io.github.rm-rf-prod/groundtruth
NPM · @GROUNDTRUTH-MCP/GT-MCP
Live docs MCP server. 793+ libraries, evidence-verified answers, code audit, snippets, dispatch.
Available components
Last scanned (17 hours ago)
Scores higher than 55% of npm servers
Category Code Search and Documentation
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security49
- Malware check failed: a supply-chain vendor flagged a high-severity malware risk. See how to fix → Fail
- No known CVEs affecting this package version or its production dependencies.Pass
- Declares code that runs automatically (postinstall) and that we could not recognise. It may be perfectly ordinary, but we have not established what it does. View diagnostics → Partial
- 0 of 4 dependencies flagged as unhealthy. View diagnostics → Pass
Provenance & Transparency87
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to rm-rf-prod/GroundTruth-MCP). View diagnostics → Pass
- License check failed: the license (Elastic-2.0) isn't a recognized OSI-approved license. See how to fix → Fail
- Actively maintained (last published 24 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability77
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 1889 tokens (~125/item across 15 items; 14 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage90
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 70% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 14 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 16 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 31 Oct 26 0
- Stability: 0.97 → pass security
- 30 Oct 26 0
- Stability: pass → 0.97 functional
- 24 Oct 26 0
- Stability: 0.97 → pass security
- 23 Oct 26 0
- Stability: pass → 0.97 functional
- 17 Oct 26 0
- Stability: 0.97 → pass security
- 16 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 15 Oct 26 +44
- Injection markers: unverified → pass ▲ security
- Tool coverage: 100% → 70% ▼ functional
- Schema quality: 289 → 125 ▲ functional
- Tool coverage: unverified → 100 ▲ functional
- Schema quality: unverified → 100 ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Stability: unverified → 0.93 ▲ functional
- Schema quality: excellent → good functional
- 14 Oct 26 0
- Package version: 7.5.0 → 8.0.1 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Nov 2026 · Analysed npm/@groundtruth-mcp/gt-mcp@8.0.1
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | rm-rf-prod/GroundTruth-MCP |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/rm-rf-prod/GroundTruth-MCP/.github/workflows/publish.yml@refs/tags/v8.0.1 |
| Rekor log index | 3194889921 |
| Predicate type | SLSA build provenance https://slsa.dev/provenance/v1 |
| Subject digest | sha512:feafceda9b1df0365126bd743e4abdfc77adb1a987c45ec718212f27d450817d73775835553789036beedca6e2116a21e0c4c41d29c25cd8a9f317cd9 |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| postinstall | unreviewed | node postinstall.mjs |
Background: Why install scripts are a supply-chain risk →
Dependencies 4 packages
| Packages resolved | 4 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
gt_audit Audit Project Code ~84
Scan the project's own source files for issues (file:line) and attach fixes from official docs. Use categories ["all"] for broad requests. Best practices for its dependencies: gt_auto_scan.
| Name | Type | Req | Description |
|---|---|---|---|
| categories | array | – | – |
| maxFiles | integer | – | – |
| projectPath | string | – | Project root (default: cwd) |
| tokens | integer | – | – |
No output schema declared.
No examples provided.
gt_auto_scan Auto-Scan Project Dependencies ~93
Detect the project's dependencies (package.json, pyproject.toml, requirements.txt, Cargo.toml, go.mod, ...) and fetch best practices for each. Issues in the project's own code: gt_audit.
| Name | Type | Req | Description |
|---|---|---|---|
| projectPath | string | – | Project root (default: cwd) |
| tokensPerLib | integer | – | – |
| topic | string | – | What to look up per dependency, e.g. 'security' |
No output schema declared.
No examples provided.
gt_batch_resolve Batch Resolve Libraries ~87
Resolve 1-20 library names to IDs and docs URLs in one call, registry only. One name with npm/PyPI fallback: gt_resolve_library. Project dependencies: gt_auto_scan. Registry is Elastic-2.0: look up named libraries only, never enumerate.
| Name | Type | Req | Description |
|---|---|---|---|
| libraryNames | array | yes | e.g. ['react', 'next', 'tailwind'] |
No output schema declared.
