nomArmy
NPM · NOMARMY
Sandboxed coding workers, verified: tests rerun fresh and must fail with the change reverted.
Available components
Last scanned (7 hours ago)
Scores higher than 37% of npm servers
Category Developer Tools
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 46 of 146 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (Apache-2.0).Pass
- Actively maintained (last published 1 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability51
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 7750 tokens (~484/item across 16 items; 16 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management10
- Stability observed for 3 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage90
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 69% of tool parameters carry a description.Partial
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "local_worker_cleanup" implies "remove" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 17 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 16 Oct 26 +16
- Malware scan: unverified → pass ▲ security
- 15 Oct 26 −15
- Malware scan: pass → unverified ▼ security
- Stability: unverified → 0.03 ▲ functional
- Package version: 0.1.0-beta.8 → 0.1.0-beta.9 functional
- 14 Oct 26 +25
- Injection markers: unverified → pass ▲ security
- First check of Judged manipulation: pass security
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- Tool coverage: unverified → 100 ▲ functional
- MCP protocol: unverified → pass ▲ functional
- First check of Schema quality: fail functional
- First check of Schema quality: fail functional
- First check of Destructive annotations: 0 functional
- First check of Tool coverage: 69 functional
- First check of Schema quality: good functional
- Package version: 0.1.0-beta.7 → 0.1.0-beta.8 functional
- 13 Oct 26 0
- Known CVEs: pass → unverified ▼ security
- Dependency health: 0.86 → unverified ▼ functional
- Package version: 0.1.0-beta.3 → 0.1.0-beta.7 functional
- Package version: 0.1.0-beta.3 → 0.1.0-beta.6 functional
- Package version: 0.1.0-beta.3 → 0.1.0-beta.4 functional
- 12 Oct 26 39
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 17 Oct 2026 · Analysed npm/nomarmy@0.1.0-beta.9
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 146 packages
| Packages resolved | 146 |
|---|---|
| Stale | 46 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
army ~132
Who you, the General, are and who you call for what in this repository: your fixed charter and the agent you're defined as, the army's workflow, then each role's description, phase (build, review, acceptance), suggested mode, and the agent it runs on, with which config layer set each value (global, project .nomarmy.yml, local .nomarmy.local.yml). Flags roles with no usable agent, and roles that share your model or subscription (not an independent review). Dispatch a role with `army_role`, or an agent directly with `agent`. Read-only, re-read on every call.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
local_worker ~2,090
Run one isolated local worker and wait for it. mode=implement edits in its own worktree and the coordinator commits only on a valid done report (or a recovered job that passed independent verification); failed or incomplete worktrees are retained. mode=scout answers a question from a read-only snapshot with mandatory [path:line] citations that nomArmy verifies and expands. mode=decompose (also read-only) proposes 2+ independent subtasks for a broad objective instead of one worker turn trying to do too much; the proposal is never auto-dispatched, review it and make a separate call with the subtasks you choose. Refuses under memory pressure or over capacity; use local_worker_start + local_worker_status to avoid blocking.
| Name | Type | Req | Description |
|---|---|---|---|
| acceptance | array | – | implement: acceptance criteria the worker must satisfy. scout: points a complete answer must cover. decompose: constraints a good split must respect. |
| agent | string | – | Run on this agent from the operator's agents.yml, by name (e.g. "codex", "grok", "local"): the local model, a metered api key, or one person's subscription. Omit agent and army_role to use the local… |
| army_role | string | – | Dispatch by army role (e.g. "sr-dev", "security-analyst"): nomArmy runs it on the agent this repo assigns to that role and puts the role's description at the top of the brief. Call the `army` tool fi… |
| base_ref | string | – | – |
| commit_subject | string | – | implement: the subject line of the commit nomArmy makes on the worker branch, e.g. "Keep held-back tables in the list_tables cache". Defaults to the task's first sentence; the body is the worker's NO… |
| confirm_over_limit | boolean | – | Override a reached usage limit: the General must ask the operator before resubmitting with confirm_over_limit: true, or send the job to another agent. nomArmy never sets it itself. |
