Thalovant MCP
NPM · @THALOVANT/MCP-SERVER · 2 COMPONENTS · SCANNED SEP 20
Connect MCP clients to Thalovant control-plane and hub runtime APIs over stdio or Streamable HTTP.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 51 of 142 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to thalovant/thalovant-mcp). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 0 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability54
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 9486 tokens (~206/item across 46 items; 46 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management87
- Stability observed for 26 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage89
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 67% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 9 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 46 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the Thalovant MCP server?
Thalovant MCP runs locally as an npm package, launched with npx -y @thalovant/mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @thalovant/mcp-server
claude mcp add thalovant-thalovant-mcp -- npx -y @thalovant/mcp-server
{
"mcpServers": {
"thalovant-thalovant-mcp": {
"command": "npx",
"args": [
"-y",
"@thalovant/mcp-server"
]
}
}
} {
"servers": {
"thalovant-thalovant-mcp": {
"command": "npx",
"args": [
"-y",
"@thalovant/mcp-server"
]
}
}
} codex mcp add thalovant-thalovant-mcp -- npx -y @thalovant/mcp-server
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"thalovant-thalovant-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"@thalovant/mcp-server"
],
"enabled": true
}
}
} openclaw mcp add thalovant-thalovant-mcp --command npx --arg -y --arg @thalovant/mcp-server
mcp_servers:
thalovant-thalovant-mcp:
command: "npx"
args: ["-y", "@thalovant/mcp-server"] {
"McpServers": {
"thalovant-thalovant-mcp": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@thalovant/mcp-server"
]
}
}
} assistant mcp add thalovant-thalovant-mcp -t stdio -c npx -a -y @thalovant/mcp-server
{
"mcpServers": {
"thalovant-thalovant-mcp": {
"command": "npx",
"args": [
"-y",
"@thalovant/mcp-server"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +15
- Malware scan: unverified → pass ▲ security
- 19 Sept 26 −14
- Malware scan: pass → unverified ▼ security
- Package version: 0.5.1 → 0.5.2 functional
- 17 Sept 26 −3
- Stability: pass → 0.77 functional
- 16 Sept 26 0
- Stability: 0.97 → pass security
- 15 Sept 26 0
- Stability: pass → 0.97 functional
- 14 Sept 26 +26
- Known CVEs: unverified → pass ▲ security
- Malware scan: unverified → pass ▲ security
- Stability: 0.97 → pass security
- Dependency health: unverified → 0.83 ▲ functional
- 13 Sept 26 −1
- Known CVEs: unverified → pass ▲ security
- Malware scan: unverified → pass ▲ security
- Dependency health: unverified → 0.83 ▲ functional
- Stability: pass → 0.97 functional
- Package version: 0.4.1 → 0.5.1 functional
- Package version: 0.4.1 → 0.5.0 functional
- 12 Sept 26 −25
- Known CVEs: pass → unverified ▼ security
- Stability: 0.97 → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Malware scan: pass → unverified ▼ security
- Stability: 0.97 → pass security
- Dependency health: 0.83 → unverified ▼ functional
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Package version: 0.1.24 → 0.4.1 functional
- Package version: 0.1.24 → 0.4.0 functional
- Package version: 0.1.24 → 0.3.0 functional
- Package version: 0.1.24 → 0.2.0 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/@thalovant/mcp-server@0.5.2
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | thalovant/thalovant-mcp |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/thalovant/thalovant-mcp/.github/workflows/release.yml@refs/tags/v0.5.2 |
| Rekor log index | 2890722474 |
| Predicate type | https://slsa.dev/provenance/v1 |
| Subject digest | sha512:8f5880b50535530f229aadfb82b71e95530584d80e66572ed7335664e232ba693cfb25e145518e94fd2e3af3efd426e46b3a1152e685540650f9c60ac |
Background: How many MCP packages publish verified provenance →
Dependencies 142 packages
| Packages resolved | 142 |
|---|---|
| Stale | 51 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
thalovant_ask Ask Hub ~246
Send one text request to a Thalovant hub using a saved identity and return the normalized reply.
| Name | Type | Req | Description |
|---|---|---|---|
| configPath | string | – | Path to a Thalovant SDK config file. |
| context | object | – | – |
| emptyReplyWaitMs | integer | – | – |
| fromEnv | boolean | – | Load the identity from Thalovant SDK environment variables. |
| identityFile | string | – | Path to a Thalovant identity JSON file. |
| includeAudio | boolean | – | Include bounded embedded skill clips as MCP audio/resources; default returns metadata without placing audio hex in text. |
| lang | string | – | – |
| location | object | – | Request location, preferred over the hub's configured city. |
| pipeline | array | – | – |
| profile | string | – | SDK config profile name. |
| protocol | string | – | Runtime transport protocol. |
| replySettleMs | integer | – | – |
| requestId | string | – | – |
| sessionId | string | – | – |
| sttLang | string | – | Language recognized by speech-to-text; the hub validates this hint. |
| text | string | yes | – |
| timeoutMs | integer | – | – |
No output schema declared.
