# Zephex (remote · zephex.dev)

MCP gateway with 10 tools for code analysis, architecture, package audit & security.

- Trust score: 72/100 (medium)
- Change this week: +12
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `zephex.dev`: 72/100 (this document), [markdown](https://verifymcp.io/servers/tanbir404-zephex/zephex.md), [page](https://verifymcp.io/servers/tanbir404-zephex/zephex)

## Channel facts

- Endpoint: `https://zephex.dev/mcp`
- Transports: `streamable-http`
- Auth: `required`
- Version: `1.0.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Endpoint Security**: 97/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token.
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
  - The authorisation server supports Client ID Metadata Documents, the current MCP client-registration mechanism.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 19/100
  - AI-judged instruction clarity (poor).
  - Context-footprint check failed: tool/resource definitions use about 6579 tokens (~657/item across 10 items; 10 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add --transport http tanbir404-zephex https://zephex.dev/mcp
```

### Codex

```toml
[mcp_servers.tanbir404-zephex]
url = "https://zephex.dev/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "tanbir404-zephex": {
      "type": "remote",
      "url": "https://zephex.dev/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add tanbir404-zephex --url https://zephex.dev/mcp --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  tanbir404-zephex:
    url: "https://zephex.dev/mcp"
```

### Other

```json
{
  "mcpServers": {
    "tanbir404-zephex": {
      "type": "http",
      "url": "https://zephex.dev/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 72, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-01 (score 71, +1)

No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-31 (score 70, +8)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 62, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-29 (score 61, +1)

No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-27 (score 60, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-26 (score 59)

First indexed and scored.

## MCP tools (10)

### `get_project_context` (~614 tokens)

Project Stack & Scripts

Scans manifests and config — one topic slice per call. Detects stack, scripts, monorepo, API routes, auth/DB providers, integrations, env vars. Secret-sanitized. Workflow: topic=identity first on new repo → follow next_calls (framework, run, structure). Topics: identity, framework, backend, frontend, database, auth, deploy, run, structure, integrations, security, overview. brief ≤500 tokens; standard adds version health; full adds file tree. 7 credits hosted. Every response: topic, focus, summary, data.key_paths, hint, related_topics, next_calls, meta.credits. Use data and next_calls — never invent commands. Call when: new session; user asks stack, scripts, or how to run/test/build. Do NOT: symbol search (find_code), file bodies (read_code), wiring (explain_architecture), tests (check_test). Pass path (absolute project dir) or inline_files (package.json + 2-4 source files). force:true refreshes cache. Read-only.

Input parameters:

- `detail_level` (string): Output tier: "brief" (default, ≤500 tokens), "standard" (full fields), "full" (all fields + file tree)
- `focus_on` (string): Subdirectory to focus the file tree scan on (e.g. 'src/tools')
- `force` (boolean): Set true to re-detect even if cached (use when project changed)
- `include_structure` (boolean): When true, includes file tree in response (also triggered by detail_level: full)
- `inline_files` (object): Primary way to supply code. Shape: { "": "", ... }. The VALUE is the actual file body — never a filename, path, or placeholder. Example: { "package.json": "{\"name\":\"my-app\",\"dependencies\":{...}…
- `path` (string): Absolute path to the project root. Stdio MCP reads manifests from disk directly. Omit on stdio when editor cwd is the project root.
- `structure_depth` (number): Max folder depth for file tree scan (default: 3, max: 6)
- `topic` (string): Which slice to return (one per call). identity=project name/type + which topics apply; run=dev/test/build/lint commands; framework=language/runtime/package manager; backend=API routes and server entr…

### `explain_architecture` (~701 tokens)

Explain Architecture

Maps how files connect across a subsystem — roles and import edges, not file bodies. Ripgrep + import-graph analyzers; detects framework, language, architecture_type. Envelope: focus, summary, hint, data, related_focus, next_calls, meta (meta.cache_hit, meta.tokens_returned, meta.credits, meta.charges_usage). Hosted: 7 credits per success; failures free. Cheapest path: mode overview + concern or seed_files — ~1.5–4k tokens, replaces 10+ blind read_code file opens. Repeat identical calls hit server cache (meta.cache_hit) until force:true. Expensive: mode deep or audit on whole monorepo — use subpath. >10k files auto-degrades to overview. data: entry_points, layer_map, concern_cluster (with concern or seed_files[]), integration_map, auth_flow, dependency_graph; deep adds request_flows + Mermaid; audit adds anti_patterns + health_score. dimension_confidence per slice; warnings on low confidence. focus: api|auth|integrations|database|security|data_flow|error_handling|full. Pass concern (any label) or seed_files[] (1–20 from find_code). subpath scopes monorepos. Call BEFORE cross-cutting edits — how a feature spans modules, where to patch. Do NOT for stack (get_project_context), search (find_code), bodies (read_code), tests, packages, live URL. After: next_calls → read_code outline on hub files. Read-only.