| continue_from | string | – | implement only: the job id of a retained, uncommitted implement job (partial, blocked, or failed verification) whose unfinished work this job should finish. The new worktree starts from that job's ba… |
| criteria | array | – | implement: contract IDs from acceptance/*.yml served by this job, read at base_ref when set (else the working tree). |
| evidence | string | – | implement only: facts YOU already resolved (e.g. via repo_evidence) that the worker should trust and not re-derive -- exact signatures, call sites, line ranges, existing behavior. Cuts exploration th… |
| mode | string | – | verify: run a required verification profile with no worker and no model tokens; base_ref selects the branch or commit (default current HEAD), task is a short record label, agent/model are unused and… |
| model | string | – | The model to run on the job's agent (an api or subscription agent), e.g. "gpt-6-sol". Overrides the role's model and the agent's default. Required when the role's model is "auto" or the agent has no… |
| on_behalf_of | string | – | Required when the job's agent is a subscription: must exactly match that agent's owner in agents.yml, or nomArmy refuses the job. A self-reported attestation, not an independently verified identity c… |
| reasoning | string | – | Thinking level passed to the worker model: off, minimal, low, medium, high, xhigh, adaptive, max or ultra (the higher ones only where the vendor offers them, e.g. xhigh on Codex models; a level the m… |
| refactor | boolean | – | implement: declares a behavior-preserving change (moving or restructuring code). nomArmy then requires a passing verification profile and refuses to commit if any test file was added, changed or dele… |
| report | string | – | How much the worker may report back, capped by its agent's tier: brief (today's local-sized report), standard (the default), full (the frontier ceiling: about 2k tokens for implement, 4k for a scout)… |
| reviews | string | – | scout: the job id this scout independently reviews, so the review is recorded against that job (nomarmy stats shows high-stakes jobs with and without one). Use a different vendor than the job's worke… |
| run_id | string | – | The /feature run this job belongs to (from run_start). Admission then enforces the run's limits (jobs, api spend, hours) and refuses an agent the run has paused after a vendor usage-limit error; the… |
| stakes | string | – | implement: how much a mistake would cost, separate from how hard the work is. high for anything touching security or access control, personal or tenant data, data loss, money, or changes that can't b… |
| task | string | yes | implement: the OBJECTIVE the worker must achieve, not the edit it should make. scout: the QUESTION to answer from the repository. decompose: the broad OBJECTIVE to propose a split for. |
| timeout_seconds | integer | – | Default 600; 1200 for a review scout (one with `reviews`, or an army role in the review phase), since a real security review read for the full 10 minutes and was cut off. |
| verification | string | – | Verification profile NAME (e.g. quick, standard, browser). Semantic; nomArmy owns execution. Ignored by scouts. |
| verify_regression | boolean | – | implement only: after the diff passes `verification` and touches production files, temporarily revert just those production files, re-run the SAME verification profile (expected to fail without the f… |
| worker_id | string | – | – |
No output schema declared.
No examples provided.
local_worker_capacity ~48
What this host can take right now: context per nom and the brief/report budgets derived from it, memory pressure and whether another job would be admitted, and the jobs currently running. Read-only.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
local_worker_cleanup ~137
Remove a retained worker worktree and optionally its agent branch after Claude has reviewed/integrated or deliberately discarded it. Refuses to delete the current branch. A branch whose commits were cherry-picked (not merged) into the current branch -- nomArmy's own integration model -- is recognized as integrated by comparing PATCH CONTENT (git cherry), not git's own ancestry-only check, so a genuinely-integrated job's cleanup does not need force: true. Reserve force for a branch you are actually discarding unintegrated work from.
| Name | Type | Req | Description |
|---|---|---|---|
| delete_branch | boolean | – | – |
| force | boolean | – | – |
| job_id | string | yes | – |
No output schema declared.
No examples provided.
local_worker_config ~129
What this checkout's .nomarmy.yml defines -- the one file every job's sandbox image and every verification uses, whichever branch the job starts from (never the job worktree's own copy, which a worker could edit): every verification profile name and its commands/environment, and any elevated (shared/remote) services that need explicit policy approval before a job may use them. Pass a profile name to `verification`/`union_verification`/`verify_regression` only if it appears here. Read-only; never writes or proposes a config (see `nomarmy scan` for that).
