longpath
PYPI · LONGPATH
Read-only P6 / MS Project schedule analysis: CPM, float, DCMA 14-point, logic checks, S-curves.
Available components
Last scanned (21 hours ago)
Scores higher than 67% of PyPI servers
Category Project Management
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security50
- Malware scan not yet available for this package.Unverified
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs hatchling.build at install time, a recognised build step with no custom scripting around it. View diagnostics → Pass
- 1 of 28 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency71
- Repository check failed: the declared repository URL returned HTTP 404. See how to fix → View diagnostics → Fail
- Cryptographically verified build provenance (signed, bound to S-CurveLabs/longpath). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 41 days ago).Pass
- Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability70
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2733 tokens (~160/item across 17 items; 17 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage67
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 0% of tool parameters carry a description.Fail
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 17 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 18 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 3 Nov 26 −15
- Malware scan: pass → unverified ▼ security
- 31 Oct 26 +15
- Malware scan: unverified → pass ▲ security
- 30 Oct 26 0
- Stability: 0.97 → pass security
- 29 Oct 26 −15
- Malware scan: pass → unverified ▼ security
- Stability: pass → 0.97 functional
- 25 Oct 26 +15
- Malware scan: unverified → pass ▲ security
- 24 Oct 26 −15
- Malware scan: pass → unverified ▼ security
- 23 Oct 26 +15
- Malware scan: unverified → pass ▲ security
- Stability: 0.97 → pass security
- 22 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Nov 2026 · Analysed pypi/longpath@0.1.0
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | pypi |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | S-CurveLabs/longpath |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/S-CurveLabs/longpath/.github/workflows/release.yml@refs/tags/v0.1.0 |
| Rekor log index | 2927118813 |
| Predicate type | PyPI publish attestation https://docs.pypi.org/attestations/publish/v1 |
| Subject digest | sha256:92841e49ae692cbde75e00f55f4721fee760d8dcbada8cd86ccfe0bc96d36745 |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | hatchling.build |
Background: Why install scripts are a supply-chain risk →
Dependencies 28 packages
| Packages resolved | 28 |
|---|---|
| No linked repository | 1 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
activity_detail ~112
Everything about one activity (by activity ID, or exact name): type, status, calendar, durations, actual / early / late dates from the CPM engine next to the dates stored in the file, total and free float (computed and stored), constraints, activity codes, user fields, resource and cost assignments, and its predecessors and successors with relationship type, lag, relationship float and a driving flag.
| Name | Type | Req | Description |
|---|---|---|---|
| activity | string | yes | – |
| path | string | yes | – |
| project | string | – | – |
No output schema declared.
No examples provided.
baseline_variance ~138
Start / finish / duration variance of every activity against a baseline, in working days (positive = later than baseline), worst finish variance first, plus the project finish variance. Baseline source, in order: baseline_path (a baseline schedule file, matched on activity ID), the baseline stored in the file (MS Project Baseline 0), or P6 Planned Start/Finish (labelled as such, since it is not a true baseline).
| Name | Type | Req | Description |
|---|---|---|---|
| baseline_path | string | – | – |
| baseline_project | string | – | – |
| limit | integer | – | – |
| path | string | yes | – |
| project | string | – | – |
No output schema declared.
No examples provided.
check_setup ~63
Show the server version, which config file is in use, and whether .mpp support is available (Java + MPXJ jars, where they were found). Run this first if a .mpp file fails to open. .xer and XML files never need Java.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
compare_schedules ~199
Update-to-update comparison of two versions of a schedule (previous vs current update). Summary: both data dates and finishes, finish slip (working and calendar days), longest-path turnover; then counts and top rows for added/deleted activities and relationships, lag changes, duration changes, date changes (largest finish movement first), float changes (biggest loss first), started / finished this period, activities that were forecast to start this period but did not, actual dates edited after the fact, constraint, calendar and name changes, activities that joined or left the longest path. Pass section=<name> for one section's full list. Activities match on P6 Activity ID (MS Project: Unique ID).
| Name | Type | Req | Description |
|---|---|---|---|
| current_path | string | yes | – |
| current_project | string | – | – |
| limit | integer | – | – |
| previous_path | string | yes | – |
| previous_project | string | – | – |
| section | string | – | – |
No output schema declared.
