# What's Inherited (npm · whats-inherited-mcp)

What a checkout tells your agent to do: instruction files, hooks, declared MCP servers.

- Trust score: 66/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `whats-inherited-mcp`: 66/100 (this document), [markdown](https://verifymcp.io/servers/stcmain-whats-inherited-mcp/whats-inherited-mcp.md), [page](https://verifymcp.io/servers/stcmain-whats-inherited-mcp/whats-inherited-mcp)

## Channel facts

- Registry: `npm`
- Package: `whats-inherited-mcp`
- Version: `0.1.6`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 1 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 77/100
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 506 tokens (~101/item across 5 items; 5 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add stcmain-whats-inherited-mcp -- npx -y whats-inherited-mcp
```

### Codex

```bash
codex mcp add stcmain-whats-inherited-mcp -- npx -y whats-inherited-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "stcmain-whats-inherited-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "whats-inherited-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add stcmain-whats-inherited-mcp --command npx --arg -y --arg whats-inherited-mcp
```

### Hermes

```yaml
mcp_servers:
  stcmain-whats-inherited-mcp:
    command: "npx"
    args: ["-y", "whats-inherited-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "stcmain-whats-inherited-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "whats-inherited-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 66, +61)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] License: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional] First check of Schema quality: excellent
- [functional] First check of Schema quality: pass
- [functional] First check of Tool coverage: 100
- [functional] First check of Schema quality: fail
- [functional] Licence: MIT

### 2026-08-01 (score 5)

First indexed and scored.

## MCP tools (5)

### `inherited_summary` (~106 tokens)

What this checkout hands your agent

Start here. Headline count of everything in a directory that is addressed to an AI agent rather than to you: instruction files, hook commands wired to run automatically, MCP servers the repo declares, and skills/commands/subagents it ships. Use before working in a repo you did not write, or when reviewing a PR that touches agent config.

Input parameters:

- `dir` (string): Absolute path to the checkout to inspect. Defaults to WI_DEFAULT_ROOT if set, otherwise the server's working directory.

### `instruction_files` (~94 tokens)

Files that instruct the agent

Every CLAUDE.md, AGENTS.md, .cursorrules and equivalent in the checkout, with size, estimated token cost, and what each one's @import lines pull in — including imports that resolve outside the repo. File contents are never returned; open the paths yourself.

Input parameters:

- `dir` (string): Absolute path to the checkout to inspect. Defaults to WI_DEFAULT_ROOT if set, otherwise the server's working directory.

### `auto_run_commands` (~99 tokens)

Commands this checkout wires to agent events

Hook commands declared in the checkout's .claude/settings.json and settings.local.json — shell commands wired to fire on agent events such as tool use, session start or prompt submit. Shows the command, its trigger, and whether the script it references lives inside the repo, outside it, or is missing.

Input parameters:

- `dir` (string): Absolute path to the checkout to inspect. Defaults to WI_DEFAULT_ROOT if set, otherwise the server's working directory.

### `declared_mcp_servers` (~94 tokens)

MCP servers this checkout declares

MCP servers declared by the checkout (.mcp.json and equivalents) — the launch command, whether it fetches code from a package registry at start time, filesystem paths it is granted outside the repo, and the NAMES of environment variables it expects. Values are never read.

Input parameters:

- `dir` (string): Absolute path to the checkout to inspect. Defaults to WI_DEFAULT_ROOT if set, otherwise the server's working directory.

### `agent_extensions` (~113 tokens)

Skills, commands and subagents the repo ships

Skills, slash commands, subagent definitions and plugin markers shipped inside the checkout's `.claude/` or `.agents/` directories (root, or one to two levels down — monorepos put them per package). These become available to an agent working in this directory. Counts distinct extensions and the markdown files they carry. Names and sizes only — contents are never returned.

Input parameters:

- `dir` (string): Absolute path to the checkout to inspect. Defaults to WI_DEFAULT_ROOT if set, otherwise the server's working directory.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/stcmain-whats-inherited-mcp/whats-inherited-mcp#diagnostics

## Score history

- 2026-08-03: 66
- 2026-08-02: 66
- 2026-08-01: 5

## Links

- npm package: https://www.npmjs.com/package/whats-inherited-mcp
- Socket report: https://socket.dev/npm/package/whats-inherited-mcp
- Repository: https://github.com/stcmain/whats-inherited-mcp
- Website: https://shifttheculture.media/agent-tools
- Changelog RSS feed: https://verifymcp.io/servers/stcmain-whats-inherited-mcp/whats-inherited-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/stcmain-whats-inherited-mcp/whats-inherited-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/stcmain-whats-inherited-mcp/whats-inherited-mcp