# io.github.sqemo/sqemo (npm · sqemo-mcp)

Design ERDs with your team's naming standards: query/edit entities and relationships, SQL/DBML

- Trust score: 66/100 (medium)
- Change this week: +40
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `sqemo-mcp`: 66/100 (this document), [markdown](https://verifymcp.io/servers/sqemo-sqemo/sqemo-mcp.md), [page](https://verifymcp.io/servers/sqemo-sqemo/sqemo-mcp)

## Channel facts

- Registry: `npm`
- Package: `sqemo-mcp`
- Version: `1.5.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (129 of 133), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (129 of 133), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 3 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 70/100
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 3095 tokens (~85/item across 36 items; 36 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 23/100
  - Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 83/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 49% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add sqemo-sqemo -- npx -y sqemo-mcp
```

### Codex

```bash
codex mcp add sqemo-sqemo -- npx -y sqemo-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "sqemo-sqemo": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "sqemo-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add sqemo-sqemo --command npx --arg -y --arg sqemo-mcp
```

### Hermes

```yaml
mcp_servers:
  sqemo-sqemo:
    command: "npx"
    args: ["-y", "sqemo-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "sqemo-sqemo": {
      "command": "npx",
      "args": [
        "-y",
        "sqemo-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 66, +1)

No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-02 (score 65, +60)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Stability: unverified → 0.20
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Schema quality: unverified → good
- [functional improvement] Tool coverage: unverified → 100
- [functional] Licence: MIT

### 2026-07-31 (score 5, −1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 6, −20)

- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified
- [functional] Package version: 1.3.0 → 1.5.0

### 2026-07-27 (score 26)

First indexed and scored.

## MCP tools (36)

### `get_erd_overview` (~56 tokens)

Returns an ERD summary (entity/relationship/domain/word-list stats, standard link status).

Input parameters:

- `source` (required): Target ERD — exactly one of a local file ({file}) or a server ERD ({erdId})

### `list_entities` (~46 tokens)

Lists entities (logical name, physical name, attribute count).

Input parameters:

- `source` (required): Target ERD — exactly one of a local file ({file}) or a server ERD ({erdId})

### `get_entity` (~74 tokens)

Entity detail (attributes and physical mapping). Prefers entityId; otherwise exact logicalName match (first hit on duplicates).

Input parameters:

- `entityId` (string)
- `logicalName` (string)
- `source` (required): Target ERD — exactly one of a local file ({file}) or a server ERD ({erdId})

### `list_relationships` (~48 tokens)

Lists relationships (endpoint entity names, cardinality, identifying flag).

Input parameters:

- `source` (required): Target ERD — exactly one of a local file ({file}) or a server ERD ({erdId})

### `list_domains` (~56 tokens)

Lists domain definitions (name, data type). With a {workspaceId} source, reads the latest workspace-standard master.

Input parameters:

- `source` (required): Dictionary source — exactly one of a local file, a server ERD, or a workspace standard

### `search_dictionary` (~82 tokens)

Partial-match word-list search across logical/physical/abbreviation/English/synonyms (case-insensitive, max 50). With a {workspaceId} source, reads the latest workspace-standard master.

Input parameters:

- `query` (string, required): Search term
- `source` (required): Dictionary source — exactly one of a local file, a server ERD, or a workspace standard

### `check_naming` (~93 tokens)

Checks a logical name against the team naming standard (word list + rules). With physicalName, compares it to the generated name (providedMatches). With a {workspaceId} source, reads the latest workspace-standard master.

Input parameters:

- `logicalName` (string, required)
- `physicalName` (string)
- `source` (required): Dictionary source — exactly one of a local file, a server ERD, or a workspace standard

### `generate_physical_name` (~80 tokens)

Generates a physical name from a logical name via the word list and naming rules (unregistered words go to warnings). With a {workspaceId} source, reads the latest workspace-standard master.

