Competiflow
NPM · @COMPETIFLOW/MCP-SERVER
Competitor monitoring for AI agents: track rival pricing, docs and changelog changes with evidence.
Available components
Last scanned (7 hours ago)
Scores higher than 34% of npm servers
Category Marketing and SEO
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security81
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects zod 3.25.76, a direct dependency. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 30 of 93 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 7 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability85
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2305 tokens (~109/item across 21 items; 20 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 22 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 29 Oct 26 +15
- Malware scan: unverified → pass ▲ security
- 28 Oct 26 +19
- Malware scan: pass → unverified ▼ security
- Injection markers: unverified → pass ▲ security
- First check of Judged manipulation: pass security
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- Schema quality: unverified → 100 ▲ functional
- Tool coverage: unverified → 100 ▲ functional
- MCP protocol: unverified → pass ▲ functional
- First check of Schema quality: excellent functional
- First check of Schema quality: fail functional
- First check of Destructive annotations: 100 functional
- First check of Tool coverage: 100 functional
- First check of Schema quality: fail functional
- First check of Tool coverage: 40 functional
- First check of Destructive annotations: 0 functional
- First check of Schema quality: pass functional
- First check of Schema quality: good functional
- Package version: 0.1.2 → 0.2.0 functional
- Package version: 0.1.2 → 0.1.3 functional
- 24 Oct 26 +10
- CVE-2023-54404 affects this package: high ▼ security
- Known CVEs: pass → fail ▼ security
- Malware scan: unverified → pass ▲ security
- 23 Oct 26 23
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed npm/@competiflow/mcp-server@0.2.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 1 finding
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-mrhx-c7xc-m3w5 | CVE-2023-54404 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 93 packages
| Packages resolved | 93 |
|---|---|
| Stale | 30 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
add_competitor Add competitor ~147
Add a competitor to a workspace by homepage URL and start discovering its pricing, docs, blog, and changelog pages. Discovery is async: poll get_competitor until discovery_status is completed. Re-adding the same URL returns the existing competitor. Returns 409 with active_competitor_id while another discovery runs in the workspace. To watch one specific page, use create_monitor.
| Name | Type | Req | Description |
|---|---|---|---|
| monitor_types | array | – | Only discover these page types. Omit to discover all of them. |
| url | string | yes | Competitor homepage URL, e.g. https://rival.com |
| workspace_id | string|number | yes | Workspace id from list_workspaces or create_workspace |
No output schema declared.
No examples provided.
check_monitor Check monitor now ~85
Queue an immediate check of one monitor. Uses one of your monthly checks and returns 429 refresh_throttled if the monitor was checked too recently. Results arrive asynchronously: read them later with list_changes or get_monitor. To check every monitor in a workspace, use refresh_workspace.
| Name | Type | Req | Description |
|---|---|---|---|
| monitor_id | string|number | yes | Monitor id from list_monitors or list_competitors |
No output schema declared.
No examples provided.
create_monitor Create monitor ~132
Watch one specific page of an existing competitor, such as a pricing or docs URL that discovery missed. To add a new competitor and discover its pages automatically, use add_competitor.
| Name | Type | Req | Description |
|---|---|---|---|
| cadence | string | – | Check frequency. Faster cadences use more monthly checks; plans set a minimum (422 cadence_not_allowed). |
| competitor_id | string|number | yes | Competitor id from list_competitors or add_competitor |
| monitor_type | string | yes | Kind of page: homepage, blog, docs, changelog, or pricing |
| url | string | yes | Full URL of the page to watch |
No output schema declared.
No examples provided.
create_workspace Create workspace ~107
Create a workspace for one product or market. Set product_url to your own product so why_it_matters explains each change relative to it. Returns 422 when your plan's workspace limit is reached. To rename or change an existing workspace, use update_workspace.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | Workspace name, e.g. the product or market it covers |
| product_url | string|null | – | Your own product's URL (e.g. example.com). The server adds https:// when missing. |
No output schema declared.
No examples provided.
delete_competitor Delete competitor ~67
Permanently delete a competitor with its monitors, snapshots, and changes. Cannot be undone. To stop checks and keep history, use update_competitor with status paused.
| Name | Type | Req | Description |
|---|---|---|---|
| competitor_id | string|number | yes | Competitor id from list_competitors or add_competitor |
No output schema declared.
