Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Competiflow

NPM · @COMPETIFLOW/MCP-SERVER

Competitor monitoring for AI agents: track rival pricing, docs and changelog changes with evidence.

0 this week 67 Trust /100

Last scanned (7 hours ago)

Scores higher than 34% of npm servers

Category Marketing and SEO

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security81
  • No malware found by supply-chain analysis.Pass
  • CVE check failed: a known high-severity CVE affects zod 3.25.76, a direct dependency. A fixed version is available. View diagnostics → Fail
  • No install/post-install scripts declared.Pass
  • 30 of 93 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
Schema Quality & AI Usability85
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 2305 tokens (~109/item across 21 items; 20 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
  • Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 22 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Unverified: 1 category

A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 29 Oct 26 +15
    • Malware scan: unverified → pass ▲ security
  • 28 Oct 26 +19
    • Malware scan: pass → unverified ▼ security
    • Injection markers: unverified → pass ▲ security
    • First check of Judged manipulation: pass security
    • Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
    • Schema quality: unverified → 100 ▲ functional
    • Tool coverage: unverified → 100 ▲ functional
    • MCP protocol: unverified → pass ▲ functional
    • First check of Schema quality: excellent functional
    • First check of Schema quality: fail functional
    • First check of Destructive annotations: 100 functional
    • First check of Tool coverage: 100 functional
    • First check of Schema quality: fail functional
    • First check of Tool coverage: 40 functional
    • First check of Destructive annotations: 0 functional
    • First check of Schema quality: pass functional
    • First check of Schema quality: good functional
    • Package version: 0.1.2 → 0.2.0 functional
    • Package version: 0.1.2 → 0.1.3 functional
  • 24 Oct 26 +10
    • CVE-2023-54404 affects this package: high ▼ security
    • Known CVEs: pass → fail ▼ security
    • Malware scan: unverified → pass ▲ security
  • 23 Oct 26 23

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Analysed npm/@competiflow/mcp-server@0.2.0

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Vulnerabilities 1 finding
ID CVE Severity Vector Fix available
GHSA-mrhx-c7xc-m3w5 CVE-2023-54404 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes

Background: What a vulnerability scan can and cannot prove →

Dependencies 93 packages
Packages resolved 93
Stale 30
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 20 exposed · ~2,053 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
add_competitor ~147

Add a competitor to a workspace by homepage URL and start discovering its pricing, docs, blog, and changelog pages. Discovery is async: poll get_competitor until discovery_status is completed. Re-adding the same URL returns the existing competitor. Returns 409 with active_competitor_id while another discovery runs in the workspace. To watch one specific page, use create_monitor.

NameTypeReqDescription
monitor_typesarray–Only discover these page types. Omit to discover all of them.
urlstringyesCompetitor homepage URL, e.g. https://rival.com
workspace_idstring|numberyesWorkspace id from list_workspaces or create_workspace

No output schema declared.

No examples provided.

check_monitor ~85

Queue an immediate check of one monitor. Uses one of your monthly checks and returns 429 refresh_throttled if the monitor was checked too recently. Results arrive asynchronously: read them later with list_changes or get_monitor. To check every monitor in a workspace, use refresh_workspace.

NameTypeReqDescription
monitor_idstring|numberyesMonitor id from list_monitors or list_competitors

No output schema declared.

No examples provided.

create_monitor ~132

Watch one specific page of an existing competitor, such as a pricing or docs URL that discovery missed. To add a new competitor and discover its pages automatically, use add_competitor.

NameTypeReqDescription
cadencestring–Check frequency. Faster cadences use more monthly checks; plans set a minimum (422 cadence_not_allowed).
competitor_idstring|numberyesCompetitor id from list_competitors or add_competitor
monitor_typestringyesKind of page: homepage, blog, docs, changelog, or pricing
urlstringyesFull URL of the page to watch

No output schema declared.

No examples provided.

create_workspace ~107

Create a workspace for one product or market. Set product_url to your own product so why_it_matters explains each change relative to it. Returns 422 when your plan's workspace limit is reached. To rename or change an existing workspace, use update_workspace.

