Reticle
NPM · @RETICLEHQ/SERVER
Verify a running web app from the inside over MCP: look, act, observe, assert. No screenshots.
Available components
Last scanned (18 minutes ago)
Scores higher than 52% of npm servers
Category Testing and QA
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security81
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects zod 3.25.76, a direct dependency. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 31 of 103 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency87
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to reticlehq/reticle). View diagnostics → Pass
- License check failed: the license (FSL-1.1-ALv2) isn't a recognized OSI-approved license. See how to fix → Fail
- Actively maintained (last published 0 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability51
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 4686 tokens (~468/item across 10 items; 10 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management37
- Stability observed for 11 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 10 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 11 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 25 Oct 26 +1
- Tool safety: pass → unverified ▼ security
- Stability: 0.33 → unverified ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Tool coverage: 94% → 100% ▲ functional
- Package version: 3.7.0 → 3.8.0 functional
- 24 Oct 26 −5
- CVE-2023-54404 affects this package: high ▼ security
- Known CVEs: pass → fail ▼ security
- 23 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.
- 22 Oct 26 +3
- Stability: unverified → 0.27 ▲ functional
- 14 Oct 26 +27
- Injection markers: unverified → pass ▲ security
- First check of Judged manipulation: pass security
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- Tool coverage: unverified → 100 ▲ functional
- MCP protocol: unverified → pass ▲ functional
- First check of Schema quality: fail functional
- First check of Destructive annotations: pass functional
- First check of Schema quality: fail functional
- First check of Tool coverage: 94 functional
- First check of Schema quality: good functional
- 13 Oct 26 47
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 25 Oct 2026 · Analysed npm/@reticlehq/server@3.8.0
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | reticlehq/reticle |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/reticlehq/reticle/.github/workflows/publish.yml@refs/tags/v3.8.0 |
| Rekor log index | 3463955155 |
| Predicate type | SLSA build provenance https://slsa.dev/provenance/v1 |
| Subject digest | sha512:0801c26d5cc2f63f1ba8a65fbd55c30d250ef5cb7dd660c97f1a9166b7990423b38f39fc3baa86e0ae7b75de6b89ec27aeebdddf233ab13eb05beca20 |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 1 finding
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-mrhx-c7xc-m3w5 | CVE-2023-54404 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 103 packages
| Packages resolved | 103 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
reticle_act ~376
Act WITHOUT checking the result — if the action is supposed to cause something, use reticle_act_and_wait { until } instead and get the verdict in the same call. e.g. {"ref":"e42","action":"fill","args":{"value":"hello"}}
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | Action to perform. |
| args | object | – | Action-specific arguments: { value } for fill/select, { text } for type/press (the key NAME, e.g. Escape or Tab), { modifiers: ["Meta","Shift"] } for a press s… |
| burst | number | – | ms gap between dispatches, to provoke an ordering race (try 50). |
| detail | string | – | "compact" keeps only the deciding fields. |
| onDeviation | string | – | What to do when a step's `expect` does not hold. |
| ref | string | – | Element ref (e.g. 'e42') from reticle_look { action: "page" }/reticle_look { action: "find" } — stable until the element leaves the DOM, so no re-snapshot between actions. |
| refuseWhenThrottled | boolean | – | Throw instead of silently sending synthetic events when the tab is throttled/backgrounded. |
| sessionId | string | – | Target a specific tab. Omit unless you mean one — see instructions. |
| steps | array | – | Ordered list of { ref | target, action, args?, expect? } objects. |
| target | object | – | Find the element and act on it in ONE call, instead of a reticle_look { action: "find" } round trip first: { testid } | { text } | { role, name } | { label }. |
| timeout_ms | integer | – | Per-step timeout in milliseconds. |
No output schema declared.
