# Competiflow (npm · @competiflow/mcp-server)

Competitor monitoring for AI agents: track rival pricing, docs and changelog changes with evidence.

- Trust score: 67/100 (medium)
- Change this week: 0
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- npm · `@competiflow/mcp-server`: 67/100 (this document), [markdown](https://verifymcp.io/servers/nyku-competiflow-mcp/competiflow-mcp-server.md), [page](https://verifymcp.io/servers/nyku-competiflow-mcp/competiflow-mcp-server)

## Channel facts

- Registry: `npm`
- Package: `@competiflow/mcp-server`
- Version: `0.2.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Supply Chain Security**: 81/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known high-severity CVE affects zod 3.25.76, a direct dependency. A fixed version is available.
  - No install/post-install scripts declared.
  - 30 of 93 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 7 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 85/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 2305 tokens (~109/item across 21 items; 20 tools + 1 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 22 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### How do I install the Competiflow MCP server?

Competiflow runs locally as an npm package, launched with npx -y @competiflow/mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add nyku-competiflow-mcp -- npx -y @competiflow/mcp-server
```

### Cursor

```json
{
  "mcpServers": {
    "nyku-competiflow-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@competiflow/mcp-server"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "nyku-competiflow-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@competiflow/mcp-server"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add nyku-competiflow-mcp -- npx -y @competiflow/mcp-server
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "nyku-competiflow-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@competiflow/mcp-server"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add nyku-competiflow-mcp --command npx --arg -y --arg @competiflow/mcp-server
```

### Hermes

```yaml
mcp_servers:
  nyku-competiflow-mcp:
    command: "npx"
    args: ["-y", "@competiflow/mcp-server"]
```

### Netclaw

```json
{
  "McpServers": {
    "nyku-competiflow-mcp": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "@competiflow/mcp-server"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add nyku-competiflow-mcp -t stdio -c npx -a -y @competiflow/mcp-server
```

### Other

```json
{
  "mcpServers": {
    "nyku-competiflow-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@competiflow/mcp-server"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-29 (score 67, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-10-28 (score 52, +19)

- [security regression] Malware scan: pass → unverified
- [security improvement] Injection markers: unverified → pass
- [security] First check of Judged manipulation: pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] Schema quality: unverified → 100
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] MCP protocol: unverified → pass
- [functional] First check of Schema quality: excellent
- [functional] First check of Schema quality: fail
- [functional] First check of Destructive annotations: 100
- [functional] First check of Tool coverage: 100
- [functional] First check of Schema quality: fail
- [functional] First check of Tool coverage: 40
- [functional] First check of Destructive annotations: 0
- [functional] First check of Schema quality: pass
- [functional] First check of Schema quality: good
- [functional] Package version: 0.1.2 → 0.2.0
- [functional] Package version: 0.1.2 → 0.1.3

### 2026-10-24 (score 33, +10)

- [security regression] CVE-2023-54404 affects this package: high
- [security regression] Known CVEs: pass → fail
- [security improvement] Malware scan: unverified → pass

### 2026-10-23 (score 23)

First indexed and scored.

## MCP tools (20)

### `list_workspaces` (~51 tokens)

List workspaces

List all your workspaces with competitor and monitor counts, needs_review_count, and the highest unreviewed severity. Start here to find a workspace_id. For one workspace's recent activity, use get_digest.

### `create_workspace` (~107 tokens)

Create workspace

Create a workspace for one product or market. Set product_url to your own product so why_it_matters explains each change relative to it. Returns 422 when your plan's workspace limit is reached. To rename or change an existing workspace, use update_workspace.

Input parameters:

- `name` (string, required): Workspace name, e.g. the product or market it covers
- `product_url` (string|null): Your own product's URL (e.g. example.com). The server adds https:// when missing.

### `update_workspace` (~153 tokens)

Update workspace

Rename a workspace, set or clear its product_url, or pause/resume every monitor in it. Send only the fields to change; nothing is written if any field is invalid. Pausing keeps all history, so prefer it over delete_workspace. To pause one competitor, use update_competitor.

Input parameters:

- `name` (string): New workspace name. Cannot be blank.
- `product_url` (string|null): Your own product's URL (e.g. example.com). Pass null to clear it; omit to leave it unchanged.
- `status` (string): paused stops checks on every monitor in the workspace; active resumes them
- `workspace_id` (string|number, required): Workspace id from list_workspaces or create_workspace

### `delete_workspace` (~76 tokens)

Delete workspace

Permanently delete a workspace with all its competitors, monitors, snapshots, and changes. Cannot be undone. Returns 409 discovery_in_progress while a competitor is still being discovered. To stop checks and keep history, use update_workspace with status paused.

