# io.github.paperdavid/manoma (npm · manoma-mcp)

MCP server for soul.md — your portable AI identity layer across every LLM.

- Trust score: 69/100 (medium)
- Change this week: +45
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-04

## Components

- npm · `manoma-mcp`: 69/100 (this document), [markdown](https://verifymcp.io/servers/paperdavid-manoma/manoma-mcp.md), [page](https://verifymcp.io/servers/paperdavid-manoma/manoma-mcp)

## Channel facts

- Registry: `npm`
- Package: `manoma-mcp`
- Version: `0.2.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-04.

- **Supply Chain Security**: 83/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known medium-severity CVE affects hono 4.12.33, reached via @modelcontextprotocol/sdk > hono. A fixed version is available.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 107 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 82/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 1307 tokens (~65/item across 20 items; 7 tools + 13 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add paperdavid-manoma -- npx -y manoma-mcp
```

### Codex

```bash
codex mcp add paperdavid-manoma -- npx -y manoma-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "paperdavid-manoma": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "manoma-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add paperdavid-manoma --command npx --arg -y --arg manoma-mcp
```

### Hermes

```yaml
mcp_servers:
  paperdavid-manoma:
    command: "npx"
    args: ["-y", "manoma-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "paperdavid-manoma": {
      "command": "npx",
      "args": [
        "-y",
        "manoma-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-04 (score 69, −1)

- [security regression] CVE-2026-69207 affects this package: medium
- [security regression] Known CVEs: partial → fail

### 2026-08-02 (score 70, +44)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Schema quality: 100 → unverified
- [functional regression] Security disclosure: fail → unverified
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Stability: unverified → 0.20
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Schema quality: unverified → good
- [functional] Licence: MIT

### 2026-07-31 (score 26, −27)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 53, +29)

- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] Schema quality: unverified → 100

### 2026-07-28 (score 24, −29)

- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Schema quality: 100 → unverified

### 2026-07-27 (score 53)

First indexed and scored.

## MCP tools (7)

### `get_context` (~148 tokens)

Get Context

Retrieve the user's identity context for the current or specified mode.

Returns all soul.md sections that should be injected for the given mode,
as defined by mode_routing in /config. This is the primary way an LLM
should bootstrap context about the user.

Args:
  \- mode (string, optional): One of work, personal, creative, learning.
    Defaults to the active_mode in soul.md config.

Returns:
  Combined markdown of all sections relevant to the requested mode,
  including identity, values, voice, skills, and any mode-specific sections.

Input parameters:

- `mode` (string): Mode to resolve context for (work, personal, creative, learning). Defaults to active_mode from config.

### `get_injection` (~196 tokens)

Get Injection

Build a smart context injection from soul.md for an LLM system prompt.

Unlike get_context which returns raw sections, this runs the full injection
algorithm: three-tier priority (always/by_mode/on_trigger), keyword matching
for skill domains, person detection, voice dial conversion to behavioral
instructions, and token budgeting (2500 max with priority-aware truncation).

Use this when assembling the full identity blob for an LLM system prompt.

Args:
  \- mode (string, optional): One of work, personal, creative, learning.
  \- message (string, optional): The user's message. Used for trigger matching.

Returns:
  The injection text, token count, matched sections, triggered domains, and
  mentioned people.

Input parameters:

- `message` (string): The user's message. Used for keyword/skill/person triggering.
- `mode` (string): Mode (work, personal, creative, learning). Defaults to active_mode from config.

### `get_skill_depth` (~115 tokens)

Get Skill Depth

Retrieve detailed skill information for a specific domain.

Searches soul.md skill sections for a matching domain and returns the
full detail block including level, years, approach, heuristics, and taste.

Args:
  \- skill (string): Skill domain name to look up.

Returns:
  Detailed skill section content if found, or a list of available skills
  with a suggestion to check skills.summary.

Input parameters:

- `skill` (string, required): Skill domain to look up (e.g. "backend systems", "observability", "frontend")

### `list_sections` (~44 tokens)

List Sections

List all available sections in soul.md.

Returns a tree-like listing of all sections with their paths, names,
metadata, and child sections. Useful for discovering what's in the soul.

### `add_decision` (~145 tokens)

Add Decision

Record a decision in /memory/decisions.

Appends a timestamped entry to the decisions section of soul.md.
This is how the AI helps maintain soul.md as a living document —
capturing decisions as they happen during conversation.

Args:
  \- decision (string): The decision to record. Be specific about what was
    chosen and why.
  \- context (string, optional): Additional reasoning or alternatives considered.

Returns:
  Confirmation with the recorded entry.

Input parameters:

- `context` (string): Optional additional context or reasoning
- `decision` (string, required): The decision to record (e.g. "Chose Postgres over DynamoDB for billing — need ACID transactions")

### `add_lesson` (~153 tokens)

Add Lesson

Record a lesson learned in /memory/lessons.

Appends a timestamped entry to the lessons section. Captures insights
and hard-won knowledge from debugging, incidents, code reviews, reading,
or any learning moment.

Args:
  \- lesson (string): The lesson to record. Be specific and actionable.
  \- source (string, optional): Where this lesson came from.

Returns:
  Confirmation with the recorded entry.

Input parameters:

- `lesson` (string, required): The lesson learned (e.g. "Redis SCAN is O(N) — don't use on hot paths without cursor batching")
- `source` (string): Where the lesson came from (e.g. "production incident", "code review", "reading")

### `update_now` (~115 tokens)

Update Now

Replace the /now section with current focus and status.

The /now section captures what the user is currently working on, thinking
about, and prioritizing. This tool replaces it entirely with new content.

Args:
  \- content (string): New markdown content for the /now section. Should
    describe current projects, focus areas, blockers, and priorities.

Returns:
  Confirmation with the new content.

Input parameters:

- `content` (string, required): New content for the /now section. Use markdown. This replaces the entire /now section.

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/paperdavid-manoma/manoma-mcp#diagnostics

## Score history

- 2026-08-04: 69
- 2026-08-03: 70
- 2026-08-02: 70
- 2026-08-01: 26
- 2026-07-31: 26
- 2026-07-30: 53
- 2026-07-28: 24
- 2026-07-27: 53

## Links

- npm package: https://www.npmjs.com/package/manoma-mcp
- Socket report: https://socket.dev/npm/package/manoma-mcp
- Repository: https://github.com/paperdavid/manoma
- Changelog RSS feed: https://verifymcp.io/servers/paperdavid-manoma/manoma-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/paperdavid-manoma/manoma-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/paperdavid-manoma/manoma-mcp