# Basis (npm · @basis1/mcp)

Parse Excel workbooks, evaluate formulas, trace dependencies and edit workbook models.

- Trust score: 65/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- remote · `api.basis1.tech`: 33/100, [markdown](https://verifymcp.io/servers/tech-basis1-mcp/api.md), [page](https://verifymcp.io/servers/tech-basis1-mcp/api)
- npm · `@basis1/mcp`: 65/100 (this document), [markdown](https://verifymcp.io/servers/tech-basis1-mcp/basis1-mcp.md), [page](https://verifymcp.io/servers/tech-basis1-mcp/basis1-mcp)

## Channel facts

- Registry: `npm`
- Package: `@basis1/mcp`
- Version: `0.1.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Supply Chain Security**: 100/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 0 of 1 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 19/100
  - Repository check failed: the declared repository URL returned HTTP 404.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (Apache-2.0).
  - Actively maintained (last published 1 days ago).
  - Security-disclosure policy not yet verified: we couldn't inspect the source repository.
- **Schema Quality & AI Usability**: 75/100
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 2387 tokens (~99/item across 24 items; 24 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 24 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 24 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### How do I install the Basis MCP server?

Basis runs locally as an npm package, launched with npx -y @basis1/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add tech-basis1-mcp -- npx -y @basis1/mcp
```

### Cursor

```json
{
  "mcpServers": {
    "tech-basis1-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@basis1/mcp"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "tech-basis1-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@basis1/mcp"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add tech-basis1-mcp -- npx -y @basis1/mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "tech-basis1-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@basis1/mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add tech-basis1-mcp --command npx --arg -y --arg @basis1/mcp
```

### Hermes

```yaml
mcp_servers:
  tech-basis1-mcp:
    command: "npx"
    args: ["-y", "@basis1/mcp"]
```

### Netclaw

```json
{
  "McpServers": {
    "tech-basis1-mcp": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "@basis1/mcp"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add tech-basis1-mcp -t stdio -c npx -a -y @basis1/mcp
```

### Other

```json
{
  "mcpServers": {
    "tech-basis1-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@basis1/mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-05 (score 65, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-11-04 (score 50)

First indexed and scored.

## MCP tools (24)

### `parse_workbook` (~135 tokens)

Parse workbook

Parse an .xlsx workbook on the Basis API and return the full semantic NDJSON output (workbook_meta, sheet, cell, edge, image, image_summary, audit records). Handles small vs. large files transparently. The file is uploaded to the Basis API.

Input parameters:

- `base64` (string): Base64-encoded .xlsx file bytes
- `path` (string): Local filesystem path to an .xlsx file (read on this machine, then uploaded)
- `url` (string): URL to fetch the .xlsx file from
- `webhook_url` (string): HMAC-signed POST here when the parse completes

### `submit_job` (~115 tokens)

Submit parse job

Submit an .xlsx workbook to the Basis API for async parsing and get back a job handle (job_id, status_url, stream_url) without waiting for it to finish.

Input parameters:

- `base64` (string): Base64-encoded .xlsx file bytes
- `path` (string): Local filesystem path to an .xlsx file (read on this machine, then uploaded)
- `url` (string): URL to fetch the .xlsx file from
- `webhook_url` (string): HMAC-signed POST here when the parse completes

### `get_job_status` (~35 tokens)

Get job status

Check the status of a parse job submitted via submit_job.

Input parameters:

- `job_id` (string, required): Job ID returned by submit_job

### `stream_job` (~56 tokens)

Stream job output

Fetch the NDJSON output of a completed parse job. Pass `since` to resume from a record index.

Input parameters:

- `job_id` (string, required): Job ID returned by submit_job
- `since` (integer): Record index to resume from

### `diff_workbooks` (~236 tokens)

Diff workbooks

Compare two .xlsx workbooks and return the cell-level differences as JSON. Both files are parsed on the Basis API, joined on (sheet title, cell ref) and classified into added, removed, and changed (value and/or formula), with format-only changes bucketed separately. Provide exactly one of before_path/before_url/before_base64 and one of after_path/after_url/after_base64.

