fieldtwin
NPM · FIELDTWIN
Local, stateful twins of the Jobber, Housecall Pro, and QuickBooks Online APIs, for agents and tests
Available components
Last scanned (10 hours ago)
Scores higher than 48% of npm servers
Category Testing and QA
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 30 of 94 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (Apache-2.0).Pass
- Actively maintained (last published 6 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability75
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 1255 tokens (~89/item across 14 items; 14 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management23
- Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 14 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 14 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.
- 3 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.
- 1 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.
- 30 Oct 26 +11
- Known CVEs: unverified → pass ▲ security
- Dependency health: unverified → 0.86 ▲ functional
- 29 Oct 26 60
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed npm/fieldtwin@0.5.3
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 94 packages
| Packages resolved | 94 |
|---|---|
| Stale | 30 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
twin_advance_clock Move twin time forward ~90
Twin time stands still until you move it. Scheduled scenario events happen on the way, each at its own time, and the webhooks they cause are delivered to the subscribed URLs before this answers; 0 minutes only sends deliveries already due. Answers with the new twin time and how many scenario events happened.
| Name | Type | Req | Description |
|---|---|---|---|
| minutes | number | yes | Minutes of twin time to move forward, up to ten years |
No output schema declared.
No examples provided.
twin_changes List changes since a checkpoint ~100
What changed since a checkpoint, one line per event, oldest first: when, which vendor, what, and its source. Set onlyFromApi to see only what your code's API calls did. Changes nothing. For whole events, use twin_export_log.
| Name | Type | Req | Description |
|---|---|---|---|
| checkpoint | string | yes | A checkpoint's name, as given to twin_checkpoint |
| onlyFromApi | boolean | – | True to leave out the seed, the scenario timeline, and control tools |
No output schema declared.
No examples provided.
twin_checkpoint Take a checkpoint ~67
Name the current moment (log position, twin time, and fault dice), to list changes since it with twin_changes or go back to it with twin_rewind. A name already taken moves to now. Answers with the checkpoint.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | Any name, like before-sync |
No output schema declared.
No examples provided.
twin_export_log Export the event log ~70
The event log as JSON Lines, one whole event per line, oldest first: everything, or only what happened since a checkpoint. Changes nothing. For a one-line summary of each, use twin_changes.
| Name | Type | Req | Description |
|---|---|---|---|
| checkpoint | string | – | Only events after this checkpoint; leave it out for the whole log |
No output schema declared.
No examples provided.
twin_list_scenarios List ready-made scenarios ~33
The ready-made scenarios twin_load_scenario can load by name, and what each one tests. Changes nothing.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
twin_load_scenario Load a scenario ~121
Throw away the current world and build one from a scenario: a ready-made one by name (see twin_list_scenarios), or your own YAML (seed, startTime, world, faults, auth, timeline). Give one of the two. A scenario that doesn't load leaves the twin as it was. twin_reset comes back to its start. Answers with the new status.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | – | A ready-made scenario's name, like flaky-apis |
| yaml | string | – | A whole scenario as YAML, instead of a name |
No output schema declared.
No examples provided.
twin_reset Reset the twin ~68
Throw away everything since the start and rebuild the seeded world (the loaded scenario's, if one is loaded), with its timeline and faults. Checkpoints go too; webhook subscriptions and the auth mode stay. To undo only part of a run, use twin_rewind. Answers with the new status.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
twin_rewind Rewind to a checkpoint ~68
Undo everything recorded after a checkpoint: records, twin time, and fault dice go back, so the same requests meet the same faults again. Checkpoints taken after it are dropped. Answers with the new status.
| Name | Type | Req | Description |
|---|---|---|---|
| checkpoint | string | yes | A checkpoint's name, as given to twin_checkpoint |
No output schema declared.