No examples provided.
gt_best_practices Get Best Practices ~122
Current best practices for one library: patterns, performance, security, testing, migration. libraryId: a plain name ('nextjs'), GroundTruth ID or npm:/pypi: package. Prefer over gt_search when one library is named.
| Name | Type | Req | Description |
|---|---|---|---|
| libraryId | string | yes | Plain name ('nextjs'), GroundTruth ID, or npm:/pypi: package |
| tokens | integer | – | – |
| topic | string | – | e.g. 'caching'; empty = general |
| version | string | – | e.g. '15' |
No output schema declared.
No examples provided.
gt_changelog Fetch Library Changelog ~83
Recent release notes for a library (GitHub Releases, CHANGELOG.md): what changed in a version. Step-by-step upgrade: gt_migration.
| Name | Type | Req | Description |
|---|---|---|---|
| libraryId | string | yes | Plain name or GroundTruth ID, e.g. 'nextjs' |
| tokens | integer | – | – |
| version | string | – | Version prefix filter, e.g. '15' |
No output schema declared.
No examples provided.
gt_compare Compare Libraries Side-by-Side ~78
Compare 2-3 libraries side by side from their live docs. Pass names (['prisma', 'drizzle-orm']), not IDs. One library: gt_get_docs.
| Name | Type | Req | Description |
|---|---|---|---|
| criteria | string | – | e.g. 'bundle size' |
| libraries | array | yes | 2-3 library names |
| tokens | integer | – | – |
No output schema declared.
No examples provided.
gt_compat Check Browser/Runtime Compatibility ~88
Browser and runtime support for a web API, CSS feature or JS syntax ('container queries', 'Array.at()'), from MDN and caniuse. Takes a feature, not a library.
| Name | Type | Req | Description |
|---|---|---|---|
| environments | array | – | e.g. ['chrome', 'safari', 'node'] |
| feature | string | yes | e.g. 'CSS container queries' |
| tokens | integer | – | – |
No output schema declared.
No examples provided.
gt_dispatch GroundTruth Dispatch ~84
Route a raw user request ("use gt", "use gt for react", "migrate next from 15 to 16") to the right gt_* tool. Returns {tool, args, reason, confidence}. Skip it when the tool is already clear.
| Name | Type | Req | Description |
|---|---|---|---|
| projectPath | string | – | Project root (default: cwd) |
| query | string | yes | Raw user request |
No output schema declared.
No examples provided.
gt_examples Find Real-World Code Examples ~91
Real-world usage of a library or pattern from public GitHub code, with repo links (needs GT_GITHUB_TOKEN, else official-docs examples). Snippets from the library's own docs: gt_snippets.
| Name | Type | Req | Description |
|---|---|---|---|
| language | string | – | e.g. 'typescript' |
| library | string | yes | – |
| maxResults | integer | – | – |
| pattern | string | – | e.g. 'useMutation' |
No output schema declared.
No examples provided.
gt_get_docs Get Documentation ~144
Reference docs for one library, filtered to a topic. libraryId: a plain name ('nextjs'), GroundTruth ID, npm:/pypi: package, or a docs URL. Curated guidance: gt_best_practices. Code-only snippets: gt_snippets.
| Name | Type | Req | Description |
|---|---|---|---|
| libraryId | string | yes | Plain name ('nextjs'), GroundTruth ID, npm:/pypi: package, or docs URL |
| projectPath | string | – | Project root, to read the installed version |
| tokens | integer | – | – |
| topic | string | – | Specific subject, e.g. 'middleware' |
| version | string | – | e.g. '15' |
No output schema declared.