No examples provided.
thalovant_clear_hub_rating Clear Hub Rating ~127
Remove the caller's own rating from a public Thalovant hub and return the hub. This clears only the caller's rating, not the hub. Requires the hubs:write scope; no paid plan is needed.
| Name | Type | Req | Description |
|---|---|---|---|
| apiUrl | string | – | Control-plane base URL. Configured credentials may only be used on their configured origin; defaults to https://api.thalovant.com. |
| hubId | string | yes | Hub UUID. |
| loginScope | string | – | Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD. |
No output schema declared.
No examples provided.
thalovant_config_status Thalovant Config Status ~25
Inspect local Thalovant MCP configuration without revealing secret values.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
thalovant_create_client_identity Create Client Identity ~252
Create a Thalovant client identity for a hub. The identity is secret; output is redacted unless savePath is used.
| Name | Type | Req | Description |
|---|---|---|---|
| active | boolean | – | – |
| apiUrl | string | – | Control-plane base URL. Configured credentials may only be used on their configured origin; defaults to https://api.thalovant.com. |
| hubId | string | yes | Hub UUID. This authenticated route rejects slugs; slugs are only accepted by the public hub tools (thalovant_get_public_hub). |
| idempotencyKey | string | – | – |
| loginScope | string | – | Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD. |
| name | string | yes | – |
| ownerId | string | – | – |
| preferredProtocols | array | – | – |
| savePath | string | – | Optional filename for the full secret identity JSON, written 0600 inside the server's identity directory (see identityDir in thalovant_config_status). Pass a plain filename like "my-hub.json"; absolu… |
| siteId | string | – | – |
| spec | object | – | – |
No output schema declared.
No examples provided.
thalovant_create_hub Create Hub ~589
Create a Thalovant hub. Requires the hubs:write scope AND a paid plan: a token without the scope fails 403, and because the scope is checked before the plan, granting the scope can then surface a 402 'API access requires a paid plan'. The create is idempotent — the SDK sends an Idempotency-Key, so a retried create returns the first hub rather than making a second one; reusing a key with a DIFFERENT body fails 409.
| Name | Type | Req | Description |
|---|---|---|---|
| active | boolean | – | Defaults to true. |
| apiUrl | string | – | Control-plane base URL. Configured credentials may only be used on their configured origin; defaults to https://api.thalovant.com. |
| capacityProfile | string | – | Hub capacity profile. Only "standard" (the API default, 1 replica) and "autoscaling" (2-32 replicas) are accepted. Omit the key entirely rather than sending null — an explicit null fails 422 INVALID_… |
| domain | string | – | Max 255 characters. Immutable once created. Plans without custom domains are rejected with 403; when omitted, a managed subdomain is generated if the plan provides one. |
| idempotencyKey | string | – | Reuse the same key to safely retry one create. Reusing it with a different body fails 409. |
| isLocked | boolean | – | – |
| loginScope | string | – | Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD. |
| name | string | yes | Hub name, 1-128 characters. Required. Immutable once created. |
| namespace | string | – | 1-128 characters. Resolved server-side when omitted. Immutable once created. |
| ownerId | string | – | Defaults to the caller. Setting another owner requires admin. |
| runtimeGroupId | string | – | Runtime group UUID to attach the hub to. |
| slug | string | – | 1-191 chars, lowercase alphanumeric segments separated by single hyphens. Defaults to a slug derived from name. Unlike name, slug stays mutable. |
| spec | object | yes | Hub spec object. `version` is REQUIRED and must be a non-empty string — {"version": "1"} is the minimum valid spec; omitting it fails 422 "Schema validation failed". Other keys pass through, and the… |
| visibility | string | – | 1-32 characters, defaults to "private". Only "public" is special-cased by the API, and public listing is plan-gated. |
No output schema declared.
No examples provided.
thalovant_create_memory_item Create Memory Item ~176
Create an explicit Thalovant memory item.
| Name | Type | Req | Description |
|---|---|---|---|
| apiUrl | string | – | Control-plane base URL. Configured credentials may only be used on their configured origin; defaults to https://api.thalovant.com. |
| consentScope | string | – | – |
| consentVersion | – | – | – |
| content | string | yes | – |
| expiresAt | string|null | – | – |
| hubId | string | – | – |
| kind | string | – | – |
| loginScope | string | – | Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD. |
| metadata | object | – | – |
| ownerId | string | – | – |
| retentionPolicy | string | – | – |
| scope | string | – | – |
| source | string | – | – |
| tags | array | – | – |
| title | – | – | – |
No output schema declared.
No examples provided.
thalovant_create_runtime_group Create Runtime Group ~206
Create a Thalovant runtime group — the unit that hosts hubs and holds installed skills. Requires the hubs:write scope and a paid plan. Unlike the hub write routes this one takes no etag.
| Name | Type | Req | Description |
|---|---|---|---|
| apiUrl | string | – | Control-plane base URL. Configured credentials may only be used on their configured origin; defaults to https://api.thalovant.com. |
| cloneFromDefault | boolean | – | Seed the new group from the workspace default group instead of starting empty. |
| description | string | – | Max 255 characters. |
| environment | string | – | 1-32 characters. Lowercased server-side; defaults from server settings. |
| loginScope | string | – | Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD. |
| name | string | yes | Runtime group name, 1-128 characters. Required. |
| ownerId | string | – | Defaults to the caller. Setting another owner requires admin. |
No output schema declared.