No examples provided.
critical_path ~127
The critical path, in start order. method='longest_path' (default) traces driving relationships back from the latest finish, as P6's Longest Path does; method='total_float' lists activities whose total float is at or below the project's critical threshold (or float_threshold_days). Each row carries total float and whether it is driven by a relationship or by the data date / a constraint.
| Name | Type | Req | Description |
|---|---|---|---|
| float_threshold_days | – | – | – |
| limit | integer | – | – |
| method | string | – | – |
| path | string | yes | – |
| project | string | – | – |
No output schema declared.
No examples provided.
dcma_assessment ~231
DCMA 14-point schedule assessment with the standard thresholds: logic, leads, lags, relationship types, hard constraints, high float (>44 d), negative float, high duration (>44 d), invalid dates, resources, missed tasks, critical path test (adds 600 days to a longest-path activity and checks the finish moves), CPLI and BEI. Each check reports metric, threshold, pass/fail and example offenders. Missed tasks / BEI / CPLI need a baseline: baseline_path = a baseline schedule file, else the baseline stored in the file, else P6 planned dates (labelled). float_source = computed (this server's CPM) or stored (the file's own float). Pass check='6_high_float' (or its number, '6') for that check's full offender list.
| Name | Type | Req | Description |
|---|---|---|---|
| baseline_path | string | – | – |
| baseline_project | string | – | – |
| check | string | – | – |
| float_source | string | – | – |
| limit | integer | – | – |
| path | string | yes | – |
| project | string | – | – |
No output schema declared.
No examples provided.
driving_path ~87
Everything that drives one activity: its driving predecessors, their driving predecessors and so on, back to the activities driven only by the data date or a constraint. Use it to answer 'why is this activity (or milestone) forecast on that date?'.
| Name | Type | Req | Description |
|---|---|---|---|
| activity | string | yes | – |
| limit | integer | – | – |
| path | string | yes | – |
| project | string | – | – |
No output schema declared.
No examples provided.
export_csv ~181
Write the FULL list behind one of the list tools to a new .csv file (Excel-friendly UTF-8). `tool` is one of list_activities, list_relationships, wbs_tree, critical_path, driving_path, dcma_assessment (with check=...), logic_check (with check=...), compare_schedules (with section=...), baseline_variance, s_curve, list_resources; `arguments` are that tool's arguments (path, filters...). Never overwrites an existing file and never touches the schedule. dry_run=true (default) returns the row count, columns and first rows without writing; writing needs dry_run=false and allow_writes = true in longpath.toml.
| Name | Type | Req | Description |
|---|---|---|---|
| arguments | – | – | – |
| csv_path | string | yes | – |
| dry_run | boolean | – | – |
| tool | string | yes | – |
No output schema declared.
No examples provided.
list_activities ~305
List activities with filters; returns the match count and the top `limit` rows (id, name, WBS, type, status, durations, start/finish, computed total float in working days, constraint). Filters: wbs = WBS code or name fragment (includes everything below it); code = 'Code Type=Value' or a bare value (activity codes and user fields); status = not_started / in_progress / complete / incomplete; activity_type = task, milestone, level_of_effort, wbs_summary, resource_dependent; text = fragment of the ID or name; min/max_float_days on the CPM total float; critical_only (float <= the project's critical threshold); longest_path_only. include_stored_float adds the float saved in the file next to the computed one. sort = start, finish, float, id, duration. For all rows use export_csv(tool='list_activities', ...).
| Name | Type | Req | Description |
|---|---|---|---|
| activity_type | string | – | – |
| code | string | – | – |
| critical_only | boolean | – | – |
| include_stored_float | boolean | – | – |
| limit | integer | – | – |
| longest_path_only | boolean | – | – |
| max_float_days | – | – | – |
| min_float_days | – | – | – |
| path | string | yes | – |
| project | string | – | – |
| sort | string | – | – |
| status | string | – | – |
| text | string | – | – |
| wbs | string | – | – |
No output schema declared.
No examples provided.
list_calendars ~93
List the work calendars in a schedule file: work week (hours per weekday), hours per day, number of holiday and changed-hours exceptions, and how many activities use each. Pass `calendar` (name or id) for one calendar with its exception dates (up to `exceptions` of them).
| Name | Type | Req | Description |
|---|---|---|---|
| calendar | string | – | – |
| exceptions | integer | – | – |
| path | string | yes | – |
No output schema declared.
