# io.github.Savirinc/unfragile (npm · @unfragile/mcp-server)

The match graph for AI. Search 100K+ capabilities across 13K+ AI artifacts.

- Trust score: 64/100 (medium)
- Change this week: +24
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `@unfragile/mcp-server`: 64/100 (this document), [markdown](https://verifymcp.io/servers/savirinc-unfragile/unfragile-mcp-server.md), [page](https://verifymcp.io/servers/savirinc-unfragile/unfragile-mcp-server)

## Channel facts

- Registry: `npm`
- Package: `@unfragile/mcp-server`
- Version: `0.3.2`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 19/100
  - Repository check failed: the declared repository URL returned HTTP 404.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 16 days ago).
  - Security-disclosure policy not yet verified: we couldn't inspect the source repository.
- **Schema Quality & AI Usability**: 77/100
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 978 tokens (~97/item across 10 items; 10 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add savirinc-unfragile -- npx -y @unfragile/mcp-server
```

### Codex

```bash
codex mcp add savirinc-unfragile -- npx -y @unfragile/mcp-server
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "savirinc-unfragile": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@unfragile/mcp-server"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add savirinc-unfragile --command npx --arg -y --arg @unfragile/mcp-server
```

### Hermes

```yaml
mcp_servers:
  savirinc-unfragile:
    command: "npx"
    args: ["-y", "@unfragile/mcp-server"]
```

### Other

```json
{
  "mcpServers": {
    "savirinc-unfragile": {
      "command": "npx",
      "args": [
        "-y",
        "@unfragile/mcp-server"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 64, +4)

- [functional improvement] Stability: unverified → 0.27

### 2026-08-02 (score 60, +60)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional] Licence: MIT

### 2026-08-01 (score 0, −16)

- [functional regression] Tool coverage: 100 → unverified

### 2026-07-31 (score 16, +16)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 0, −40)

- [security regression] Malware scan: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified

### 2026-07-27 (score 40)

First indexed and scored.

## MCP tools (10)

### `search` (~98 tokens)

Search the Unfragile match graph for AI tools, frameworks, APIs, MCP servers, agents, and more. Returns ranked results with capability matches and graph signals. Every query feeds the graph.

Input parameters:

- `limit` (number): Max results to return
- `query` (string, required): What you're looking for (e.g., 'best framework for building AI agents', 'MCP server for database access')
- `type` (string): Filter by artifact type

### `find_mcps` (~86 tokens)

Find MCP servers by capability need. Use this when you need to discover MCP servers for specific integrations (e.g., databases, APIs, cloud services). Returns MCP servers ranked by capability match.

Input parameters:

- `limit` (number): Max results
- `need` (string, required): What capability you need (e.g., 'Postgres database access', 'Slack messaging', 'GitHub repository management')

### `get_artifact` (~89 tokens)

Get full details and capabilities for a specific AI artifact by name or slug. Uses search-based lookup (best-effort name matching — may return a different artifact for ambiguous names like 'express'). Use this to understand what an artifact can do before adding it to your stack.

Input parameters:

- `name` (string, required): Artifact name or slug (e.g., 'cursor', 'langchain', 'claude-code')

### `resolve_capability` (~126 tokens)

Resolve a capability:// URI or natural-language capability into ranked AI artifacts. This is Unfragile's capability DNS primitive. Use when an agent knows what capability it needs and must choose the safest current artifact at runtime.

Input parameters:

- `capability` (string, required): Capability URI or phrase, e.g. 'capability://database.postgres.query.readonly' or 'read-only Postgres database access'
- `limit` (number): Max resolutions
- `risk` (string): Risk posture. production/enterprise/strict require stronger quality/status gates.
- `type` (string): Filter by artifact type

### `trust_passport` (~90 tokens)

Get the machine-readable trust passport for an AI artifact. Use this before an agent selects a tool, API, MCP server, model, repo, or framework for a task. Returns capability URIs, permissions, data access risk, known failure modes, observed outcomes, and trust score.

Input parameters:

- `slug` (string, required): Artifact slug (e.g., 'cursor', 'claude-code', 'langchain')

### `compare` (~81 tokens)

Compare two AI artifacts side-by-side. Shows capabilities, pricing, rank, and graph signals for each. Uses search-based lookup (best-effort name matching). Use this when deciding between alternatives.

Input parameters:

- `artifact_a` (string, required): First artifact name (e.g., 'cursor')
- `artifact_b` (string, required): Second artifact name (e.g., 'windsurf')

### `find_stack` (~149 tokens)

Assemble a complete AI harness stack for a use case. Given a description of what you're building, returns recommended tools across harness layers: orchestration, tools/MCPs, memory, guardrails, context assembly, and evaluation. This is the key differentiator — Unfragile understands that modern AI systems are composed of 5-15 tools working together.

Input parameters:

- `description` (string, required): What you're building (e.g., 'a customer support agent that connects to our Postgres database and Slack, with memory of past conversations')
- `focus` (string): Stack focus: 'full' = all layers, 'tools-only' = just MCPs and integrations, 'infrastructure' = frameworks and platforms

### `feedback` (~101 tokens)

Report whether a recommended tool worked or not. This closes the learning loop — the Unfragile graph uses this feedback to improve future recommendations. Call this after trying a tool from search results.

Input parameters:

- `comment` (string): Optional: brief note on why it worked or didn't
- `matchRecordId` (string, required): Match record ID from search results (shown at the bottom of search output)
- `outcome` (string, required): Did the recommended tool work for your use case?

### `subscribe` (~117 tokens)

Set up a persistent watch for new AI tools matching a query. Get notified daily when something new appears in the Unfragile graph. Requires at least one notification channel (email or webhook).

Input parameters:

- `email` (string): Email address for notifications
- `query` (string, required): What to watch for (e.g., 'new MCP server for Postgres', 'framework for building AI agents')
- `type` (string): Only watch for this artifact type
- `webhook` (string): Webhook URL for notifications (receives POST with new matches)

### `unsubscribe` (~41 tokens)

Cancel a persistent watch (monitor). Use the monitor ID returned from subscribe.

Input parameters:

- `monitorId` (string, required): Monitor ID from subscribe (e.g., 'mon_...')

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/savirinc-unfragile/unfragile-mcp-server#diagnostics

## Score history

- 2026-08-03: 64
- 2026-08-02: 60
- 2026-08-01: 0
- 2026-07-31: 16
- 2026-07-30: 0
- 2026-07-28: 40
- 2026-07-27: 40

## Links

- npm package: https://www.npmjs.com/package/@unfragile/mcp-server
- Socket report: https://socket.dev/npm/package/@unfragile/mcp-server
- Changelog RSS feed: https://verifymcp.io/servers/savirinc-unfragile/unfragile-mcp-server/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/savirinc-unfragile/unfragile-mcp-server/changelog.json
- HTML version of this page: https://verifymcp.io/servers/savirinc-unfragile/unfragile-mcp-server