Seedfast
NPM · SEEDFAST · SCANNED SEP 21
Generates relationally valid test data in a PostgreSQL database from its live schema.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 0 of 5 dependencies flagged as unhealthy. View diagnostics → Pass
Provenance & Transparency19
- Repository check failed: no source repository is declared. See how to fix → View diagnostics → Fail
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 10 days ago).Pass
- Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability81
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2534 tokens (~194/item across 13 items; 13 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management83
- Stability observed for 25 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "seedfast_plan_delete" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 13 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the Seedfast MCP server?
Seedfast runs locally as an npm package, launched with npx -y seedfast. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · seedfast
claude mcp add st-seedfa-seedfast -- npx -y seedfast
{
"mcpServers": {
"st-seedfa-seedfast": {
"command": "npx",
"args": [
"-y",
"seedfast"
]
}
}
} {
"servers": {
"st-seedfa-seedfast": {
"command": "npx",
"args": [
"-y",
"seedfast"
]
}
}
} codex mcp add st-seedfa-seedfast -- npx -y seedfast
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"st-seedfa-seedfast": {
"type": "local",
"command": [
"npx",
"-y",
"seedfast"
],
"enabled": true
}
}
} openclaw mcp add st-seedfa-seedfast --command npx --arg -y --arg seedfast
mcp_servers:
st-seedfa-seedfast:
command: "npx"
args: ["-y", "seedfast"] {
"McpServers": {
"st-seedfa-seedfast": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"seedfast"
]
}
}
} assistant mcp add st-seedfa-seedfast -t stdio -c npx -a -y seedfast
{
"mcpServers": {
"st-seedfa-seedfast": {
"command": "npx",
"args": [
"-y",
"seedfast"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 21 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 19 Sept 26 −3
- Stability: pass → 0.77 functional
- 17 Sept 26 +1
- Stability: 0.97 → pass security
- 15 Sept 26 +16
- Malware scan: unverified → pass ▲ security
- 12 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 11 Sept 26 −18
- Malware scan: pass → unverified ▼ security
- Stability: pass → 0.80 functional
- Package version: 2.6.3 → 2.6.4 functional
- 10 Sept 26 +1
- Stability: 0.97 → pass security
- 8 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 21 Sept 2026 · Analysed npm/seedfast@2.6.4
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 5 packages
| Packages resolved | 5 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
seedfast_connections_test ~158
Probes a PostgreSQL database for reachability by opening a connection pool and issuing a ping with a 10-second timeout. Returns a short text line stating success or failure for the supplied DSN (credentials are masked in the output). Use this before seedfast_plan or seedfast_run to catch bad DSNs, firewall issues, or wrong credentials without incurring a planning or seeding round-trip. Does not require SEEDFAST_API_KEY. Next: on success, call seedfast_plan to preview a seeding plan or seedfast_run to execute one.
| Name | Type | Req | Description |
|---|---|---|---|
| dsn | string | yes | PostgreSQL connection string (e.g., postgres://user:pass@host:5432/db). Credentials are masked in log/response output. |
No output schema declared.
No examples provided.
seedfast_doctor ~124
Diagnoses whether the Seedfast CLI environment is healthy and ready to run seedings. Returns a multi-line text summary: CLI status and version, binary path, whether SEEDFAST_API_KEY is configured, platform (GOOS/GOARCH), Go runtime version, and MCP server version. Call this FIRST before any other seedfast_* tool — it surfaces misconfigurations (missing CLI, missing API key) early and in plain language. Next: if status is OK, call seedfast_connections_test to verify database reachability before seedfast_plan or seedfast_run.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
seedfast_plan ~218
Generates a seeding plan for the given database and scope WITHOUT writing any data, then stores the plan in the current MCP session for later reuse. Returns a text block containing the generated plan ID, the scope echoed back, a table list with count, and an optional human-readable preview. Use this when the user wants to review what would be seeded before committing — e.g., to inspect which tables the scope covers. Requires SEEDFAST_API_KEY configured in MCP env. For scope-writing guidance, request the `scope-examples` prompt. Next: call seedfast_plan_get or read the seedfast://plans/{planId} resource to inspect the plan, then seedfast_run with planId to execute it.
| Name | Type | Req | Description |
|---|---|---|---|
| dsn | string | yes | PostgreSQL connection string for the target database. |
| scope | string | yes | Plain-text description of what to seed (e.g., 'seed only the sales schema', 'populate users and orders'). Interpreted server-side by the backend LLM — do not pre-parse or validate it. |
No output schema declared.