No examples provided.
delete_monitor Delete monitor ~58
Permanently delete one monitor with its snapshots and changes. Cannot be undone. To stop checks and keep history, use update_monitor with status paused.
| Name | Type | Req | Description |
|---|---|---|---|
| monitor_id | string|number | yes | Monitor id from list_monitors or list_competitors |
No output schema declared.
No examples provided.
delete_workspace Delete workspace ~76
Permanently delete a workspace with all its competitors, monitors, snapshots, and changes. Cannot be undone. Returns 409 discovery_in_progress while a competitor is still being discovered. To stop checks and keep history, use update_workspace with status paused.
| Name | Type | Req | Description |
|---|---|---|---|
| workspace_id | string|number | yes | Workspace id from list_workspaces or create_workspace |
No output schema declared.
No examples provided.
get_change Get change ~85
Get one change with why_it_matters, field-level diffs, and related clusters. Set include to add the captured page or the raw diff as evidence.
| Name | Type | Req | Description |
|---|---|---|---|
| change_id | string|number | yes | Change id from list_changes or get_digest |
| include | array | – | Evidence to add: capture (structured page data), capture_markdown (page as markdown), raw_diff |
No output schema declared.
No examples provided.
get_competitor Get competitor ~61
Get one competitor with its monitors and discovery fields. Use it to poll discovery after add_competitor until discovery_status is completed or failed.
| Name | Type | Req | Description |
|---|---|---|---|
| competitor_id | string|number | yes | Competitor id from list_competitors or add_competitor |
No output schema declared.
No examples provided.
get_digest Get workspace digest ~86
Get a workspace summary for a period: changes needing review with why_it_matters, an activity map by competitor, and top opportunities. Use it for briefings; to page through individual changes, use list_changes.
| Name | Type | Req | Description |
|---|---|---|---|
| period | string | – | Time window to summarize (default 7d) |
| workspace_id | string|number | yes | Workspace id from list_workspaces or create_workspace |
No output schema declared.
No examples provided.
get_monitor Get monitor ~83
Get one monitor's settings, health, and last run. Set include to also return the latest successful capture as structured data or markdown.
| Name | Type | Req | Description |
|---|---|---|---|
| include | array | – | Evidence to add: capture (structured page data), capture_markdown (page as markdown), raw_diff |
| monitor_id | string|number | yes | Monitor id from list_monitors or list_competitors |
No output schema declared.
No examples provided.
list_changes List changes ~228
List detected competitor changes in a workspace, newest first, with summary, severity, why_it_matters, monitor_type, and review_status. meta.counts gives inbox totals; page with after set to next_cursor. For a summarized period, use get_digest; for evidence on one change, use get_change.
| Name | Type | Req | Description |
|---|---|---|---|
| after | string|number | – | next_cursor from the previous page |
| competitor_id | string|number | – | Only this competitor's changes |
| limit | number | – | Page size, 1-100 (default 25) |
| min_severity | string | – | Lowest severity to include |
| monitor_type | string | – | Kind of page: homepage, blog, docs, changelog, or pricing |
| review_status | string | – | unreviewed (in the inbox), acknowledged (seen and relevant), or dismissed (noise) |
| since | string | – | ISO 8601 timestamp, or a relative window: 1d, 7d, 30d |
| workspace_id | string|number | yes | Workspace id from list_workspaces or create_workspace |
No output schema declared.
No examples provided.
list_competitors List competitors ~72
List the competitors in a workspace with discovery_status and their monitors, each with last_run. Use it for an overview of what is tracked. To list monitors alone or filter them by competitor, use list_monitors.
| Name | Type | Req | Description |
|---|---|---|---|
| workspace_id | string|number | yes | Workspace id from list_workspaces or create_workspace |
No output schema declared.
No examples provided.
list_monitors List monitors ~96
List the monitors in a workspace, optionally for one competitor, with URL, type, cadence, status, health, and last_run. Use it to find a monitor_id or spot failing monitors. For competitors with their monitors nested, use list_competitors.
| Name | Type | Req | Description |
|---|---|---|---|
| competitor_id | string|number | – | Only list this competitor's monitors |
| workspace_id | string|number | yes | Workspace id from list_workspaces or create_workspace |
No output schema declared.
