# fieldtwin (npm · fieldtwin)

Local, stateful twins of the Jobber, Housecall Pro, and QuickBooks Online APIs, for agents and tests

- Trust score: 74/100 (medium)
- Change this week: +14
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- npm · `fieldtwin`: 74/100 (this document), [markdown](https://verifymcp.io/servers/nickgeorgeseo-fieldtwin/fieldtwin.md), [page](https://verifymcp.io/servers/nickgeorgeseo-fieldtwin/fieldtwin)

## Channel facts

- Registry: `npm`
- Package: `fieldtwin`
- Version: `0.5.3`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Supply Chain Security**: 98/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 30 of 94 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 48/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (Apache-2.0).
  - Actively maintained (last published 6 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 75/100
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 1255 tokens (~89/item across 14 items; 14 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 23/100
  - Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 14 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 14 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the fieldtwin MCP server?

fieldtwin runs locally as an npm package, launched with npx -y fieldtwin. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add nickgeorgeseo-fieldtwin -- npx -y fieldtwin
```

### Cursor

```json
{
  "mcpServers": {
    "nickgeorgeseo-fieldtwin": {
      "command": "npx",
      "args": [
        "-y",
        "fieldtwin"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "nickgeorgeseo-fieldtwin": {
      "command": "npx",
      "args": [
        "-y",
        "fieldtwin"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add nickgeorgeseo-fieldtwin -- npx -y fieldtwin
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "nickgeorgeseo-fieldtwin": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "fieldtwin"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add nickgeorgeseo-fieldtwin --command npx --arg -y --arg fieldtwin
```

### Hermes

```yaml
mcp_servers:
  nickgeorgeseo-fieldtwin:
    command: "npx"
    args: ["-y", "fieldtwin"]
```

### Netclaw

```json
{
  "McpServers": {
    "nickgeorgeseo-fieldtwin": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "fieldtwin"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add nickgeorgeseo-fieldtwin -t stdio -c npx -a -y fieldtwin
```

### Other

```json
{
  "mcpServers": {
    "nickgeorgeseo-fieldtwin": {
      "command": "npx",
      "args": [
        "-y",
        "fieldtwin"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-05 (score 74, +1)

No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-11-03 (score 73, +1)

No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-11-01 (score 72, +1)

No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-30 (score 71, +11)

- [security improvement] Known CVEs: unverified → pass
- [functional improvement] Dependency health: unverified → 0.86

### 2026-10-29 (score 60)

First indexed and scored.

## MCP tools (14)

### `twin_status` (~53 tokens)

Twin status

Where the test world stands: company, seed, loaded scenario, twin time, event count, auth mode, active faults, checkpoints, and the timeline entries due next. Changes nothing. Call it first to get your bearings.

### `twin_reset` (~68 tokens)

Reset the twin

Throw away everything since the start and rebuild the seeded world (the loaded scenario's, if one is loaded), with its timeline and faults. Checkpoints go too; webhook subscriptions and the auth mode stay. To undo only part of a run, use twin_rewind. Answers with the new status.

### `twin_advance_clock` (~90 tokens)

Move twin time forward

Twin time stands still until you move it. Scheduled scenario events happen on the way, each at its own time, and the webhooks they cause are delivered to the subscribed URLs before this answers; 0 minutes only sends deliveries already due. Answers with the new twin time and how many scenario events happened.

Input parameters:

- `minutes` (number, required): Minutes of twin time to move forward, up to ten years

### `twin_run_action` (~130 tokens)

Make something happen in a vendor's app

Make something happen now, as if someone did it in the vendor's own app: jobber newClients or payInvoices; housecallpro newCustomers, completeJobs, invoiceJobs, or payInvoices (quickbooks has none). Each takes params: how many. Recorded with source "control"; its webhooks are delivered before this answers. Answers with the events it recorded.

Input parameters:

- `action` (string, required): The action's name, like payInvoices
- `params` (required): How many, like 2
- `vendor` (string, required): The vendor: quickbooks, jobber, or housecallpro

### `twin_checkpoint` (~67 tokens)

Take a checkpoint

Name the current moment (log position, twin time, and fault dice), to list changes since it with twin_changes or go back to it with twin_rewind. A name already taken moves to now. Answers with the checkpoint.

Input parameters:

- `name` (string, required): Any name, like before-sync

### `twin_changes` (~100 tokens)

List changes since a checkpoint

What changed since a checkpoint, one line per event, oldest first: when, which vendor, what, and its source. Set onlyFromApi to see only what your code's API calls did. Changes nothing. For whole events, use twin_export_log.

Input parameters:

- `checkpoint` (string, required): A checkpoint's name, as given to twin_checkpoint
- `onlyFromApi` (boolean): True to leave out the seed, the scenario timeline, and control tools

### `twin_rewind` (~68 tokens)

Rewind to a checkpoint

Undo everything recorded after a checkpoint: records, twin time, and fault dice go back, so the same requests meet the same faults again. Checkpoints taken after it are dropped. Answers with the new status.