No examples provided.
reticle_act_and_wait ~619
Act on a ref, then wait for a predicate to hold — one hop for the act->observe->assert loop. e.g. {"ref":"e42","action":"click","until":{"kind":"signal","name":"todos:loaded"}}
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform. |
| args | object | – | Action-specific arguments: { value } for fill/select, { text } for type/press (the key NAME, e.g. Escape or Tab), { modifiers: ["Meta","Shift"] } for a press s… |
| detail | string | – | "compact" keeps only the deciding fields. |
| durable | boolean | – | After a yes, reload and require the element/text/state part of `until` to hold again. |
| intent | string | – | What this change is meant to make true — as a durable statement ABOUT THE PRODUCT, or the id of an intent you already declared. |
| predicate | object | – | Predicate object: { kind, ...fields }. kind is one of element | text | net | route | console | animation | signal | state | settled | compare | allOf | anyOf | not. Bug-catching options: net.count (e… |
| ref | string | – | Element ref (e.g. 'e42') from reticle_look { action: "page" }/reticle_look { action: "find" } — stable until the element leaves the DOM, so no re-snapshot between actions. |
| refuseWhenThrottled | boolean | – | Throw if the tab is throttled. |
| sessionId | string | – | Target a specific tab. Omit unless you mean one — see instructions. |
| target | object | – | Find the element and act on it in ONE call, instead of a reticle_look { action: "find" } round trip first: { testid } | { text } | { role, name } | { label }. |
| timeout_ms | integer | – | Maximum wait time in milliseconds. |
| until | object | – | Predicate object: { kind, ...fields }. kind is one of element | text | net | route | console | animation | signal | state | settled | compare | allOf | anyOf | not. |
No output schema declared.
No examples provided.
reticle_assert ~266
Prove a consequence, by action: "now" evaluates a predicate against the window that already exists, "wait" waits for one to become true within a budget. e.g. {"action":"now"}
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | Which operation to run. |
| detail | string | – | "compact" keeps only the deciding fields. |
| intent | string | – | What this change is meant to make true — as a durable statement ABOUT THE PRODUCT, or the id of an intent you already declared. |
| predicate | object | – | Predicate object: { kind, ...fields }. kind is one of element | text | net | route | console | animation | signal | state | settled | compare | allOf | anyOf | not. |
| sessionId | string | – | Target a specific tab. Omit unless you mean one — see instructions. |
| since | integer | – | Cursor (a number) from a prior act or observe result. |
| timeout_ms | integer | – | If > 0, wait up to this many milliseconds before failing. |
| until | object | – | Predicate object: { kind, ...fields }. kind is one of element | text | net | route | console | animation | signal | state | settled | compare | allOf | anyOf | not. |
No output schema declared.
No examples provided.
reticle_look ~600
Read the page, by action: "page" is the semantic snapshot of what is rendered, "find" resolves a locator (testid/role/text/component) to refs you can act on, "… e.g. {"action":"find","by":"testid","value":"submit"}
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | Which operation to run. |
| alt | string | – | Predicate spelling of by/value. |
| attrs | array | – | Attribute NAMES to return per match, e.g. ['href'] for links, ['src'] for images. |
| audit | boolean | – | Also measure the page for what a person would see broken: text cut off with no ellipsis, controls drawn over each other, text under WCAG contrast. |
| by | string | – | Query strategy. |
| count_only | boolean | – | Return just { count } (no element descriptors) — use when you only need "how many match?" and not their refs. |
| depth | integer | – | Collapse anything deeper than N levels to a size marker — avoids huge outputs for large stores. |
| diff | boolean | – | Return only what changed since your last snapshot of the same scope/mode (mode:delta|unchanged). |
| ids | boolean | – | Add [testid=…] to each control that carries one: a stable identity for a harness mapping the app. |
| label | string | – | Predicate spelling of by/value. |
| limit | integer | – | Cap descriptors to the first N. |
| mode | string | – | full = all elements; interactive = only clickable/focusable elements; status = only route + title. |
| name | string | – | Accessible name filter — narrows results when `by` is role and the page has many elements of that role. |
| path | string | – | Dot-path into the store (e.g. 'captionCache.v3'). |
| placeholder | string | – | Predicate spelling of by/value. |
| ref | string | – | Element ref (e.g. 'e42') from reticle_look { action: "page" }/reticle_look { action: "find" } — stable until the element leaves the DOM, so no re-snapshot between actions. |
| role | string | – | Predicate spelling of by/value. |
| scope | string | – | CSS selector or element ref to restrict the snapshot to a subtree. |
| self | boolean | – | Return the `scope` element ITSELF instead of searching inside it. |
| sessionId | string | – | Target a specific tab. Omit unless you mean one — see instructions. |
| store | string | – | Registered store name (e.g. 'workspace'). |
| testid | string | – | Predicate spelling of by/value. |
| text | string | – | Predicate spelling of by/value. |
| value | string | – | Query value for the selected strategy (e.g. by=role value=button, or by=testid value=submit-btn). |
No output schema declared.
