io.github.sapiom/mcp

NPM · @SAPIOM/MCP · SCANNED AUG 3

Sapiom MCP server — authentication, verification, and API tools

Available components

+35 this week 78 78 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security88

No malware found by supply-chain analysis.Pass
Only part of the dependency tree could be resolved (128 of 132), so this covers what we could see, not the whole tree.Partial
No install/post-install scripts declared.Pass
Only part of the dependency tree could be resolved (128 of 132), so this covers what we could see, not the whole tree. View diagnostics → Partial

Provenance & Transparency97

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Cryptographically verified build provenance (signed, bound to sapiom/sapiom-js). View diagnostics → Pass
Clear OSI-approved license (MIT).Pass
Actively maintained (last published 20 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability67

AI-judged instruction clarity (excellent).Pass
Context-footprint check failed: tool/resource definitions use about 2721 tokens (~181/item across 15 items; 15 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management23

Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial

Tool Coverage100

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
100% of tool parameters carry a description.Pass

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · @sapiom/mcp

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add sapiom-mcp -- npx -y @sapiom/mcp

# add to Codex CLI

codex mcp add sapiom-mcp -- npx -y @sapiom/mcp

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "sapiom-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@sapiom/mcp"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add sapiom-mcp --command npx --arg -y --arg @sapiom/mcp

# ~/.hermes/config.yaml

mcp_servers:
  sapiom-mcp:
    command: "npx"
    args: ["-y", "@sapiom/mcp"]

// mcp.json

{
  "mcpServers": {
    "sapiom-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@sapiom/mcp"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

3 Aug 26 +1

No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.
2 Aug 26 +72
- Provenance: unverified → pass ▲ security
- Install scripts: unverified → pass ▲ security
- Known CVEs: unverified → partial ▲ security
- Malware scan: unverified → pass ▲ security
- The attested source repository moved: sapiom/sapiom-js security
- Security disclosure: fail → unverified ▼ functional
- Schema quality: unverified → excellent ▲ functional
- License: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- Stability: unverified → 0.20 ▲ functional
- Maintenance: unverified → pass ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Tool coverage: unverified → 100 ▲ functional
- Licence: MIT functional
1 Aug 26 −14
- Tool coverage: 100 → unverified ▼ functional
- First check of Schema quality: unverified functional
31 Jul 26 −6
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
30 Jul 26 −18
- Malware scan: pass → unverified ▼ security
27 Jul 26 43

First indexed and scored.

Show 3 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/@sapiom/[email protected]

Provenance verified

Ecosystem: npm · Outcome: verified

Reason: verified

Source repo:: sapiom/sapiom-js
Certificate issuer:: https://token.actions.githubusercontent.com
Certificate SAN:: https://github.com/sapiom/sapiom-js/.github/workflows/publish.yml@refs/heads/main
Rekor log index:: 2039061748
Predicate type:: https://slsa.dev/provenance/v1
Subject digest:: sha512:3945cf272788e147738b686d44f191adaebbe856729379a03efc559611c491211b5ee60b9708bdba1902c09a6821fa5e55825b481e51549c11aded264
Discovery method:: attestation_endpoint

Dependencies 128 packages

128 packages in the resolved dependency tree · 124 deprecated · 29 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 15 exposed · ~1,918 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

sapiom_authenticate ~36

Authenticate with Sapiom by opening a browser login flow. Run this when other Sapiom tools report that authentication is required.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

sapiom_dev_orchestrations_check ~79

Validate an orchestration locally: bundle index.ts, derive the manifest, and check the step graph. Offline and instant. Returns the orchestration name, step count, the manifest (which contains the full step graph for visualization), and any graph warnings.

Input Output Examples

Name	Type	Req	Description
dir	string	—	Project directory (defaults to the current working directory).

No output schema declared.

No examples provided.

sapiom_dev_orchestrations_cron_preview ~112

Validate a cron expression and preview its next occurrences, creating nothing. Use before sapiom_dev_orchestrations_schedule to confirm a cron + timezone fire when you expect (cron syntax is easy to get subtly wrong).