Input parameters:

- `checkpoint` (string, required): A checkpoint's name, as given to twin_checkpoint

### `twin_list_scenarios` (~33 tokens)

List ready-made scenarios

The ready-made scenarios twin_load_scenario can load by name, and what each one tests. Changes nothing.

### `twin_load_scenario` (~121 tokens)

Load a scenario

Throw away the current world and build one from a scenario: a ready-made one by name (see twin_list_scenarios), or your own YAML (seed, startTime, world, faults, auth, timeline). Give one of the two. A scenario that doesn't load leaves the twin as it was. twin_reset comes back to its start. Answers with the new status.

Input parameters:

- `name` (string): A ready-made scenario's name, like flaky-apis
- `yaml` (string): A whole scenario as YAML, instead of a name

### `twin_set_faults` (~166 tokens)

Set fault rules

Replace the active fault rules, so the vendor APIs fail the way real ones do. Each rule: { name, vendor: quickbooks|jobber|housecallpro, method?, pathIncludes?, pathExcludes?, rate: 0-1, effect: { status?: HTTP error status, latencyMs?, message?, lostResponse?: do the work, then answer with status } }. A rule with webhook: TOPIC or "*" (and no method, pathIncludes, or pathExcludes) affects webhook deliveries instead: effect { duplicate?: true, delayMs? }. An empty list turns faults off. Bad rules change nothing. Answers with the active rules' names.

Input parameters:

- `rules` (array, required): Every rule to keep active, shaped as above; [] turns faults off

### `twin_set_auth` (~59 tokens)

Set the auth mode

How the vendor APIs treat bearer tokens: "any-token" accepts anything; "oauth" accepts only unexpired tokens from the twin's OAuth endpoints. Changes no records. Answers with the mode.

Input parameters:

- `mode` (string, required): The new auth mode

### `twin_set_webhooks` (~201 tokens)

Set webhook subscriptions

Replace the webhook subscriptions, as an app would set them up in the vendor's developer settings. Each: { vendor: quickbooks | jobber | housecallpro, url, topics, clientId, clientSecret (signs deliveries: for Jobber the app's OAuth client secret, for QuickBooks its verifier token, for Housecall Pro its signing secret) }. quickbooks topics: qbo.customer.created.v1, qbo.customer.updated.v1, qbo.invoice.created.v1, qbo.invoice.updated.v1, qbo.payment.created.v1. jobber topics: CLIENT_CREATE, INVOICE_UPDATE. housecallpro topics: customer.created, customer.updated, job.created, job.scheduled, job.completed, job.paid, invoice.created, invoice.sent, invoice.payment.succeeded, invoice.paid. Answers as twin_webhooks does.

Input parameters:

- `subscriptions` (array, required): Every subscription to keep, shaped as above; [] removes them all

### `twin_webhooks` (~29 tokens)

Show webhooks

The webhook subscriptions, without their secrets, and the latest deliveries with how each went. Changes nothing.

### `twin_export_log` (~70 tokens)

Export the event log

The event log as JSON Lines, one whole event per line, oldest first: everything, or only what happened since a checkpoint. Changes nothing. For a one-line summary of each, use twin_changes.

Input parameters:

- `checkpoint` (string): Only events after this checkpoint; leave it out for the whole log

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/nickgeorgeseo-fieldtwin/fieldtwin#diagnostics

## Score history

- 2026-11-05: 74
- 2026-11-04: 73
- 2026-11-03: 73
- 2026-11-02: 72
- 2026-11-01: 72
- 2026-10-31: 71
- 2026-10-30: 71
- 2026-10-29: 60

## Common questions

### What is the fieldtwin MCP server?

fieldtwin is an MCP server listed in the public MCP registry as io.github.nickgeorgeseo/fieldtwin. Local, stateful twins of the Jobber, Housecall Pro, and QuickBooks Online APIs, for agents and tests. This page covers its npm package (fieldtwin).

### Is the fieldtwin MCP server safe to use?

fieldtwin scores 74 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the fieldtwin MCP server expose?

fieldtwin exposes 14 tools: twin_status, twin_reset, twin_advance_clock, twin_run_action, twin_checkpoint, and 9 more. Their descriptions and schemas cost roughly 1,255 tokens of context every time the server is loaded.

### Is the fieldtwin MCP server still maintained?

fieldtwin is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the fieldtwin MCP server under?

fieldtwin declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/fieldtwin
- Socket report: https://socket.dev/npm/package/fieldtwin
- Repository: https://github.com/nickgeorgeseo/fieldtwin
- Website: https://nickgeorgeai.com/fieldtwin
- Changelog RSS feed: https://verifymcp.io/servers/nickgeorgeseo-fieldtwin/fieldtwin.xml
- Changelog JSON feed: https://verifymcp.io/servers/nickgeorgeseo-fieldtwin/fieldtwin.json
- HTML version of this page: https://verifymcp.io/servers/nickgeorgeseo-fieldtwin/fieldtwin