Input parameters:

- `concern` (string): Any subsystem label (folder name, feature codename, module). Uses find_code concept search + import graph — not a fixed keyword list. Returns roles, edges, symbols (no file bodies).
- `detail_level` (string): Legacy alias for verbosity
- `exclude` (array): Optional glob patterns to exclude from ripgrep (vendor, build, etc.).
- `focus` (string): Wiring slice. Default: api. auth=validation chain, integrations=external SDK touchpoints, database=ORM, security=auth+errors, full=all analyzers.
- `force` (boolean): Bypass architecture result cache. Default false.
- `inline_files` (object): Fallback for remote transports. Shape: { "": "" }. Include 10-50 SOURCE files (entry points, routes, middleware, auth, DB setup) plus package.json. For local stdio, prefer 'path'.
- `mode` (string): overview=fast wiring map (no AST flow trace), deep=request_flows + sequenceDiagram, audit=anti_patterns + health_score. Default: overview
- `path` (string): Where the project lives. Stdio MCP: absolute path to the project directory on disk. Hosted transport without local disk: use inline_files (10–50 source files + package.json).
- `project_path` (string): Alias for 'path' (some clients pass this name). Accepts the same values.
- `seed_files` (array): 1–20 paths from find_code — graph expands to related modules. Use with or without concern.
- `subpath` (string): Monorepo scope — analyze only this subdirectory (e.g. apps/api). Faster than whole repo.
- `verbosity` (string): Output size. minimal=core only, standard=default, full=adds constraints + state_management. Alias: detail_level

### `read_code` (~929 tokens)

Read Code

Extracts code surgically via tree-sitter AST — not repo-wide search. Eight modes; envelope: mode, focus, summary, data, hint, related_modes, next_calls, meta (meta.tokens_returned, meta.credits, meta.charges_usage). Hosted: 5 credits per success; failures free. Cheapest path: mode file or outline with files[] you already have — ~300–2000 tokens vs full-file Read (data.tokens_saved_vs_full_files). Expensive: mode symbol without find_code first on large repos (may scan many files). Free alternative: editor Read on files under ~50 lines. symbol: fuzzy match by name; symbol_id direct lookup; detail_level signature|body|context; targets[] batch (max 8). file: batch 1–20 paths, paginate offset_line. outline: TOC + plain-English overview before 300+ line files. scan/smell: keyword or bug patterns across known files[] only. callers|blast_radius|dead_code: local SQLite call-graph (index builds after first symbol call on that path) — not on hosted without disk; use find_code for remote usage search. Call when: symbol or files[] known (from find_code or explain_architecture next_calls). Do NOT when: location unknown (find_code); stack (get_project_context); wiring map (explain_architecture); repo-wide grep (find_code). Pass path (absolute dir) or inline_files. compact:true saves tokens; session_id dedupes across turns. After: summary + next_calls before paging. Read-only.

Input parameters:

- `compact` (boolean): With mode:file|symbol. true = omit line numbers to save tokens.
- `confidence_threshold` (number): With mode:symbol. Min match confidence 0–1 (default 0.5). Raise 0.8 for exact; lower 0.3 to explore.
- `context_path` (string): With mode:symbol. File path hint for ranking (e.g. src/auth.ts when repo has many auth symbols).
- `detail_level` (string): With mode:symbol. signature=~100 tokens. body=full implementation (default). context=body+imports.
- `files` (array): With mode:file|outline. Relative paths — from find_code hits. File mode: every path returns in one call (truncated per file if large, never dropped).
- `inline_files` (object): When path disk is unavailable: {"src/auth.ts": ""}. Hosted/private transport fallback.
- `kind` (string): With mode:symbol. Filter to one symbol kind — disambiguate class vs method with same name.
- `limit_lines` (number): With mode:file. Max lines per file. Default: budget-based; set for pagination slices.
- `max_results` (number): mode:symbol — max symbols (default 3, max 10). mode:scan|smell — max hits returned (default 30, max 100).
- `max_tokens` (number): Response size cap (default 2000, max 8000). File batch auto-shares across paths. Lower only if context is tight.
- `mode` (string): symbol=AST extract by name (default). file=batch read files[] (all paths return). outline=file TOC. scan=keyword/pattern hits across files[] (use target or targets). smell=bug-pattern pass on files[]…
- `offset_line` (number): With mode:file. Start line (1-indexed). Use after batch read when data.hint says truncated.
- `path` (string): Project root. Stdio MCP: absolute path to the directory on disk. Hosted transport without local disk: use inline_files instead. Pair files[] paths from find_code.
- `session_id` (string): Dedup across turns — symbols already returned get a stub with symbol_id instead of full body.
- `symbol_id` (string): With mode:symbol. Direct lookup ID from a prior hit (e.g. src/auth.ts::validateUser#function). Skips fuzzy search.
- `target` (string): mode:symbol|callers|blast_radius — symbol name (fuzzy). mode:scan — keyword or regex to find across files[].
- `targets` (array): mode:symbol — batch symbol names (max 8, set max_results:10). mode:scan — multiple keywords in one pass across files[].

### `find_code` (~481 tokens)

Find Code

PREFER over native Grep when location is unknown. Ripgrep + AST ranking across web, mobile, CLI, and monorepos. Envelope: intent, focus, summary, data.matches, files_hit, next_calls, meta.credits (5 hosted). intent: snippet=pasted line; symbol=known name; concept=topic+also_try synonyms; everywhere=rename map (whole_word). include docs|config|data when markdown, JSON, or SQL matter. Call when: where is X, usages, rename prep. DO NOT: known symbol+file (read_code), stack/scripts (get_project_context), wiring (explain_architecture), tests (check_test), packages (check_package), URL audit (audit_headers). After: read summary + next_calls → read_code on top hit. path=absolute dir (stdio) or public Git URL / inline_files (hosted). Token-capped vs raw grep. Read-only.

Input parameters:

- `also_try` (array): Extra keywords merged in parallel. concept=topic synonyms. everywhere=rename variants (crystal, CRYSTAL, crystal-app).
- `case_sensitive` (boolean): true = match exact casing (Crystal vs crystal). Default false.
- `file_pattern` (string): Custom glob; overrides include. Examples: src/**/*.ts, **/*.md.
- `include` (string): Limit file types. code=src. docs=md/readme. config=json/yaml. data=sql/prisma. all=default.
- `inline_files` (object): Hosted MCP only: {"path/to/file.ts": "file contents"}. Use when path disk is unavailable.
- `intent` (string): Search mode. snippet=paste exact line. symbol=find definition. concept=topic hunt. everywhere=all hits before rename.
- `path` (string): Project folder to search. Local MCP: absolute path (/Users/jane/myapp). Hosted MCP: public GitHub URL or inline_files.
- `query` (string, required): Required. Text to find: pasted editor line, symbol name (validateToken), or topic keyword (encrypt).
- `response_format` (string): concise=line preview per hit. detailed=full function/class block when AST available.
- `whole_word` (boolean): With intent everywhere. true = whole word only (Crystal not Crystalline). Use before renames.

### `audit_headers` (~646 tokens)

Audit HTTP Headers

Audit a public HTTPS URL the user deployed — security grade A–F, SSL, headers, cookies, health (ALIVE/DEGRADED/BROKEN), exposed secrets, tech stack. Read plain_summary first; only drill into security_headers or secrets if grade is poor. quick ~1–3s; scan_depth=deep for secret scan (~8–12s). 6 credits hosted. Call when user pastes a live URL — post-deploy check, is it secure, what framework, exposed keys. Blocks localhost/private IPs. NOT for repo code (find_code), packages (check_package), tests (check_test), or project layout (get_project_context). Example: audit_headers({ url: 'https://myapp.vercel.app' }). Read-only.

