# longpath (pypi · longpath)

Read-only P6 / MS Project schedule analysis: CPM, float, DCMA 14-point, logic checks, S-curves.

- Trust score: 71/100 (medium)
- Change this week: −15
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-04

## Components

- pypi · `longpath`: 71/100 (this document), [markdown](https://verifymcp.io/servers/s-curvelabs-longpath/longpath.md), [page](https://verifymcp.io/servers/s-curvelabs-longpath/longpath)

## Channel facts

- Registry: `pypi`
- Package: `longpath`
- Version: `0.1.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-04.

- **Supply Chain Security**: 50/100
  - Malware scan not yet available for this package.
  - No known CVEs affecting this package version or its production dependencies.
  - Runs hatchling.build at install time, a recognised build step with no custom scripting around it.
  - 1 of 28 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 71/100
  - Repository check failed: the declared repository URL returned HTTP 404.
  - Cryptographically verified build provenance (signed, bound to S-CurveLabs/longpath).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 41 days ago).
  - Security-disclosure policy not yet verified: we couldn't inspect the source repository.
- **Schema Quality & AI Usability**: 70/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 2733 tokens (~160/item across 17 items; 17 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 100/100
  - No destabilizing schema changes in the last 30 days.
- **Tool Coverage**: 67/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 0% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 17 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 18 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

## Install

### How do I install the longpath MCP server?

longpath runs locally as a PyPI package, launched with uvx longpath. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add s-curvelabs-longpath -- uvx longpath
```

### Cursor

```json
{
  "mcpServers": {
    "s-curvelabs-longpath": {
      "command": "uvx",
      "args": [
        "longpath"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "s-curvelabs-longpath": {
      "command": "uvx",
      "args": [
        "longpath"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add s-curvelabs-longpath -- uvx longpath
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "s-curvelabs-longpath": {
      "type": "local",
      "command": [
        "uvx",
        "longpath"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add s-curvelabs-longpath --command uvx --arg longpath
```

### Hermes

```yaml
mcp_servers:
  s-curvelabs-longpath:
    command: "uvx"
    args: ["longpath"]
```

### Netclaw

```json
{
  "McpServers": {
    "s-curvelabs-longpath": {
      "Transport": "stdio",
      "Command": "uvx",
      "Arguments": [
        "longpath"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add s-curvelabs-longpath -t stdio -c uvx -a longpath
```

### Other

```json
{
  "mcpServers": {
    "s-curvelabs-longpath": {
      "command": "uvx",
      "args": [
        "longpath"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-03 (score 71, −15)

- [security regression] Malware scan: pass → unverified

### 2026-10-31 (score 86, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-10-30 (score 71, 0)

- [security] Stability: 0.97 → pass

### 2026-10-29 (score 71, −15)

- [security regression] Malware scan: pass → unverified
- [functional] Stability: pass → 0.97

### 2026-10-25 (score 86, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-10-24 (score 71, −15)

- [security regression] Malware scan: pass → unverified

### 2026-10-23 (score 86, +15)

- [security improvement] Malware scan: unverified → pass
- [security] Stability: 0.97 → pass

### 2026-10-22 (score 71, +1)

No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.

## MCP tools (17)

### `check_setup` (~63 tokens)

Show the server version, which config file is in use, and whether .mpp support is available (Java + MPXJ jars,
where they were found). Run this first if a .mpp file fails to open. .xer and XML files never need Java.

### `schedule_summary` (~136 tokens)

Open a schedule file (.xer, .mpp, MS Project .xml, P6 .xml) and summarize it: projects in the file, data date,
activity/relationship/WBS/calendar/resource counts by type and status, planned start, finish (stored and as
computed by the CPM engine), critical and longest-path counts, float spread, scheduling options, and warnings from
reading the file. Use this first on any new file. `project` = short name or id, needed only when the file holds
several projects (the error lists them).

Input parameters:

- `path` (string, required)
- `project` (string)

### `list_calendars` (~93 tokens)

List the work calendars in a schedule file: work week (hours per weekday), hours per day, number of holiday and
changed-hours exceptions, and how many activities use each. Pass `calendar` (name or id) for one calendar with its
exception dates (up to `exceptions` of them).

Input parameters:

- `calendar` (string)
- `exceptions` (integer)
- `path` (string, required)

### `list_activities` (~305 tokens)

List activities with filters; returns the match count and the top `limit` rows (id, name, WBS, type, status,
durations, start/finish, computed total float in working days, constraint).
Filters: wbs = WBS code or name fragment (includes everything below it); code = 'Code Type=Value' or a bare value
(activity codes and user fields); status = not_started / in_progress / complete / incomplete; activity_type = task,
milestone, level_of_effort, wbs_summary, resource_dependent; text = fragment of the ID or name; min/max_float_days on
the CPM total float; critical_only (float <= the project's critical threshold); longest_path_only.
include_stored_float adds the float saved in the file next to the computed one. sort = start, finish, float, id,
duration. For all rows use export_csv(tool='list_activities', ...).