NameTypeReqDescription
namestringyesWorkspace name, e.g. the product or market it covers
product_urlstring|null–Your own product's URL (e.g. example.com). The server adds https:// when missing.

No output schema declared.

No examples provided.

delete_competitor ~67

Permanently delete a competitor with its monitors, snapshots, and changes. Cannot be undone. To stop checks and keep history, use update_competitor with status paused.

NameTypeReqDescription
competitor_idstring|numberyesCompetitor id from list_competitors or add_competitor

No output schema declared.

No examples provided.

delete_monitor ~58

Permanently delete one monitor with its snapshots and changes. Cannot be undone. To stop checks and keep history, use update_monitor with status paused.

NameTypeReqDescription
monitor_idstring|numberyesMonitor id from list_monitors or list_competitors

No output schema declared.

No examples provided.

delete_workspace ~76

Permanently delete a workspace with all its competitors, monitors, snapshots, and changes. Cannot be undone. Returns 409 discovery_in_progress while a competitor is still being discovered. To stop checks and keep history, use update_workspace with status paused.

NameTypeReqDescription
workspace_idstring|numberyesWorkspace id from list_workspaces or create_workspace

No output schema declared.

No examples provided.

get_change ~85

Get one change with why_it_matters, field-level diffs, and related clusters. Set include to add the captured page or the raw diff as evidence.

NameTypeReqDescription
change_idstring|numberyesChange id from list_changes or get_digest
includearray–Evidence to add: capture (structured page data), capture_markdown (page as markdown), raw_diff

No output schema declared.

No examples provided.

get_competitor ~61

Get one competitor with its monitors and discovery fields. Use it to poll discovery after add_competitor until discovery_status is completed or failed.

NameTypeReqDescription
competitor_idstring|numberyesCompetitor id from list_competitors or add_competitor

No output schema declared.

No examples provided.

get_digest ~86

Get a workspace summary for a period: changes needing review with why_it_matters, an activity map by competitor, and top opportunities. Use it for briefings; to page through individual changes, use list_changes.

NameTypeReqDescription
periodstring–Time window to summarize (default 7d)
workspace_idstring|numberyesWorkspace id from list_workspaces or create_workspace

No output schema declared.

No examples provided.

get_monitor ~83

Get one monitor's settings, health, and last run. Set include to also return the latest successful capture as structured data or markdown.

NameTypeReqDescription
includearray–Evidence to add: capture (structured page data), capture_markdown (page as markdown), raw_diff
monitor_idstring|numberyesMonitor id from list_monitors or list_competitors

No output schema declared.

No examples provided.

list_changes ~228

List detected competitor changes in a workspace, newest first, with summary, severity, why_it_matters, monitor_type, and review_status. meta.counts gives inbox totals; page with after set to next_cursor. For a summarized period, use get_digest; for evidence on one change, use get_change.

NameTypeReqDescription
afterstring|number–next_cursor from the previous page
competitor_idstring|number–Only this competitor's changes
limitnumber–Page size, 1-100 (default 25)
min_severitystring–Lowest severity to include
monitor_typestring–Kind of page: homepage, blog, docs, changelog, or pricing
review_statusstring–unreviewed (in the inbox), acknowledged (seen and relevant), or dismissed (noise)
sincestring–ISO 8601 timestamp, or a relative window: 1d, 7d, 30d
workspace_idstring|numberyesWorkspace id from list_workspaces or create_workspace

No output schema declared.

No examples provided.

list_competitors ~72

List the competitors in a workspace with discovery_status and their monitors, each with last_run. Use it for an overview of what is tracked. To list monitors alone or filter them by competitor, use list_monitors.

NameTypeReqDescription
workspace_idstring|numberyesWorkspace id from list_workspaces or create_workspace

No output schema declared.

No examples provided.

list_monitors ~96

List the monitors in a workspace, optionally for one competitor, with URL, type, cadence, status, health, and last_run. Use it to find a monitor_id or spot failing monitors. For competitors with their monitors nested, use list_competitors.