Input parameters:

- `after_base64` (string): Base64-encoded bytes of the second (after) .xlsx file
- `after_path` (string): Local filesystem path to the second (after) .xlsx file
- `after_url` (string): URL to fetch the second (after) .xlsx file from
- `before_base64` (string): Base64-encoded bytes of the first (before) .xlsx file
- `before_path` (string): Local filesystem path to the first (before) .xlsx file
- `before_url` (string): URL to fetch the first (before) .xlsx file from
- `include_format` (boolean): Report cells whose only change is number format (default true)

### `evaluate_formula` (~233 tokens)

Evaluate formula

Evaluate an Excel formula and return the computed result. Pass data as a map of cell references to values (e.g. {"A1": 100, "A2": 200, "B1": "hello"}) and a formula string (e.g. "SUM(A1:A2)"). The formula is placed in the first unused cell and recalculated. Supports 276 Excel functions: math, financial (NPV, IRR, XIRR, PMT, PRICE, YIELD…), statistical distributions, regression, lookup, date/time, text, logical, and dynamic arrays (FILTER, SORT, UNIQUE, SEQUENCE, CHOOSECOLS, TAKE, DROP). Runs on the Basis API (needs an API key).

Input parameters:

- `data` (object): Cell data to populate before evaluating. Keys are cell references like "A1", "B2". Values can be numbers, strings, or booleans.
- `formula` (string, required): Excel formula to evaluate (without the leading '='), e.g. "SUM(A1:A2)" or "NPV(0.08,B1:B5)"

### `create_session` (~159 tokens)

Create session

Create a persistent computation session for a workbook. Pass path/base64/url for xlsx input, or omit all for a blank model. Returns a session_id for subsequent calls. The workbook is uploaded to the Basis API and held there for the session. Pass library_file_id instead to open a file from your Library.

Input parameters:

- `base64` (string): Base64-encoded .xlsx file bytes
- `calc` (object): Iterative-calculation settings for circular models
- `document_id` (string): Display label for this session
- `library_file_id` (string): Library file ID to load
- `path` (string): Local filesystem path to an .xlsx file
- `url` (string): URL to fetch the .xlsx file from

### `close_session` (~29 tokens)

Close session

Close a computation session and release its resources.

Input parameters:

- `session_id` (string, required): Session ID to close

### `list_sessions` (~14 tokens)

List sessions

List all active computation sessions.

### `add_sheet` (~64 tokens)

Add sheet

Add a new sheet to a session's workbook. The new sheet becomes the active sheet. Only works on sessions created from blank documents (not imported xlsx files).

Input parameters:

- `name` (string, required): Display name for the new sheet
- `session_id` (string, required): Session ID

### `rename_sheet` (~111 tokens)

Rename sheet

Rename a sheet in a session's workbook. Formulas, named ranges and validations that reference the sheet are rewritten to the new name, so results don't change. Excel's rules apply: 1-31 characters, none of : \ / ? * [ ], no leading or trailing apostrophe, unique ignoring case.

Input parameters:

- `name` (string, required): New display name for the sheet
- `session_id` (string, required): Session ID
- `sheet_index` (integer, required): 0-based index of the sheet to rename

### `set_inputs` (~75 tokens)

Set inputs

Set one or more input values in a session and recalculate. Keys can be defined names or cell references. Returns applied changes and which named outputs changed (effects).

Input parameters:

- `inputs` (object, required): Map of name-or-ref to value. Example: {"Revenue": 1000000}
- `session_id` (string, required): Session ID

### `set_calc_settings` (~166 tokens)

Set calc settings

Turn iterative calculation on or off for a session and recalculate. Needed for circular models (e.g. development pro formas where loan size depends on cost, which includes the loan's interest and fees): with it on, set_inputs re-converges the loop on every call. Saved with the session's next commit (restore_session to an earlier commit rolls it back) and written to the workbook, so an exported xlsx iterates in Excel too.

Input parameters:

- `iterative` (boolean, required): Enable iterative calculation (Excel: Enable iterative calculation)
- `max_change` (number): Converged once no value moves more than this (Excel default 0.001)
- `max_iterations` (integer): Maximum passes (Excel default 100)
- `session_id` (string, required): Session ID

### `get_outputs` (~54 tokens)

Get outputs

Read computed values from a session. Pass specific names/refs, or omit to read all defined names.

Input parameters:

- `names` (array): Specific defined names or cell refs to read
- `session_id` (string, required): Session ID

### `define_variable` (~83 tokens)

Define variable

Create or retarget a named variable in the session's workbook.

Input parameters:

- `name` (string, required): Variable name (e.g. "Revenue")
- `refers_to` (string, required): Cell reference (e.g. "Sheet1!$A$1")
- `scope_sheet` (integer): Sheet index for sheet-scoped name
- `session_id` (string, required): Session ID

### `inspect_model` (~50 tokens)

Inspect model

Inspect a session's model structure: sheets, defined names, stats, and optionally dependency edges.

