Thalovant MCP

NPM · @THALOVANT/MCP-SERVER · 2 COMPONENTS · SCANNED AUG 3

Connect MCP clients to Thalovant control-plane and hub runtime APIs over stdio or Streamable HTTP.

Available components

npm · @thalovant/mcp-server 31 oci · ghcr.io/thalovant/thalovant-mcp:0.1.7 9

−11 this week 31 31 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security38

Malware scan not yet available for this package.Unverified
Only part of the dependency tree could be resolved (139 of 144), so this covers what we could see, not the whole tree.Partial
No install/post-install scripts declared.Pass
Only part of the dependency tree could be resolved (139 of 144), so this covers what we could see, not the whole tree. View diagnostics → Partial

Provenance & Transparency97

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Cryptographically verified build provenance (signed, bound to thalovant/thalovant-mcp). View diagnostics → Pass
Clear OSI-approved license (MIT).Pass
Actively maintained (last published 0 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability0

Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.Unverified

Stability & Change Management0

Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.Unverified

Tool Coverage0

Tool coverage not yet verified: we do not have a sandbox capture of the tool definitions this version of the package serves yet.Unverified

Capabilities0

Protocol version not yet verified: we do not have a sandbox capture of the MCP handshake this version of the package performs yet.Unverified

Unverified: 4 categories

Categories scored 0 because our sandbox run of this package has not given us the schema these checks need to read. That is a gap on our side rather than a finding about the package, and we only credit what we can confirm, so the score stands at 0 until the capture succeeds. We are working through the fleet, so this normally clears without any action from you. How we score packages →

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · @thalovant/mcp-server

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add thalovant-thalovant-mcp -- npx -y @thalovant/mcp-server

# add to Codex CLI

codex mcp add thalovant-thalovant-mcp -- npx -y @thalovant/mcp-server

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "thalovant-thalovant-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@thalovant/mcp-server"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add thalovant-thalovant-mcp --command npx --arg -y --arg @thalovant/mcp-server

# ~/.hermes/config.yaml

mcp_servers:
  thalovant-thalovant-mcp:
    command: "npx"
    args: ["-y", "@thalovant/mcp-server"]

// mcp.json

{
  "mcpServers": {
    "thalovant-thalovant-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@thalovant/mcp-server"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

3 Aug 26 −40
- Malware scan: pass → unverified ▼ security
- Stability: 0.20 → unverified ▼ security
- Tool coverage: 100 → unverified ▼ functional
- Capabilities: pass → unverified ▼ functional
- Package version: 0.1.6 → 0.1.7 functional
2 Aug 26 +48
- Known CVEs: unverified → partial ▲ security
- Install scripts: unverified → pass ▲ security
- Provenance: unverified → pass ▲ security
- Malware scan: unverified → pass ▲ security
- Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. security
- The attested source repository moved: thalovant/thalovant-mcp security
- Capabilities: pass → unverified ▼ functional
- License: unverified → pass ▲ functional
- Stability: unverified → 0.20 ▲ functional
- Maintenance: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- Schema quality: unverified → fair ▲ functional
- Licence: MIT functional
1 Aug 26 +18
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- Tool coverage: unverified → 100 ▲ functional
- MCP protocol: unverified → pass ▲ functional
31 Jul 26 −37
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
27 Jul 26 42

First indexed and scored.

Show 2 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/@thalovant/[email protected]

Provenance verified

Ecosystem: npm · Outcome: verified

Reason: verified

Source repo:: thalovant/thalovant-mcp
Certificate issuer:: https://token.actions.githubusercontent.com
Certificate SAN:: https://github.com/thalovant/thalovant-mcp/.github/workflows/release.yml@refs/tags/v0.1.7
Rekor log index:: 2334934142
Predicate type:: https://slsa.dev/provenance/v1
Subject digest:: sha512:a703e8d4ae06c62172bd0b6afb083cc22acb5e0187b3deb08c2a43573651944b810dcd2198bcf06c1a36ddf6a829a56d845dfc6707761fdf2ccbcd85d
Discovery method:: attestation_endpoint

Dependencies 139 packages

139 packages in the resolved dependency tree · 121 deprecated · 51 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 20 exposed · ~2,356 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

thalovant_ask Ask Hub ~174

Send one text request to a Thalovant hub using a saved identity and return the normalized reply.

Input Output Examples

Name	Type	Req	Description
configPath	string	—	Path to a Thalovant SDK config file.
context	object	—	—
emptyReplyWaitMs	integer	—	—
fromEnv	boolean	—	Load the identity from Thalovant SDK environment variables.
identityFile	string	—	Path to a Thalovant identity JSON file.
lang	string	—	—
profile	string	—	SDK config profile name.
protocol	string	—	Runtime transport protocol.
replySettleMs	integer	—	—
requestId	string	—	—
sessionId	string	—	—
text	string	yes	—
timeoutMs	integer	—	—

No output schema declared.