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
local_worker_jobs ~200
List recent job records for review/recovery, including jobs still running or orphaned by a server restart. Does not modify repositories. Returns a small PROJECTION per job by default (jobId, outcome, branch/commit, worktreeRetained, filesChanged, timing, issues) -- enough to decide what needs recovery or cleanup without pulling every job's full execution record (objective text, budgets, git records, ...) into context, which can exceed the tool result size past a handful of jobs. Pass full: true only for the specific job(s) you already know need deep inspection.
| Name | Type | Req | Description |
|---|---|---|---|
| full | boolean | – | Return each job's complete, uncompacted manifest instead of the small default projection. Requesting this across many jobs at once risks exceeding the tool result size cap -- prefer the default proje… |
| limit | integer | – | – |
No output schema declared.
No examples provided.
local_worker_start ~2,001
Start one worker or scout in the background and return immediately with a job_id. Poll it with local_worker_status (optionally long-polling with wait_seconds). Same admission rules as local_worker: refuses under memory pressure or when NOMARMY_MAX_WORKERS jobs are already running.
| Name | Type | Req | Description |
|---|---|---|---|
| acceptance | array | – | implement: acceptance criteria the worker must satisfy. scout: points a complete answer must cover. decompose: constraints a good split must respect. |
| agent | string | – | Run on this agent from the operator's agents.yml, by name (e.g. "codex", "grok", "local"): the local model, a metered api key, or one person's subscription. Omit agent and army_role to use the local… |
| army_role | string | – | Dispatch by army role (e.g. "sr-dev", "security-analyst"): nomArmy runs it on the agent this repo assigns to that role and puts the role's description at the top of the brief. Call the `army` tool fi… |
| base_ref | string | – | – |
| commit_subject | string | – | implement: the subject line of the commit nomArmy makes on the worker branch, e.g. "Keep held-back tables in the list_tables cache". Defaults to the task's first sentence; the body is the worker's NO… |
| confirm_over_limit | boolean | – | Override a reached usage limit: the General must ask the operator before resubmitting with confirm_over_limit: true, or send the job to another agent. nomArmy never sets it itself. |
| continue_from | string | – | implement only: the job id of a retained, uncommitted implement job (partial, blocked, or failed verification) whose unfinished work this job should finish. The new worktree starts from that job's ba… |
| criteria | array | – | implement: contract IDs from acceptance/*.yml served by this job, read at base_ref when set (else the working tree). |
| evidence | string | – | implement only: facts YOU already resolved (e.g. via repo_evidence) that the worker should trust and not re-derive -- exact signatures, call sites, line ranges, existing behavior. Cuts exploration th… |
| mode | string | – | verify: run a required verification profile with no worker and no model tokens; base_ref selects the branch or commit (default current HEAD), task is a short record label, agent/model are unused and… |
| model | string | – | The model to run on the job's agent (an api or subscription agent), e.g. "gpt-6-sol". Overrides the role's model and the agent's default. Required when the role's model is "auto" or the agent has no… |
| on_behalf_of | string | – | Required when the job's agent is a subscription: must exactly match that agent's owner in agents.yml, or nomArmy refuses the job. A self-reported attestation, not an independently verified identity c… |
| reasoning | string | – | Thinking level passed to the worker model: off, minimal, low, medium, high, xhigh, adaptive, max or ultra (the higher ones only where the vendor offers them, e.g. xhigh on Codex models; a level the m… |
| refactor | boolean | – | implement: declares a behavior-preserving change (moving or restructuring code). nomArmy then requires a passing verification profile and refuses to commit if any test file was added, changed or dele… |
| report | string | – | How much the worker may report back, capped by its agent's tier: brief (today's local-sized report), standard (the default), full (the frontier ceiling: about 2k tokens for implement, 4k for a scout)… |
| reviews | string | – | scout: the job id this scout independently reviews, so the review is recorded against that job (nomarmy stats shows high-stakes jobs with and without one). Use a different vendor than the job's worke… |
| run_id | string | – | The /feature run this job belongs to (from run_start). Admission then enforces the run's limits (jobs, api spend, hours) and refuses an agent the run has paused after a vendor usage-limit error; the… |
| stakes | string | – | implement: how much a mistake would cost, separate from how hard the work is. high for anything touching security or access control, personal or tenant data, data loss, money, or changes that can't b… |
| task | string | yes | implement: the OBJECTIVE the worker must achieve, not the edit it should make. scout: the QUESTION to answer from the repository. decompose: the broad OBJECTIVE to propose a split for. |
| timeout_seconds | integer | – | Default 600; 1200 for a review scout (one with `reviews`, or an army role in the review phase), since a real security review read for the full 10 minutes and was cut off. |
| verification | string | – | Verification profile NAME (e.g. quick, standard, browser). Semantic; nomArmy owns execution. Ignored by scouts. |
| verify_regression | boolean | – | implement only: after the diff passes `verification` and touches production files, temporarily revert just those production files, re-run the SAME verification profile (expected to fail without the f… |
| worker_id | string | – | – |
No output schema declared.