Input parameters:

- `logicalName` (string, required)
- `source` (required): Dictionary source — exactly one of a local file, a server ERD, or a workspace standard

### `export_sql` (~61 tokens)

Exports the physical model as CREATE TABLE SQL. Without dialect, uses the project dialect.

Input parameters:

- `dialect` (string): SQL dialect
- `source` (required): Target ERD — exactly one of a local file ({file}) or a server ERD ({erdId})

### `export_dbml` (~44 tokens)

Exports the project as DBML text.

Input parameters:

- `source` (required): Target ERD — exactly one of a local file ({file}) or a server ERD ({erdId})

### `validate_erd` (~49 tokens)

Validates project structure and referential integrity ({ valid, errors }).

Input parameters:

- `source` (required): Target ERD — exactly one of a local file ({file}) or a server ERD ({erdId})

### `lint_erd` (~92 tokens)

Lints the whole project — structure (PKs, attributes, descriptions, domains), referential integrity, duplicate physical names, and the naming standard (unregistered words, physical-name drift) in one pass. Quality/standards oriented, unlike validate_erd (structural validity).

Input parameters:

- `source` (required): Target ERD — exactly one of a local file ({file}) or a server ERD ({erdId})

### `diff_erds` (~115 tokens)

Compares two ERD sources (entities/attributes/domains/relationships — unchanged omitted). A dry run before full-replace import_sql/import_dbml. A side freshly parsed from text has different ids, so most items appear as added/removed — matching the actual import behavior (full replace). summary aggregates entities only; see the arrays for domain/relationship changes.

Input parameters:

- `after` (required)
- `before` (required): Comparison target — exactly one of a local file, a server ERD, SQL text, or DBML text

### `export_alter_sql` (~128 tokens)

Generates a migration (ALTER) script from the physical diff between a baseline and the current model — renames stay renames (stable-id matching), destructive changes come commented out, unsupported changes are flagged as [WARNING] comments. Baselines from the same project lineage ({file}/{erdId}) preserve renames; freshly parsed SQL/DBML text falls back to name matching. Pro plan required; requires login.

Input parameters:

- `after` (required): Target state (the current model)
- `before` (required): Baseline (e.g. the state last applied to the database)
- `dialect`: SQL dialect

### `list_erds` (~38 tokens)

Lists server ERDs (owned/shared). Owner and shared editors can both write. Requires login — `npx sqemo-mcp login`.

### `list_workspaces` (~33 tokens)

Lists my workspaces (owner first) and whether a standard (word list + naming rules) exists. Requires login.

### `propose_dictionary_word` (~156 tokens)

Proposes a new word for the workspace standard's word list (the owner approves/rejects in the web app). source is {workspaceId} or a standard-linked ERD ({file}/{erdId}, resolved via glossaryLink). Registered words return already_exists; a pending duplicate returns already_proposed. Requires login.

Input parameters:

- `abbreviation` (string)
- `description` (string)
- `englishName` (string)
- `logicalWord` (string, required): Logical word to register
- `note` (string): Reason for the proposal
- `physicalWord` (string, required): Physical word — normalized to uppercase
- `source` (required): Dictionary source — exactly one of a local file, a server ERD, or a workspace standard

### `list_proposals` (~66 tokens)

Lists the workspace-standard proposal queue (word/domain, newest first, mine = my proposals). Filterable by status. Requires login.

Input parameters:

- `source` (required): Dictionary source — exactly one of a local file, a server ERD, or a workspace standard
- `status` (string)

### `withdraw_proposal` (~44 tokens)

Withdraws your own pending proposal. Proposals by others or already processed return not_found. Requires login.

Input parameters:

- `proposalId` (string, required): Proposal id from list_proposals

### `create_erd` (~103 tokens)

Creates a new ERD — empty or from SQL/DBML text. With a {file} target it saves locally; with {server:true} it saves to the server (login required).