No examples provided.
thalovant_delete_memory_item Delete Memory Item ~89
Delete one Thalovant memory item.
| Name | Type | Req | Description |
|---|---|---|---|
| apiUrl | string | – | Control-plane base URL. Configured credentials may only be used on their configured origin; defaults to https://api.thalovant.com. |
| loginScope | string | – | Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD. |
| memoryId | string | yes | – |
No output schema declared.
No examples provided.
thalovant_emit_event Emit Event ~134
Emit a raw Thalovant event to a hub. Use only when a more specific runtime tool is not enough.
| Name | Type | Req | Description |
|---|---|---|---|
| configPath | string | – | Path to a Thalovant SDK config file. |
| context | object | – | – |
| data | object | – | – |
| eventType | string | yes | – |
| fromEnv | boolean | – | Load the identity from Thalovant SDK environment variables. |
| identityFile | string | – | Path to a Thalovant identity JSON file. |
| profile | string | – | SDK config profile name. |
| protocol | string | – | Runtime transport protocol. |
No output schema declared.
No examples provided.
thalovant_get_analytics_overview Analytics Overview ~173
Read authenticated Thalovant analytics overview data.
| Name | Type | Req | Description |
|---|---|---|---|
| apiUrl | string | – | Control-plane base URL. Configured credentials may only be used on their configured origin; defaults to https://api.thalovant.com. |
| bucket | string | – | – |
| clientId | string | – | – |
| country | string | – | – |
| hour | integer | – | – |
| hubId | string | – | – |
| intent | string | – | – |
| loginScope | string | – | Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD. |
| message | string | – | – |
| range | string | – | – |
| timeEnd | string | – | – |
| timeStart | string | – | – |
| utterance | string | – | – |
| weekday | integer | – | – |
No output schema declared.
No examples provided.
thalovant_get_hub Get Hub ~119
Fetch one authenticated Thalovant hub by UUID.
| Name | Type | Req | Description |
|---|---|---|---|
| apiUrl | string | – | Control-plane base URL. Configured credentials may only be used on their configured origin; defaults to https://api.thalovant.com. |
| hubId | string | yes | Hub UUID. This authenticated route rejects slugs; slugs are only accepted by the public hub tools (thalovant_get_public_hub). |
| loginScope | string | – | Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD. |
No output schema declared.
No examples provided.
thalovant_get_hub_runtime_capabilities Get Hub Runtime Capabilities ~146
Read the live skill and intent inventory a hub runtime exposes. Requires the hubs:inspect scope. The API answers HTTP 409 when the hub has no connected client that can report inventory — for a group-level view that returns an empty list instead of failing, use thalovant_list_runtime_group_inventory.
| Name | Type | Req | Description |
|---|---|---|---|
| apiUrl | string | – | Control-plane base URL. Configured credentials may only be used on their configured origin; defaults to https://api.thalovant.com. |
| hubId | string | yes | Hub UUID. |
| loginScope | string | – | Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD. |
No output schema declared.
No examples provided.
thalovant_get_memory_item Get Memory Item ~90
Read one authenticated Thalovant memory item.
| Name | Type | Req | Description |
|---|---|---|---|
| apiUrl | string | – | Control-plane base URL. Configured credentials may only be used on their configured origin; defaults to https://api.thalovant.com. |
| loginScope | string | – | Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD. |
| memoryId | string | yes | – |
No output schema declared.
No examples provided.
thalovant_get_memory_summary Memory Summary ~90
Read authenticated Thalovant memory summary data.
| Name | Type | Req | Description |
|---|---|---|---|
| apiUrl | string | – | Control-plane base URL. Configured credentials may only be used on their configured origin; defaults to https://api.thalovant.com. |
| loginScope | string | – | Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD. |
| ownerId | string | – | – |
No output schema declared.
No examples provided.
thalovant_get_operation Get Provisioning Operation ~92
Read the status of an asynchronous control-plane operation returned by provisioning.
| Name | Type | Req | Description |
|---|---|---|---|
| apiUrl | string | – | Control-plane base URL. Configured credentials may only be used on their configured origin; defaults to https://api.thalovant.com. |
| loginScope | string | – | Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD. |
| operationId | string | yes | – |
No output schema declared.
No examples provided.
thalovant_get_public_hub Get Public Hub ~75
Fetch one public Thalovant hub by id or slug.
| Name | Type | Req | Description |
|---|---|---|---|
| apiUrl | string | – | Control-plane base URL. Configured credentials may only be used on their configured origin; defaults to https://api.thalovant.com. |
| hubRef | string | yes | Public hub id or slug. |
No output schema declared.
No examples provided.
thalovant_get_runtime_group Get Runtime Group ~100
Fetch one Thalovant runtime group. Requires the hubs:read scope.
| Name | Type | Req | Description |
|---|---|---|---|
| apiUrl | string | – | Control-plane base URL. Configured credentials may only be used on their configured origin; defaults to https://api.thalovant.com. |
| loginScope | string | – | Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD. |
| runtimeGroupId | string | yes | Runtime group UUID. |
No output schema declared.
