NEAT

NPM · @NEAT.IS/MCP · SCANNED AUG 4

Fused graph of your codebase — static code + runtime OTel — for AI agents, over MCP.

Available components

63 63 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security83

No malware found by supply-chain analysis.Pass
CVE check failed: a known medium-severity CVE affects hono 4.12.33, reached via @modelcontextprotocol/sdk > hono. A fixed version is available. View diagnostics → Fail
No install/post-install scripts declared.Pass
Only part of the dependency tree could be resolved (96 of 100), so this covers what we could see, not the whole tree. View diagnostics → Partial

Provenance & Transparency32

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
License check failed: the license (BUSL-1.1) isn't a recognized OSI-approved license. See how to fix → Fail
Actively maintained (last published 1 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability70

AI-judged instruction clarity (excellent).Pass
Context-footprint check failed: tool/resource definitions use about 2282 tokens (~142/item across 16 items; 16 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management17

Stability observed for 5 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial

Tool Coverage100

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
100% of tool parameters carry a description.Pass

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · @neat.is/mcp

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add neat-technologies-neat -- npx -y @neat.is/mcp

# add to Codex CLI

codex mcp add neat-technologies-neat -- npx -y @neat.is/mcp

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "neat-technologies-neat": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@neat.is/mcp"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add neat-technologies-neat --command npx --arg -y --arg @neat.is/mcp

# ~/.hermes/config.yaml

mcp_servers:
  neat-technologies-neat:
    command: "npx"
    args: ["-y", "@neat.is/mcp"]

// mcp.json

{
  "mcpServers": {
    "neat-technologies-neat": {
      "command": "npx",
      "args": [
        "-y",
        "@neat.is/mcp"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

4 Aug 26 0
- CVE-2026-69207 affects this package: medium ▼ security
- Known CVEs: partial → fail ▼ security
2 Aug 26 +58
- Provenance: unverified → fail ▼ security
- Install scripts: unverified → pass ▲ security
- Known CVEs: unverified → partial ▲ security
- Malware scan: unverified → pass ▲ security
- License: unverified → fail ▼ functional
- Schema quality: unverified → excellent ▲ functional
- Stability: unverified → 0.10 ▲ functional
- Dependency health: unverified → partial ▲ functional
- Maintenance: unverified → pass ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Tool coverage: unverified → 100 ▲ functional
- Licence: BUSL-1.1 functional
- Package version: 0.7.1 → 0.7.4 functional
- Package version: 0.7.1 → 0.7.3 functional
1 Aug 26 −20
- Provenance: fail → unverified ▼ security
- Install scripts: pass → unverified ▼ security
- Tool coverage: 100 → unverified ▼ functional
- Maintenance: pass → unverified ▼ functional
- License: fail → unverified ▼ functional
- Licence: BUSL-1.1 functional
- Package version: 0.6.4 → 0.7.1 functional
31 Jul 26 +19
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
30 Jul 26 6

First indexed and scored.

Show 2 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 4 Aug 2026 · Analysed npm/@neat.is/[email protected]

Provenance none

Ecosystem: npm · Outcome: none

Vulnerabilities 1 finding

ID	CVE	Severity	Vector	Fix available
GHSA-8j4g-w8fx-2239	CVE-2026-69207	medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	yes

Dependencies 96 packages

96 packages in the resolved dependency tree · 95 deprecated · 29 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 16 exposed · ~2,011 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

check_policies ~222

Inspect, dry-run, or get the soft guardrail for the project's policy.json. With applicableTo, returns the policies that apply where you are working — surfaced as context so you stay inside the lines (informs, never blocks). Without hypotheticalAction or applicableTo, returns currently-recorded violations. With hypotheticalAction, returns violations that would result if the action were applied. Architectural assertions in five shapes (structural / compatibility / provenance / ownership / blast-radius).

Input Output Examples

Name	Type	Req	Description
applicableTo	string	—	Soft guardrail (ADR-108): pass the node id you are about to edit and check_policies returns the policies that govern it, as a context block — so you stay inside the lines. Advisory only; never blocks.
hypotheticalAction	—	—	Dry-run mode: simulate the action and return resulting violations. Omit for current state.
project	string	—	Project name when the core hosts more than one (set NEAT_PROJECTS=...). Omit to use the default project.
scope	—	—	Narrow to a subset. Default "all".