Input parameters:

- `check_apis` (boolean): Probe /api/health and common API paths — adds ~1-2s (default: false)
- `check_cookies` (boolean): Check cookie Secure/HttpOnly/SameSite flags (default: true)
- `check_headers` (boolean): Grade all security headers and return fix snippets when include_fix_snippets=true (default: true)
- `check_health` (boolean): Site health: verdict, trust score, load time, page title (default: true)
- `check_network` (boolean): HTTP network timing table — slow requests, API probes (default: true)
- `check_redirects` (boolean): Follow and audit the full redirect chain (default: true)
- `check_secrets` (boolean): Secret scan: HTML/JS keys, exposed .env/.git, GraphQL (default: true; depth via scan_depth)
- `check_ssl` (boolean): Check SSL certificate validity, expiry, and protocol (default: true)
- `check_tech` (boolean): Tech stack: framework, hosting, CDN, third-party (default: true)
- `focus` (string): Trim output layers (default: all)
- `include_fix_snippets` (boolean): Include Nginx/Vercel/Next fix snippets — token-heavy (default: false)
- `path` (string): Optional subpath (e.g. /checkout) — appended to url
- `probe_engine` (string): fetch=HTTP only (default); browser=headless Chrome on Zephex servers for console errors + browser network (falls back to fetch with warning if unavailable)
- `scan_depth` (string): quick=light scan, 3 bundles (default); deep=full supply URL phase with JWT decode, source maps, verification (~8-12s)
- `scan_mode` (string): quick=~1-3s (default); thorough=DNS+APIs+secrets ~5-12s
- `security_depth` (string): basic=fast (default); full adds DNS SPF/DMARC/DKIM + HSTS preload lookup
- `timeout_ms` (number): Max scan time in ms (default: 8000, max: 15000)
- `url` (string, required): Public https:// URL to audit — e.g. https://myapp.vercel.app or https://zephex.dev

### `keep_thinking` (~588 tokens)

Structured Reasoning

Structure multi-step debugging and planning across tool calls — not a one-shot think. Tracks hypotheses, observations, plans; detects loops via lastActions; riskLevel high/critical blocks dangerous edits (drop table, prod deploy). Loads projectBrief (stack, key_paths, project_memory recall) on local project. On close, suggestedRemember → call project_memory remember. 4 credits hosted. Hard cap 10 thoughts/session. Call when: stuck after 2+ failed debug attempts, auth/billing/schema change spans 3+ files, flaky test you cannot explain, or you need a plan before editing. Pass lastActions (2–5 recent tool calls), goalAnchor after thought 2, sessionId to resume, area for subsystem. NOT when fix is known, single typo, repeating without new evidence, or session ended (nextThoughtNeeded:false). Read thoughtConfirmed and shouldContinue first. Legacy alias: thinking. Example: keep_thinking({ thought: 'Hypothesis: refresh token not rotated in middleware', thoughtType: 'hypothesis', thoughtNumber: 1, totalThoughts: 5, nextThoughtNeeded: true, confidence: 0.6, goalAnchor: 'Fix auth logout loop', lastActions: ['find_code(query=refreshToken)', 'read_code(target=authMiddleware)'], area: 'auth' }). Read-only.

Input parameters:

- `actionReady` (boolean): true when done planning and about to execute edits.
- `area` (string): Subsystem (auth, billing, api) — scopes project_memory recall.
- `assumptions` (array): Up to 5 assumptions; set invalidated:true when contradicted.
- `confidence` (number, required): 0–1. Below 0.5 forces revision. Above 0.85 safe to proceed.
- `goalAnchor` (string): One sentence restating the task — required after thought 2.
- `lastActions` (array): Last 2–5 tool calls as name(arg=val) — identical pair triggers boredLoopDetected.
- `nextThoughtNeeded` (boolean, required): false ends session and writes checkpoint.
- `projectPath` (string): Local project root (stdio defaults to cwd) for projectBrief.
- `revises` (integer): Thought number this revision replaces.
- `sessionId` (string): Resume prior session; restores checkpoint on thought 1.
- `thought` (string, required): Reasoning (20–2000 chars) — file names, symbols, error messages.
- `thoughtNumber` (integer, required): 1-based thought index in this session.
- `thoughtType` (string, required): hypothesis|debug for investigation; plan|conclusion before acting.
- `toolOutputRelevance` (string): Classify last tool result — 3+ noise/error in last 5 triggers loop.
- `totalThoughts` (integer, required): Estimated thoughts needed (revise upward if needed).