Input parameters:

- `activity_type` (string)
- `code` (string)
- `critical_only` (boolean)
- `include_stored_float` (boolean)
- `limit` (integer)
- `longest_path_only` (boolean)
- `max_float_days`
- `min_float_days`
- `path` (string, required)
- `project` (string)
- `sort` (string)
- `status` (string)
- `text` (string)
- `wbs` (string)

### `wbs_tree` (~85 tokens)

The WBS hierarchy down to `max_depth` levels, each node with its activity count (including everything below
it), how many are incomplete, the earliest start, latest finish and lowest total float (working days) under it.

Input parameters:

- `limit` (integer)
- `max_depth` (integer)
- `path` (string, required)
- `project` (string)

### `activity_detail` (~112 tokens)

Everything about one activity (by activity ID, or exact name): type, status, calendar, durations, actual /
early / late dates from the CPM engine next to the dates stored in the file, total and free float (computed and
stored), constraints, activity codes, user fields, resource and cost assignments, and its predecessors and
successors with relationship type, lag, relationship float and a driving flag.

Input parameters:

- `activity` (string, required)
- `path` (string, required)
- `project` (string)

### `list_relationships` (~125 tokens)

List relationships (predecessor -> successor, type, lag in working days of the predecessor, driving flag and
relationship float from the CPM engine). Filter by an activity (either end), rel_type (FS/SS/FF/SF),
lag range, or driving_only.

Input parameters:

- `activity` (string)
- `driving_only` (boolean)
- `limit` (integer)
- `max_lag_days`
- `min_lag_days`
- `path` (string, required)
- `project` (string)
- `rel_type` (string)

### `run_cpm` (~142 tokens)

Run the server's own CPM engine (forward/backward pass: FS/SS/FF/SF, lags, each activity's calendar with holidays,
constraints, data date, retained logic or progress override per the file's settings) and report the computed
finish, critical and longest-path counts, and a check against the float and early dates the scheduling tool saved in
the file: how many total floats match, and the largest differences. Differences point at settings, calendars or
stale files (a schedule not recalculated after edits) worth investigating.

Input parameters:

- `limit` (integer)
- `path` (string, required)
- `project` (string)

### `critical_path` (~127 tokens)

The critical path, in start order. method='longest_path' (default) traces driving relationships back from the
latest finish, as P6's Longest Path does; method='total_float' lists activities whose total float is at or below
the project's critical threshold (or float_threshold_days). Each row carries total float and whether it is driven
by a relationship or by the data date / a constraint.

Input parameters:

- `float_threshold_days`
- `limit` (integer)
- `method` (string)
- `path` (string, required)
- `project` (string)

### `driving_path` (~87 tokens)

Everything that drives one activity: its driving predecessors, their driving predecessors and so on, back to the
activities driven only by the data date or a constraint. Use it to answer 'why is this activity (or milestone)
forecast on that date?'.

Input parameters:

- `activity` (string, required)
- `limit` (integer)
- `path` (string, required)
- `project` (string)

### `dcma_assessment` (~231 tokens)

DCMA 14-point schedule assessment with the standard thresholds: logic, leads, lags, relationship types, hard
constraints, high float (>44 d), negative float, high duration (>44 d), invalid dates, resources, missed tasks,
critical path test (adds 600 days to a longest-path activity and checks the finish moves), CPLI and BEI.
Each check reports metric, threshold, pass/fail and example offenders. Missed tasks / BEI / CPLI need a baseline:
baseline_path = a baseline schedule file, else the baseline stored in the file, else P6 planned dates (labelled).
float_source = computed (this server's CPM) or stored (the file's own float). Pass check='6_high_float' (or its
number, '6') for that check's full offender list.

Input parameters:

- `baseline_path` (string)
- `baseline_project` (string)
- `check` (string)
- `float_source` (string)
- `limit` (integer)
- `path` (string, required)
- `project` (string)

### `logic_check` (~155 tokens)

Logic-quality sweep: loops, open starts/finishes, dangling starts/finishes, leads, excessive lags (> max_lag_days),
SF links, SS/FF-only activities, hard and soft constraints, long durations, out-of-sequence progress, dates on the
wrong side of the data date, zero-duration tasks, duplicate and redundant links, summary-task and external links.
Returns every check's count with a few examples; pass check=<name> for that check's full list.

Input parameters:

- `check` (string)
- `limit` (integer)
- `long_duration_days` (number)
- `max_lag_days` (number)
- `path` (string, required)
- `project` (string)

### `compare_schedules` (~199 tokens)

Update-to-update comparison of two versions of a schedule (previous vs current update). Summary: both data
dates and finishes, finish slip (working and calendar days), longest-path turnover; then counts and top rows for
added/deleted activities and relationships, lag changes, duration changes, date changes (largest finish movement
first), float changes (biggest loss first), started / finished this period, activities that were forecast to start
this period but did not, actual dates edited after the fact, constraint, calendar and name changes, activities that
joined or left the longest path. Pass section=<name> for one section's full list. Activities match on P6 Activity ID
(MS Project: Unique ID).

