypeReqDescription
job_idstringJob ID returned by deepthonk.start.
run_dirstringRun directory returned by deepthonk.start or deepthonk.run.
NameTypeReqDescription
completeboolean
run_dirstring
run_idstring

No examples provided.

deepthonk.resume ~41

Detect resume state (default) or replay an interrupted run with continue: true.

NameTypeReqDescription
continueboolean
run_dirstringyes
NameTypeReqDescription
generation
messagestringyes
phasestring
run_idstring
safe_to_continueboolean
statusstringyes

No examples provided.

deepthonk.run ~870

Run DeepThonk through the shared core engine.

NameTypeReqDescription
api_key_envstringEnvironment variable that contains the API key.
base_urlstringOpenAI-compatible base URL, ending at /v1.
concurrencyobjectPer-phase concurrency overrides.
config_pathstringOptional DeepThonk YAML config path, such as ~/.config/deepthonk/config.yaml.
critique_limitsobjectCritique aggregation bounds.
finalizer_modelstringOptional model used to polish the winning candidate.
generator_modelstringModel used for initial candidate generation.
include_promptsbooleanStore rendered prompts in candidate/comparison metadata.
include_raw_model_outputsbooleanStore raw provider responses in trace metadata.
judge_modelstringModel used for pairwise judging.
judge_temperaturenumberTemperature for pairwise judging.
kintegerComparisons per candidate per mutation-generation round.
lambdanumberBradley-Terry L2 regularization. Defaults to 0.01.
mintegerComparisons per candidate in the final dense ranking round. Mutation count per generation is n - ceil(n/4), not m.
max_callsintegerMaximum logical model invocations, including failed calls and invalid-JSON retries; internal HTTP retries are reported separately.
max_input_tokensintegerMaximum recorded input tokens before the run stops at a phase boundary.
max_output_tokensintegerMaximum recorded output tokens before the run stops at a phase boundary.
max_usdnumberMaximum estimated USD spend; requires matching budget.prices in config.
model_output_tokensobjectPer-role model output token caps.
mutate_temperaturenumberTemperature for critique-guided mutation.
mutator_modelstringModel used for critique-guided mutation.
nintegerPopulation size override. Defaults to the profile's n.
profilestringRun profile. quick is safest for smoke tests; paper plans 285 calls.
profile_namestringSaved profile bundle name; loads ~/.config/deepthonk/profiles/<name>.yaml. Mutually exclusive with config_path.
prompt_stylestringPrompt template style. Defaults to paper-programming for the paper profile, general otherwise.
promptsobjectOptional per-phase prompt template overrides. Templates use {task}, {rubric}, {candidate}, {candidateA}, {candidateB}, {critique} placeholders. Use {{ and }} to escape literal braces. See docs/custom…
providerstringProvider label. Built-ins include fake, deepseek, openrouter, and openai-compatible; custom labels require base_url.
provider_max_concurrencyintegerProcess-shared maximum concurrent calls to this provider route.
rankobjectFinal ranking mode, degree, seed, and logical-call limit.
request_timeout_msintegerLogical provider-call deadline in milliseconds, including body reads and retry waits.
rubricstringOptional judging rubric text.
run_dirstringDirectory for trace files.
run_idstringOptional stable caller-supplied run ID.
sample_temperaturenumberTemperature for initial candidate generation.
sampling_cost_prioritynumberMCP Sampling model preference for lower cost, from 0 to 1.
sampling_intelligence_prioritynumberMCP Sampling model preference for intelligence, from 0 to 1.
sampling_model_hintsarrayOptional MCP Sampling model hints. Hints guide host model choice but do not enforce it.
sampling_speed_prioritynumberMCP Sampling model preference for speed, from 0 to 1.
seedintegerDeterministic seed for pair ordering and IDs.
supports_json_modebooleanWhether the base OpenAI-compatible provider supports response_format JSON mode.
tintegerNumber of mutation generations (t=0 disables mutation rounds).
taskstringyesTask text to solve. MCP tools do not read task files.
NameTypeReqDescription
final_answerstringyes
run_dirstringyes
run_idstringyes
summary_resourcestringyes
trace_resourcestringyes
winner_idstringyes

No examples provided.

deepthonk.start ~875

Start DeepThonk in the background and persist status in the run directory.