No examples provided.
seedfast_plan_create ~211
Stores a manually-crafted seeding plan in the current MCP session without calling the backend planner. Returns a text block with the new plan ID, scope, and table list. Use this when the caller already knows exactly which tables to seed (e.g., derived from a user prompt or a previous run) and wants to skip the planner round-trip, or to construct a plan for seedfast_run with planId. At least one entry in `tables` is required. Does not require SEEDFAST_API_KEY. Next: call seedfast_run with planId to execute, or seedfast_plan_update to refine the plan.
| Name | Type | Req | Description |
|---|---|---|---|
| preview | string | – | Optional human-readable summary shown by seedfast_plan_get and seedfast_plans_list. |
| scope | string | yes | Plain-text scope description (e.g., 'seed only sales schema'). Stored verbatim alongside the plan. |
| tables | null|array | yes | Non-empty list of table names to seed (e.g., ['users', 'orders']). |
No output schema declared.
No examples provided.
seedfast_plan_delete ~124
Permanently removes a stored plan from the current MCP session. Returns a short text line confirming deletion; returns an error when the ID is unknown or the delete fails. This is a destructive action — the plan cannot be recovered through this tool. It does NOT cancel or affect any seeding run that was previously started from the plan. Use only when the user explicitly wants to discard a plan. Does not require SEEDFAST_API_KEY. Next: call seedfast_plans_list to confirm the plan is gone.
| Name | Type | Req | Description |
|---|---|---|---|
| planId | string | yes | Plan ID to delete. |
No output schema declared.
No examples provided.
seedfast_plan_get ~150
Retrieves a single stored seeding plan by ID. Returns a text block with the plan ID, scope, full table list, optional human-readable preview, and created/updated timestamps; returns an error when the ID is unknown. Use this to inspect a plan's table set before executing it, or to show the user what a plan contains. Does not require SEEDFAST_API_KEY (reads local session state). Next: call seedfast_run with planId to execute, seedfast_plan_update to modify, or seedfast_plan_delete to remove it.
| Name | Type | Req | Description |
|---|---|---|---|
| planId | string | yes | Plan ID (as shown by seedfast_plans_list or returned by seedfast_plan / seedfast_plan_create). |
No output schema declared.
No examples provided.
seedfast_plan_update ~234
Modifies an existing stored plan in place. Returns a text block confirming the update with the plan ID, scope, table list, and new updated-at timestamp; returns an error when the ID is unknown. Only non-empty/non-zero fields in the request overwrite the stored plan — omitted fields are preserved (there is no way to clear preview or scope to empty via this tool). Use this to adjust a plan's tables or scope before executing with seedfast_run. Does not require SEEDFAST_API_KEY. Next: call seedfast_plan_get to verify, or seedfast_run with planId to execute.
| Name | Type | Req | Description |
|---|---|---|---|
| planId | string | yes | Plan ID to update. |
| preview | string | – | Replacement preview text. When non-empty, overwrites the stored preview; empty string is treated as 'leave unchanged'. |
| scope | string | – | Replacement scope description. When non-empty, overwrites the stored scope; empty string is treated as 'leave unchanged'. |
| tables | null|array | – | Replacement list of tables. When provided and non-empty, overwrites the stored tables; when omitted, existing tables are preserved. |
No output schema declared.
No examples provided.
seedfast_plans_list ~161
Lists seeding plans stored in the current MCP session (in-memory; plans do not persist across MCP server restarts). Returns a text block with up to `limit` plans, each showing ID, scope, table count with names, and created/updated timestamps; returns 'No plans found' when the session has none. Use this to discover plan IDs before calling seedfast_plan_get, seedfast_plan_update, seedfast_plan_delete, or seedfast_run with planId. Does not require SEEDFAST_API_KEY. Next: pick an ID and call seedfast_plan_get for full details, or seedfast_run to execute.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Maximum number of plans to return. Defaults to 50 when omitted or non-positive. |
No output schema declared.
No examples provided.
seedfast_run ~327
Kicks off an asynchronous seeding run against the target database. Returns immediately with a text block containing the new runId, initial status (pending), the plan ID if supplied, and the effective scope; the seeding itself runs in the background — poll seedfast_run_status or subscribe to the seedfast://runs/{runId}/summary and seedfast://runs/{runId}/log resources for progress. If planId is provided, the scope is auto-generated from that plan's tables and the scope argument is ignored; otherwise scope is required. If idempotencyKey matches a prior run, that existing run is returned instead of starting a new one. Use this once the user has approved a plan (or wants direct execution). Requires SEEDFAST_API_KEY configured in MCP env. For production-safe workflows, request the `seed-production-db` prompt first. Next: seedfast_run_status to poll, or seedfast_run_cancel to abort.
| Name | Type | Req | Description |
|---|---|---|---|
| dsn | string | yes | PostgreSQL connection string for the target database. |
| idempotencyKey | string | – | Caller-chosen key for safe retries. If a prior run was started with the same key, that run is returned and no new run is created. |
| planId | string | – | ID of a plan previously produced by seedfast_plan or seedfast_plan_create. When set, the run seeds exactly those tables and the scope argument is overridden. |
| scope | string | – | Plain-text scope description. Required unless planId is provided; ignored when planId is set (scope is derived from the plan's tables). |
No output schema declared.