Input Output Examples

Name	Type	Req	Description
count	number	—	How many upcoming occurrences to return (default 5).
cron	string	yes	Cron expression to validate, e.g. '0 9 * * 1-5'.
timezone	string	—	IANA timezone (default UTC).

No output schema declared.

No examples provided.

sapiom_dev_orchestrations_deploy ~89

Deploy the linked orchestration: push the current git commit, trigger a build, and wait for it to finish. The project must be linked (sapiom.json) and a git repo with at least one commit.

Input Output Examples

Name	Type	Req	Description
branch	string	—	Branch to push to (default 'main').
dir	string	—	Project directory (defaults to the current working directory).

No output schema declared.

No examples provided.

sapiom_dev_orchestrations_inspect ~261

Inspect a cloud execution (its steps and errors) by executionId, a build by buildRunId, or list recent executions when neither is given. On a failed step, pull its input here to reproduce the failure locally with run_local. Reads are a fresh point-in-time snapshot. To wait for a still-running execution to finish, set wait:true (the tool polls until it settles or the wait window elapses) — do NOT sleep-and-poll this tool yourself. If a wait returns waiting:true, just call inspect again with wait:true.

Input Output Examples

Name	Type	Req	Description
buildRunId	string	—	Build to inspect (requires a linked project).
dir	string	—	Project directory (for build inspection, which needs the linked id).
executionId	string	—	Execution to inspect.
maxWaitSeconds	number	—	Max seconds to wait when wait:true (default 45, capped at 55). On timeout it returns the latest snapshot with waiting:true — call again to keep waiting.
wait	boolean	—	When inspecting an executionId, block until it reaches a terminal state (or settles on a pause needing a signal) instead of returning the current snapshot. Lets the tool own the polling so you don't…

No output schema declared.

No examples provided.

sapiom_dev_orchestrations_link ~107

Resolve a hosted orchestration by name (or create it with create:true) and cache its id in the project's sapiom.json. Run this before deploy.

Input Output Examples

Name	Type	Req	Description
create	boolean	—	Create the orchestration if it does not exist.
dir	string	—	Project directory (defaults to the current working directory).
name	string	—	Orchestration name (matches defineOrchestration({ name })). Defaults to the orchestration's name read from index.ts.

No output schema declared.

No examples provided.

sapiom_dev_orchestrations_run ~70

Start a real (cloud) execution of the linked orchestration. Use sapiom_dev_orchestrations_inspect to follow it.

Input Output Examples

Name	Type	Req	Description
dir	string	—	Project directory (defaults to the current working directory).
input	—	—	The workflow's entry-step input (any JSON value).

No output schema declared.

No examples provided.

sapiom_dev_orchestrations_run_local ~392

Execute an orchestration entirely on the local machine, running the author's actual step code with every ctx.sapiom.* capability call resolved from stubs (no real capability calls, no cost, instant). Returns { outcome, output, steps[], unusedStubs[], stubWarnings[] }. outcome is 'completed' | 'failed' | 'paused' | 'running'. A paused dispatch (e.g. agent.coding.launch) is auto-resumed locally with its stub result, so the happy path runs end-to-end. Returns `unusedStubs` (supplied stub keys that matched no call — a typo or wrong path form) and `stubWarnings` (a stub key matched but its value was the wrong shape for the capability). Check both: a green run with a non-empty unusedStubs/stubWarnings usually means your stub didn't take effect. Stub shape: { version: 1, steps: { <stepName>: { <methodPath>: <response> } } }. The response is the value that call returns verbatim — e.g. `repositories.list` takes the array list() should return ([{ slug, cloneUrl }]), not a wrapped/sequence form. For a dispatched run, stub `agent.coding.run` (or `agent.coding.launch`) in the step that launches it; that value becomes both the run result and the payload the paused step resumes with — set status:'failed' there to exercise the failure branch.

