# NEAT (npm · @neat.is/mcp)

Fused graph of your codebase — static code + runtime OTel — for AI agents, over MCP.

- Trust score: 63/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-04

## Components

- npm · `@neat.is/mcp`: 63/100 (this document), [markdown](https://verifymcp.io/servers/neat-technologies-neat/neat-is-mcp.md), [page](https://verifymcp.io/servers/neat-technologies-neat/neat-is-mcp)

## Channel facts

- Registry: `npm`
- Package: `@neat.is/mcp`
- Version: `0.7.4`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-04.

- **Supply Chain Security**: 83/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known medium-severity CVE affects hono 4.12.33, reached via @modelcontextprotocol/sdk > hono. A fixed version is available.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (96 of 100), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 32/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - License check failed: the license (BUSL-1.1) isn't a recognized OSI-approved license.
  - Actively maintained (last published 1 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 70/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 2282 tokens (~142/item across 16 items; 16 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 17/100
  - Stability observed for 5 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add neat-technologies-neat -- npx -y @neat.is/mcp
```

### Codex

```bash
codex mcp add neat-technologies-neat -- npx -y @neat.is/mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "neat-technologies-neat": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@neat.is/mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add neat-technologies-neat --command npx --arg -y --arg @neat.is/mcp
```

### Hermes

```yaml
mcp_servers:
  neat-technologies-neat:
    command: "npx"
    args: ["-y", "@neat.is/mcp"]
```

### Other

```json
{
  "mcpServers": {
    "neat-technologies-neat": {
      "command": "npx",
      "args": [
        "-y",
        "@neat.is/mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-04 (score 63, 0)

- [security regression] CVE-2026-69207 affects this package: medium
- [security regression] Known CVEs: partial → fail

### 2026-08-02 (score 63, +58)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [functional regression] License: unverified → fail
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] Stability: unverified → 0.10
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Tool coverage: unverified → 100
- [functional] Licence: BUSL-1.1
- [functional] Package version: 0.7.1 → 0.7.4
- [functional] Package version: 0.7.1 → 0.7.3

### 2026-08-01 (score 5, −20)

- [security regression] Provenance: fail → unverified
- [security regression] Install scripts: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Maintenance: pass → unverified
- [functional regression] License: fail → unverified
- [functional] Licence: BUSL-1.1
- [functional] Package version: 0.6.4 → 0.7.1

### 2026-07-31 (score 25, +19)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 6)

First indexed and scored.

## MCP tools (16)

### `get_root_cause` (~125 tokens)

Trace a failing node up its dependency graph to find the underlying cause. Use this when something is breaking and you want to know which upstream component is the actual culprit.

Input parameters:

- `errorId` (string): Specific error event id from incident history; if set, the result is coloured with that error message
- `errorNode` (string, required): Graph node id where the error surfaced, e.g. "database:payments-db"
- `project` (string): Project name when the core hosts more than one (set NEAT_PROJECTS=...). Omit to use the default project.

### `get_blast_radius` (~93 tokens)

List every node that depends on the given node — what would break if this node failed or was redeployed.

Input parameters:

- `depth` (integer): Max BFS depth (default 10)
- `nodeId` (string, required): Graph node id to compute blast radius from
- `project` (string): Project name when the core hosts more than one (set NEAT_PROJECTS=...). Omit to use the default project.

### `get_dependencies` (~132 tokens)

List the transitive outgoing dependencies of a node, BFS to depth N (default 3, max 10). Each result carries distance, edge type, and provenance — both static (EXTRACTED) and runtime (OBSERVED). Pass depth=1 for direct-only.

Input parameters:

- `depth` (integer): BFS depth (default 3, max 10). depth=1 returns direct dependencies only.
- `nodeId` (string, required): Graph node id to inspect
- `project` (string): Project name when the core hosts more than one (set NEAT_PROJECTS=...). Omit to use the default project.

### `get_observed_dependencies` (~89 tokens)

List only the runtime (OBSERVED via OTel) outgoing dependencies of a node. Use this to compare what code SAYS the service depends on vs what production actually does.

Input parameters:

- `nodeId` (string, required): Graph node id to inspect
- `project` (string): Project name when the core hosts more than one (set NEAT_PROJECTS=...). Omit to use the default project.

### `get_incident_history` (~84 tokens)

Return recent OTel error events recorded against a node, most recent first.

Input parameters:

- `limit` (integer): Max events to return (default 20)
- `nodeId` (string, required): Graph node id to query
- `project` (string): Project name when the core hosts more than one (set NEAT_PROJECTS=...). Omit to use the default project.

### `semantic_search` (~105 tokens)

Search nodes by natural-language query. Uses embedding vectors when an embedder is available (Ollama nomic-embed-text → in-process MiniLM → substring fallback) — phrase the query the way you would describe what you want.

Input parameters:

- `project` (string): Project name when the core hosts more than one (set NEAT_PROJECTS=...). Omit to use the default project.
- `query` (string, required): Free-text query, e.g. "service handling checkout payments"

### `get_graph_diff` (~120 tokens)

Diff a saved graph snapshot against the current live graph. Useful for change reviews and post-incidents — answers "what changed in the architecture between then and now." Returns added/removed/changed nodes and edges with both snapshot timestamps.

Input parameters:

- `againstSnapshot` (string, required): Path or http(s) URL of the snapshot to diff against (the "before" state). The current graph is the "after".
- `project` (string): Project name when the core hosts more than one (set NEAT_PROJECTS=...). Omit to use the default project.

### `get_recent_stale_edges` (~126 tokens)

List the most recent OBSERVED → STALE edge transitions. Use this to spot integrations that have gone quiet — a CALLS edge that just went stale typically means an upstream stopped calling, not that the link is healthy.