No output schema declared.

No examples provided.

get_blast_radius ~93

List every node that depends on the given node — what would break if this node failed or was redeployed.

Input Output Examples

Name	Type	Req	Description
depth	integer	—	Max BFS depth (default 10)
nodeId	string	yes	Graph node id to compute blast radius from
project	string	—	Project name when the core hosts more than one (set NEAT_PROJECTS=...). Omit to use the default project.

No output schema declared.

No examples provided.

get_dependencies ~132

List the transitive outgoing dependencies of a node, BFS to depth N (default 3, max 10). Each result carries distance, edge type, and provenance — both static (EXTRACTED) and runtime (OBSERVED). Pass depth=1 for direct-only.

Input Output Examples

Name	Type	Req	Description
depth	integer	—	BFS depth (default 3, max 10). depth=1 returns direct dependencies only.
nodeId	string	yes	Graph node id to inspect
project	string	—	Project name when the core hosts more than one (set NEAT_PROJECTS=...). Omit to use the default project.

No output schema declared.

No examples provided.

get_divergences ~224

Returns places where what the code declares (EXTRACTED) doesn't match what production observed (OBSERVED). The single most NEAT-shaped query — the one that justifies the whole graph. Use when the user asks 'is anything weird?' or 'what does production do that the code doesn't?' or 'find me a bug' on an unfamiliar codebase. Returns divergences ranked by confidence × severity. Prefer this over `get_root_cause` when no specific node is failing.

Input Output Examples

Name	Type	Req	Description
minConfidence	number	—	Drop divergences below this confidence threshold (0.0 - 1.0).
node	string	—	Scope to divergences involving this node id (as source or target).
project	string	—	Project name when the core hosts more than one (set NEAT_PROJECTS=...). Omit to use the default project.
type	array	—	Filter by divergence type. One or more of: missing-observed, missing-extracted, version-mismatch, host-mismatch, compat-violation. Omit for all.

No output schema declared.

No examples provided.

get_graph_diff ~120

Diff a saved graph snapshot against the current live graph. Useful for change reviews and post-incidents — answers "what changed in the architecture between then and now." Returns added/removed/changed nodes and edges with both snapshot timestamps.

Input Output Examples

Name	Type	Req	Description
againstSnapshot	string	yes	Path or http(s) URL of the snapshot to diff against (the "before" state). The current graph is the "after".
project	string	—	Project name when the core hosts more than one (set NEAT_PROJECTS=...). Omit to use the default project.

No output schema declared.

No examples provided.

get_incident_history ~84

Return recent OTel error events recorded against a node, most recent first.

Input Output Examples

Name	Type	Req	Description
limit	integer	—	Max events to return (default 20)
nodeId	string	yes	Graph node id to query
project	string	—	Project name when the core hosts more than one (set NEAT_PROJECTS=...). Omit to use the default project.

No output schema declared.

No examples provided.

get_observed_dependencies ~89

List only the runtime (OBSERVED via OTel) outgoing dependencies of a node. Use this to compare what code SAYS the service depends on vs what production actually does.

Input Output Examples

Name	Type	Req	Description
nodeId	string	yes	Graph node id to inspect
project	string	—	Project name when the core hosts more than one (set NEAT_PROJECTS=...). Omit to use the default project.

No output schema declared.

No examples provided.

get_recent_stale_edges ~126

List the most recent OBSERVED → STALE edge transitions. Use this to spot integrations that have gone quiet — a CALLS edge that just went stale typically means an upstream stopped calling, not that the link is healthy.

Input Output Examples

Name	Type	Req	Description
edgeType	string	—	Filter by edge type — e.g. "CALLS" or "CONNECTS_TO"
limit	integer	—	Max events to return (default 50)
project	string	—	Project name when the core hosts more than one (set NEAT_PROJECTS=...). Omit to use the default project.

No output schema declared.