No examples provided.
reticle_navigate ~169
Navigate the connected browser tab to a URL, or reload it in place with { reload: true } (add { hard: true } to bypass the cache). e.g. {"url":"/settings"}
| Name | Type | Req | Description |
|---|---|---|---|
| hard | boolean | – | With reload:true, bypass the browser cache (Cmd+Shift+R). |
| reload | boolean | – | Reload the current page instead of navigating (replaces the former standalone refresh tool). |
| sessionId | string | – | Target a specific tab. Omit unless you mean one — see instructions. |
| timeout_ms | integer | – | How long to wait for the page to come back (the SDK reconnecting at the new URL, or under the same id on a reload) before answering confirmed:false. |
| url | string | – | The URL to navigate to. |
No output schema declared.
No examples provided.
reticle_observe ~333
What the app DID, by action: "events" is the reaction window since a cursor, "network" the requests it made, "console" what it logged. e.g. {"action":"events"}
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | Which operation to run. |
| actionId | string | – | Keep only events attributed to this action — answers "what did action N cause". |
| assets | boolean | – | List the dev server's own successful asset GETs (modules, styles, maps, Vite plumbing). |
| bodies | boolean | – | Body detail. |
| filters | array | – | Event type allowlist — the cheapest way to shrink a large timeline. |
| level | string | – | Log level filter. |
| limit | – | – | Cap descriptors to the first N. |
| max_events | integer | – | Cap the timeline to the most recent N events. |
| method | string | – | HTTP method filter: GET | POST | PUT | DELETE | PATCH etc. |
| ok | boolean | – | Outcome filter: false keeps only calls that FAILED, true only those that succeeded. |
| sessionId | string | – | Target a specific tab. Omit unless you mean one — see instructions. |
| since | integer | – | Cursor (a number) from a prior act or observe result. |
| status | integer | – | HTTP status code filter (e.g. 200, 404, 500). |
| until | – | – | Upper cursor bound. |
| urlContains | string | – | Substring that the request URL must contain. |
| window_ms | integer | – | Time window to look back, in ms (must be > 0). |
No output schema declared.
No examples provided.
reticle_run ~108
Invoke any Reticle tool by name (discover names/params first with reticle_tools). On an unknown tool or bad arguments it returns the available names or the tool's params, so you can correct and retry.
| Name | Type | Req | Description |
|---|---|---|---|
| args | object | – | Arguments object for that tool. |
| sessionId | string | – | Target tab for the invoked tool. Forwarded to it — an explicit args.sessionId wins. |
| tool | string | yes | Tool name to invoke, e.g. reticle_clock. |
No output schema declared.
No examples provided.
reticle_session ~511
By action: "list" (the default) shows connected tabs; "yield" is MANDATORY before you stop; "tune" hides or moves the HUD; "feedback" reports a problem. e.g. {"action":"yield","mode":"waiting"}
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | Which operation to run. |
| all | boolean | – | Include already-resolved marks in the listing (default: pending only). |
| claim | string | – | What YOU claim this session showed. |
| contact | string | – | An email address for a reply from the maintainers. |
| currentApproach | string | – | How you work around it TODAY. |
| disconnect | boolean | – | Also detach this page for good (needs sessionId). |
| hud | string | – | Hide, show or remove the HUD, or move it to a corner. |
| idleEndMs | integer | – | Idle window in milliseconds after which the panel shows WAITING (your turn). |
| impact | string | – | What measurably improves — fewer tool calls, fewer retries, a verdict that stops being ambiguous, a flow you currently cannot verify at all. |
| kind | string | – | bug = a Reticle tool returned a wrong or broken result; gap = Reticle could not observe something you needed at all; ambiguity = the verification ran but you c… |
| level | string | – | Display severity. |
| mode | string | – | "waiting" = turn done, will resume; "ask" = blocked, need the human to answer. |
| model | string | – | The model you are running (e.g. "claude-opus-4", "gpt-5"). |
| need | string | – | The GOAL behind a request, not the request itself. |
| note | string | – | For mode:"ask", the question to show the human on the panel. |
| rating | integer | – | How well it worked, 1-5, with an `experience`. |
| resolve | string | – | A mark id (e.g. "m1") to retire after you have fixed it. |
| sessionId | string | – | Target a specific tab. Omit unless you mean one — see instructions. |
| summary | string | – | One sentence: what this session proved. |
| text | string | – | Short sentence describing your next action, shown on the presenter HUD for the developer watching. |
| trace | string | – | The literal tool calls and responses that led here, so the failure can be reproduced without guessing. |
No output schema declared.