No examples provided.
list_relationships ~125
List relationships (predecessor -> successor, type, lag in working days of the predecessor, driving flag and relationship float from the CPM engine). Filter by an activity (either end), rel_type (FS/SS/FF/SF), lag range, or driving_only.
| Name | Type | Req | Description |
|---|---|---|---|
| activity | string | – | – |
| driving_only | boolean | – | – |
| limit | integer | – | – |
| max_lag_days | – | – | – |
| min_lag_days | – | – | – |
| path | string | yes | – |
| project | string | – | – |
| rel_type | string | – | – |
No output schema declared.
No examples provided.
list_resources ~68
Resources assigned in the project with totals: activities, budget / actual / remaining units and cost, resource type. Expenses and fixed costs are summed on their own line. Largest budget cost first.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | – |
| path | string | yes | – |
| project | string | – | – |
No output schema declared.
No examples provided.
logic_check ~155
Logic-quality sweep: loops, open starts/finishes, dangling starts/finishes, leads, excessive lags (> max_lag_days), SF links, SS/FF-only activities, hard and soft constraints, long durations, out-of-sequence progress, dates on the wrong side of the data date, zero-duration tasks, duplicate and redundant links, summary-task and external links. Returns every check's count with a few examples; pass check=<name> for that check's full list.
| Name | Type | Req | Description |
|---|---|---|---|
| check | string | – | – |
| limit | integer | – | – |
| long_duration_days | number | – | – |
| max_lag_days | number | – | – |
| path | string | yes | – |
| project | string | – | – |
No output schema declared.
No examples provided.
run_cpm ~142
Run the server's own CPM engine (forward/backward pass: FS/SS/FF/SF, lags, each activity's calendar with holidays, constraints, data date, retained logic or progress override per the file's settings) and report the computed finish, critical and longest-path counts, and a check against the float and early dates the scheduling tool saved in the file: how many total floats match, and the largest differences. Differences point at settings, calendars or stale files (a schedule not recalculated after edits) worth investigating.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | – |
| path | string | yes | – |
| project | string | – | – |
No output schema declared.
No examples provided.
s_curve ~169
S-curve / loading data by period: planned (baseline) vs actual vs forecast, per period and cumulative, for measure = cost, units (resource hours/quantities) or activities (count of finishes). period = week, month or quarter. resource = one resource's code or name for its histogram. Planned values come from baseline_path, the file's stored baseline, or P6 planned dates, spread linearly over working time. Also returns planned vs actual to the data date.
| Name | Type | Req | Description |
|---|---|---|---|
| baseline_path | string | – | – |
| baseline_project | string | – | – |
| limit | integer | – | – |
| measure | string | – | – |
| path | string | yes | – |
| period | string | – | – |
| project | string | – | – |
| resource | string | – | – |
No output schema declared.
No examples provided.
schedule_summary ~136
Open a schedule file (.xer, .mpp, MS Project .xml, P6 .xml) and summarize it: projects in the file, data date, activity/relationship/WBS/calendar/resource counts by type and status, planned start, finish (stored and as computed by the CPM engine), critical and longest-path counts, float spread, scheduling options, and warnings from reading the file. Use this first on any new file. `project` = short name or id, needed only when the file holds several projects (the error lists them).
| Name | Type | Req | Description |
|---|---|---|---|
| path | string | yes | – |
| project | string | – | – |
No output schema declared.
No examples provided.
wbs_tree ~85
The WBS hierarchy down to `max_depth` levels, each node with its activity count (including everything below it), how many are incomplete, the earliest start, latest finish and lowest total float (working days) under it.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | – |
| max_depth | integer | – | – |
| path | string | yes | – |
| project | string | – | – |
No output schema declared.
No examples provided.
How do I install the longpath MCP server?
longpath runs locally as a PyPI package, launched with uvx longpath. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · longpath
claude mcp add s-curvelabs-longpath -- uvx longpath
What is the longpath MCP server?
longpath is an MCP server listed in the public MCP registry as io.github.S-CurveLabs/longpath. Read-only P6 / MS Project schedule analysis: CPM, float, DCMA 14-point, logic checks, S-curves. This page covers its PyPI package (longpath).
Is the longpath MCP server safe to use?
longpath scores 71 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 4 November 2026. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the longpath MCP server expose?
longpath exposes 17 tools: check_setup, schedule_summary, list_calendars, list_activities, wbs_tree, and 12 more. Their descriptions and schemas cost roughly 2,416 tokens of context every time the server is loaded.
Is the longpath MCP server still maintained?
longpath is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the longpath MCP server under?
longpath declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.