Input parameters:

- `dbml` (string): DBML text (mutually exclusive with sql)
- `dialect` (string): SQL dialect
- `name` (string)
- `sql` (string): CREATE TABLE SQL (mutually exclusive with dbml)
- `target` (required)

### `import_sql` (~78 tokens)

Fully replaces an existing ERD with the SQL parse result (project id preserved). Rejected as invalid_source when no tables are found.

Input parameters:

- `dialect` (string): Defaults to mysql
- `source` (required): Target ERD — exactly one of a local file ({file}) or a server ERD ({erdId})
- `sql` (string, required)

### `import_dbml` (~76 tokens)

Fully replaces an existing ERD with the DBML parse result (project id preserved, dialect fixed to mysql). Rejected as invalid_source when no tables are found.

Input parameters:

- `dbml` (string, required)
- `source` (required): Target ERD — exactly one of a local file ({file}) or a server ERD ({erdId})

### `introspect_db` (~142 tokens)

Imports the schema of a live PostgreSQL/MySQL database into an existing ERD (full replace, project id preserved). Read-only — queries only the information schema/catalog; never reads table data. The database URL is used by this local process only and is never sent to Sqemo servers. Pro plan required; requires login.

Input parameters:

- `dbSchema` (string): Schema to read (postgres default: public; mysql default: database in the URL)
- `source` (required): Target ERD — exactly one of a local file ({file}) or a server ERD ({erdId})
- `url` (string, required): postgres:// or mysql:// connection URL (credentials stay local)

### `check_db_drift` (~221 tokens)

Checks whether a live database (url) or a schema dump (schemaSql) has drifted from the ERD's physical model. Errors: missing/extra tables and columns, PK/FK/NOT NULL mismatches. Warnings (strict promotes to errors): type/unique/auto-increment representation differences. Read-only; the database URL never leaves this process. Pro plan required; requires login.

Input parameters:

- `dbSchema` (string): Schema to read (url only)
- `dialect` (string): Dump dialect (required with schemaSql)
- `ignore` (array): Table name globs to ignore on the DB side, e.g. flyway_*
- `schemaSql` (string): Schema dump text, e.g. pg_dump -s output
- `source` (required): Target ERD — exactly one of a local file ({file}) or a server ERD ({erdId})
- `strict` (boolean): Promote warnings to errors
- `url` (string): postgres:// or mysql:// URL (exactly one of url/schemaSql)

### `upsert_entity` (~92 tokens)

Creates an entity (no entityId, logicalName required) or updates one (entityId given, only provided fields change). The physical table and name are derived automatically.

Input parameters:

- `description` (string)
- `entityId` (string)
- `logicalName` (string)
- `source` (required): Target ERD — exactly one of a local file ({file}) or a server ERD ({erdId})

### `delete_entity` (~54 tokens)

Deletes an entity (including its mapped physical table and relationships).

Input parameters:

- `entityId` (string, required)
- `source` (required): Target ERD — exactly one of a local file ({file}) or a server ERD ({erdId})

### `upsert_attribute` (~153 tokens)

Creates an attribute (no attributeId, logicalName required) or updates one (attributeId given, only provided fields change). primaryKey=true forces nullable=false and propagates child FKs. With a domain, the domain decides the data type.

Input parameters:

- `attributeId` (string)
- `dataType` (string)
- `defaultValue` (string)
- `domain` (string)
- `entityId` (string, required)
- `logicalName` (string)
- `nullable` (boolean)
- `primaryKey` (boolean)
- `source` (required): Target ERD — exactly one of a local file ({file}) or a server ERD ({erdId})
- `unique` (boolean)

### `delete_attribute` (~60 tokens)

Deletes an attribute (including its mapped physical column).

