# io.github.supertrained/rhumb-mcp (npm · rhumb-mcp)

Agent gateway for Index discovery, AN Score evaluation, and Resolve governed execution

- Trust score: 67/100 (medium)
- Change this week: +43
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `rhumb-mcp`: 67/100 (this document), [markdown](https://verifymcp.io/servers/supertrained-rhumb-mcp/rhumb-mcp.md), [page](https://verifymcp.io/servers/supertrained-rhumb-mcp/rhumb-mcp)

## Channel facts

- Registry: `npm`
- Package: `rhumb-mcp`
- Version: `0.8.2`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 86/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 83 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 71/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 2190 tokens (~136/item across 16 items; 16 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 23/100
  - Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add supertrained-rhumb-mcp -- npx -y rhumb-mcp
```

### Codex

```bash
codex mcp add supertrained-rhumb-mcp -- npx -y rhumb-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "supertrained-rhumb-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "rhumb-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add supertrained-rhumb-mcp --command npx --arg -y --arg rhumb-mcp
```

### Hermes

```yaml
mcp_servers:
  supertrained-rhumb-mcp:
    command: "npx"
    args: ["-y", "rhumb-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "supertrained-rhumb-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "rhumb-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 67, +47)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [security improvement] Malware scan: unverified → pass
- [functional regression] Security disclosure: fail → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Stability: unverified → 0.20
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] License: unverified → pass
- [functional improvement] Schema quality: unverified → excellent
- [functional] Licence: MIT

### 2026-08-01 (score 20, −7)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-31 (score 27, +2)

- [security regression] Malware scan: pass → unverified
- [functional regression] Dependency health: partial → unverified
- [functional improvement] Tool coverage: unverified → 100

### 2026-07-30 (score 25, −20)

- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] Dependency health: unverified → partial

### 2026-07-28 (score 45, +21)

- [functional improvement] Tool coverage: unverified → 100
- [functional] First check of Tool coverage: 100
- [functional] First check of Schema quality: unverified
- [functional] First check of Schema quality: fail
- [functional] First check of Schema quality: fail

### 2026-07-27 (score 24)

First indexed and scored.

## MCP tools (16)

### `find_services` (~129 tokens)

Search indexed Services by what you need them to do. Returns ranked Services with AN Scores. Use this when you know the problem but not which Service to call. For Capability-level search (e.g. 'email.send'), use discover_capabilities instead.

Input parameters:

- `limit` (number): Max results (default 10). Each result includes a slug you can pass to get_score, get_alternatives, or get_failure_modes.
- `query` (string, required): What you need the Service to do, in natural language. Examples: 'send email', 'process payments', 'generate images', 'web scraping'

### `get_score` (~74 tokens)

Get the full AN Score breakdown for a Service: execution quality, access readiness, autonomy level, tier label, and freshness. Use after find_services to evaluate a specific Service.

Input parameters:

- `slug` (string, required): Service identifier from find_services results (e.g. 'stripe', 'sendgrid', 'openai', 'twilio')

### `get_alternatives` (~70 tokens)

Find alternative Services, ranked by AN Score. Use when a Service doesn't meet your needs or you want to compare options in the same category.

Input parameters:

- `slug` (string, required): Service slug from find_services results (e.g. 'stripe'). Returns other Services in the same category, ranked by AN Score.

### `get_failure_modes` (~74 tokens)

Get known failure patterns, impact severity, and workarounds for a service. Use BEFORE integrating to write defensive code, or AFTER hitting an error to diagnose it.

Input parameters:

- `slug` (string, required): Service slug from find_services results (e.g. 'stripe'). Returns known failure patterns, impact severity, and workarounds.

### `discover_capabilities` (~175 tokens)

Browse Capabilities by domain or search text. A Capability is an action (e.g. 'email.send', 'payment.charge') that multiple providers can fulfill. Use this when you know WHAT you need to do but not which Service does it. Returns Capability IDs for resolve_capability. Different from find_services: find_services searches Services, this searches Capabilities.