No examples provided.
thalovant_get_runtime_group_config Get Runtime Group Config ~118
Read a Thalovant runtime group's runtime configuration and personas. Requires the hubs:read scope. The revision returned by this call is used by safe configuration merges.
| Name | Type | Req | Description |
|---|---|---|---|
| apiUrl | string | – | Control-plane base URL. Configured credentials may only be used on their configured origin; defaults to https://api.thalovant.com. |
| loginScope | string | – | Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD. |
| runtimeGroupId | string | yes | Runtime group UUID. |
No output schema declared.
No examples provided.
thalovant_healthcheck Runtime Healthcheck ~114
Connect to a Thalovant hub with a saved identity and return runtime transport health.
| Name | Type | Req | Description |
|---|---|---|---|
| configPath | string | – | Path to a Thalovant SDK config file. |
| fromEnv | boolean | – | Load the identity from Thalovant SDK environment variables. |
| identityFile | string | – | Path to a Thalovant identity JSON file. |
| profile | string | – | SDK config profile name. |
| protocol | string | – | Runtime transport protocol. |
| timeoutMs | integer | – | – |
No output schema declared.
No examples provided.
thalovant_identity_status Identity Status ~104
Load a Thalovant identity and return redacted protocol and endpoint status.
| Name | Type | Req | Description |
|---|---|---|---|
| configPath | string | – | Path to a Thalovant SDK config file. |
| fromEnv | boolean | – | Load the identity from Thalovant SDK environment variables. |
| identityFile | string | – | Path to a Thalovant identity JSON file. |
| profile | string | – | SDK config profile name. |
| protocol | string | – | Runtime transport protocol. |
No output schema declared.
No examples provided.
thalovant_install_hub_skill Install Hub Skill ~454
Install a skill on the runtime group attached to a Thalovant hub. All hubs sharing that runtime group are affected. The change applies live on the hub in about 15 seconds, with no hub restart; a hub may start with no skills and gain them one at a time. Discover the skill name with thalovant_list_marketplace_skills. The API answers 202 with an operation_id and state "installing": pass wait: true to poll the operation until it converges (state "installed", or an error carrying the operation's failure message), with a 120 s default timeout; otherwise follow it with thalovant_get_operation. The 202 body also carries hub_id, runtime_group_id and previous_version. Installing a skill that is already installed at ANOTHER version performs an update; the SAME version fails 409 with code skill_version_already_installed. Fails 404 with code hub_without_runtime_group when the hub has no runtime group attached yet, and 422 when "latest" cannot be resolved or the version string is invalid. hubId must be the hub UUID — the authenticated hub routes reject slugs. Requires the hubs:write scope and a paid plan; scope is checked before plan, so a free-plan token sees 403, never 402. A hub-restricted token must cover every hub sharing the affected runtime group.
| Name | Type | Req | Description |
|---|---|---|---|
| apiUrl | string | – | Control-plane base URL. Configured credentials may only be used on their configured origin; defaults to https://api.thalovant.com. |
| hubId | string | yes | Hub UUID (not the slug). |
| loginScope | string | – | Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD. |
| skill | string | yes | Skill name, 1-191 characters. |
| timeoutMs | integer | – | How long to wait when wait is true, 1000-600000 ms. Defaults to 120000. |
| version | string | – | Version to install, 1-64 characters. Defaults to "latest". |
| wait | boolean | – | Poll the operation until the install converges (installed or failed). Defaults to false. |
No output schema declared.
No examples provided.
thalovant_install_runtime_group_skill Install Runtime Group Skill ~565
Install (or re-install) a skill in a Thalovant runtime group from the marketplace catalog. Installing a skill that is already present updates the existing entry rather than failing. Discover skillId with thalovant_list_marketplace_skills, then confirm installable/purchase_required with thalovant_list_runtime_group_marketplace before calling this. Requires the hubs:write scope and a paid plan (402 'API access requires a paid plan'); a paid marketplace skill ALSO needs marketplace access on the tenant plan, which fails with a second, distinct 402 about paid marketplace access. Only catalog sources are allowed by default: installing from a non-catalog source such as sourceType "git" runs code the marketplace never vetted and is refused unless the operator sets THALOVANT_ENABLE_GIT_SKILL_SOURCES.
| Name | Type | Req | Description |
|---|---|---|---|
| active | boolean | – | Whether the skill is enabled after install. Defaults to true. Installing with false also adds the skill to the group's blacklist. |
| apiUrl | string | – | Control-plane base URL. Configured credentials may only be used on their configured origin; defaults to https://api.thalovant.com. |
| loginScope | string | – | Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD. |
| marketplaceSkillId | string | – | Catalog entry UUID, to disambiguate when the skill id alone is ambiguous. |
| runtimeGroupId | string | yes | Runtime group UUID. |
| skillId | string | yes | Skill id from the catalog, 1-191 characters. Sent as skill_id in the request BODY on install (it is a path segment only on uninstall). For a catalog install the API persists the resolved catalog id,… |
| sourceRef | string | – | Max 255 characters. Required for git installs — a git install without a valid repository URL fails 422. Only usable when THALOVANT_ENABLE_GIT_SKILL_SOURCES is set. |
| sourceType | string | – | Install source, 1-32 characters, defaulting to "catalog". The API accepts any string here rather than a fixed enum, but only "catalog" (requires the skill to exist in the marketplace catalog) and "gi… |
| versionPin | string | – | Pin the skill to an exact version. Max 64 characters. |
No output schema declared.