Input parameters:

- `edgeType` (string): Filter by edge type — e.g. "CALLS" or "CONNECTS_TO"
- `limit` (integer): Max events to return (default 50)
- `project` (string): Project name when the core hosts more than one (set NEAT_PROJECTS=...). Omit to use the default project.

### `get_divergences` (~224 tokens)

Returns places where what the code declares (EXTRACTED) doesn't match what production observed (OBSERVED). The single most NEAT-shaped query — the one that justifies the whole graph. Use when the user asks 'is anything weird?' or 'what does production do that the code doesn't?' or 'find me a bug' on an unfamiliar codebase. Returns divergences ranked by confidence × severity. Prefer this over `get_root_cause` when no specific node is failing.

Input parameters:

- `minConfidence` (number): Drop divergences below this confidence threshold (0.0 - 1.0).
- `node` (string): Scope to divergences involving this node id (as source or target).
- `project` (string): Project name when the core hosts more than one (set NEAT_PROJECTS=...). Omit to use the default project.
- `type` (array): Filter by divergence type. One or more of: missing-observed, missing-extracted, version-mismatch, host-mismatch, compat-violation. Omit for all.

### `check_policies` (~222 tokens)

Inspect, dry-run, or get the soft guardrail for the project's policy.json. With applicableTo, returns the policies that apply where you are working — surfaced as context so you stay inside the lines (informs, never blocks). Without hypotheticalAction or applicableTo, returns currently-recorded violations. With hypotheticalAction, returns violations that would result if the action were applied. Architectural assertions in five shapes (structural / compatibility / provenance / ownership / blast-radius).

Input parameters:

- `applicableTo` (string): Soft guardrail (ADR-108): pass the node id you are about to edit and check_policies returns the policies that govern it, as a context block — so you stay inside the lines. Advisory only; never blocks.
- `hypotheticalAction`: Dry-run mode: simulate the action and return resulting violations. Omit for current state.
- `project` (string): Project name when the core hosts more than one (set NEAT_PROJECTS=...). Omit to use the default project.
- `scope`: Narrow to a subset. Default "all".

### `neat_list_uninstrumented` (~75 tokens)

List libraries in the project that need instrumentation beyond the auto-instrumentations bundle. Returns first-party, third-party, and gap libraries that require an explicit instrumentation package.

Input parameters:

- `project` (string): Project name when the core hosts more than one (set NEAT_PROJECTS=...). Omit to use the default project.

### `neat_lookup_instrumentation` (~98 tokens)

Look up the registry entry for a specific library. Returns the canonical instrumentation package, version, and registration snippet if one exists.

Input parameters:

- `installedVersion` (string): Installed version for range matching
- `library` (string, required): npm package name, e.g. "@prisma/client"
- `project` (string): Project name when the core hosts more than one (set NEAT_PROJECTS=...). Omit to use the default project.

### `neat_describe_project_instrumentation` (~76 tokens)

Describe the current state of OTel instrumentation in the project: which hook files exist, whether .env.neat is present, which OTel deps are installed.

Input parameters:

- `project` (string): Project name when the core hosts more than one (set NEAT_PROJECTS=...). Omit to use the default project.

### `neat_apply_extension` (~189 tokens)

Install an instrumentation package and splice its registration into the existing OTel hook file. Idempotent — calling twice with the same args is a no-op. Only modifies instrumentation files, package.json, and the lockfile (via the project package manager).

Input parameters:

- `instrumentation_package` (string, required): The instrumentation npm package, e.g. "@prisma/instrumentation"
- `library` (string, required): The library being instrumented, e.g. "@prisma/client"
- `project` (string): Project name when the core hosts more than one (set NEAT_PROJECTS=...). Omit to use the default project.
- `registration_snippet` (string, required): The JS/TS snippet to splice into the instrumentations array, e.g. "instrumentations.push(new PrismaInstrumentation())"
- `version` (string, required): Semver range for the instrumentation package, e.g. "^6.0.0"

### `neat_dry_run_extension` (~155 tokens)

Preview what neat_apply_extension would do without making any changes. Returns the exact file diff, deps to add, and install command.

Input parameters:

- `instrumentation_package` (string, required): The instrumentation npm package, e.g. "@prisma/instrumentation"
- `library` (string, required): The library being instrumented, e.g. "@prisma/client"
- `project` (string): Project name when the core hosts more than one (set NEAT_PROJECTS=...). Omit to use the default project.
- `registration_snippet` (string, required): The JS/TS snippet to splice into the instrumentations array
- `version` (string, required): Semver range for the instrumentation package, e.g. "^6.0.0"

### `neat_rollback_extension` (~98 tokens)

Undo the last neat_apply_extension for a given library. Removes the dep from package.json and the registration from the hook file. Does not re-run the package manager — run install manually to sync the lockfile.

Input parameters:

- `library` (string, required): The library whose instrumentation should be rolled back
- `project` (string): Project name when the core hosts more than one (set NEAT_PROJECTS=...). Omit to use the default project.

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/neat-technologies-neat/neat-is-mcp#diagnostics

## Score history

- 2026-08-04: 63
- 2026-08-03: 63
- 2026-08-02: 63
- 2026-08-01: 5
- 2026-07-31: 25
- 2026-07-30: 6

## Links

- npm package: https://www.npmjs.com/package/@neat.is/mcp
- Socket report: https://socket.dev/npm/package/@neat.is/mcp
- Repository: https://github.com/NEAT-Technologies/Neat
- Changelog RSS feed: https://verifymcp.io/servers/neat-technologies-neat/neat-is-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/neat-technologies-neat/neat-is-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/neat-technologies-neat/neat-is-mcp