Input Output Examples

Name	Type	Req	Description
dir	string	—	Project directory (defaults to the current working directory).
input	—	—	The workflow's entry-step input (any JSON value).
maxAttemptsPerStep	integer	—	Retry cap per step (default 3).
stubs	—	—	Stub file object: { version, steps: { <step>: { <method.path>: <response> \| [<response>] } } }.

No output schema declared.

No examples provided.

sapiom_dev_orchestrations_scaffold ~138

Scaffold a new Sapiom orchestration project into <dir>. Produces an npm-install-ready TypeScript project with a starter orchestration in index.ts. After scaffolding, the author writes step definitions and uses sapiom_dev_orchestrations_run_local to test them.

Input Output Examples

Name	Type	Req	Description
dir	string	yes	Target directory for the new project (created if absent; must be empty).
template	string	—	Template name. 'default' (a minimal two-step starter) or 'coding-pause' (the launch + pauseUntilSignal + resume pattern for a non-blocking coding-agent run). Defaults to 'default'.

No output schema declared.

No examples provided.

sapiom_dev_orchestrations_schedule ~307

Create a schedule for a deployed orchestration: a recurring cron schedule (kind 'schedule_cron' + cron + timezone) or a one-off delayed run (kind 'schedule_once' + at). Returns the schedule with its next fire time. Tip: validate a cron with sapiom_dev_orchestrations_cron_preview first.

Input Output Examples

Name	Type	Req	Description
at	string	—	ISO 8601 fire time — required for 'schedule_once'. E.g. '2026-07-01T17:00:00Z'.
cron	string	—	Cron expression — required for 'schedule_cron'. E.g. '0 9 * * 1-5' = 9am on weekdays.
definition	string	yes	The orchestration's tenant-unique slug (the handle it was deployed under).
endAt	string	—	Cron only: ISO time after which the schedule completes.
input	—	—	Execution input passed to each run (any JSON value).
kind	string	yes	'schedule_cron' = recurring; 'schedule_once' = a single delayed run.
policy	—	—	Cron only: { catchupPolicy?: 'skip'\|'all', overlapPolicy?: 'allow', jitterMs?: number }.
startAt	string	—	Cron only: ISO time before which no occurrence fires.
timezone	string	—	IANA timezone the cron runs in (e.g. 'America/New_York'). Defaults to UTC.

No output schema declared.

No examples provided.

sapiom_dev_orchestrations_schedule_cancel ~60

Cancel a schedule by id. Stops all future fires (a recurring schedule won't re-arm; a pending one-off won't run). Irreversible — recreate to reschedule.

Input Output Examples

Name	Type	Req	Description
scheduleId	string	yes	The schedule to cancel.

No output schema declared.

No examples provided.

sapiom_dev_orchestrations_schedule_inspect ~144

Inspect schedules. With scheduleId: returns one schedule's config, next fire time, and recent fire history (each with the run's executionId) — use this to debug a misbehaving schedule, then inspect a failed run's executionId with sapiom_dev_orchestrations_inspect. With definition (slug) and no scheduleId: lists that orchestration's schedules.

Input Output Examples

Name	Type	Req	Description
definition	string	—	List schedules for this orchestration slug (used when scheduleId is omitted).
scheduleId	string	—	Inspect one schedule (detail + recent fires + a health hint).
status	string	—	Filter the list by status.

No output schema declared.

No examples provided.

sapiom_dev_orchestrations_signal ~75

Resume a paused cloud execution by delivering a named signal (matched by name + correlationId).

Input Output Examples

Name	Type	Req	Description
correlationId	string	yes	Signal correlation id.
executionId	string	yes	The paused execution.
name	string	yes	Signal name to deliver.
payload	—	—	Signal payload (any JSON value).

No output schema declared.

No examples provided.

sapiom_logout ~24

Log out of Sapiom by removing cached credentials for the current environment.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

sapiom_status ~24

Check Sapiom authentication status. Returns whether you're authenticated and which organization.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

27 Jul 3 Aug