No examples provided.
thalovant_intent_inventory Runtime Intent Inventory ~248
Discover a hub's registered intents, language examples and fallback skills using its runtime identity. Unknown fallback support remains distinct from a known empty list; answerability is a conservative hint.
| Name | Type | Req | Description |
|---|---|---|---|
| configPath | string | – | Path to a Thalovant SDK config file. |
| describe | boolean | – | – |
| exampleLimit | integer | – | – |
| fallback | boolean | – | Try engine manifests if the intent listing is refused or unanswered. |
| fromEnv | boolean | – | Load the identity from Thalovant SDK environment variables. |
| identityFile | string | – | Path to a Thalovant identity JSON file. |
| languages | array | – | – |
| profile | string | – | SDK config profile name. |
| protocol | string | – | Runtime transport protocol. |
| sentence | boolean | – | Capitalize and punctuate examples using the selected locale. Implies speakable rendering. |
| slots | object | – | Example values for named intent slots. |
| speakable | boolean | – | Render intent patterns with locale slot examples; preserve complete-phrase priority. |
| timeoutMs | integer | – | Per-query/batch timeout; the optional fallback-skill probe is capped at 1500ms. |
No output schema declared.
No examples provided.
thalovant_list_hub_skill_history List Hub Skill History ~162
Read newest-first skill events and operations for the runtime group attached to a hub. This history is shared by all hubs using that runtime. Requires hubs:inspect (hubs:read implies it); restricted tokens must cover all served hubs. Returns event/operation kind, timestamps, versions, actors and outcome fields. No changes are made.
| Name | Type | Req | Description |
|---|---|---|---|
| apiUrl | string | – | Control-plane base URL. Configured credentials may only be used on their configured origin; defaults to https://api.thalovant.com. |
| hubId | string | yes | Hub UUID (not the slug). |
| limit | integer | – | – |
| loginScope | string | – | Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD. |
No output schema declared.
No examples provided.
thalovant_list_hub_skills List Hub Skills ~290
List the skills installed on the runtime group attached to a Thalovant hub. Returns the whole envelope: hub_id, runtime_group_id, observed_at, source, the runtime's phase and message, and data — one row per skill with version, version_pin, installed_version, observed_version, previous_version, latest_version, available_version, update_available, changelog, active, state (pending, installed, failed, removing, drifted, quarantined, unmanaged; a change in progress shows as pending), the runtime's last error and last_transition_at. The hub UUID selects its attached runtime group. Skills and changes are shared by every hub using that group; restricted tokens must cover all served hubs. hubId must be the hub UUID — the authenticated hub routes reject slugs; a hub with no runtime group attached fails 404 with code hub_without_runtime_group. Requires the hubs:inspect scope (hubs:read implies it); hub-restricted tokens only see the hubs in their allowlist.
| Name | Type | Req | Description |
|---|---|---|---|
| apiUrl | string | – | Control-plane base URL. Configured credentials may only be used on their configured origin; defaults to https://api.thalovant.com. |
| hubId | string | yes | Hub UUID (not the slug). |
| loginScope | string | – | Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD. |
No output schema declared.
No examples provided.
thalovant_list_hubs List Visible Hubs ~113
List authenticated Thalovant hubs visible to the account.
| Name | Type | Req | Description |
|---|---|---|---|
| apiUrl | string | – | Control-plane base URL. Configured credentials may only be used on their configured origin; defaults to https://api.thalovant.com. |
| cursor | string | – | – |
| limit | integer | – | Page size, 1-100. |
| loginScope | string | – | Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD. |
| ownerId | string | – | – |
No output schema declared.
No examples provided.
thalovant_list_marketplace_skills List Marketplace Skills ~273
Browse the Thalovant marketplace skill catalog. Start here when discovering what a hub could run: each entry carries the fields an install needs (skill_id, source_type, source_ref, package_name, version compatibility, config_schema, secret_schema) plus category, tags, verified, access_tier, and billing_sku. Requires the hubs:read scope and is NOT paid-gated, so a free-tier token can browse the catalog even though it cannot install from it. The response is not paginated — the whole catalog comes back at once.
| Name | Type | Req | Description |
|---|---|---|---|
| apiUrl | string | – | Control-plane base URL. Configured credentials may only be used on their configured origin; defaults to https://api.thalovant.com. |
| forceRefresh | boolean | – | Re-sync the global catalog from its source before answering. Open to all callers; noticeably slower. |
| includeInactive | boolean | – | Admin tokens only. A non-admin caller silently gets active entries only, with no error. |
| loginScope | string | – | Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD. |
| ownerId | string | – | Admin tokens only. A non-admin caller is silently scoped to their own tenant instead of being rejected, so this is a no-op for ordinary tokens. |
No output schema declared.