No examples provided.

get_root_cause ~125

Trace a failing node up its dependency graph to find the underlying cause. Use this when something is breaking and you want to know which upstream component is the actual culprit.

Input Output Examples

Name	Type	Req	Description
errorId	string	—	Specific error event id from incident history; if set, the result is coloured with that error message
errorNode	string	yes	Graph node id where the error surfaced, e.g. "database:payments-db"
project	string	—	Project name when the core hosts more than one (set NEAT_PROJECTS=...). Omit to use the default project.

No output schema declared.

No examples provided.

neat_apply_extension ~189

Install an instrumentation package and splice its registration into the existing OTel hook file. Idempotent — calling twice with the same args is a no-op. Only modifies instrumentation files, package.json, and the lockfile (via the project package manager).

Input Output Examples

Name	Type	Req	Description
instrumentation_package	string	yes	The instrumentation npm package, e.g. "@prisma/instrumentation"
library	string	yes	The library being instrumented, e.g. "@prisma/client"
project	string	—	Project name when the core hosts more than one (set NEAT_PROJECTS=...). Omit to use the default project.
registration_snippet	string	yes	The JS/TS snippet to splice into the instrumentations array, e.g. "instrumentations.push(new PrismaInstrumentation())"
version	string	yes	Semver range for the instrumentation package, e.g. "^6.0.0"

No output schema declared.

No examples provided.

neat_describe_project_instrumentation ~76

Describe the current state of OTel instrumentation in the project: which hook files exist, whether .env.neat is present, which OTel deps are installed.

Input Output Examples

Name	Type	Req	Description
project	string	—	Project name when the core hosts more than one (set NEAT_PROJECTS=...). Omit to use the default project.

No output schema declared.

No examples provided.

neat_dry_run_extension ~155

Preview what neat_apply_extension would do without making any changes. Returns the exact file diff, deps to add, and install command.

Input Output Examples

Name	Type	Req	Description
instrumentation_package	string	yes	The instrumentation npm package, e.g. "@prisma/instrumentation"
library	string	yes	The library being instrumented, e.g. "@prisma/client"
project	string	—	Project name when the core hosts more than one (set NEAT_PROJECTS=...). Omit to use the default project.
registration_snippet	string	yes	The JS/TS snippet to splice into the instrumentations array
version	string	yes	Semver range for the instrumentation package, e.g. "^6.0.0"

No output schema declared.

No examples provided.

neat_list_uninstrumented ~75

List libraries in the project that need instrumentation beyond the auto-instrumentations bundle. Returns first-party, third-party, and gap libraries that require an explicit instrumentation package.

Input Output Examples

Name	Type	Req	Description
project	string	—	Project name when the core hosts more than one (set NEAT_PROJECTS=...). Omit to use the default project.

No output schema declared.

No examples provided.

neat_lookup_instrumentation ~98

Look up the registry entry for a specific library. Returns the canonical instrumentation package, version, and registration snippet if one exists.

Input Output Examples

Name	Type	Req	Description
installedVersion	string	—	Installed version for range matching
library	string	yes	npm package name, e.g. "@prisma/client"
project	string	—	Project name when the core hosts more than one (set NEAT_PROJECTS=...). Omit to use the default project.

No output schema declared.

No examples provided.

neat_rollback_extension ~98

Undo the last neat_apply_extension for a given library. Removes the dep from package.json and the registration from the hook file. Does not re-run the package manager — run install manually to sync the lockfile.

Input Output Examples

Name	Type	Req	Description
library	string	yes	The library whose instrumentation should be rolled back
project	string	—	Project name when the core hosts more than one (set NEAT_PROJECTS=...). Omit to use the default project.

No output schema declared.

No examples provided.

semantic_search ~105

Search nodes by natural-language query. Uses embedding vectors when an embedder is available (Ollama nomic-embed-text → in-process MiniLM → substring fallback) — phrase the query the way you would describe what you want.

Input Output Examples

Name	Type	Req	Description
project	string	—	Project name when the core hosts more than one (set NEAT_PROJECTS=...). Omit to use the default project.
query	string	yes	Free-text query, e.g. "service handling checkout payments"

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

30 Jul 4 Aug