No examples provided.

thalovant_config_status Thalovant Config Status ~25

Inspect local Thalovant MCP configuration without revealing secret values.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

thalovant_create_client_identity Create Client Identity ~189

Create a Thalovant client identity for a hub. The identity is secret; output is redacted unless savePath is used.

Input Output Examples

Name	Type	Req	Description
active	boolean	—	—
apiUrl	string	—	Control-plane base URL. Defaults to https://api.thalovant.com.
hubId	string	yes	Hub id or slug accepted by the Thalovant SDK.
idempotencyKey	string	—	—
loginScope	string	—	Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD.
name	string	yes	—
ownerId	string	—	—
preferredProtocols	array	—	—
savePath	string	—	Optional local file path for the full secret identity JSON. File mode is set to 0600.
siteId	string	—	—
spec	object	—	—

No output schema declared.

No examples provided.

thalovant_create_memory_item Create Memory Item ~167

Create an explicit Thalovant memory item.

Input Output Examples

Name	Type	Req	Description
apiUrl	string	—	Control-plane base URL. Defaults to https://api.thalovant.com.
consentScope	string	—	—
consentVersion	string\|null	—	—
content	string	yes	—
expiresAt	string\|null	—	—
hubId	string	—	—
kind	string	—	—
loginScope	string	—	Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD.
metadata	object	—	—
ownerId	string	—	—
retentionPolicy	string	—	—
scope	string	—	—
source	string	—	—
tags	array	—	—
title	—	—	—

No output schema declared.

No examples provided.

thalovant_delete_memory_item Delete Memory Item ~77

Delete one Thalovant memory item.

Input Output Examples

Name	Type	Req	Description
apiUrl	string	—	Control-plane base URL. Defaults to https://api.thalovant.com.
loginScope	string	—	Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD.
memoryId	string	yes	—

No output schema declared.

No examples provided.

thalovant_emit_event Emit Event ~134

Emit a raw Thalovant event to a hub. Use only when a more specific runtime tool is not enough.

Input Output Examples

Name	Type	Req	Description
configPath	string	—	Path to a Thalovant SDK config file.
context	object	—	—
data	object	—	—
eventType	string	yes	—
fromEnv	boolean	—	Load the identity from Thalovant SDK environment variables.
identityFile	string	—	Path to a Thalovant identity JSON file.
profile	string	—	SDK config profile name.
protocol	string	—	Runtime transport protocol.

No output schema declared.

No examples provided.

thalovant_get_analytics_overview Analytics Overview ~176

Read authenticated Thalovant analytics overview data.

Input Output Examples

Name	Type	Req	Description
admin	boolean	—	—
apiUrl	string	—	Control-plane base URL. Defaults to https://api.thalovant.com.
bucket	string	—	—
clientId	string	—	—
country	string	—	—
hour	integer	—	—
hubId	string	—	—
intent	string	—	—
loginScope	string	—	Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD.
message	string	—	—
ownerId	string	—	—
range	string	—	—
timeEnd	string	—	—
timeStart	string	—	—
utterance	string	—	—
weekday	integer	—	—

No output schema declared.

No examples provided.

thalovant_get_hub Get Hub ~79

Fetch one authenticated Thalovant hub by id.

Input Output Examples

Name	Type	Req	Description
apiUrl	string	—	Control-plane base URL. Defaults to https://api.thalovant.com.
hubId	string	yes	—
loginScope	string	—	Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD.

No output schema declared.

No examples provided.

thalovant_get_memory_item Get Memory Item ~78

Read one authenticated Thalovant memory item.

Input Output Examples

Name	Type	Req	Description
apiUrl	string	—	Control-plane base URL. Defaults to https://api.thalovant.com.
loginScope	string	—	Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD.
memoryId	string	yes	—

No output schema declared.

No examples provided.

thalovant_get_memory_summary Memory Summary ~78

Read authenticated Thalovant memory summary data.

Input Output Examples

Name	Type	Req	Description
apiUrl	string	—	Control-plane base URL. Defaults to https://api.thalovant.com.
loginScope	string	—	Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD.
ownerId	string	—	—

No output schema declared.

No examples provided.

thalovant_get_public_hub Get Public Hub ~63

Fetch one public Thalovant hub by id or slug.

Input Output Examples

Name	Type	Req	Description
apiUrl	string	—	Control-plane base URL. Defaults to https://api.thalovant.com.
hubRef	string	yes	Public hub id or slug.

No output schema declared.

No examples provided.

thalovant_healthcheck Runtime Healthcheck ~114

Connect to a Thalovant hub with a saved identity and return runtime transport health.