NameTypeReqDescription
competitor_idstring|number–Only list this competitor's monitors
workspace_idstring|numberyesWorkspace id from list_workspaces or create_workspace

No output schema declared.

No examples provided.

list_workspaces ~51

List all your workspaces with competitor and monitor counts, needs_review_count, and the highest unreviewed severity. Start here to find a workspace_id. For one workspace's recent activity, use get_digest.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

refresh_workspace ~100

Queue immediate checks for every active monitor in a workspace, or for one competitor when competitor_id is set. Each monitor checked uses one monthly check; recently checked monitors are skipped and listed in skipped_ids. Returns 409 while discovery is running. For a single monitor, use check_monitor.

NameTypeReqDescription
competitor_idstring|number–Only refresh this competitor's monitors
workspace_idstring|numberyesWorkspace id from list_workspaces or create_workspace

No output schema declared.

No examples provided.

update_change ~86

Triage a change by setting its review_status: acknowledged when it is relevant, dismissed when it is noise, or unreviewed to put it back in the inbox.

NameTypeReqDescription
change_idstring|numberyesChange id from list_changes or get_digest
review_statusstringyesunreviewed (in the inbox), acknowledged (seen and relevant), or dismissed (noise)

No output schema declared.

No examples provided.

update_competitor ~114

Set the check cadence or pause/resume every monitor of one competitor. History is kept. To change a single monitor, use update_monitor; for a whole workspace, use update_workspace.

NameTypeReqDescription
cadencestring–Check frequency. Faster cadences use more monthly checks; plans set a minimum (422 cadence_not_allowed).
competitor_idstring|numberyesCompetitor id from list_competitors or add_competitor
statusstring–active runs checks; paused stops checks and keeps history

No output schema declared.

No examples provided.

update_monitor ~166

Change one monitor's URL, type, cadence, status, or min_severity. Use status paused to stop checks and keep history. To change every monitor of a competitor at once, use update_competitor.

NameTypeReqDescription
cadencestring–Check frequency. Faster cadences use more monthly checks; plans set a minimum (422 cadence_not_allowed).
min_severitystring–Changes below this severity are not reported
monitor_idstring|numberyesMonitor id from list_monitors or list_competitors
monitor_typestring–Kind of page: homepage, blog, docs, changelog, or pricing
statusstring–active runs checks; paused stops checks and keeps history
urlstring–New URL to watch

No output schema declared.

No examples provided.

update_workspace ~153

Rename a workspace, set or clear its product_url, or pause/resume every monitor in it. Send only the fields to change; nothing is written if any field is invalid. Pausing keeps all history, so prefer it over delete_workspace. To pause one competitor, use update_competitor.

NameTypeReqDescription
namestring–New workspace name. Cannot be blank.
product_urlstring|null–Your own product's URL (e.g. example.com). Pass null to clear it; omit to leave it unchanged.
statusstring–paused stops checks on every monitor in the workspace; active resumes them
workspace_idstring|numberyesWorkspace id from list_workspaces or create_workspace

No output schema declared.

No examples provided.

Install

How do I install the Competiflow MCP server?

Competiflow runs locally as an npm package, launched with npx -y @competiflow/mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · @competiflow/mcp-server

# add to Claude Code
claude mcp add nyku-competiflow-mcp -- npx -y @competiflow/mcp-server
Common questions

What is the Competiflow MCP server?

Competiflow is an MCP server listed in the public MCP registry as io.github.nyku/competiflow-mcp. Competitor monitoring for AI agents: track rival pricing, docs and changelog changes with evidence. This page covers its npm package (@competiflow/mcp-server).

Is the Competiflow MCP server safe to use?

Competiflow scores 67 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Competiflow MCP server expose?

Competiflow exposes 20 tools: list_workspaces, create_workspace, update_workspace, delete_workspace, add_competitor, and 15 more. Their descriptions and schemas cost roughly 2,053 tokens of context every time the server is loaded.

Is the Competiflow MCP server still maintained?

Competiflow is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the Competiflow MCP server under?

Competiflow declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.