No examples provided.
list_workspaces List workspaces ~51
List all your workspaces with competitor and monitor counts, needs_review_count, and the highest unreviewed severity. Start here to find a workspace_id. For one workspace's recent activity, use get_digest.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
refresh_workspace Refresh workspace ~100
Queue immediate checks for every active monitor in a workspace, or for one competitor when competitor_id is set. Each monitor checked uses one monthly check; recently checked monitors are skipped and listed in skipped_ids. Returns 409 while discovery is running. For a single monitor, use check_monitor.
| Name | Type | Req | Description |
|---|---|---|---|
| competitor_id | string|number | – | Only refresh this competitor's monitors |
| workspace_id | string|number | yes | Workspace id from list_workspaces or create_workspace |
No output schema declared.
No examples provided.
update_change Triage change ~86
Triage a change by setting its review_status: acknowledged when it is relevant, dismissed when it is noise, or unreviewed to put it back in the inbox.
| Name | Type | Req | Description |
|---|---|---|---|
| change_id | string|number | yes | Change id from list_changes or get_digest |
| review_status | string | yes | unreviewed (in the inbox), acknowledged (seen and relevant), or dismissed (noise) |
No output schema declared.
No examples provided.
update_competitor Update competitor ~114
Set the check cadence or pause/resume every monitor of one competitor. History is kept. To change a single monitor, use update_monitor; for a whole workspace, use update_workspace.
| Name | Type | Req | Description |
|---|---|---|---|
| cadence | string | – | Check frequency. Faster cadences use more monthly checks; plans set a minimum (422 cadence_not_allowed). |
| competitor_id | string|number | yes | Competitor id from list_competitors or add_competitor |
| status | string | – | active runs checks; paused stops checks and keeps history |
No output schema declared.
No examples provided.
update_monitor Update monitor ~166
Change one monitor's URL, type, cadence, status, or min_severity. Use status paused to stop checks and keep history. To change every monitor of a competitor at once, use update_competitor.
| Name | Type | Req | Description |
|---|---|---|---|
| cadence | string | – | Check frequency. Faster cadences use more monthly checks; plans set a minimum (422 cadence_not_allowed). |
| min_severity | string | – | Changes below this severity are not reported |
| monitor_id | string|number | yes | Monitor id from list_monitors or list_competitors |
| monitor_type | string | – | Kind of page: homepage, blog, docs, changelog, or pricing |
| status | string | – | active runs checks; paused stops checks and keeps history |
| url | string | – | New URL to watch |
No output schema declared.
No examples provided.
update_workspace Update workspace ~153
Rename a workspace, set or clear its product_url, or pause/resume every monitor in it. Send only the fields to change; nothing is written if any field is invalid. Pausing keeps all history, so prefer it over delete_workspace. To pause one competitor, use update_competitor.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | – | New workspace name. Cannot be blank. |
| product_url | string|null | – | Your own product's URL (e.g. example.com). Pass null to clear it; omit to leave it unchanged. |
| status | string | – | paused stops checks on every monitor in the workspace; active resumes them |
| workspace_id | string|number | yes | Workspace id from list_workspaces or create_workspace |
No output schema declared.
No examples provided.
How do I install the Competiflow MCP server?
Competiflow runs locally as an npm package, launched with npx -y @competiflow/mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @competiflow/mcp-server
claude mcp add nyku-competiflow-mcp -- npx -y @competiflow/mcp-server
What is the Competiflow MCP server?
Competiflow is an MCP server listed in the public MCP registry as io.github.nyku/competiflow-mcp. Competitor monitoring for AI agents: track rival pricing, docs and changelog changes with evidence. This page covers its npm package (@competiflow/mcp-server).
Is the Competiflow MCP server safe to use?
Competiflow scores 67 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Competiflow MCP server expose?
Competiflow exposes 20 tools: list_workspaces, create_workspace, update_workspace, delete_workspace, add_competitor, and 15 more. Their descriptions and schemas cost roughly 2,053 tokens of context every time the server is loaded.
Is the Competiflow MCP server still maintained?
Competiflow is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Competiflow MCP server under?
Competiflow declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.