Input parameters:

- `attributeId` (string, required)
- `entityId` (string, required)
- `source` (required): Target ERD — exactly one of a local file ({file}) or a server ERD ({erdId})

### `upsert_relationship` (~198 tokens)

Creates a relationship (no relationshipId, source/targetEntityId required — FKs derived automatically) or updates one (relationshipId given). On update, sourceEnd/targetEnd take precedence; otherwise ends are re-derived from cardinality. onDelete/onUpdate set the FK referential actions ('noAction' reverts to the DB default); constraintName sets the FK constraint name (empty string reverts to auto-generation).

Input parameters:

- `cardinality` (string)
- `constraintName` (string)
- `onDelete` (string)
- `onUpdate`
- `relationshipId` (string)
- `relationshipType` (string)
- `source` (required): Target ERD — exactly one of a local file ({file}) or a server ERD ({erdId})
- `sourceEnd` (string)
- `sourceEntityId` (string)
- `targetEnd`
- `targetEntityId` (string)

### `delete_relationship` (~51 tokens)

Deletes a relationship (including derived FKs).

Input parameters:

- `relationshipId` (string, required)
- `source` (required): Target ERD — exactly one of a local file ({file}) or a server ERD ({erdId})

### `upsert_domain` (~88 tokens)

Creates a domain (upsert by name) or updates one (domainId given). Existing description preserved when omitted.

Input parameters:

- `dataType` (string, required)
- `description` (string)
- `domainId` (string)
- `name` (string, required)
- `source` (required): Target ERD — exactly one of a local file ({file}) or a server ERD ({erdId})

### `delete_domain` (~53 tokens)

Deletes a domain (attributes referencing it are unlinked).

Input parameters:

- `domainId` (string, required)
- `source` (required): Target ERD — exactly one of a local file ({file}) or a server ERD ({erdId})

### `upsert_dictionary_word` (~125 tokens)

Adds a glossary entry (upsert by logicalWord) or updates one (entryId given). Physical words are normalized to uppercase. Standard-linked (glossaryLink) dictionaries are rejected with dictionary_is_linked.

Input parameters:

- `abbreviation` (string)
- `description` (string)
- `englishName` (string)
- `entryId` (string)
- `logicalWord` (string, required)
- `physicalWord` (string, required)
- `source` (required): Target ERD — exactly one of a local file ({file}) or a server ERD ({erdId})

### `delete_dictionary_word` (~65 tokens)

Deletes a glossary entry. Standard-linked (glossaryLink) dictionaries are rejected with dictionary_is_linked.

Input parameters:

- `entryId` (string, required)
- `source` (required): Target ERD — exactly one of a local file ({file}) or a server ERD ({erdId})

### `update_naming_rules` (~88 tokens)

Partially updates the naming rules (delimiter, case, unknown-word handling). Existing physical names are not regenerated retroactively (noted in warnings).

Input parameters:

- `casing` (string)
- `separator` (string)
- `source` (required): Target ERD — exactly one of a local file ({file}) or a server ERD ({erdId})
- `unknownWordMode` (string)

### `auto_layout` (~87 tokens)

Auto-arranges entities (logical view) and tables (physical view) by relationships (dagre LR). view defaults to both. Reference copies, notes, and relationship waypoints are not moved.

Input parameters:

- `source` (required): Target ERD — exactly one of a local file ({file}) or a server ERD ({erdId})
- `view` (string): View to arrange (defaults to both)

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/sqemo-sqemo/sqemo-mcp#diagnostics

## Score history

- 2026-08-03: 66
- 2026-08-02: 65
- 2026-08-01: 5
- 2026-07-31: 5
- 2026-07-30: 6
- 2026-07-28: 26
- 2026-07-27: 26

## Links

- npm package: https://www.npmjs.com/package/sqemo-mcp
- Socket report: https://socket.dev/npm/package/sqemo-mcp
- Repository: https://github.com/sqemo/sqemo-mcp
- Website: https://sqemo.com/
- Changelog RSS feed: https://verifymcp.io/servers/sqemo-sqemo/sqemo-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/sqemo-sqemo/sqemo-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/sqemo-sqemo/sqemo-mcp