# three.ws Autopilot (npm · @three-ws/autopilot-mcp)

Set autopilot scopes and a daily SOL spend cap, then propose, execute, and undo agent actions.

- Trust score: 66/100 (medium)
- Change this week: +23
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `@three-ws/autopilot-mcp`: 66/100 (this document), [markdown](https://verifymcp.io/servers/nirholas-autopilot-mcp/three-ws-autopilot-mcp.md), [page](https://verifymcp.io/servers/nirholas-autopilot-mcp/three-ws-autopilot-mcp)

## Channel facts

- Registry: `npm`
- Package: `@three-ws/autopilot-mcp`
- Version: `0.2.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (Apache-2.0).
  - Actively maintained (last published 39 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 63/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 2376 tokens (~216/item across 11 items; 11 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 23/100
  - Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add nirholas-autopilot-mcp -- npx -y @three-ws/autopilot-mcp
```

### Codex

```bash
codex mcp add nirholas-autopilot-mcp -- npx -y @three-ws/autopilot-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "nirholas-autopilot-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@three-ws/autopilot-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add nirholas-autopilot-mcp --command npx --arg -y --arg @three-ws/autopilot-mcp
```

### Hermes

```yaml
mcp_servers:
  nirholas-autopilot-mcp:
    command: "npx"
    args: ["-y", "@three-ws/autopilot-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "nirholas-autopilot-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@three-ws/autopilot-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 66, +48)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Stability: unverified → 0.20
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Schema quality: unverified → excellent
- [functional] Licence: Apache-2.0

### 2026-08-01 (score 18, +13)

- [functional improvement] Tool coverage: unverified → 100

### 2026-07-31 (score 5, −38)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-27 (score 43)

First indexed and scored.

## MCP tools (11)

### `get_autopilot_config` (~143 tokens)

Get autopilot config

Read the agent's autopilot permission model: whether autopilot is enabled, which capability scopes the owner granted (create_alert, briefing, wallet_transfer), which reversible scopes may auto-execute, the daily SOL spend ceiling (in SOL; 0 = no spending), and whether irreversible actions require explicit confirmation. Also returns the live trust level (sandbox → trusted → autonomous) computed from real action history. Nothing the agent can do exists outside these owner-granted scopes — read this before proposing or executing. Read-only.

Input parameters:

- `agentId` (string, required): UUID of the three.ws agent whose autopilot config to read. Must be an agent owned by the credential.

### `set_autopilot_config` (~317 tokens)

Set autopilot config

Update the agent's autopilot guardrails. A partial patch — only the fields you pass change; the rest are preserved. Set `enabled` to arm/disarm autopilot, `scopes` to grant/revoke each capability (create_alert, briefing, wallet_transfer), `autoExecute` to let reversible scopes run without review, `dailySpendSol` for the daily SOL outflow ceiling (in SOL; 0 disables spending), and `requireConfirm` to force explicit confirmation on irreversible actions. WRITE but idempotent: it changes only the boundaries, takes no action, and re-applying the same values is a no-op. Returns the full updated config. Scopes are enforced server-side at execution time — granting one here is what makes a later execute_proposal possible.

Input parameters:

- `agentId` (string, required): UUID of the three.ws agent to configure. Must be an agent owned by the credential.
- `autoExecute` (object): Reversible scopes allowed to auto-execute on generation (wallet_transfer can never auto-run).
- `dailySpendSol` (number): Daily ceiling on autonomous SOL outflow, in SOL (fractional allowed). 0 means no spending. The agent spends SOL, never $THREE.
- `enabled` (boolean): Master switch — autopilot can only act when this is true.
- `requireConfirm` (boolean): When true (default), irreversible actions need explicit confirm:true at execution.
- `scopes` (object): Per-capability grants. Omitted keys keep their current value.