Input parameters:

- `workspace_id` (string|number, required): Workspace id from list_workspaces or create_workspace

### `add_competitor` (~147 tokens)

Add competitor

Add a competitor to a workspace by homepage URL and start discovering its pricing, docs, blog, and changelog pages. Discovery is async: poll get_competitor until discovery_status is completed. Re-adding the same URL returns the existing competitor. Returns 409 with active_competitor_id while another discovery runs in the workspace. To watch one specific page, use create_monitor.

Input parameters:

- `monitor_types` (array): Only discover these page types. Omit to discover all of them.
- `url` (string, required): Competitor homepage URL, e.g. https://rival.com
- `workspace_id` (string|number, required): Workspace id from list_workspaces or create_workspace

### `list_competitors` (~72 tokens)

List competitors

List the competitors in a workspace with discovery_status and their monitors, each with last_run. Use it for an overview of what is tracked. To list monitors alone or filter them by competitor, use list_monitors.

Input parameters:

- `workspace_id` (string|number, required): Workspace id from list_workspaces or create_workspace

### `get_competitor` (~61 tokens)

Get competitor

Get one competitor with its monitors and discovery fields. Use it to poll discovery after add_competitor until discovery_status is completed or failed.

Input parameters:

- `competitor_id` (string|number, required): Competitor id from list_competitors or add_competitor

### `update_competitor` (~114 tokens)

Update competitor

Set the check cadence or pause/resume every monitor of one competitor. History is kept. To change a single monitor, use update_monitor; for a whole workspace, use update_workspace.

Input parameters:

- `cadence` (string): Check frequency. Faster cadences use more monthly checks; plans set a minimum (422 cadence_not_allowed).
- `competitor_id` (string|number, required): Competitor id from list_competitors or add_competitor
- `status` (string): active runs checks; paused stops checks and keeps history

### `delete_competitor` (~67 tokens)

Delete competitor

Permanently delete a competitor with its monitors, snapshots, and changes. Cannot be undone. To stop checks and keep history, use update_competitor with status paused.

Input parameters:

- `competitor_id` (string|number, required): Competitor id from list_competitors or add_competitor

### `list_monitors` (~96 tokens)

List monitors

List the monitors in a workspace, optionally for one competitor, with URL, type, cadence, status, health, and last_run. Use it to find a monitor_id or spot failing monitors. For competitors with their monitors nested, use list_competitors.

Input parameters:

- `competitor_id` (string|number): Only list this competitor's monitors
- `workspace_id` (string|number, required): Workspace id from list_workspaces or create_workspace

### `get_monitor` (~83 tokens)

Get monitor

Get one monitor's settings, health, and last run. Set include to also return the latest successful capture as structured data or markdown.

Input parameters:

- `include` (array): Evidence to add: capture (structured page data), capture_markdown (page as markdown), raw_diff
- `monitor_id` (string|number, required): Monitor id from list_monitors or list_competitors

### `create_monitor` (~132 tokens)

Create monitor

Watch one specific page of an existing competitor, such as a pricing or docs URL that discovery missed. To add a new competitor and discover its pages automatically, use add_competitor.

Input parameters:

- `cadence` (string): Check frequency. Faster cadences use more monthly checks; plans set a minimum (422 cadence_not_allowed).
- `competitor_id` (string|number, required): Competitor id from list_competitors or add_competitor
- `monitor_type` (string, required): Kind of page: homepage, blog, docs, changelog, or pricing
- `url` (string, required): Full URL of the page to watch

### `update_monitor` (~166 tokens)

Update monitor

Change one monitor's URL, type, cadence, status, or min_severity. Use status paused to stop checks and keep history. To change every monitor of a competitor at once, use update_competitor.

Input parameters:

- `cadence` (string): Check frequency. Faster cadences use more monthly checks; plans set a minimum (422 cadence_not_allowed).
- `min_severity` (string): Changes below this severity are not reported
- `monitor_id` (string|number, required): Monitor id from list_monitors or list_competitors
- `monitor_type` (string): Kind of page: homepage, blog, docs, changelog, or pricing
- `status` (string): active runs checks; paused stops checks and keeps history
- `url` (string): New URL to watch

### `delete_monitor` (~58 tokens)

Delete monitor

Permanently delete one monitor with its snapshots and changes. Cannot be undone. To stop checks and keep history, use update_monitor with status paused.

Input parameters:

- `monitor_id` (string|number, required): Monitor id from list_monitors or list_competitors

### `check_monitor` (~85 tokens)

Check monitor now

Queue an immediate check of one monitor. Uses one of your monthly checks and returns 429 refresh_throttled if the monitor was checked too recently. Results arrive asynchronously: read them later with list_changes or get_monitor. To check every monitor in a workspace, use refresh_workspace.

