# io.github.openpouch/openpouch (npm · @openpouch/mcp)

Agent-native hosting: deploy any folder to a live URL in one command. No approve tool.

- Trust score: 71/100 (medium)
- Change this week: −8
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `@openpouch/mcp`: 71/100 (this document), [markdown](https://verifymcp.io/servers/openpouch-openpouch/openpouch-mcp.md), [page](https://verifymcp.io/servers/openpouch-openpouch/openpouch-mcp)

## Channel facts

- Registry: `npm`
- Package: `@openpouch/mcp`
- Version: `0.4.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 100/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - No production dependencies, so there is no dependency health to assess.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (Apache-2.0).
  - Actively maintained (last published 15 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 69/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 2340 tokens (~137/item across 17 items; 17 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 23/100
  - Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add openpouch-openpouch -- npx -y @openpouch/mcp
```

### Codex

```bash
codex mcp add openpouch-openpouch -- npx -y @openpouch/mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "openpouch-openpouch": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@openpouch/mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add openpouch-openpouch --command npx --arg -y --arg @openpouch/mcp
```

### Hermes

```yaml
mcp_servers:
  openpouch-openpouch:
    command: "npx"
    args: ["-y", "@openpouch/mcp"]
```

### Other

```json
{
  "mcpServers": {
    "openpouch-openpouch": {
      "command": "npx",
      "args": [
        "-y",
        "@openpouch/mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 71, +3)

- [functional improvement] Stability: unverified → 0.23

### 2026-08-02 (score 68, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-08-01 (score 53, −8)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-31 (score 61, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-27 (score 79, +32)

- [functional improvement] Tool coverage: unverified → 100
- [functional] First check of Schema quality: fail
- [functional] First check of Schema quality: fail
- [functional] First check of Schema quality: good
- [functional] First check of Tool coverage: 100

### 2026-07-26 (score 47)

First indexed and scored.

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

## MCP tools (17)

### `openpouch_init` (~91 tokens)

Initialize a project for openpouch: detects framework/build/env vars, writes deploy.manifest.json + deploy.policy.json (default policy: previews autonomous, production requires human approval), auto-matches an existing provider service by name. Idempotent.

Input parameters:

- `cwd` (string): Project directory containing deploy.manifest.json (default: server cwd)
- `force` (boolean): Overwrite existing manifest/policy

### `openpouch_inspect` (~122 tokens)

Answer: what is deployed, where, on which commit, which required env vars are missing (names only — never values), and what drift exists between manifest and provider. Env vars passed at deploy time (--var/--env-file) appear as `deployProvided` (names from local evidence — the instant lane never exposes them via the API). Read-only. The result carries a plain-language `summary` you can relay directly to a non-technical human.

Input parameters:

- `cwd` (string): Project directory containing deploy.manifest.json (default: server cwd)

### `openpouch_plan` (~67 tokens)

Per environment: the policy decision (allowed / requires-approval / denied), blockers, readiness, and concrete next steps including the human-approval path. Read-only — reports, never acts.

Input parameters:

- `cwd` (string): Project directory containing deploy.manifest.json (default: server cwd)

### `openpouch_deploy` (~497 tokens)

Zero-config INSTANT preview on openpouch's own infra — the `openpouch deploy` command (was CLI-only; Codex 2026-07-04). No account, no provider key, no manifest needed (a saved openpouch API key lifts the deploy into your tier; otherwise anonymous). Uploads the folder, builds on deploy (dynamic Node apps run in a container), probes health, and returns top-level `url`, `healthStatus` (+ `pending`), and a plain-language `summary` to relay to your human. The private claim link (a save token — like a password) is REDACTED from the result BY DEFAULT here, because tool results flow through chat context; it is saved locally to .openpouch/claim.json (0600, gitignored), so nothing is lost. Env var VALUES are secrets: injected into the container only, never in output or evidence (names only). For a full-stack app set healthPath (e.g. /api/health) so the deploy is held to its API too, not just `/`.