### `generate_proposals` (~171 tokens)

Generate autopilot proposals

Run the agent's mind: read its high-salience memories and pending reflections and synthesize real, concrete autopilot proposals — each citing the exact memories that justify it. New proposals are persisted to the queue (see list_proposals). WRITE: any reversible proposal the owner has scoped for auto-execution may run immediately and is reported under `autoRan`; irreversible SOL transfers never auto-run — they stay pending for explicit execute_proposal. Returns the created proposals, the autoRan receipts, the generation `source` (reflection | memory | heuristic), what was `scanned`, and updated trust. Deduped server-side, so calling it repeatedly will not enqueue duplicates.

Input parameters:

- `agentId` (string, required): UUID of the three.ws agent to generate proposals for. Must be an agent owned by the credential.

### `list_proposals` (~178 tokens)

List autopilot proposals

List the agent's autopilot proposals — candidate actions it generated, each grounded in cited memories (provenance hydrated). Each proposal carries its id (needed for dryrun/execute/dismiss/undo/adjust), kind (create_alert | briefing | wallet_transfer), title, plain-language rationale (the receipt), params, confidence, requiresConfirmation, status, result, and the source memories. Filter by status to find what is actionable. Also returns the current config + trust for context. Read-only.

Input parameters:

- `agentId` (string, required): UUID of the three.ws agent whose proposals to list. Must be an agent owned by the credential.
- `limit` (integer): Max proposals to return (1–200, default 50).
- `status` (string): Filter to one lifecycle status. Omit to return all statuses (newest first).

### `dryrun_proposal` (~152 tokens)

Dry-run an autopilot proposal

Preview exactly what executing a proposal WOULD do, without taking any action. Returns the kind, a plain-language "willDo" sentence, and a checklist of guard checks (scope granted? params valid? within the daily SOL cap? wallet balance covers a transfer?) plus a `blocked` flag if any check fails. Always dry-run an irreversible wallet_transfer before executing it. Performs a live balance read but no write and no spend — safe to call freely. Read-only.

Input parameters:

- `agentId` (string, required): UUID of the agent that owns the proposal. Must be an agent owned by the credential.
- `proposalId` (string, required): UUID of the proposal to preview (from list_proposals or generate_proposals).

### `adjust_proposal` (~264 tokens)

Adjust a pending autopilot proposal

Edit a pending proposal's params before executing it — tune a threshold, swap a briefing cadence, correct a transfer amount/recipient. The new params are validated SERVER-SIDE against the proposal kind and shape: create_alert → { asset:"three"|<mint>, condition:"price_above"|"price_below"|"graduation"|"whale_buy", threshold_usd?|threshold_sol? }; briefing → { summary, cadence:"once"|"daily"|"weekly", topic }; wallet_transfer → { recipient:<solana addr>, amount_sol:number, reason? }. An invalid edit is rejected with the reason and nothing changes. Only a pending proposal can be adjusted. WRITE but idempotent (no action taken; re-applying the same params is a no-op). For alerts the only coin is $THREE (asset:"three"); wallet_transfer sends SOL only and never sells or sends $THREE. Returns the updated proposal.

Input parameters:

- `agentId` (string, required): UUID of the agent that owns the proposal. Must be an agent owned by the credential.
- `params` (object, required): The full replacement params object for the proposal, matching its kind (see description). Validated server-side.
- `proposalId` (string, required): UUID of the pending proposal to adjust.

### `execute_proposal` (~256 tokens)

Execute an autopilot proposal (moves real value)

EXECUTE a proposal for real, within the owner-granted scope. ⚠️ This is the funds-touching action: a `wallet_transfer` proposal sends REAL SOL on Solana mainnet and is IRREVERSIBLE — you MUST pass confirm:true for it (unless the owner durably pre-authorized that scope), and it is capped by the daily SOL budget. It sends native SOL only — never $THREE. `create_alert` and `briefing` are real writes but reversible via undo_action. Always dryrun_proposal first. Scope, confirmation, and spend caps are enforced SERVER-SIDE; this tool cannot override them — an out-of-scope, over-budget, or unconfirmed call is denied (no action taken). Returns the updated proposal, a human receipt, the signed action-log id, and updated trust.