No examples provided.
thalovant_list_memory_items List Memory Items ~155
List authenticated Thalovant memory items.
| Name | Type | Req | Description |
|---|---|---|---|
| apiUrl | string | – | Control-plane base URL. Configured credentials may only be used on their configured origin; defaults to https://api.thalovant.com. |
| hubId | string | – | – |
| includeDeleted | boolean | – | – |
| includeExpired | boolean | – | – |
| kind | string | – | – |
| limit | integer | – | Page size, 1-100. |
| loginScope | string | – | Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD. |
| offset | integer | – | – |
| ownerId | string | – | – |
| query | string | – | – |
| scope | string | – | – |
No output schema declared.
No examples provided.
thalovant_list_public_hubs List Public Hubs ~107
List Thalovant public hubs. This read-only discovery call does not require authentication. Page size is capped at 48.
| Name | Type | Req | Description |
|---|---|---|---|
| apiUrl | string | – | Control-plane base URL. Configured credentials may only be used on their configured origin; defaults to https://api.thalovant.com. |
| cursor | string | – | – |
| limit | integer | – | Page size, 1-48. The public hubs endpoint caps page size at 48. |
No output schema declared.
No examples provided.
thalovant_list_runtime_group_inventory List Runtime Group Inventory ~254
List the skills a runtime group is actually observed running right now. Where thalovant_list_runtime_group_marketplace answers 'what could be installed here', this answers 'what is loaded'. Each entry carries skill_id, version, source, active, adapt_intents, padatious_intents, total_intents, and observed_at; the envelope reports source (ovos-runtime-operator, runtime-group-cache, or ovos-runtime-operator-pending), operator_phase, and operator_message. Unlike thalovant_get_hub_runtime_capabilities this never fails with 409 when nothing is reporting — it returns an empty list with a pending source. Requires the hubs:inspect scope; no paid plan needed.
| Name | Type | Req | Description |
|---|---|---|---|
| apiUrl | string | – | Control-plane base URL. Configured credentials may only be used on their configured origin; defaults to https://api.thalovant.com. |
| loginScope | string | – | Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD. |
| refresh | boolean | – | Force a live operator read. The API also refreshes on its own when it holds no cached snapshot. |
| runtimeGroupId | string | yes | Runtime group UUID. |
No output schema declared.
No examples provided.
thalovant_list_runtime_group_marketplace List Runtime Group Marketplace ~250
List the marketplace catalog resolved against one runtime group. This is the view to read immediately before installing: every catalog entry comes back with the group's own state folded in — whether the skill is desired (active, version_pin, source_type), whether it was observed running (observed_source, observed_at, intent counts), operator status, and the plan verdict (purchase_required, installable, access_message). Check installable and purchase_required here to avoid a 402 at install time. Requires the hubs:inspect scope; browsing needs no paid plan. Answers 404 for an unknown group and 403 when the caller does not own it.
| Name | Type | Req | Description |
|---|---|---|---|
| apiUrl | string | – | Control-plane base URL. Configured credentials may only be used on their configured origin; defaults to https://api.thalovant.com. |
| loginScope | string | – | Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD. |
| refreshInventory | boolean | – | Force a live read from the runtime operator. Without it the envelope source is runtime-group-cache (or runtime-group-cache-empty), never a live read. |
| runtimeGroupId | string | yes | Runtime group UUID. |
No output schema declared.
No examples provided.
thalovant_list_runtime_groups List Runtime Groups ~155
List the Thalovant runtime groups visible to the authenticated account. Requires the hubs:read scope. The response is not paginated — every visible group is returned at once.
| Name | Type | Req | Description |
|---|---|---|---|
| apiUrl | string | – | Control-plane base URL. Configured credentials may only be used on their configured origin; defaults to https://api.thalovant.com. |
| loginScope | string | – | Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD. |
| ownerId | string | – | Admin tokens only. Unlike the marketplace catalog, which silently ignores this for non-admins, passing another account's id here fails 403 "Ownership required". Omit it to list your own groups. |
No output schema declared.
No examples provided.
thalovant_query Query Hub ~201
Send a routed HiveMind query using a saved identity and return the normalized reply. The hub may cascade the query according to its routing policy; a query can trigger actions.
| Name | Type | Req | Description |
|---|---|---|---|
| configPath | string | – | Path to a Thalovant SDK config file. |
| context | object | – | – |
| fromEnv | boolean | – | Load the identity from Thalovant SDK environment variables. |
| identityFile | string | – | Path to a Thalovant identity JSON file. |
| includeAudio | boolean | – | Include bounded embedded skill clips as MCP audio/resources. |
| lang | string | – | – |
| profile | string | – | SDK config profile name. |
| protocol | string | – | Runtime transport protocol. |
| queryId | string | – | – |
| replySettleMs | integer | – | – |
| requestId | string | – | – |
| sessionId | string | – | – |
| text | string | yes | – |
| timeoutMs | integer | – | – |
No output schema declared.
