YAP — Yet Another Packager

OCI · GHCR.IO/M0RF30/YAP-MCP:2.5.3 · SCANNED AUG 3

Build native Linux packages (.deb/.rpm/.apk/.pkg.tar.zst) from a single PKGBUILD via MCP.

Available components

38 38 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security0

Malware scan not yet available for this package.Unverified
CVE data not yet available for this package.Unverified
Install-script risk not yet assessed.Unverified
Dependency-health data not yet available.Unverified

Provenance & Transparency32

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
License check failed: no license is declared. See how to fix → Fail
Actively maintained (last published 0 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability85

100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
AI-judged instruction clarity (excellent).Pass
Context-footprint check failed: tool/resource definitions use about 2167 tokens (~108/item across 20 items; 19 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management0

Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified

Tool Coverage100

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
99% of tool parameters carry a description.Partial
Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Unverified: 2 categories

Categories scored 0 because we could not verify them: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

oci · ghcr.io/m0rf30/yap-mcp:2.5.3

Claude Codex opencode Hermes Other

# add to Claude Code

claude mcp add m0rf30-yap -- docker run --rm -i ghcr.io/m0rf30/yap-mcp:2.5.3

# add to Codex CLI

codex mcp add m0rf30-yap -- docker run --rm -i ghcr.io/m0rf30/yap-mcp:2.5.3

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "m0rf30-yap": {
      "type": "local",
      "command": [
        "docker",
        "run",
        "--rm",
        "-i",
        "ghcr.io/m0rf30/yap-mcp:2.5.3"
      ],
      "enabled": true
    }
  }
}

# ~/.hermes/config.yaml

mcp_servers:
  m0rf30-yap:
    command: "docker"
    args: ["run", "--rm", "-i", "ghcr.io/m0rf30/yap-mcp:2.5.3"]

// mcp.json

{
  "mcpServers": {
    "m0rf30-yap": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "ghcr.io/m0rf30/yap-mcp:2.5.3"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

2 Aug 26 38

First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed oci/ghcr.io/m0rf30/yap-mcp:2.5.3

Provenance none

Ecosystem: oci · Outcome: none

Reason: no_attestation

MCP tools — 19 exposed · ~1,706 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

build ~565

Start a yap build asynchronously. Returns a buildID; poll via build_status. The tool-call context is NOT propagated to the build — use build_cancel to stop a running build.

Input Output Examples

Name	Type	Req	Description
cleanBuild	boolean	—	clean build dirs before starting
compressionDeb	string	—	deb compression: zstd, gzip, or xz
compressionRpm	string	—	rpm compression: zstd, gzip, or xz
debugDir	string	—	dir to capture per-step build debug artifacts
distro	string	—	target distro; auto-detected when empty
extraRepos	null\|array	—	extra apt/dnf repo defs (--repo syntax)
fromPkgName	string	—	start build at this pkg
noBuild	boolean	—	prepare/resolve only, skip the build step
noCheck	boolean	—	skip the PKGBUILD check() function
noMakeDeps	boolean	—	skip makedeps installation entirely
onlyPkgNames	string	—	csv allowlist of pkg names to build
overridePkgRel	string	—	override PKGBUILD pkgrel for all pkgs
overridePkgVer	string	—	override PKGBUILD pkgver for all pkgs
parallel	boolean	—	run independent build steps in parallel
path	string	yes	yap.json file, PKGBUILD file, or dir with either
release	string	—	target release; auto-detected when empty
sbom	boolean	—	emit CycloneDX+SPDX SBOMs per artifact
sbomFormat	string	—	sbom format: cyclonedx, spdx, or both
sign	boolean	—	sign produced artifacts
signKey	string	—	signing key path
signKeyName	string	—	key name embedded in APK signature stream
signPassphrase	string	—	passphrase for the signing key
skipDeps	null\|array	—	pkgs to omit from makedeps
skipHashCheck	boolean	—	disable sha verification of sources
skipPkgNames	string	—	csv denylist of pkg names to skip
skipSyncDeps	boolean	—	skip pkg-manager update before makedeps
skipToolchainValidation	boolean	—	skip cross toolchain checks
targetArch	string	—	cross target; arm64/amd64 aliases ok
toPkgName	string	—	stop build order at this pkg (inclusive)
unverifiedRepos	boolean	—	allow apt sources w/o Signed-By
verbose	boolean	—	enable verbose logging for the build
zap	boolean	—	remove the build dir after a successful build

Name	Type	Req	Description
buildID	string	yes	opaque id; poll via build_status
containerImage	string	—	resolved image tag, e.g. ubuntu-jammy
containerRuntime	string	—	backend: cli (podman/docker) or rootless
distro	string	yes	—
inContainer	boolean	—	true when dispatched into a container image
path	string	yes	—
release	string	yes	—
state	string	yes	—

No examples provided.

build_cancel ~39

Cancel a running yap build by buildID. May leave partial artifacts or stale package-manager locks inside the build container.