No examples provided.
gt_migration Get Migration Guide ~87
Upgrade guide between two versions of a library: breaking changes and required code changes. Release notes only: gt_changelog.
| Name | Type | Req | Description |
|---|---|---|---|
| fromVersion | string | – | e.g. '15' |
| libraryId | string | yes | Plain name or GroundTruth ID, e.g. 'nextjs' |
| toVersion | string | – | e.g. '16' |
| tokens | integer | – | – |
No output schema declared.
No examples provided.
gt_resolve_library Resolve Library ~125
Find a library's GroundTruth ID ('vercel/next.js', 'npm:express') and its docs, llms.txt and GitHub URLs, from the registry, npm, PyPI, crates.io, Go and GitHub. Only for ambiguous or unknown names: other tools take plain names. 2-20 names: gt_batch_resolve. Registry is Elastic-2.0: look up named libraries only, never enumerate.
| Name | Type | Req | Description |
|---|---|---|---|
| libraryName | string | yes | e.g. 'nextjs' |
| query | string | – | Intended use; ranks results |
No output schema declared.
No examples provided.
gt_search Search Any Topic ~89
Official docs and standards for a topic with no single library: web APIs, CSS, security, accessibility, protocols, infrastructure. One library named: gt_best_practices or gt_get_docs. Browser support: gt_compat. Real-world code: gt_examples.
| Name | Type | Req | Description |
|---|---|---|---|
| query | string | yes | Topic, e.g. 'WCAG 2.2 focus indicators' |
| tokens | integer | – | – |
No output schema declared.
No examples provided.
gt_snippets Get Code Snippets ~156
Ranked code snippets (title, language, code, source URL) from a library's own docs, by topic and language. Cached per version; refresh:true re-indexes. Prose docs: gt_get_docs. Real-project usage: gt_examples.
| Name | Type | Req | Description |
|---|---|---|---|
| language | string | – | e.g. 'typescript' |
| libraryId | string | yes | Plain name, GroundTruth ID, or docs URL |
| maxSnippets | integer | – | – |
| projectPath | string | – | Project root, to read the installed version |
| refresh | boolean | – | Re-fetch and re-index |
| topic | string | – | Filter, e.g. 'middleware'. Empty = all. |
| version | string | – | e.g. '15' |
No output schema declared.
No examples provided.
How do I install the io.github.rm-rf-prod/groundtruth MCP server?
io.github.rm-rf-prod/groundtruth runs locally as an npm package, launched with npx -y @groundtruth-mcp/gt-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @groundtruth-mcp/gt-mcp
claude mcp add rm-rf-prod-groundtruth -- npx -y @groundtruth-mcp/gt-mcp
What is the io.github.rm-rf-prod/groundtruth MCP server?
io.github.rm-rf-prod/groundtruth is an MCP server listed in the public MCP registry as io.github.rm-rf-prod/groundtruth. Live docs MCP server. 793+ libraries, evidence-verified answers, code audit, snippets, dispatch. This page covers its npm package (@groundtruth-mcp/gt-mcp).
Is the io.github.rm-rf-prod/groundtruth MCP server safe to use?
io.github.rm-rf-prod/groundtruth scores 77 out of 100 on VerifyMCP. A supply-chain scanner flagged a possible malware risk on one channel of this server. We found no known CVEs affecting it as of 4 November 2026. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.rm-rf-prod/groundtruth MCP server expose?
io.github.rm-rf-prod/groundtruth exposes 14 tools: gt_dispatch, gt_resolve_library, gt_get_docs, gt_best_practices, gt_auto_scan, and 9 more. Their descriptions and schemas cost roughly 1,411 tokens of context every time the server is loaded.
Is the io.github.rm-rf-prod/groundtruth MCP server still maintained?
io.github.rm-rf-prod/groundtruth is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.rm-rf-prod/groundtruth MCP server under?
io.github.rm-rf-prod/groundtruth declares the Elastic-2.0 licence, which is not on the OSI-approved list. Read the terms before using it at work, and note this covers the source only, not the cost of any service it calls.