No examples provided.
thalovant_release_hub Release Hub ~223
Apply a release policy to a hub and return the updated hub. Every option is optional; omitted fields fall back to the workspace release policy. Passing images switches the hub to custom mode unless mode is also set. Requires the hubs:write scope and a paid plan. No etag is needed.
| Name | Type | Req | Description |
|---|---|---|---|
| apiUrl | string | – | Control-plane base URL. Configured credentials may only be used on their configured origin; defaults to https://api.thalovant.com. |
| channel | string | – | Release channel. Falls back to the workspace release policy when omitted. |
| hubId | string | yes | Hub UUID. |
| images | object | – | Explicit image overrides. Switches to custom mode unless mode is also set. |
| loginScope | string | – | Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD. |
| mode | string | – | Release mode. Passing images without mode switches to "custom". |
| reason | string | – | Audit reason recorded with the release. |
| version | string | – | Pinned release version. |
No output schema declared.
No examples provided.
thalovant_release_runtime_group Release Runtime Group ~234
Apply a runtime image policy to a Thalovant runtime group and return the updated group. Options behave like thalovant_release_hub: everything is optional, omitted fields fall back to the workspace release policy, and passing images switches to custom mode unless mode is also set. Requires the hubs:write scope and a paid plan.
| Name | Type | Req | Description |
|---|---|---|---|
| apiUrl | string | – | Control-plane base URL. Configured credentials may only be used on their configured origin; defaults to https://api.thalovant.com. |
| channel | string | – | Release channel. Falls back to the workspace release policy when omitted. |
| images | object | – | Explicit image overrides. Switches to custom mode unless mode is also set. |
| loginScope | string | – | Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD. |
| mode | string | – | Release mode. Passing images without mode switches to "custom". |
| reason | string | – | Audit reason recorded with the release. |
| runtimeGroupId | string | yes | Runtime group UUID. |
| version | string | – | Pinned release version. |
No output schema declared.
No examples provided.
thalovant_remove_hub_skill Remove Hub Skill ~370
Remove one skill from the runtime group attached to a Thalovant hub. Every hub sharing the runtime loses this skill; other skill attachments are unchanged, and the change applies live on the hub in about 15 seconds with no hub restart. The API answers 202 with an operation_id, hub_id, runtime_group_id, previous_version (version is null) and state "removing": pass wait: true to poll the operation until it converges (state "removed", or an error carrying the operation's failure message), with a 120 s default timeout; otherwise follow it with thalovant_get_operation. Fails 404 when the skill is not installed on the hub (code hub_without_runtime_group when the hub has no runtime group). hubId must be the hub UUID — the authenticated hub routes reject slugs. Requires the hubs:write scope and a paid plan; scope is checked before plan, so a free-plan token sees 403, never 402. A hub-restricted token must cover every hub sharing the affected runtime group.
| Name | Type | Req | Description |
|---|---|---|---|
| apiUrl | string | – | Control-plane base URL. Configured credentials may only be used on their configured origin; defaults to https://api.thalovant.com. |
| hubId | string | yes | Hub UUID (not the slug). |
| loginScope | string | – | Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD. |
| skill | string | yes | Skill name to remove, 1-191 characters. |
| timeoutMs | integer | – | How long to wait when wait is true, 1000-600000 ms. Defaults to 120000. |
| wait | boolean | – | Poll the operation until the removal converges (removed or failed). Defaults to false. |
No output schema declared.
No examples provided.
thalovant_send_action Send Action ~145
Send a structured action payload to a Thalovant hub.
| Name | Type | Req | Description |
|---|---|---|---|
| configPath | string | – | Path to a Thalovant SDK config file. |
| context | object | – | – |
| fromEnv | boolean | – | Load the identity from Thalovant SDK environment variables. |
| identityFile | string | – | Path to a Thalovant identity JSON file. |
| lang | string | – | – |
| payload | string | yes | – |
| profile | string | – | SDK config profile name. |
| protocol | string | – | Runtime transport protocol. |
| requestId | string | – | – |
| sessionId | string | – | – |
| title | string | – | – |
No output schema declared.
No examples provided.
thalovant_send_code Send Code ~161
Send an exact typed, scanned, barcode, QR, or serial value to a Thalovant hub.
| Name | Type | Req | Description |
|---|---|---|---|
| configPath | string | – | Path to a Thalovant SDK config file. |
| context | object | – | – |
| fromEnv | boolean | – | Load the identity from Thalovant SDK environment variables. |
| identityFile | string | – | Path to a Thalovant identity JSON file. |
| kind | string | – | – |
| label | string | – | – |
| lang | string | – | – |
| profile | string | – | SDK config profile name. |
| protocol | string | – | Runtime transport protocol. |
| requestId | string | – | – |
| sessionId | string | – | – |
| value | string | yes | – |
No output schema declared.
No examples provided.
thalovant_set_hub_rating Set Hub Rating ~174
Rate a public Thalovant hub from 1 to 5 and return the updated hub. Requires the hubs:write scope; no paid plan is needed, so free-tier tokens can rate. Rating a non-public hub fails 400 "Only public hubs can be rated." and rating your own hub fails 400 "Hub owners cannot rate their own public hubs."
| Name | Type | Req | Description |
|---|---|---|---|
| apiUrl | string | – | Control-plane base URL. Configured credentials may only be used on their configured origin; defaults to https://api.thalovant.com. |
| hubId | string | yes | Hub UUID. |
| loginScope | string | – | Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD. |
| rating | integer | yes | Rating, an integer from 1 to 5. |
No output schema declared.
