# ember (pypi · ember-advise)

Calibrated advice for coding agents: typed questions in, probabilities out. Apple Silicon.

- Trust score: 0/100 (low)
- Change this week: 0
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

> **Recent critical change**: CVE-2026-112398 affects this package (2026-10-24). See the changelog below before you install this server.

## Components

- pypi · `ember-advise`: 0/100 (this document), [markdown](https://verifymcp.io/servers/shapeandshare-ember/ember-advise.md), [page](https://verifymcp.io/servers/shapeandshare-ember/ember-advise)

## Channel facts

- Registry: `pypi`
- Package: `ember-advise`
- Version: `0.16.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Supply Chain Security**: 25/100
  - Malware scan not yet available for this package.
  - CVE check failed: an unpatched critical CVE affects this package; the score is capped at 0.
  - Runs hatchling.build at install time, a recognised build step with no custom scripting around it.
  - 4 of 91 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 48/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 22 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 67/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 671 tokens (~335/item across 2 items; 1 tools + 1 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 50/100
  - Stability observed for 15 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 71/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 0% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 1 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 3 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

## Install

### How do I install the ember MCP server?

ember runs locally as a PyPI package, launched with uvx ember-advise. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add shapeandshare-ember -- uvx ember-advise
```

### Cursor

```json
{
  "mcpServers": {
    "shapeandshare-ember": {
      "command": "uvx",
      "args": [
        "ember-advise"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "shapeandshare-ember": {
      "command": "uvx",
      "args": [
        "ember-advise"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add shapeandshare-ember -- uvx ember-advise
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "shapeandshare-ember": {
      "type": "local",
      "command": [
        "uvx",
        "ember-advise"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add shapeandshare-ember --command uvx --arg ember-advise
```

### Hermes

```yaml
mcp_servers:
  shapeandshare-ember:
    command: "uvx"
    args: ["ember-advise"]
```

### Netclaw

```json
{
  "McpServers": {
    "shapeandshare-ember": {
      "Transport": "stdio",
      "Command": "uvx",
      "Arguments": [
        "ember-advise"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add shapeandshare-ember -t stdio -c uvx -a ember-advise
```

### Other

```json
{
  "mcpServers": {
    "shapeandshare-ember": {
      "command": "uvx",
      "args": [
        "ember-advise"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-05 (score 0, 0)

- [security regression] Malware scan: pass → unverified

### 2026-10-29 (score 0, 0)

- [security improvement] Malware scan: unverified → pass

### 2026-10-24 (score 0, 0)

- [critical regression] CVE-2026-112398 affects this package: high
- [security improvement] Source repository: unverified → pass

### 2026-10-23 (score 0, 0)

- [critical regression] CVE-2026-96639 affects this package: high
- [security regression] Provenance: pass → unverified

### 2026-10-22 (score 0, 0)

- [critical regression] CVE-2026-112393 affects this package: high
- [critical regression] CVE-2026-112900 affects this package: high

### 2026-10-21 (score 0, −25)

- [critical regression] CVE-2026-112403 affects this package: high
- [critical regression] Known CVEs: pass → fail
- [critical regression] Score status: scored → failed
- [security improvement] Injection markers: unverified → pass
- [security] First check of Judged manipulation: pass
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] Stability: unverified → 0.00
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Schema quality: unverified → 100
- [functional] First check of Tool coverage: 0
- [functional] First check of Schema quality: fail
- [functional] First check of Destructive annotations: pass
- [functional] First check of Schema quality: fail
- [functional] First check of Schema quality: good
- [functional] First check of Tool coverage: 100

### 2026-10-18 (score 25, −15)

- [security regression] Malware scan: pass → unverified

### 2026-10-17 (score 40, +15)

- [security improvement] Malware scan: unverified → pass

## MCP tools (1)

### `advise` (~155 tokens)

Get ember's read on a situation, as calibrated probabilities.

ember (a decision model) advises; you decide. Consult it at bounded decision
points: intent, triage, routing, yes/no gates, and risk, severity, or effort
scores. It sees only what you pass, so include every piece of evidence the call
depends on and attach images or video frames as base64 `data:` URIs in
\`images`/`videos` when pixels are the evidence. For 'choice' the answer has the
leading option, its confidence, and full probabilities; for 'score' an expected
score over the ordered criteria; for 'noul' the probability the proposition is true.

Input parameters:

- `input` (required)

## Diagnostics

Captured diagnostic sections: Provenance, Install scripts, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/shapeandshare-ember/ember-advise#diagnostics

## Score history

- 2026-11-05: 0
- 2026-11-04: 0
- 2026-11-03: 0
- 2026-11-02: 0
- 2026-11-01: 0
- 2026-10-31: 0
- 2026-10-30: 0
- 2026-10-29: 0
- 2026-10-28: 0
- 2026-10-27: 0
- 2026-10-26: 0
- 2026-10-25: 0
- 2026-10-24: 0
- 2026-10-23: 0
- 2026-10-22: 0
- 2026-10-21: 0
- 2026-10-20: 25
- 2026-10-19: 25
- 2026-10-18: 25
- 2026-10-17: 40
- 2026-10-16: 25
- 2026-10-15: 25
- 2026-10-14: 25
- 2026-10-13: 40
- 2026-10-12: 29

## Common questions

### What is the ember MCP server?

ember is an MCP server listed in the public MCP registry as io.github.shapeandshare/ember. Calibrated advice for coding agents: typed questions in, probabilities out. Apple Silicon. This page covers its PyPI package (ember-advise).

### What tools does the ember MCP server expose?

ember exposes 1 tool: advise. Their descriptions and schemas cost roughly 155 tokens of context every time the server is loaded.

### Is the ember MCP server still maintained?

ember is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the ember MCP server under?

ember declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- PyPI project: https://pypi.org/project/ember-advise/
- Socket report: https://socket.dev/pypi/package/ember-advise
- Repository: https://github.com/shapeandshare/ember
- Website: https://shapeandshare.github.io/ember/
- Changelog RSS feed: https://verifymcp.io/servers/shapeandshare-ember/ember-advise.xml
- Changelog JSON feed: https://verifymcp.io/servers/shapeandshare-ember/ember-advise.json
- HTML version of this page: https://verifymcp.io/servers/shapeandshare-ember/ember-advise