Input parameters:

- `current_path` (string, required)
- `current_project` (string)
- `limit` (integer)
- `previous_path` (string, required)
- `previous_project` (string)
- `section` (string)

### `baseline_variance` (~138 tokens)

Start / finish / duration variance of every activity against a baseline, in working days (positive = later than
baseline), worst finish variance first, plus the project finish variance. Baseline source, in order: baseline_path
(a baseline schedule file, matched on activity ID), the baseline stored in the file (MS Project Baseline 0), or P6
Planned Start/Finish (labelled as such, since it is not a true baseline).

Input parameters:

- `baseline_path` (string)
- `baseline_project` (string)
- `limit` (integer)
- `path` (string, required)
- `project` (string)

### `s_curve` (~169 tokens)

S-curve / loading data by period: planned (baseline) vs actual vs forecast, per period and cumulative, for
measure = cost, units (resource hours/quantities) or activities (count of finishes). period = week, month or
quarter. resource = one resource's code or name for its histogram. Planned values come from baseline_path, the
file's stored baseline, or P6 planned dates, spread linearly over working time. Also returns planned vs actual to
the data date.

Input parameters:

- `baseline_path` (string)
- `baseline_project` (string)
- `limit` (integer)
- `measure` (string)
- `path` (string, required)
- `period` (string)
- `project` (string)
- `resource` (string)

### `list_resources` (~68 tokens)

Resources assigned in the project with totals: activities, budget / actual / remaining units and cost, resource
type. Expenses and fixed costs are summed on their own line. Largest budget cost first.

Input parameters:

- `limit` (integer)
- `path` (string, required)
- `project` (string)

### `export_csv` (~181 tokens)

Write the FULL list behind one of the list tools to a new .csv file (Excel-friendly UTF-8). `tool` is one of
list_activities, list_relationships, wbs_tree, critical_path, driving_path, dcma_assessment (with check=...),
logic_check (with check=...), compare_schedules (with section=...), baseline_variance, s_curve, list_resources;
\`arguments` are that tool's arguments (path, filters...). Never overwrites an existing file and never touches the
schedule. dry_run=true (default) returns the row count, columns and first rows without writing; writing needs
dry_run=false and allow_writes = true in longpath.toml.

Input parameters:

- `arguments`
- `csv_path` (string, required)
- `dry_run` (boolean)
- `tool` (string, required)

## Diagnostics

Captured diagnostic sections: Provenance, Install scripts, Dependencies. The full working is on the page: https://verifymcp.io/servers/s-curvelabs-longpath/longpath#diagnostics

## Score history

- 2026-11-04: 71
- 2026-11-03: 71
- 2026-11-02: 86
- 2026-11-01: 86
- 2026-10-31: 86
- 2026-10-30: 71
- 2026-10-29: 71
- 2026-10-28: 86
- 2026-10-27: 86
- 2026-10-26: 86
- 2026-10-25: 86
- 2026-10-24: 71
- 2026-10-23: 86
- 2026-10-22: 71
- 2026-10-21: 70
- 2026-10-20: 70
- 2026-10-19: 69
- 2026-10-18: 84
- 2026-10-17: 68
- 2026-10-16: 68
- 2026-10-15: 67
- 2026-10-14: 67
- 2026-10-13: 67
- 2026-10-12: 81
- 2026-10-04: 68
- 2026-10-03: 67
- 2026-10-02: 67
- 2026-10-01: 66
- 2026-09-30: 62
- 2026-09-29: 62

## Common questions

### What is the longpath MCP server?

longpath is an MCP server listed in the public MCP registry as io.github.S-CurveLabs/longpath. Read-only P6 / MS Project schedule analysis: CPM, float, DCMA 14-point, logic checks, S-curves. This page covers its PyPI package (longpath).

### Is the longpath MCP server safe to use?

longpath scores 71 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 4 November 2026. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the longpath MCP server expose?

longpath exposes 17 tools: check_setup, schedule_summary, list_calendars, list_activities, wbs_tree, and 12 more. Their descriptions and schemas cost roughly 2,416 tokens of context every time the server is loaded.

### Is the longpath MCP server still maintained?

longpath is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the longpath MCP server under?

longpath declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- PyPI project: https://pypi.org/project/longpath/
- Socket report: https://socket.dev/pypi/package/longpath
- Changelog RSS feed: https://verifymcp.io/servers/s-curvelabs-longpath/longpath.xml
- Changelog JSON feed: https://verifymcp.io/servers/s-curvelabs-longpath/longpath.json
- HTML version of this page: https://verifymcp.io/servers/s-curvelabs-longpath/longpath