Input parameters:

- `include_edges` (boolean): Include the formula dependency graph
- `session_id` (string, required): Session ID

### `get_cell_formula` (~97 tokens)

Get cell formula

Read the formula source text and computed value for a single cell in a session. Returns whether the cell contains a formula, the formula text (with = prefix), the computed value, and value type. Use to inspect what a cell actually computes.

Input parameters:

- `cell` (string, required): Cell reference, optionally with sheet prefix (e.g. "B4" or "Sheet1!B4")
- `session_id` (string, required): Session ID

### `trace_dependencies` (~139 tokens)

Trace dependencies

Trace the formula dependency graph for a cell in a session. Returns precedents (cells this cell references) and/or dependents (cells that reference this cell), with their formulas and values. Use to understand calculation chains, debug circular refs, and find the root cause of errors.

Input parameters:

- `cell` (string, required): Cell reference, optionally with sheet prefix (e.g. "B4" or "Sheet1!B4")
- `depth` (integer): How many levels deep to trace (default 1, max 5)
- `direction` (string): Which direction to trace (default "both")
- `session_id` (string, required): Session ID

### `audit_workbook` (~60 tokens)

Audit workbook

Run a comprehensive audit of a session's workbook. Returns statistics on sheets, cells, formulas, errors, named ranges, and the dependency graph. Use to get an overview of model structure before making changes.

Input parameters:

- `session_id` (string, required): Session ID

### `get_formula_range` (~91 tokens)

Get formula range

Batch-read formulas and computed values for a rectangular range of cells. Returns an array of {cell, formula, value, value_type} for each cell in the range. Much more efficient than calling get_cell_formula repeatedly.

Input parameters:

- `range` (string, required): Range address, e.g. "A1:D10" or "Sheet1!B2:F2"
- `session_id` (string, required): Session ID

### `commit_session` (~90 tokens)

Commit session

Create a named checkpoint of the session's current state. Returns the commit ID which can be passed to restore_session to roll back. Checkpoints live in the session only; to keep one in the Library's version history, call save_to_library after it (the version takes this message as its name).

Input parameters:

- `message` (string, required): Short description of the checkpoint
- `session_id` (string, required): Session ID

### `restore_session` (~66 tokens)

Restore session

Roll back a session to a previous commit. Reverts all cell changes made since that commit. Returns the number of cells that were changed by the rollback.

Input parameters:

- `commit_id` (integer, required): Commit ID to restore to (from commit_session)
- `session_id` (string, required): Session ID

### `snapshot_session` (~55 tokens)

Snapshot session

Export the session's current state as xlsx bytes (base64). Optionally creates a commit first.

Input parameters:

- `commit_message` (string): If provided, creates a commit before saving
- `session_id` (string, required): Session ID

### `save_to_library` (~174 tokens)

Save to Library

Save the session's workbook to the user's Library for durable storage. If the session was loaded from the Library or was previously saved, this creates a new version of that file. Otherwise it creates a new Library file. Each save is a named version in the Library's history: pass `message`, or it takes the latest commit_session message since the last save. commit_session checkpoints themselves stay in the session, so save after each step you want kept as a version. Requires a Basis API key. Returns the library_file_id.

Input parameters:

- `message` (string): Name for this version in the Library, e.g. "23 — revised exit cap" (defaults to the latest commit_session message)
- `name` (string): File name (defaults to the session's document label)
- `session_id` (string, required): Session ID

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/tech-basis1-mcp/basis1-mcp#diagnostics

## Score history

- 2026-11-05: 65
- 2026-11-04: 50

## Common questions

### What is the Basis MCP server?

Basis is an MCP server listed in the public MCP registry as tech.basis1/mcp. Parse Excel workbooks, evaluate formulas, trace dependencies and edit workbook models. This page covers its npm package (@basis1/mcp).

### Is the Basis MCP server safe to use?

Basis scores 65 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Basis MCP server expose?

Basis exposes 24 tools: parse_workbook, submit_job, get_job_status, stream_job, diff_workbooks, and 19 more. Their descriptions and schemas cost roughly 2,387 tokens of context every time the server is loaded.

### Is the Basis MCP server still maintained?

Basis is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the Basis MCP server under?

Basis declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/@basis1/mcp
- Socket report: https://socket.dev/npm/package/@basis1/mcp
- Website: https://basis1.tech/
- Changelog RSS feed: https://verifymcp.io/servers/tech-basis1-mcp/basis1-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/tech-basis1-mcp/basis1-mcp.json
- HTML version of this page: https://verifymcp.io/servers/tech-basis1-mcp/basis1-mcp