No examples provided.
local_worker_status ~165
Status of one job started by this server: phase (starting, worktree, worker, verification, commit, record, finished), elapsed time against its timeout, and the result once finished. wait_seconds long-polls up to that long for completion (max 110, to stay inside MCP client request timeouts; poll again for longer jobs). report=true returns just the worker's report (a scout's findings with their verified citations), the outcome, issues, verification and commit. full=true returns the complete execution record.
| Name | Type | Req | Description |
|---|---|---|---|
| full | boolean | – | – |
| job_id | string | yes | – |
| report | boolean | – | Just the report and nomArmy's verdict on it, without the rest of the record. Prefer this to full. |
| wait_seconds | integer | – | – |
No output schema declared.
No examples provided.
local_worker_stop ~137
Stop a running job's worker, for example one burning a frontier model's usage on the wrong track. Its worker ends within about 15 seconds, without the report-recovery call a timeout gets and without running verification; its worktree is kept uncommitted, so a new job with continue_from: <job_id> (and a cheaper model if you like) can finish the work. Works for a job started by any session. Refuses a job that isn't running or is already past its worker.
| Name | Type | Req | Description |
|---|---|---|---|
| job_id | string | yes | – |
| reason | string | – | Why it's being stopped; recorded in the job's issues. |
No output schema declared.
No examples provided.
local_worker_sweep ~251
Bulk-reap job worktrees/branches that are PROVABLY EMPTY: the branch's tip is identical to the base SHA it started from (zero commits) AND the worktree has no uncommitted changes left either -- there is nothing here to inspect, recover, or lose. Never removes a worktree holding any real committed or uncommitted work, regardless of age or older_than_hours -- emptiness is what makes it safe, not age. A worktree with real work always stays a deliberate, individual local_worker_cleanup call. Use dry_run first to see what would be reaped.
| Name | Type | Req | Description |
|---|---|---|---|
| delete_branches | boolean | – | Also delete each reaped job's branch. Safe unconditionally here (never force) -- a branch identical to its base SHA is trivially git's own definition of already-merged. |
| dry_run | boolean | – | Report what WOULD be reaped without removing anything. |
| limit | integer | – | Maximum number of job directories to examine in one call. |
| older_than_hours | number | – | Only consider jobs finished (or, if never finished, last touched) at least this many hours ago. 0 (default) considers every job regardless of age. |
No output schema declared.
No examples provided.
local_workers ~409
Run independent jobs (implement or scout) with bounded parallelism and wait for all of them. Every implement job receives its own branch, worktree, sandbox session, logs, validation, and coordinator-owned commit. This tool never merges any branch into the developer's branch. With auto_union: true, implement jobs that reach a valid outcome and touch non-overlapping files are additionally merged (git merge --no-ff) into ONE new integration branch -- a review artifact alongside the untouched per-job branches, still not the developer's branch, still reviewed and integrated explicitly. Jobs that overlap or did not finish validly are excluded from the union and reported individually exactly as without auto_union. For long batches prefer local_worker_start per job and poll.
| Name | Type | Req | Description |
|---|---|---|---|
| auto_union | boolean | – | After all jobs finish, mechanically merge (git merge --no-ff) implement jobs that reached a valid outcome and touched non-overlapping files into ONE new integration branch for review -- never into th… |
| jobs | array | yes | – |
| max_parallel | integer | – | A cap on how many of this batch run at once. Omit it: local jobs then use the local ceiling and api/subscription jobs theirs (`nomarmy config max-jobs`, default 4), with each agent's own max_concurre… |
| union_verification | string | – | Verification profile NAME to run once against the union branch after merging (same semantics as each job's own `verification` field). Only meaningful with auto_union: true. Omitted: union-level verif… |
No output schema declared.