Input Output Examples

Name	Type	Req	Description
buildID	string	yes	—

Name	Type	Req	Description
canceled	boolean	yes	—

No examples provided.

build_logs ~108

Fetch captured stdout+stderr from a build session, with tail/since/grep filters.

Input Output Examples

Name	Type	Req	Description
buildID	string	yes	identifier returned by build
context	integer	—	with grep: include N lines before/after each match
grep	string	—	return only lines matching this Go regexp
tail	integer	—	return only the last N lines; 0 = all
withLineNo	boolean	—	return per-line {lineno,text} structs alongside log

Name	Type	Req	Description
buildID	string	yes	—
bytes	integer	yes	byte count after filtering
lines	integer	yes	line count after filtering
log	string	yes	filtered log payload
numbered	null\|array	—	set when withLineNo=true
regexpInvalid	boolean	—	true when the grep regexp failed to compile and was ignored
state	string	yes	running, succeeded, failed, canceled, or unknown

No examples provided.

build_status ~31

Return the state of a previously-launched yap build.

Input Output Examples

Name	Type	Req	Description
buildID	string	yes	identifier returned by build

Name	Type	Req	Description
buildID	string	yes	—
containerImage	string	—	resolved image tag for the dispatch
containerRuntime	string	—	container backend: cli or rootless
distro	string	—	—
endedAt	string	—	—
error	string	—	—
inContainer	boolean	—	true when running in a yap image
logBytes	integer	—	current size of captured log; fetch via build_logs
logLines	integer	—	current line count of captured log
path	string	—	—
release	string	—	—
startedAt	string	—	—
state	string	yes	running, succeeded, failed, or canceled

No examples provided.

build_summary ~54

One-shot terminal diagnosis: state, duration, last error line, best-guess failed step, artifact count, and keyword-based hints. Cheaper than fetching full logs.

Input Output Examples

Name	Type	Req	Description
buildID	string	yes	identifier returned by build

Name	Type	Req	Description
artifactCount	integer	yes	recognised artifacts found in output dir
buildID	string	yes	—
durationSec	integer	—	—
error	string	—	top-level error from the build pipeline
failedStep	string	—	phase tag from log: build/strip/package/sign/sbom
hints	null\|array	—	diagnostic hints inferred from log keywords
lastErrorLine	string	—	last log line matching ERROR/FAIL/fatal
state	string	yes	running, succeeded, failed, canceled, or unknown

No examples provided.

build_wait ~66

Block until a build reaches a terminal state or the timeout elapses.

Input Output Examples

Name	Type	Req	Description
buildID	string	yes	identifier returned by build
timeoutSec	integer	—	max seconds to wait; 0/omitted uses the 50s server cap. Poll again when timedOut=true

Name	Type	Req	Description
buildID	string	yes	—
endedAt	string	—	—
error	string	—	—
startedAt	string	—	—
state	string	yes	final state, or 'running' on timeout
timedOut	boolean	—	—

No examples provided.

graph ~61

Build the dependency graph (nodes+edges) for a yap project or single PKGBUILD.

Input Output Examples

Name	Type	Req	Description
path	string	yes	yap.json file, PKGBUILD file, or dir with either
theme	string	—	optional theme passed to loader; cosmetic only

Name	Type	Req	Description
edges	null\|array	yes	—
nodes	null\|array	yes	—

No examples provided.

inspect ~75

Inspect an artifact: format, size, sibling SBOM/signature presence. Accepts any host path the server can stat — there is no project sandboxing; clients should pass paths returned by list_artifacts or known build outputs.

Input Output Examples

Name	Type	Req	Description
artifact	string	yes	path to a built package (.deb/.rpm/.apk/.pkg.tar.*)

Name	Type	Req	Description
artifact	string	yes	—
format	string	yes	—
hasCycloneDX	boolean	yes	—
hasSPDX	boolean	yes	—
hasSig	boolean	yes	—
sizeBytes	integer	yes	—

No examples provided.

install ~60

Install a built package artifact on the host. Requires confirm: true.

Input Output Examples

Name	Type	Req	Description
artifact	string	yes	path to a built .deb/.rpm/.apk/.pkg.tar.* artifact
confirm	boolean	yes	must be true to perform the install; default refuses

Name	Type	Req	Description
artifact	string	yes	—
error	string	—	—
format	string	yes	—
ok	boolean	yes	—

No examples provided.

list_artifacts ~70

List built package artifacts (.deb/.rpm/.apk/.pkg.tar.*) plus sibling SBOM/sig presence.

Input Output Examples

Name	Type	Req	Description
buildID	string	—	build session whose output dir to scan
path	string	—	yap.json/PKGBUILD/dir to scan (used when buildID empty)

Name	Type	Req	Description
artifacts	null\|array	yes	—
outputDir	string	yes	—

No examples provided.

list_distros ~22

List supported distributions, their package managers, and known packers.