### `check_package` (~396 tokens)

Check Package

Check a public registry package before install or version bump — frameworks (next, react, vite), payments (stripe), auth (next-auth, clerk), ORMs (prisma, drizzle). task=check: exists, slopsquat, deprecation, CVEs (pass version); task=upgrade|migrate: breaking_changes + migration_steps from release notes; task=security: CVEs for your version. Returns summary, data, next_calls, meta.credits (5 hosted). No project path — just package name + version. Call BEFORE npm install or bumping next/stripe/prisma. NOT for repo layout (get_project_context), import search (find_code), tests (check_test), architecture (explain_architecture), live URLs (audit_headers). Example: check_package({ package: 'next', task: 'upgrade', from_version: '14.2.0' }). Read-only.

Input parameters:

- `channel` (string): INTERNAL: Zephex terminal CLI only. Agents must omit — returns richer fields than agent-safe JSON.
- `cli_depth` (string): INTERNAL: CLI terminal depth. Agents must omit.
- `ecosystem` (string): Registry (default npm, auto-detected). Omit for next/stripe/prisma.
- `from_version` (string): Version you are upgrading FROM — required for task=upgrade|migrate.
- `package` (string, required): Package name on the public registry — e.g. next, stripe, prisma, express, @supabase/supabase-js.
- `source` (string): Optional. local = read pinned version from disk (stdio only). Prefer passing version/from_version directly.
- `task` (string): check=safe to add? upgrade|migrate=bump plan; security=CVEs; debug=advisories+detail.
- `version` (string): Your installed/pinned version — required for CVE check on task=check|security.

### `check_test` (~731 tokens)

Test Pulse

Run tests and return structured health — fix_first, broken_areas, failure_clusters, coverage_by_area, blind_spots, deploy probes. Not for finding which files to edit (find_code). Workflow: task=detect (0 credits — framework, command, test file count, missing-test gaps) → task=run once (1 credit hosted on success) → task=failures|missing|why|status|fix_prompt on session_id (0 credits, cached session, no re-run). task=missing scans git diff for source files without tests (0 credits, no suite run). meta.credits and meta.charges_usage show billing. Read summary and fix_first first; detail_level=brief on PASS. Call after every substantive edit, when user asks if tests pass or if tests are missing, or before push. Pass diff_base: main for failures_in_diff. area/file_filter scopes re-runs after a full run. Local stdio: absolute project path (runs on your machine). Hosted: public GitHub URL or inline_files — not local disk paths. NOT for symbols (find_code), packages (check_package), stack brief (get_project_context), URL audit (audit_headers). Example: check_test({ task: "detect", path: "/abs/my-app" }) then check_test({ task: "missing", path: "/abs/my-app" }) then check_test({ task: "run", path: "/abs/my-app" }). Does not modify source.

Input parameters:

- `area` (string): Scope to module/area name derived from test paths (e.g. proxy, auth, handlers)
- `command` (string): Override auto-detected test command
- `coverage_top` (number): Max files in coverage slice
- `detail_level` (string): Token budget: brief <500 tokens on PASS; agent default; full=all slices
- `diff_base` (string): Git branch for patch coverage and failures_in_diff (e.g. main) — use after edits
- `failed_only` (boolean): Re-run only tests that failed in the prior session
- `file_filter` (string): Substring or glob fragment to filter test_files (e.g. auth, handlers)
- `include_flaky` (boolean): Include flaky test hints from local history
- `include_missing` (boolean): Git-diff scan for source files without matching tests (default true on detect and when diff_base set)
- `inline_files` (object): Hosted fallback when github is unavailable: { "package.json": "...", "src/foo.test.ts": "..." }. Supports task detect and task run (temp dir on Railway). Include package.json with scripts.test.
- `limit` (number): Max rows for task:history (1–20)
- `path` (string): Project root — absolute path (stdio) or public GitHub URL (hosted). Required for run/detect/missing (or session_id for missing).
- `question` (string): Natural-language follow-up for task:why (e.g. "what failed in proxy?")
- `session_id` (string): Pass back from prior response (ts_*) for session tasks without re-running
- `task` (string): detect=0 credits (inventory+gaps); missing=0 credits (test gaps only); run=1 credit hosted; failures|why|status=0 credits on session_id.
- `timeout_ms` (number): Max run time ms (default 1800000 stdio, capped 600000 hosted)
- `with_coverage` (boolean): Collect lcov coverage (default true)