Input parameters:

- `domain` (string): Filter by domain: 'email', 'payment', 'ai', 'communication', 'data', 'storage', 'search', etc. Omit for all domains.
- `limit` (number): Max results (default 20). Returns capability IDs you can pass to resolve_capability.
- `search` (string): Free-text search across capability names and descriptions. Examples: 'send message', 'charge card', 'scrape website'

### `resolve_capability` (~103 tokens)

Given a Capability ID, returns ranked providers with health status, cost per call, auth methods, endpoint patterns, and fallback chains. This is the core routing decision: 'I need email.send — which provider should I use?' Call this before execute_capability to understand your options.

Input parameters:

- `capability` (string, required): Capability ID from discover_capabilities (e.g. 'email.send', 'payment.charge'). Returns ranked providers with costs, health status, and fallback chains.

### `execute_capability` (~507 tokens)

Call a Capability through Rhumb Resolve. Typical workflow: discover_capabilities → resolve_capability → estimate_capability → execute_capability. Default credential mode is auto: Rhumb uses Rhumb Resolve when an active managed config exists, otherwise falls back to byo (BYOK). Other explicit modes: rhumb_managed — zero-config through Rhumb Resolve when available; byo — BYOK via agent_token + method + path; agent_vault — use a key from credential_ceremony via agent_token + method + path. Alternative: pass x_payment for a per-call USDC payment with no account needed. Use check_credentials to see which modes are available.

Input parameters:

- `agent_token` (string): Your API token for byo/agent_vault mode. For agent_vault: obtain via credential_ceremony first. Never stored by Rhumb — used for this single call only.
- `body` (object): Request body in the provider's native format. See provider docs or resolve_capability for expected structure.
- `capability_id` (string, required): Capability to call (e.g. 'email.send', 'payment.charge'). Get IDs from discover_capabilities or resolve_capability.
- `credential_mode` (string): 'auto' (default: use Rhumb Resolve when an active managed config exists, otherwise fall back to byo), 'rhumb_managed' (Rhumb Resolve zero-config call path), 'byo' (BYOK via agent_token — requires met…
- `idempotency_key` (string): UUID for safe retry — if this request was already processed, returns the cached result instead of re-calling the provider. Required to enable automatic fallback to backup providers on failure.
- `method` (string): HTTP method (GET, POST, PUT, PATCH, DELETE). Required for byo (BYOK) and agent_vault modes. Not needed for rhumb_managed.
- `params` (object): URL query parameters as key-value pairs
- `path` (string): Provider API path (e.g. '/v3/mail/send'). Get the pattern from resolve_capability. Required for byo (BYOK)/agent_vault. Not needed for rhumb_managed.
- `provider` (string): Specific provider slug (e.g. 'resend', 'stripe'). Omit to let Rhumb auto-select the best healthy provider based on your routing strategy.

### `estimate_capability` (~199 tokens)

Get the cost of a Capability call WITHOUT making the call. Returns cost in USD, circuit health, and endpoint pattern. Default credential mode is auto: Rhumb uses Rhumb Resolve when an active managed config exists, otherwise falls back to byo (BYOK). Always call this before execute_capability for cost-sensitive workflows — no charge for estimates.

Input parameters:

- `capability_id` (string, required): Capability to estimate (e.g. 'email.send'). Call this BEFORE execute_capability to know the cost in advance.
- `credential_mode` (string): 'auto' (default: use Rhumb Resolve when an active managed config exists, otherwise fall back to byo), 'rhumb_managed', 'byo' (BYOK), or 'agent_vault'. Affects pricing — rhumb_managed includes a 20% m…
- `provider` (string): Specific provider slug. Omit to estimate for the auto-selected provider based on your routing strategy.

### `credential_ceremony` (~116 tokens)

Get step-by-step instructions to obtain API credentials for a Service. Returns signup steps, expected token format (prefix, pattern), verification endpoint, estimated time, and whether human intervention is needed. Use before calling in agent_vault mode. Call without params to list all Services with available ceremonies.