Input Output Examples

Name	Type	Req	Description
configPath	string	—	Path to a Thalovant SDK config file.
fromEnv	boolean	—	Load the identity from Thalovant SDK environment variables.
identityFile	string	—	Path to a Thalovant identity JSON file.
profile	string	—	SDK config profile name.
protocol	string	—	Runtime transport protocol.
timeoutMs	integer	—	—

No output schema declared.

No examples provided.

thalovant_identity_status Identity Status ~104

Load a Thalovant identity and return redacted protocol and endpoint status.

Input Output Examples

Name	Type	Req	Description
configPath	string	—	Path to a Thalovant SDK config file.
fromEnv	boolean	—	Load the identity from Thalovant SDK environment variables.
identityFile	string	—	Path to a Thalovant identity JSON file.
profile	string	—	SDK config profile name.
protocol	string	—	Runtime transport protocol.

No output schema declared.

No examples provided.

thalovant_list_hubs List Visible Hubs ~94

List authenticated Thalovant hubs visible to the account.

Input Output Examples

Name	Type	Req	Description
apiUrl	string	—	Control-plane base URL. Defaults to https://api.thalovant.com.
cursor	string	—	—
limit	integer	—	—
loginScope	string	—	Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD.
ownerId	string	—	—

No output schema declared.

No examples provided.

thalovant_list_memory_items List Memory Items ~136

List authenticated Thalovant memory items.

Input Output Examples

Name	Type	Req	Description
apiUrl	string	—	Control-plane base URL. Defaults to https://api.thalovant.com.
hubId	string	—	—
includeDeleted	boolean	—	—
includeExpired	boolean	—	—
kind	string	—	—
limit	integer	—	—
loginScope	string	—	Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD.
offset	integer	—	—
ownerId	string	—	—
query	string	—	—
scope	string	—	—

No output schema declared.

No examples provided.

thalovant_list_public_hubs List Public Hubs ~69

List Thalovant public hubs. This read-only discovery call does not require authentication.

Input Output Examples

Name	Type	Req	Description
apiUrl	string	—	Control-plane base URL. Defaults to https://api.thalovant.com.
cursor	string	—	—
limit	integer	—	—

No output schema declared.

No examples provided.

thalovant_send_action Send Action ~145

Send a structured action payload to a Thalovant hub.

Input Output Examples

Name	Type	Req	Description
configPath	string	—	Path to a Thalovant SDK config file.
context	object	—	—
fromEnv	boolean	—	Load the identity from Thalovant SDK environment variables.
identityFile	string	—	Path to a Thalovant identity JSON file.
lang	string	—	—
payload	string	yes	—
profile	string	—	SDK config profile name.
protocol	string	—	Runtime transport protocol.
requestId	string	—	—
sessionId	string	—	—
title	string	—	—

No output schema declared.

No examples provided.

thalovant_send_code Send Code ~161

Send an exact typed, scanned, barcode, QR, or serial value to a Thalovant hub.

Input Output Examples

Name	Type	Req	Description
configPath	string	—	Path to a Thalovant SDK config file.
context	object	—	—
fromEnv	boolean	—	Load the identity from Thalovant SDK environment variables.
identityFile	string	—	Path to a Thalovant identity JSON file.
kind	string	—	—
label	string	—	—
lang	string	—	—
profile	string	—	SDK config profile name.
protocol	string	—	Runtime transport protocol.
requestId	string	—	—
sessionId	string	—	—
value	string	yes	—

No output schema declared.

No examples provided.

thalovant_update_memory_item Update Memory Item ~154

Update an explicit Thalovant memory item.

Input Output Examples

Name	Type	Req	Description
apiUrl	string	—	Control-plane base URL. Defaults to https://api.thalovant.com.
clearExpiresAt	boolean	—	—
consentScope	string	—	—
consentVersion	string\|null	—	—
content	string	—	—
expiresAt	string\|null	—	—
kind	string	—	—
loginScope	string	—	Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD.
memoryId	string	yes	—
metadata	object	—	—
retentionPolicy	string	—	—
tags	array	—	—
title	—	—	—

No output schema declared.

No examples provided.

thalovant_wait_for_event Wait For Event ~139

Wait for one named hub event using a saved identity.

Input Output Examples

Name	Type	Req	Description
configPath	string	—	Path to a Thalovant SDK config file.
context	object	—	—
eventName	string	yes	—
fromEnv	boolean	—	Load the identity from Thalovant SDK environment variables.
identityFile	string	—	Path to a Thalovant identity JSON file.
profile	string	—	SDK config profile name.
protocol	string	—	Runtime transport protocol.
requestId	string	—	—
sessionId	string	—	—
timeoutMs	integer	—	—

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

27 Jul 3 Aug