No examples provided.
reticle_tools ~211
Discover Reticle tools on demand. Call with no arguments to list every tool (name + one-line summary); call with names:["reticle_screenshot", …] to load full descriptions and parameters for specific tools. Then invoke them with reticle_run. This avoids paying for every tool definition on every turn. To make a verification REUSABLE (record once, replay free forever), the flow workflow lives here: reticle_record{action:"start"} → act → reticle_record{action:"stop"} → reticle_flow_save → reticle_verify{action:"flows"} (and reticle_verify { action: "heal" } on drift). Load those names when you want to save or re-run a flow.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | "list": the catalogue, same as no arguments. |
| name | string | – | One tool name: the same as names:[name]. |
| names | array | – | Tool names to load full params for. Omit to list all tools with summaries. |
No output schema declared.
No examples provided.
reticle_verify ~579
The Reticle Harness is { action: "explore" }: when the user asks for the Harness, or asks Reticle to drive and verify the app for you, call it and do not drive… e.g. {"action":"change","files":["src/App.tsx"]}
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Which operation to run. |
| app | boolean | – | Also fold into the app-wide ledger; returns `app.levels`. |
| apply | boolean | – | Write the rebind. |
| confirmDangerous | boolean | – | Set true to allow destructive controls during this run of the suite only. |
| driveId | string | – | The drive id an explore call answered with. |
| exhaustive | boolean | – | Walk every state it can tell apart, drive each write's failure path, fold into the coverage ledger. |
| expect | object | – | Predicate it must end in (route, net, state), asserted after. |
| files | array | – | Changed file paths, repo-relative (e.g. ["src/App.tsx"]). |
| flow | string | – | Alias for `flowName`. |
| flowName | string | – | Flow file name (without .json), from reticle_verify { action: "flows" }, which names every saved flow. |
| labels | array | – | Verify flows with ANY of these labels. |
| maxSteps | integer | – | Maximum number of controls to click. |
| names | array | – | Flow names to verify. |
| parallel | integer | – | Replay this many affected flows at once (needs the browser pool). |
| persona | string | – | The journey in plain words; "quoted text" must show at the end. |
| planId | string | – | Run a plan saved on the dashboard, as it stands. |
| runId | string | – | The run id an explore call answered with; pass it to poll that run. |
| say | string | – | With runId: a note to the running Harness. |
| scope | string | – | CSS selector or element ref to restrict crawling to a subtree. |
| secrets | object | – | Redacted fields' values, this call only, never kept: { "auth-password": "…" } |
| sessionId | string | – | Target a specific tab. Omit unless you mean one — see instructions. |
| settleMs | integer | – | Milliseconds to wait after each click for the app to react. |
| since | string | – | Git ref to diff against (e.g. "HEAD~1", "main"). |
| skipWrites | boolean | – | Certify without changing data: hold back every flow with a step that sends a write request (POST, PUT, PATCH, DELETE), and name them in `skippedWrites`. |
| stop | boolean | – | With runId: stop that Harness run. |
| wait | number | – | Seconds; default 50. |
No output schema declared.
No examples provided.
How do I install the Reticle MCP server?
Reticle runs locally as an npm package, launched with npx -y @reticlehq/server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @reticlehq/server
claude mcp add reticlehq-reticle -- npx -y @reticlehq/server
What is the Reticle MCP server?
Reticle is an MCP server listed in the public MCP registry as io.github.reticlehq/reticle. Verify a running web app from the inside over MCP: look, act, observe, assert. No screenshots. This page covers its npm package (@reticlehq/server).
Is the Reticle MCP server safe to use?
Reticle scores 74 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 25 October 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Reticle MCP server expose?
Reticle exposes 10 tools: reticle_navigate, reticle_act_and_wait, reticle_session, reticle_verify, reticle_look, and 5 more. Their descriptions and schemas cost roughly 3,772 tokens of context every time the server is loaded.
Is the Reticle MCP server still maintained?
Reticle is still listed as active in the MCP registry. We last reached this channel on 25 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Reticle MCP server under?
Reticle declares the FSL-1.1-ALv2 licence, which is not on the OSI-approved list. Read the terms before using it at work, and note this covers the source only, not the cost of any service it calls.