Input parameters:

- `monitor_id` (string|number, required): Monitor id from list_monitors or list_competitors

### `refresh_workspace` (~100 tokens)

Refresh workspace

Queue immediate checks for every active monitor in a workspace, or for one competitor when competitor_id is set. Each monitor checked uses one monthly check; recently checked monitors are skipped and listed in skipped_ids. Returns 409 while discovery is running. For a single monitor, use check_monitor.

Input parameters:

- `competitor_id` (string|number): Only refresh this competitor's monitors
- `workspace_id` (string|number, required): Workspace id from list_workspaces or create_workspace

### `list_changes` (~228 tokens)

List changes

List detected competitor changes in a workspace, newest first, with summary, severity, why_it_matters, monitor_type, and review_status. meta.counts gives inbox totals; page with after set to next_cursor. For a summarized period, use get_digest; for evidence on one change, use get_change.

Input parameters:

- `after` (string|number): next_cursor from the previous page
- `competitor_id` (string|number): Only this competitor's changes
- `limit` (number): Page size, 1-100 (default 25)
- `min_severity` (string): Lowest severity to include
- `monitor_type` (string): Kind of page: homepage, blog, docs, changelog, or pricing
- `review_status` (string): unreviewed (in the inbox), acknowledged (seen and relevant), or dismissed (noise)
- `since` (string): ISO 8601 timestamp, or a relative window: 1d, 7d, 30d
- `workspace_id` (string|number, required): Workspace id from list_workspaces or create_workspace

### `get_change` (~85 tokens)

Get change

Get one change with why_it_matters, field-level diffs, and related clusters. Set include to add the captured page or the raw diff as evidence.

Input parameters:

- `change_id` (string|number, required): Change id from list_changes or get_digest
- `include` (array): Evidence to add: capture (structured page data), capture_markdown (page as markdown), raw_diff

### `update_change` (~86 tokens)

Triage change

Triage a change by setting its review_status: acknowledged when it is relevant, dismissed when it is noise, or unreviewed to put it back in the inbox.

Input parameters:

- `change_id` (string|number, required): Change id from list_changes or get_digest
- `review_status` (string, required): unreviewed (in the inbox), acknowledged (seen and relevant), or dismissed (noise)

### `get_digest` (~86 tokens)

Get workspace digest

Get a workspace summary for a period: changes needing review with why_it_matters, an activity map by competitor, and top opportunities. Use it for briefings; to page through individual changes, use list_changes.

Input parameters:

- `period` (string): Time window to summarize (default 7d)
- `workspace_id` (string|number, required): Workspace id from list_workspaces or create_workspace

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/nyku-competiflow-mcp/competiflow-mcp-server#diagnostics

## Score history

- 2026-11-05: 67
- 2026-11-04: 67
- 2026-11-03: 67
- 2026-11-02: 67
- 2026-11-01: 67
- 2026-10-31: 67
- 2026-10-30: 67
- 2026-10-29: 67
- 2026-10-28: 52
- 2026-10-27: 33
- 2026-10-26: 33
- 2026-10-25: 33
- 2026-10-24: 33
- 2026-10-23: 23

## Common questions

### What is the Competiflow MCP server?

Competiflow is an MCP server listed in the public MCP registry as io.github.nyku/competiflow-mcp. Competitor monitoring for AI agents: track rival pricing, docs and changelog changes with evidence. This page covers its npm package (@competiflow/mcp-server).

### Is the Competiflow MCP server safe to use?

Competiflow scores 67 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Competiflow MCP server expose?

Competiflow exposes 20 tools: list_workspaces, create_workspace, update_workspace, delete_workspace, add_competitor, and 15 more. Their descriptions and schemas cost roughly 2,053 tokens of context every time the server is loaded.

### Is the Competiflow MCP server still maintained?

Competiflow is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the Competiflow MCP server under?

Competiflow declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/@competiflow/mcp-server
- Socket report: https://socket.dev/npm/package/@competiflow/mcp-server
- Repository: https://github.com/nyku/competiflow-mcp
- Website: https://competiflow.com/
- Changelog RSS feed: https://verifymcp.io/servers/nyku-competiflow-mcp/competiflow-mcp-server.xml
- Changelog JSON feed: https://verifymcp.io/servers/nyku-competiflow-mcp/competiflow-mcp-server.json
- HTML version of this page: https://verifymcp.io/servers/nyku-competiflow-mcp/competiflow-mcp-server