NameTypeReqDescription
api_key_envstringEnvironment variable that contains the API key.
base_urlstringOpenAI-compatible base URL, ending at /v1.
concurrencyobjectPer-phase concurrency overrides.
config_pathstringOptional DeepThonk YAML config path, such as ~/.config/deepthonk/config.yaml.
critique_limitsobjectCritique aggregation bounds.
finalizer_modelstringOptional model used to polish the winning candidate.
generator_modelstringModel used for initial candidate generation.
include_promptsbooleanStore rendered prompts in candidate/comparison metadata.
include_raw_model_outputsbooleanStore raw provider responses in trace metadata.
judge_modelstringModel used for pairwise judging.
judge_temperaturenumberTemperature for pairwise judging.
kintegerComparisons per candidate per mutation-generation round.
lambdanumberBradley-Terry L2 regularization. Defaults to 0.01.
mintegerComparisons per candidate in the final dense ranking round. Mutation count per generation is n - ceil(n/4), not m.
max_callsintegerMaximum logical model invocations, including failed calls and invalid-JSON retries; internal HTTP retries are reported separately.
max_input_tokensintegerMaximum recorded input tokens before the run stops at a phase boundary.
max_output_tokensintegerMaximum recorded output tokens before the run stops at a phase boundary.
max_usdnumberMaximum estimated USD spend; requires matching budget.prices in config.
model_output_tokensobjectPer-role model output token caps.
mutate_temperaturenumberTemperature for critique-guided mutation.
mutator_modelstringModel used for critique-guided mutation.
nintegerPopulation size override. Defaults to the profile's n.
profilestringRun profile. quick is safest for smoke tests; paper plans 285 calls.
profile_namestringSaved profile bundle name; loads ~/.config/deepthonk/profiles/<name>.yaml. Mutually exclusive with config_path.
prompt_stylestringPrompt template style. Defaults to paper-programming for the paper profile, general otherwise.
promptsobjectOptional per-phase prompt template overrides. Templates use {task}, {rubric}, {candidate}, {candidateA}, {candidateB}, {critique} placeholders. Use {{ and }} to escape literal braces. See docs/custom…
providerstringProvider label. Built-ins include fake, deepseek, openrouter, and openai-compatible; custom labels require base_url.
provider_max_concurrencyintegerProcess-shared maximum concurrent calls to this provider route.
rankobjectFinal ranking mode, degree, seed, and logical-call limit.
request_timeout_msintegerLogical provider-call deadline in milliseconds, including body reads and retry waits.
rubricstringOptional judging rubric text.
run_dirstringDirectory for trace files.
run_idstringOptional stable caller-supplied run ID.
sample_temperaturenumberTemperature for initial candidate generation.
sampling_cost_prioritynumberMCP Sampling model preference for lower cost, from 0 to 1.
sampling_intelligence_prioritynumberMCP Sampling model preference for intelligence, from 0 to 1.
sampling_model_hintsarrayOptional MCP Sampling model hints. Hints guide host model choice but do not enforce it.
sampling_speed_prioritynumberMCP Sampling model preference for speed, from 0 to 1.
seedintegerDeterministic seed for pair ordering and IDs.
supports_json_modebooleanWhether the base OpenAI-compatible provider supports response_format JSON mode.
tintegerNumber of mutation generations (t=0 disables mutation rounds).
taskstringyesTask text to solve. MCP tools do not read task files.
NameTypeReqDescription
artifact_resourcesobjectyes
job_idstringyes
result_resourcestringyes
run_dirstringyes
statestringyes
status_resourcestringyes

No examples provided.

deepthonk.status ~57

Read persisted job/run status from a run directory.

NameTypeReqDescription
job_idstringJob ID returned by deepthonk.start.
run_dirstringRun directory returned by deepthonk.start or deepthonk.run.
NameTypeReqDescription
errorobject
generation
job_idstring
messagestring
phasestring
run_dirstring
run_idstring
statestring
statusstring
usageobject

No examples provided.

Common questions

What is the DeepThonk MCP server?

DeepThonk is an MCP server listed in the public MCP registry as io.github.linxule/deepthonk. Provider-neutral OpenDeepThink reasoning server: generate, judge, rank, mutate. This page covers its npm package (deepthonk).

Is the DeepThonk MCP server safe to use?

DeepThonk scores 89 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the DeepThonk MCP server expose?

DeepThonk exposes 17 tools: deepthonk.plan, deepthonk.start, deepthonk.status, deepthonk.result, deepthonk.cancel, and 12 more. Their descriptions and schemas cost roughly 3,352 tokens of context every time the server is loaded.

Is the DeepThonk MCP server still maintained?

DeepThonk is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the DeepThonk MCP server under?

DeepThonk declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.