No examples provided.
twin_run_action Make something happen in a vendor's app ~130
Make something happen now, as if someone did it in the vendor's own app: jobber newClients or payInvoices; housecallpro newCustomers, completeJobs, invoiceJobs, or payInvoices (quickbooks has none). Each takes params: how many. Recorded with source "control"; its webhooks are delivered before this answers. Answers with the events it recorded.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | The action's name, like payInvoices |
| params | – | yes | How many, like 2 |
| vendor | string | yes | The vendor: quickbooks, jobber, or housecallpro |
No output schema declared.
No examples provided.
twin_set_auth Set the auth mode ~59
How the vendor APIs treat bearer tokens: "any-token" accepts anything; "oauth" accepts only unexpired tokens from the twin's OAuth endpoints. Changes no records. Answers with the mode.
| Name | Type | Req | Description |
|---|---|---|---|
| mode | string | yes | The new auth mode |
No output schema declared.
No examples provided.
twin_set_faults Set fault rules ~166
Replace the active fault rules, so the vendor APIs fail the way real ones do. Each rule: { name, vendor: quickbooks|jobber|housecallpro, method?, pathIncludes?, pathExcludes?, rate: 0-1, effect: { status?: HTTP error status, latencyMs?, message?, lostResponse?: do the work, then answer with status } }. A rule with webhook: TOPIC or "*" (and no method, pathIncludes, or pathExcludes) affects webhook deliveries instead: effect { duplicate?: true, delayMs? }. An empty list turns faults off. Bad rules change nothing. Answers with the active rules' names.
| Name | Type | Req | Description |
|---|---|---|---|
| rules | array | yes | Every rule to keep active, shaped as above; [] turns faults off |
No output schema declared.
No examples provided.
twin_set_webhooks Set webhook subscriptions ~201
Replace the webhook subscriptions, as an app would set them up in the vendor's developer settings. Each: { vendor: quickbooks | jobber | housecallpro, url, topics, clientId, clientSecret (signs deliveries: for Jobber the app's OAuth client secret, for QuickBooks its verifier token, for Housecall Pro its signing secret) }. quickbooks topics: qbo.customer.created.v1, qbo.customer.updated.v1, qbo.invoice.created.v1, qbo.invoice.updated.v1, qbo.payment.created.v1. jobber topics: CLIENT_CREATE, INVOICE_UPDATE. housecallpro topics: customer.created, customer.updated, job.created, job.scheduled, job.completed, job.paid, invoice.created, invoice.sent, invoice.payment.succeeded, invoice.paid. Answers as twin_webhooks does.
| Name | Type | Req | Description |
|---|---|---|---|
| subscriptions | array | yes | Every subscription to keep, shaped as above; [] removes them all |
No output schema declared.
No examples provided.
twin_status Twin status ~53
Where the test world stands: company, seed, loaded scenario, twin time, event count, auth mode, active faults, checkpoints, and the timeline entries due next. Changes nothing. Call it first to get your bearings.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
twin_webhooks Show webhooks ~29
The webhook subscriptions, without their secrets, and the latest deliveries with how each went. Changes nothing.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
How do I install the fieldtwin MCP server?
fieldtwin runs locally as an npm package, launched with npx -y fieldtwin. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · fieldtwin
claude mcp add nickgeorgeseo-fieldtwin -- npx -y fieldtwin
What is the fieldtwin MCP server?
fieldtwin is an MCP server listed in the public MCP registry as io.github.nickgeorgeseo/fieldtwin. Local, stateful twins of the Jobber, Housecall Pro, and QuickBooks Online APIs, for agents and tests. This page covers its npm package (fieldtwin).
Is the fieldtwin MCP server safe to use?
fieldtwin scores 74 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the fieldtwin MCP server expose?
fieldtwin exposes 14 tools: twin_status, twin_reset, twin_advance_clock, twin_run_action, twin_checkpoint, and 9 more. Their descriptions and schemas cost roughly 1,255 tokens of context every time the server is loaded.
Is the fieldtwin MCP server still maintained?
fieldtwin is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the fieldtwin MCP server under?
fieldtwin declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.