### `Zephex_dev_info` (~289 tokens)

Zephex Developer Knowledge Base

Expert developer playbooks — not your repo. Stripe webhooks & checkout, Supabase RLS, Next.js auth (clerk, next-auth), payment flows, CSP/HSTS, deploy patterns. operation=search finds entries by question; operation=get returns full guidance by slug from search. Read summary and checklist first. 2 credits hosted. No project path. Call when standard patterns beat guessing — wiring stripe checkout, fixing auth middleware, Supabase RLS policies, hardening after audit_headers. Use AFTER repo tools if code context is still thin. NOT for user's codebase (get_project_context, find_code, read_code), registry packages (check_package), tests (check_test), live URL (audit_headers), or saving decisions (project_memory). Example: Zephex_dev_info({ operation: 'search', query: 'Stripe webhook raw body verification', category: 'payments' }) then get with returned slug. Read-only.

Input parameters:

- `category` (string): Optional search filter — payments, auth, security, databases, etc.
- `operation` (string): search=find by query (first step); get=full entry by slug from search.
- `query` (string): Required for search — e.g. 'Supabase RLS for multi-tenant' or 'Next.js middleware auth'.
- `slug` (string): Required for get — exact slug from a search hit.

### `project_memory` (~598 tokens)

Project Memory

Persists short notes about this project across chat sessions — facts you learned that are not in source code. Not a repo scanner (use get_project_context for stack). remember: saves title (max 80 chars), content (max 500 chars), type, optional area/tags — rejects API keys, tokens, and instruction-poisoning text. recall: keyword search over title/content/area/tags; returns up to 5 matches with content, type, area, age_days (~500 token cap). list: recent titles. forget: delete by uuid. Max 200 memories per project. Types: decision (why we chose X), gotcha (surprise bug), goal (current objective), preference (user style), area_fact (subsystem fact), convention (naming/rules). scope: project (default), personal (cross-project notes), all (search every project with warnings). Call when: user says remember/recall/last time; before auth/billing/deploy where past choices matter; after a non-obvious fix worth saving; new session on same repo. Do not call when: stack/scripts (get_project_context), finding code (find_code), fact already in this chat. After recall: apply matches directly — do not re-scan the repo. Use the same path on remember, recall, and list (stdio: optional, uses cwd). Stdio stores in ~/.zephex SQLite; hosted stores in cloud per user.

Input parameters:

- `action` (string, required): remember=save a fact, recall=keyword search, list=recent titles, forget=delete by id
- `area` (string): Subsystem label (auth, billing, deploy) — included in search index for scoped recall. Max 64 chars.
- `content` (string): Required for remember. Max 500 chars. Paraphrase, not file dumps.
- `id` (string): Required for forget. Memory uuid.
- `limit` (number): recall/list cap. Default 5, max 10.
- `path` (string): Project bucket — use the same absolute path on remember, recall, and list. Stdio: optional (defaults to editor cwd). Hosted: reuse normalized_path from the remember response.
- `query` (string): Required for recall. Short keywords from the title or topic (e.g. auth middleware stripe).
- `scope` (string): project=current DB, personal=~/.zephex personal, all=cross-project with warnings.
- `tags` (array): Optional lowercase tags. Max 10.
- `title` (string): Required for remember. Max 80 chars.
- `type` (string): Required for remember. decision=chose an approach; gotcha=non-obvious bug; goal=what we are building toward; preference=user style; area_fact=fact about a subsystem; convention=naming or process rule.
- `written_by` (string): Who authored this memory.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/tanbir404-zephex/zephex#diagnostics

## Score history

- 2026-08-03: 72
- 2026-08-02: 71
- 2026-08-01: 71
- 2026-07-31: 70
- 2026-07-30: 62
- 2026-07-29: 61
- 2026-07-28: 60
- 2026-07-27: 60
- 2026-07-26: 59

## Links

- Remote endpoint: https://zephex.dev/mcp
- Authorisation metadata: https://zephex.dev/.well-known/oauth-protected-resource/mcp
- Website: https://zephex.dev/
- Changelog RSS feed: https://verifymcp.io/servers/tanbir404-zephex/zephex/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/tanbir404-zephex/zephex/changelog.json
- HTML version of this page: https://verifymcp.io/servers/tanbir404-zephex/zephex