Input parameters:

- `alwaysOn` (boolean): Paid tiers: keep the container running (no scale-to-zero cold start). Capped per tier; denied with an honest fix when unavailable.
- `cwd` (string): Project directory containing deploy.manifest.json (default: server cwd)
- `dir` (string): Subfolder to deploy (e.g. `dist` for a built frontend) — default: the project folder itself (source trees build server-side)
- `env` (object): Env vars for the deployed app as NAME→value. Values are secrets (never surfaced; PORT/HOME are reserved and rejected).
- `healthPath` (string): Extra health check: after `/` answers, GET <path> must return 200 too (e.g. /api/health); recorded in the manifest so verify re-checks it
- `redactSecrets` (boolean): Default TRUE (unlike the CLI flag): the private claim link is omitted from the result and kept only in .openpouch/claim.json. Set false to include it — only in a private context, never in a shared re…
- `volume` (boolean): Paid tiers: mount the account's persistent /data volume (keyed to account+project — survives redeploys). Dynamic apps only; denied with an honest fix on free tiers.

### `openpouch_deploy_preview` (~104 tokens)

Deploy the preview environment through the governed pipeline (policy check → deploy → poll → smoke → evidence). Default policy allows previews autonomously. For the zero-config instant preview (no manifest/provider key) use openpouch_deploy instead. On success the live URL is returned at top-level `url`, plus a plain-language `summary` to relay to your human.

Input parameters:

- `cwd` (string): Project directory containing deploy.manifest.json (default: server cwd)

### `openpouch_deploy_production` (~117 tokens)

Deploy production through the governed pipeline. If policy requires approval, this returns approvalRequest{id} with isError — ask your HUMAN to run `openpouch approve <id>` in their own terminal, then call this tool again. Agents cannot approve; there is intentionally no approve tool. Every result carries a plain-language `summary` to relay to your human; on a live deploy the URL is at top-level `url`.

Input parameters:

- `cwd` (string): Project directory containing deploy.manifest.json (default: server cwd)

### `openpouch_verify` (~196 tokens)

Run the healthcheck/smoke against the environment's live URL and append the results to the evidence (deploy.evidence.json + DEPLOYMENT.md). For a full-stack app pass healthPath (e.g. /api/health) — it is checked IN ADDITION to `/`, because a live shell can hide a dead API. The result carries a plain-language `summary` (healthy / has a problem) you can relay to your human.

Input parameters:

- `cwd` (string): Project directory containing deploy.manifest.json (default: server cwd)
- `environment` (string): Target environment. Omit to use the deploy's environment — production if the manifest has one, otherwise the single mapped env (e.g. an instant-lane preview). Same default as the CLI.
- `healthPath` (string): Extra path that must ALSO return 200 (e.g. /api/health) — checked in addition to /

### `openpouch_logs` (~168 tokens)

Structured runtime logs ({timestamp, message}) of the mapped service. Read-only. This is the first step of the self-repair loop: when a deploy comes back unhealthy (a failed verify, a non-200 app, or a pending/not-yet-live URL), read the logs to find the cause, fix the code or config, redeploy, then verify — repeat until it passes.

Input parameters:

- `cwd` (string): Project directory containing deploy.manifest.json (default: server cwd)
- `environment` (string): Target environment. Omit to use the deploy's environment — production if the manifest has one, otherwise the single mapped env (e.g. an instant-lane preview). Same default as the CLI.
- `limit` (integer): Max log lines (default 50)

### `openpouch_rollback` (~112 tokens)

Redeploy the recorded rollback anchor commit (the deploy that was live before the latest one). Approval-gated like any write action — may return approvalRequest{id} for your human.

Input parameters:

- `cwd` (string): Project directory containing deploy.manifest.json (default: server cwd)
- `environment` (string): Target environment. Omit to use the deploy's environment — production if the manifest has one, otherwise the single mapped env (e.g. an instant-lane preview). Same default as the CLI.