Input parameters:

- `service` (string): Service slug (e.g. 'openai', 'stripe', 'resend'). Returns step-by-step signup instructions, expected token format, and verification endpoint. Omit to list all services with available ceremonies.

### `check_credentials` (~114 tokens)

Check what credential modes are available to you. Shows: (1) which Capabilities have Rhumb Resolve credentials (ready to call immediately), (2) which Services have ceremony guides (self-provision in minutes), and (3) BYOK status. Start here when you're new to Rhumb or unsure what you can call.

Input parameters:

- `capability` (string): Check a specific Capability (e.g. 'email.send'). Omit to see all modes and managed Capabilities. Start here to understand what you can call and how.

### `budget` (~167 tokens)

Check or set your call spending limit. Budgets are enforced BEFORE a call — you get HTTP 402 (not a surprise bill) when you'd exceed your limit. Call with no params to check current budget and remaining balance.

Input parameters:

- `action` (string): 'get' (check current budget) or 'set' (create/update). Default: 'get'
- `budget_usd` (number): Budget cap in USD. Required when action='set'. Example: 10.00 for $10/month.
- `hard_limit` (boolean): true = reject calls over budget with HTTP 402. false = warn but allow. Default: true
- `period` (string): 'daily', 'weekly', 'monthly', or 'total'. Default: 'monthly'. Resets at period boundary.

### `spend` (~80 tokens)

Get your spending breakdown for a billing period: total USD spent, call count, average cost per call, broken down by Capability and by provider. Use to audit costs or optimize routing.

Input parameters:

- `period` (string): Billing period as YYYY-MM (e.g. '2026-03'). Defaults to current month. Returns per-capability and per-provider spend breakdown.

### `routing` (~196 tokens)

Get or set how Rhumb auto-selects providers when you don't specify one in execute_capability. Controls the tradeoff between cost, speed, and quality. Also sets a quality floor (minimum AN Score) and optional per-call cost ceiling.

Input parameters:

- `action` (string): 'get' (check current strategy) or 'set' (update). Default: 'get'
- `max_cost_per_call_usd` (number): Hard ceiling on per-call cost. Calls that would exceed this are rejected with 402.
- `quality_floor` (number): Minimum AN Score (0-10). Providers below this are excluded from auto-selection. Default: 6.0
- `strategy` (string): 'cheapest' (lowest cost above quality floor), 'fastest' (healthiest circuits, lowest latency), 'highest_quality' (highest AN Score), or 'balanced' (weighted mix of all three). Default: 'balanced'

### `check_balance` (~40 tokens)

Check your current Rhumb credit balance in USD. Also shows whether auto-reload is enabled. If balance is low, use get_payment_url to top up.

### `get_payment_url` (~62 tokens)

Get a checkout URL to add credits to your Rhumb balance. Present this URL to a human to complete payment. Credits are available immediately after payment.

Input parameters:

- `amount_usd` (number, required): Amount to add in USD (min $5, max $5000)

### `get_ledger` (~84 tokens)

Get your billing history: charges (debits), top-ups (credits), and auto-reload events. Each entry shows amount, balance after, description, and timestamp. Most recent first.

Input parameters:

- `event_type` (string): Filter: debit, credit_added, auto_reload_triggered
- `limit` (number): Number of entries (default 20, max 100)

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/supertrained-rhumb-mcp/rhumb-mcp#diagnostics

## Score history

- 2026-08-03: 67
- 2026-08-02: 67
- 2026-08-01: 20
- 2026-07-31: 27
- 2026-07-30: 25
- 2026-07-28: 45
- 2026-07-27: 24

## Links

- npm package: https://www.npmjs.com/package/rhumb-mcp
- Socket report: https://socket.dev/npm/package/rhumb-mcp
- Repository: https://github.com/supertrained/rhumb
- Changelog RSS feed: https://verifymcp.io/servers/supertrained-rhumb-mcp/rhumb-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/supertrained-rhumb-mcp/rhumb-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/supertrained-rhumb-mcp/rhumb-mcp