Input Output Examples

Input schema present but exposes no named parameters.

Name	Type	Req	Description
distros	null\|array	yes	distro ids paired with their pkg manager
packers	null\|array	yes	package managers yap knows how to drive
releases	null\|array	yes	deprecated alias for distros[*].name

No examples provided.

list_images ~67

List pre-built yap container image tags from build/deploy/ in the yap source tree. Requires running with repoPath pointing at a yap checkout; end-user installations should pass distros from list_distros instead.

Input Output Examples

Name	Type	Req	Description
repoPath	string	—	path to yap source tree; defaults to cwd

Name	Type	Req	Description
images	null\|array	yes	—
repoPath	string	yes	—

No examples provided.

parse_pkgbuild ~102

Parse a PKGBUILD into structured JSON (name, version, deps, sources, ...).

Input Output Examples

Name	Type	Req	Description
distro	string	—	distro context for arch/distro-qualified directives
path	string	yes	path to a dir containing a PKGBUILD, or to PKGBUILD itself
release	string	—	release/codename context; auto-detected when empty
targetArch	string	—	target arch for cross-compile; empty for native

Name	Type	Req	Description
arch	null\|array	—	—
codename	string	—	—
conflicts	null\|array	—	—
depends	null\|array	—	—
distro	string	—	—
epoch	string	—	—
hashSums	null\|array	—	—
isSplit	boolean	yes	—
license	null\|array	—	—
makeDepends	null\|array	—	—
optDepends	null\|array	—	—
pkgBase	string	—	—
pkgDesc	string	yes	—
pkgName	string	yes	—
pkgNames	null\|array	—	—
pkgRel	string	yes	—
pkgVer	string	yes	—
provides	null\|array	—	—
replaces	null\|array	—	—
sources	null\|array	—	—
targetArch	string	—	—
url	string	—	—

No examples provided.

prepare ~97

Prepare the host build environment (toolchain + base makedeps) for a distro.

Input Output Examples

Name	Type	Req	Description
distro	string	—	distribution name; auto-detected when empty
goLang	boolean	—	install Go toolchain
release	string	—	release/codename; auto-detected when empty
skipSync	boolean	—	skip package-manager update before prerequisites
targetArch	string	—	target arch; empty for native

Name	Type	Req	Description
distro	string	yes	—
error	string	—	—
ok	boolean	yes	—
release	string	yes	—

No examples provided.

pull ~38

Pull the yap container image for the requested distro.

Input Output Examples

Name	Type	Req	Description
distro	string	yes	distro tag, e.g. 'ubuntu' or 'ubuntu-noble'

Name	Type	Req	Description
distro	string	yes	—
error	string	—	—
ok	boolean	yes	—
runtime	string	yes	—

No examples provided.

resolve_distro ~59

Auto-detect distribution and release from /etc/os-release.

Input Output Examples

Name	Type	Req	Description
distro	string	—	distro name; auto-detected from /etc/os-release when empty
release	string	—	release/codename; auto-detected when matching host

Name	Type	Req	Description
distro	string	yes	resolved distribution name
release	string	yes	resolved release / codename

No examples provided.

status ~20

Return yap version, build metadata, and runtime/container detection info.

Input Output Examples

Input schema present but exposes no named parameters.

Name	Type	Req	Description
buildTime	string	yes	RFC3339 build timestamp
commit	string	yes	git short commit hash
goVersion	string	yes	go runtime version
goarch	string	yes	runtime GOARCH
goos	string	yes	runtime GOOS
inContainer	boolean	yes	true when running inside a container
version	string	yes	yap semantic version

No examples provided.

validate ~58

Validate a PKGBUILD: parse + check mandatory vars + general validation.

Input Output Examples

Name	Type	Req	Description
distro	string	—	distro context
path	string	yes	path to PKGBUILD or its directory
release	string	—	release/codename context

Name	Type	Req	Description
errors	null\|array	—	validation error messages; empty when valid
pkg	string	—	resolved package name
valid	boolean	yes	true when all mandatory fields are well-formed

No examples provided.

zap ~114

Deeply clean a yap project's build env and artifacts. Requires confirm: true.

Input Output Examples

Name	Type	Req	Description
confirm	boolean	yes	must be true; zap removes build state and artifacts
distro	string	—	distro context; auto-detected when empty
fromPkgName	string	—	only clean from this package onward
path	string	yes	yap.json file, PKGBUILD file, or dir with either
release	string	—	release context
toPkgName	string	—	only clean up to this package

Name	Type	Req	Description
distro	string	yes	—
error	string	—	—
ok	boolean	yes	—
path	string	yes	—
release	string	yes	—

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

2 Aug 3 Aug