Input parameters:

- `agentId` (string, required): UUID of the agent that owns the proposal. Must be an agent owned by the credential.
- `confirm` (boolean): Must be true to execute an irreversible SOL wallet_transfer (when require_confirm is on). Ignored for reversible kinds.
- `proposalId` (string, required): UUID of the pending proposal to execute (from list_proposals or generate_proposals).

### `dismiss_proposal` (~126 tokens)

Dismiss a pending autopilot proposal

Dismiss a pending proposal the agent decided not to act on. Marks it dismissed and records a feedback memory ("don't propose this again") so future generate_proposals steers away from it — this is how the agent learns the owner's boundaries. WRITE. Only a pending proposal can be dismissed (executed/undone/dismissed ones are rejected). Returns the updated proposal and trust.

Input parameters:

- `agentId` (string, required): UUID of the agent that owns the proposal. Must be an agent owned by the credential.
- `proposalId` (string, required): UUID of the pending proposal to dismiss.

### `undo_action` (~145 tokens)

Undo a reversible autopilot action

Reverse a reversible executed proposal: deletes the real artifact the execution created — the alert rule (create_alert) or the briefing notification (briefing) — and records a feedback memory so the agent learns to be more conservative next time. WRITE. NOTE: an irreversible SOL wallet_transfer is on-chain and cannot be undone — the server rejects that with `irreversible`; to send value back you would have to execute a new transfer. Returns the updated proposal (status → undone) and trust.

Input parameters:

- `agentId` (string, required): UUID of the agent that owns the proposal. Must be an agent owned by the credential.
- `proposalId` (string, required): UUID of the executed proposal to undo.

### `list_autopilot_activity` (~199 tokens)

List autopilot activity (signed receipts)

Read the append-only log of every autonomous action the agent has taken, newest first — the real agent_actions trail. Each receipt carries the kind (alert created / briefing authored / wallet transfer), its rationale, the outcome (created rule id / notification id / on-chain signature), the source memories it was grounded in, and the cryptographic signature + signer address when the action was signed by the agent's wallet. Use it to audit what the agent did and why. Omit agentId to aggregate across every agent the credential owns. Paginate with the returned next_cursor. Read-only.

Input parameters:

- `agentId` (string): UUID of a specific agent (must be owned by the credential). Omit to aggregate across all your agents.
- `cursor` (string): Pagination cursor: pass the next_cursor from a previous call to fetch the next page.
- `limit` (integer): Max receipts per page (1–200, default 50).

### `compute_trust` (~130 tokens)

Compute autopilot trust level

The agent's earned trust level, computed from its REAL autopilot history. Returns level (sandbox → trusted → autonomous), a 0+ score (net kept executions weighted by reliability), the underlying stats (executed / undone / dismissed / pending counts + reliability %), and what it takes to reach the next level. Trust rises as the owner keeps the agent's actions and falls when they undo or dismiss them — it is not configurable, only earned. Read-only.

Input parameters:

- `agentId` (string, required): UUID of the three.ws agent whose trust to compute. Must be an agent owned by the credential.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/nirholas-autopilot-mcp/three-ws-autopilot-mcp#diagnostics

## Score history

- 2026-08-03: 66
- 2026-08-02: 66
- 2026-08-01: 18
- 2026-07-31: 5
- 2026-07-30: 43
- 2026-07-28: 43
- 2026-07-27: 43

## Links

- npm package: https://www.npmjs.com/package/@three-ws/autopilot-mcp
- Socket report: https://socket.dev/npm/package/@three-ws/autopilot-mcp
- Repository: https://github.com/nirholas/three.ws
- Website: https://three.ws/
- Changelog RSS feed: https://verifymcp.io/servers/nirholas-autopilot-mcp/three-ws-autopilot-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/nirholas-autopilot-mcp/three-ws-autopilot-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/nirholas-autopilot-mcp/three-ws-autopilot-mcp