# io.github.sapiom/mcp (npm · @sapiom/mcp)

Sapiom MCP server — authentication, verification, and API tools

- Trust score: 78/100 (medium)
- Change this week: +35
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `@sapiom/mcp`: 78/100 (this document), [markdown](https://verifymcp.io/servers/sapiom-mcp/sapiom-mcp.md), [page](https://verifymcp.io/servers/sapiom-mcp/sapiom-mcp)

## Channel facts

- Registry: `npm`
- Package: `@sapiom/mcp`
- Version: `0.8.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 88/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (128 of 132), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (128 of 132), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 97/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to sapiom/sapiom-js).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 20 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 67/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 2721 tokens (~181/item across 15 items; 15 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 23/100
  - Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add sapiom-mcp -- npx -y @sapiom/mcp
```

### Codex

```bash
codex mcp add sapiom-mcp -- npx -y @sapiom/mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "sapiom-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@sapiom/mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add sapiom-mcp --command npx --arg -y --arg @sapiom/mcp
```

### Hermes

```yaml
mcp_servers:
  sapiom-mcp:
    command: "npx"
    args: ["-y", "@sapiom/mcp"]
```

### Other

```json
{
  "mcpServers": {
    "sapiom-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@sapiom/mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 78, +1)

No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-02 (score 77, +72)

- [security improvement] Provenance: unverified → pass
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [security] The attested source repository moved: sapiom/sapiom-js
- [functional regression] Security disclosure: fail → unverified
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Stability: unverified → 0.20
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Tool coverage: unverified → 100
- [functional] Licence: MIT

### 2026-08-01 (score 5, −14)

- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified

### 2026-07-31 (score 19, −6)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 25, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-27 (score 43)

First indexed and scored.

## MCP tools (15)

### `sapiom_authenticate` (~36 tokens)

Authenticate with Sapiom by opening a browser login flow. Run this when other Sapiom tools report that authentication is required.

### `sapiom_status` (~24 tokens)

Check Sapiom authentication status. Returns whether you're authenticated and which organization.

### `sapiom_logout` (~24 tokens)

Log out of Sapiom by removing cached credentials for the current environment.

### `sapiom_dev_orchestrations_scaffold` (~138 tokens)

Scaffold a new Sapiom orchestration project into <dir>. Produces an npm-install-ready TypeScript project with a starter orchestration in index.ts. After scaffolding, the author writes step definitions and uses sapiom_dev_orchestrations_run_local to test them.

Input parameters:

- `dir` (string, required): Target directory for the new project (created if absent; must be empty).
- `template` (string): Template name. 'default' (a minimal two-step starter) or 'coding-pause' (the launch + pauseUntilSignal + resume pattern for a non-blocking coding-agent run). Defaults to 'default'.

### `sapiom_dev_orchestrations_check` (~79 tokens)

Validate an orchestration locally: bundle index.ts, derive the manifest, and check the step graph. Offline and instant. Returns the orchestration name, step count, the manifest (which contains the full step graph for visualization), and any graph warnings.

Input parameters:

- `dir` (string): Project directory (defaults to the current working directory).

### `sapiom_dev_orchestrations_run_local` (~392 tokens)

Execute an orchestration entirely on the local machine, running the author's actual step code with every ctx.sapiom.* capability call resolved from stubs (no real capability calls, no cost, instant).
Returns { outcome, output, steps[], unusedStubs[], stubWarnings[] }. outcome is 'completed' | 'failed' | 'paused' | 'running'. A paused dispatch (e.g. agent.coding.launch) is auto-resumed locally with its stub result, so the happy path runs end-to-end.
Returns `unusedStubs` (supplied stub keys that matched no call — a typo or wrong path form) and `stubWarnings` (a stub key matched but its value was the wrong shape for the capability). Check both: a green run with a non-empty unusedStubs/stubWarnings usually means your stub didn't take effect.
Stub shape: { version: 1, steps: { <stepName>: { <methodPath>: <response> } } }. The response is the value that call returns verbatim — e.g. `repositories.list` takes the array list() should return ([{ slug, cloneUrl }]), not a wrapped/sequence form. For a dispatched run, stub `agent.coding.run` (or `agent.coding.launch`) in the step that launches it; that value becomes both the run result and the payload the paused step resumes with — set status:'failed' there to exercise the failure branch.

Input parameters:

- `dir` (string): Project directory (defaults to the current working directory).
- `input`: The workflow's entry-step input (any JSON value).
- `maxAttemptsPerStep` (integer): Retry cap per step (default 3).
- `stubs`: Stub file object: { version, steps: { <step>: { <method.path>: <response> | [<response>] } } }.

### `sapiom_dev_orchestrations_link` (~107 tokens)

Resolve a hosted orchestration by name (or create it with create:true) and cache its id in the project's sapiom.json. Run this before deploy.

Input parameters:

- `create` (boolean): Create the orchestration if it does not exist.
- `dir` (string): Project directory (defaults to the current working directory).
- `name` (string): Orchestration name (matches defineOrchestration({ name })). Defaults to the orchestration's name read from index.ts.

### `sapiom_dev_orchestrations_deploy` (~89 tokens)

Deploy the linked orchestration: push the current git commit, trigger a build, and wait for it to finish. The project must be linked (sapiom.json) and a git repo with at least one commit.