No examples provided.
repo_evidence ~171
Deterministic repository evidence with exact [path:line] citations and no model involved. ops: grep, definitions, references, outline, files. definitions/references take a symbol in 'query' (heuristic per language family); outline takes 'path'; grep takes a regex in 'query'; files takes a glob. Runs against the project working tree in milliseconds. Prefer this over reading files for where-is / who-calls / what-declares questions, and over a scout for anything it can answer.
| Name | Type | Req | Description |
|---|---|---|---|
| glob | string | – | – |
| ignore_case | boolean | – | – |
| json | boolean | – | – |
| max_results | integer | – | – |
| op | string | yes | – |
| path | string | – | – |
| query | string | – | – |
| whole_word | boolean | – | – |
No output schema declared.
No examples provided.
run_finish ~69
Close a /feature run as complete or stopped, with a one-paragraph summary. A closed run admits no more jobs. Nothing is merged: the run's branch still waits for the operator.
| Name | Type | Req | Description |
|---|---|---|---|
| run_id | string | yes | – |
| status | string | yes | – |
| summary | string | yes | – |
No output schema declared.
No examples provided.
run_start ~246
Start a /feature run (or reattach to one with `resume`): one feature, end to end, with limits. It becomes this session's active run: every job you dispatch from now on joins it automatically (pass run_id only to target a different run). Admission enforces the run's limits -- jobs, api spend in dollars, wall-clock hours -- warning at the configured share and refusing at the cap. A vendor usage-limit error pauses that agent for the rest of the run. Limits come from the operator's army run_limits; you may lower them for this run, never raise them. Returns the run id and a log path: keep the run log (plan, decisions, progress) there so a fresh session can resume if yours hits its own usage limit.
| Name | Type | Req | Description |
|---|---|---|---|
| max_api_usd | number | – | – |
| max_hours | number | – | – |
| max_jobs | integer | – | – |
| name | string | – | A short name for the feature (required unless resuming). |
| resume | string | – | Reattach this session to an existing, still-running run (e.g. after the previous session hit its own limit) instead of starting a new one. |
No output schema declared.
No examples provided.
run_status ~62
A /feature run's limits, what it has used (jobs, api spend, hours), per-agent jobs/spend/tokens, warnings (80% of a limit, paused agents), and its log path. Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| run_id | string | yes | – |
No output schema declared.
No examples provided.
stats ~331
What nomArmy's own job records show for this repository (or all repositories): jobs by mode, role and model; code committed; worker and job time; tokens and API spend; claim vs evidence (how often a "done, tests pass" report failed independent verification, or passed with tests that couldn't catch the change); what didn't complete; reviewer outcomes; and review flags. Every number comes from nomArmy's verified records, never a worker's report. Defects you find at integration aren't in the records: add your own count. Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| all_repos | boolean | – | Every repository this machine's nomArmy has run jobs for, not just this one. |
| details | boolean | – | The full report (volume, reviewers, flags, what didn't finish). Default is the one-screen summary: what nomArmy caught, high-stakes work needing review, the top routing tips, spend. |
| format | string | – | text (default) is the report; json is the raw numbers. |
| model | string | – | Only jobs that ran on this model (e.g. grok-4.7). |
| repo | string | – | Another repository, by path or folder name ("senti" matches rayson-senti if unambiguous). |
| role | string | – | Only jobs dispatched as this army role (e.g. sr-dev). |
| since | string | – | Only jobs started since this: a date (2026-09-25) or an age (7d, 24h). Default: all. |
| until | string | – | Only jobs started before this date. |
No output schema declared.
No examples provided.
How do I install the nomArmy MCP server?
nomArmy runs locally as an npm package, launched with npx -y nomarmy. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · nomarmy
claude mcp add rayson-tech-nomarmy -- npx -y nomarmy
What is the nomArmy MCP server?
nomArmy is an MCP server listed in the public MCP registry as io.github.rayson-tech/nomarmy. Sandboxed coding workers, verified: tests rerun fresh and must fail with the change reverted. This page covers its npm package (nomarmy).
Is the nomArmy MCP server safe to use?
nomArmy scores 65 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 17 October 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the nomArmy MCP server expose?
nomArmy exposes 16 tools: local_worker, local_worker_start, local_worker_status, stats, local_worker_stop, and 11 more. Their descriptions and schemas cost roughly 6,578 tokens of context every time the server is loaded.
Is the nomArmy MCP server still maintained?
nomArmy is still listed as active in the MCP registry. We last reached this channel on 17 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the nomArmy MCP server under?
nomArmy declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.