No examples provided.
seedfast_run_answer ~246
Answers a pending question for a run that is in state 'awaiting_input'. The CLI forwards backend questions (scope validation issues, replans) to this MCP server via subprocess stdio and blocks for up to 5 minutes on a reply. Call this tool with the runId, the questionId from seedfast_run_status (or the seedfast://runs/{runId}/pending_question resource), and an answer object. Set answer.human_answer=true to approve the current plan/scope as-is; set human_answer=false and supply answer.raw with a textual refinement (e.g., 'seed only the org schema') when the plan should be adjusted. Returns a short text confirmation. On success the run transitions back to 'running'; poll seedfast_run_status to observe progress. Does not require SEEDFAST_API_KEY.
| Name | Type | Req | Description |
|---|---|---|---|
| answer | object | yes | Answer payload: set human_answer=true to approve, otherwise provide refined scope in raw. |
| questionId | string | yes | Question ID from the pending_question resource or from seedfast_run_status output. |
| runId | string | yes | Run ID returned by seedfast_run (the run must be in state 'awaiting_input'). |
No output schema declared.
No examples provided.
seedfast_run_cancel ~132
Requests cancellation of a pending or running seeding operation. Returns a text line confirming cancellation, or — if the run is already completed/failed/cancelled — a message that it is not cancellable (no error). This is a destructive action against the run: partial inserts already written to the database are NOT rolled back. Use only when the user explicitly asks to stop a run or when a runaway operation must be aborted. Does not require SEEDFAST_API_KEY. Next: call seedfast_run_status to confirm the final state.
| Name | Type | Req | Description |
|---|---|---|---|
| runId | string | yes | Run ID returned by seedfast_run. |
No output schema declared.
No examples provided.
seedfast_run_status ~173
Reports the current state and progress of a seeding run by ID. Returns a text block containing: run ID, state (pending/running/completed/failed/cancelled), scope, started/completed timestamps, progress (completed vs total tables with percent, total rows, failed count, currently-seeding table), any error message, and — once finished — a summary block with success flag, totals, and elapsed milliseconds. Use this to poll an async seedfast_run; it is safe to call repeatedly. Does not require SEEDFAST_API_KEY (reads local in-memory state). Next: if state is still running, poll again; if failed, inspect the error and failed-tables map; if completed, the run is done.
| Name | Type | Req | Description |
|---|---|---|---|
| runId | string | yes | Run ID returned by seedfast_run. |
No output schema declared.
No examples provided.
seedfast_schema_info ~276
Introspects a PostgreSQL database schema — lists tables, columns, primary keys, foreign keys, and approximate row counts. Returns a JSON object with a tables array; each entry has name (schema-qualified), columns (name, data_type, nullable, default), primary_key, foreign_keys (columns, references_table, references_columns), and approximate_row_count. Row counts come from pg_class.reltuples and are APPROXIMATE — they may be stale between ANALYZEs and may be -1 on never-analyzed tables. Implementation invokes `seedfast schema --json` as a subprocess with a 30s timeout. Call this before writing a scope description — it helps you understand table relationships and size so you can craft a precise scope; especially useful for large databases where you want to target specific tables. Does not require SEEDFAST_API_KEY. The `dsn` argument is optional — when omitted, the server falls back to SEEDFAST_DSN or DATABASE_URL from its environment. Next: use the schema info to write a scope string, then call seedfast_plan with that scope. For scope-writing guidance, also request the `scope-examples` prompt.
| Name | Type | Req | Description |
|---|---|---|---|
| dsn | string | – | PostgreSQL connection string. When omitted, the MCP server falls back to SEEDFAST_DSN, then DATABASE_URL. |
No output schema declared.
No examples provided.
What is the Seedfast MCP server?
Seedfast is an MCP server listed in the public MCP registry as st.seedfa/seedfast. Generates relationally valid test data in a PostgreSQL database from its live schema. This page covers its npm package (seedfast).
Is the Seedfast MCP server safe to use?
Seedfast scores 77 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 21 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Seedfast MCP server expose?
Seedfast exposes 13 tools: seedfast_connections_test, seedfast_doctor, seedfast_plan, seedfast_plan_create, seedfast_plan_delete, and 8 more. Their descriptions and schemas cost roughly 2,534 tokens of context every time the server is loaded.
Is the Seedfast MCP server still maintained?
Seedfast is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Seedfast MCP server under?
Seedfast declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.