Input parameters:

- `branch` (string): Branch to push to (default 'main').
- `dir` (string): Project directory (defaults to the current working directory).

### `sapiom_dev_orchestrations_run` (~70 tokens)

Start a real (cloud) execution of the linked orchestration. Use sapiom_dev_orchestrations_inspect to follow it.

Input parameters:

- `dir` (string): Project directory (defaults to the current working directory).
- `input`: The workflow's entry-step input (any JSON value).

### `sapiom_dev_orchestrations_inspect` (~261 tokens)

Inspect a cloud execution (its steps and errors) by executionId, a build by buildRunId, or list recent executions when neither is given. On a failed step, pull its input here to reproduce the failure locally with run_local.

Reads are a fresh point-in-time snapshot. To wait for a still-running execution to finish, set wait:true (the tool polls until it settles or the wait window elapses) — do NOT sleep-and-poll this tool yourself. If a wait returns waiting:true, just call inspect again with wait:true.

Input parameters:

- `buildRunId` (string): Build to inspect (requires a linked project).
- `dir` (string): Project directory (for build inspection, which needs the linked id).
- `executionId` (string): Execution to inspect.
- `maxWaitSeconds` (number): Max seconds to wait when wait:true (default 45, capped at 55). On timeout it returns the latest snapshot with waiting:true — call again to keep waiting.
- `wait` (boolean): When inspecting an executionId, block until it reaches a terminal state (or settles on a pause needing a signal) instead of returning the current snapshot. Lets the tool own the polling so you don't…

### `sapiom_dev_orchestrations_signal` (~75 tokens)

Resume a paused cloud execution by delivering a named signal (matched by name + correlationId).

Input parameters:

- `correlationId` (string, required): Signal correlation id.
- `executionId` (string, required): The paused execution.
- `name` (string, required): Signal name to deliver.
- `payload`: Signal payload (any JSON value).

### `sapiom_dev_orchestrations_schedule` (~307 tokens)

Create a schedule for a deployed orchestration: a recurring cron schedule (kind 'schedule_cron' + cron + timezone) or a one-off delayed run (kind 'schedule_once' + at). Returns the schedule with its next fire time. Tip: validate a cron with sapiom_dev_orchestrations_cron_preview first.

Input parameters:

- `at` (string): ISO 8601 fire time — required for 'schedule_once'. E.g. '2026-07-01T17:00:00Z'.
- `cron` (string): Cron expression — required for 'schedule_cron'. E.g. '0 9 * * 1-5' = 9am on weekdays.
- `definition` (string, required): The orchestration's tenant-unique slug (the handle it was deployed under).
- `endAt` (string): Cron only: ISO time after which the schedule completes.
- `input`: Execution input passed to each run (any JSON value).
- `kind` (string, required): 'schedule_cron' = recurring; 'schedule_once' = a single delayed run.
- `policy`: Cron only: { catchupPolicy?: 'skip'|'all', overlapPolicy?: 'allow', jitterMs?: number }.
- `startAt` (string): Cron only: ISO time before which no occurrence fires.
- `timezone` (string): IANA timezone the cron runs in (e.g. 'America/New_York'). Defaults to UTC.

### `sapiom_dev_orchestrations_schedule_inspect` (~144 tokens)

Inspect schedules. With scheduleId: returns one schedule's config, next fire time, and recent fire history (each with the run's executionId) — use this to debug a misbehaving schedule, then inspect a failed run's executionId with sapiom_dev_orchestrations_inspect. With definition (slug) and no scheduleId: lists that orchestration's schedules.

Input parameters:

- `definition` (string): List schedules for this orchestration slug (used when scheduleId is omitted).
- `scheduleId` (string): Inspect one schedule (detail + recent fires + a health hint).
- `status` (string): Filter the list by status.

### `sapiom_dev_orchestrations_schedule_cancel` (~60 tokens)

Cancel a schedule by id. Stops all future fires (a recurring schedule won't re-arm; a pending one-off won't run). Irreversible — recreate to reschedule.

Input parameters:

- `scheduleId` (string, required): The schedule to cancel.

### `sapiom_dev_orchestrations_cron_preview` (~112 tokens)

Validate a cron expression and preview its next occurrences, creating nothing. Use before sapiom_dev_orchestrations_schedule to confirm a cron + timezone fire when you expect (cron syntax is easy to get subtly wrong).

Input parameters:

- `count` (number): How many upcoming occurrences to return (default 5).
- `cron` (string, required): Cron expression to validate, e.g. '0 9 * * 1-5'.
- `timezone` (string): IANA timezone (default UTC).

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/sapiom-mcp/sapiom-mcp#diagnostics

## Score history

- 2026-08-03: 78
- 2026-08-02: 77
- 2026-08-01: 5
- 2026-07-31: 19
- 2026-07-30: 25
- 2026-07-28: 43
- 2026-07-27: 43

## Links

- npm package: https://www.npmjs.com/package/@sapiom/mcp
- Socket report: https://socket.dev/npm/package/@sapiom/mcp
- Repository: https://github.com/sapiom/sapiom-js
- Changelog RSS feed: https://verifymcp.io/servers/sapiom-mcp/sapiom-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/sapiom-mcp/sapiom-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/sapiom-mcp/sapiom-mcp