### `openpouch_whoami` (~108 tokens)

Report the openpouch account behind the current API key: tier (plan) and current usage (live apps, deploys this hour/day), or that the caller is anonymous. Read-only. The key is read from OPENPOUCH_API_KEY / ~/.openpouch/openpouch-run.key and never echoed. Carries a plain-language `summary` you can relay to your human. (Signup/activation are CLI/web only — they involve a human email or browser step.)

### `openpouch_upgrade` (~122 tokens)

Get a hosted-checkout URL for a paid openpouch tier (plan). Payment is deliberately a HUMAN step: hand the returned checkoutUrl to your human — they pay in the browser at the Merchant of Record; agents never enter payment data and there is no pay tool. The account tier updates automatically after payment (verify with openpouch_whoami). Needs an API key; returns availablePlans in the error when the plan name is unknown.

Input parameters:

- `plan` (string, required): Paid tier to buy, e.g. starter | pro | scale | business

### `openpouch_list` (~104 tokens)

List the instant-lane apps owned by the current openpouch account key: name (slug), kind (static/dynamic), status, live URL, and expiry. Read-only; needs an account key (anonymous previews aren't grouped under an account → an empty list with a signup pointer). Carries a plain-language `summary` to relay to your human. Pair with openpouch_delete to free a quota slot when a deploy hits a 'limit reached' error.

### `openpouch_delete` (~147 tokens)

Delete one of YOUR OWN instant-lane apps by name (slug) → frees a quota slot. This is the self-service fix for a 'limit reached' deploy error: list your apps, delete an unused one, redeploy. Owner-only — it uses your account key and the server verifies ownership, so you can never delete another account's app. Deleting an ephemeral preview is NOT a governed-production action, so it needs no approval (there is still no approve tool, D13). Returns the removed name + a plain-language `summary`.

Input parameters:

- `slug` (string, required): The app name (slug / subdomain) to delete — exactly as shown by openpouch_list

### `openpouch_data_push` (~150 tokens)

Replace a named app's persistent /data volume with a local directory's contents (L13 — the migration/restore primitive). The server stops the app for the write and restarts it health-gated, so files like a SQLite DB are never swapped under a running process. Owner-only (account key); file CONTENTS never appear in logs or results (counts/sizes only). Typical migration: export data from the old host (your own means — you own the code), then push it here.

Input parameters:

- `app` (string, required): The named app (created with deploy --app <name> --volume)
- `dir` (string, required): Local directory whose contents REPLACE the app's /data

### `openpouch_data_pull` (~102 tokens)

Download a named app's persistent /data volume as a gzipped tar file (L13 — the BACKUP primitive: your human's data is never locked in). Owner-only (account key). Writes the archive to a local path and returns its location + size.

Input parameters:

- `app` (string, required): The named app whose /data to back up
- `dest` (string): Local file path for the backup (default: <app>-data.tgz)

### `openpouch_data_ls` (~66 tokens)

List the files in a named app's persistent /data volume — names, sizes and timestamps only, never contents. Owner-only (account key). Use it to verify a data push/migration landed.

Input parameters:

- `app` (string, required): The named app whose /data to list

### `openpouch_list_approvals` (~67 tokens)

List pending approval requests (read-only). Approving itself is human-only via `openpouch approve <id>` in an interactive terminal — by design not available to agents.

Input parameters:

- `cwd` (string): Project directory containing deploy.manifest.json (default: server cwd)

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/openpouch-openpouch/openpouch-mcp#diagnostics

## Score history

- 2026-08-03: 71
- 2026-08-02: 68
- 2026-08-01: 53
- 2026-07-31: 61
- 2026-07-29: 79
- 2026-07-28: 79
- 2026-07-27: 79
- 2026-07-26: 47

## Links

- npm package: https://www.npmjs.com/package/@openpouch/mcp
- Socket report: https://socket.dev/npm/package/@openpouch/mcp
- Repository: https://github.com/openpouch/openpouch
- Changelog RSS feed: https://verifymcp.io/servers/openpouch-openpouch/openpouch-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/openpouch-openpouch/openpouch-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/openpouch-openpouch/openpouch-mcp