No examples provided.
thalovant_uninstall_runtime_group_skill Uninstall Runtime Group Skill ~138
Remove one skill from a Thalovant runtime group. This removes only the named skill; the runtime group and its other skills are untouched. Requires the hubs:write scope and a paid plan.
| Name | Type | Req | Description |
|---|---|---|---|
| apiUrl | string | – | Control-plane base URL. Configured credentials may only be used on their configured origin; defaults to https://api.thalovant.com. |
| loginScope | string | – | Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD. |
| runtimeGroupId | string | yes | Runtime group UUID. |
| skillId | string | yes | Skill id to remove. |
No output schema declared.
No examples provided.
thalovant_update_hub Update Hub ~595
Partially update a Thalovant hub. Send ONLY the fields you are changing — do not round-trip a whole hub resource. name, namespace, and domain are immutable and are deliberately not accepted here; the API rejects a changed value with HTTP 400. This route uses optimistic locking and requires the hub's current etag, which lives in the hub resource BODY (there is no ETag response header), so call thalovant_get_hub first and pass the etag field from its response. A missing or stale etag fails 412 and changes nothing. Requires the hubs:write scope and a paid plan.
| Name | Type | Req | Description |
|---|---|---|---|
| active | boolean | – | – |
| apiUrl | string | – | Control-plane base URL. Configured credentials may only be used on their configured origin; defaults to https://api.thalovant.com. |
| capacityProfile | string | – | Hub capacity profile. Only "standard" (the API default, 1 replica) and "autoscaling" (2-32 replicas) are accepted. Omit the key entirely rather than sending null — an explicit null fails 422 INVALID_… |
| etag | string | yes | Required. The hub's current etag, sent as If-Match for optimistic locking. Read it from the `etag` field in the hub resource BODY returned by thalovant_get_hub — the API does not send an ETag respons… |
| hubId | string | yes | Hub UUID. This authenticated route rejects slugs. |
| isLocked | boolean | – | Admin only: a non-admin gets 403, and a non-admin cannot update a locked hub at all. |
| loginScope | string | – | Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD. |
| ownerId | string | – | – |
| runtimeGroupId | string | – | – |
| slug | string | – | Mutable, unlike name/namespace/domain. Fails 409 if the slug is already taken. |
| spec | object | – | Hub spec object. `version` is REQUIRED and must be a non-empty string — {"version": "1"} is the minimum valid spec; omitting it fails 422 "Schema validation failed". Other keys pass through, and the… |
| visibility | string | – | 1-32 characters. Switching to "public" is plan-gated and fails 403 on plans that keep hubs private. |
No output schema declared.
No examples provided.
thalovant_update_hub_skill Update Hub Skill ~426
Move a skill already installed on the runtime group attached to a Thalovant hub to a specific version (not a runtime group or skill set). The change applies live on the hub in about 15 seconds, with no hub restart. version is required — read the current version and latest_version from thalovant_list_hub_skills. The API answers 202 with an operation_id, hub_id, runtime_group_id, previous_version and state "updating": pass wait: true to poll the operation until it converges (state "installed", or an error carrying the operation's failure message), with a 120 s default timeout; otherwise follow it with thalovant_get_operation. Fails 404 when the skill is not installed on the hub (code hub_without_runtime_group when the hub has no runtime group), 409 with code skill_version_already_installed when it is already at that version, and 422 for an invalid version. hubId must be the hub UUID — the authenticated hub routes reject slugs. Requires the hubs:write scope and a paid plan; scope is checked before plan, so a free-plan token sees 403, never 402. A hub-restricted token must cover every hub sharing the affected runtime group.
| Name | Type | Req | Description |
|---|---|---|---|
| apiUrl | string | – | Control-plane base URL. Configured credentials may only be used on their configured origin; defaults to https://api.thalovant.com. |
| hubId | string | yes | Hub UUID (not the slug). |
| loginScope | string | – | Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD. |
| skill | string | yes | Skill name, 1-191 characters. |
| timeoutMs | integer | – | How long to wait when wait is true, 1000-600000 ms. Defaults to 120000. |
| version | string | yes | Required target version, 1-64 characters. |
| wait | boolean | – | Poll the operation until the update converges (installed or failed). Defaults to false. |
No output schema declared.
No examples provided.
thalovant_update_memory_item Update Memory Item ~163
Update an explicit Thalovant memory item.
| Name | Type | Req | Description |
|---|---|---|---|
| apiUrl | string | – | Control-plane base URL. Configured credentials may only be used on their configured origin; defaults to https://api.thalovant.com. |
| clearExpiresAt | boolean | – | – |
| consentScope | string | – | – |
| consentVersion | – | – | – |
| content | string | – | – |
| expiresAt | string|null | – | – |
| kind | string | – | – |
| loginScope | string | – | Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD. |
| memoryId | string | yes | – |
| metadata | object | – | – |
| retentionPolicy | string | – | – |
| tags | array | – | – |
| title | – | – | – |
No output schema declared.
No examples provided.
thalovant_update_runtime_group Update Runtime Group ~191
Update a Thalovant runtime group's name, description, or spec. spec patches replicas and container resources. This route does NOT use If-Match, so no etag is required. Requires the hubs:write scope and a paid plan.
| Name | Type | Req | Description |
|---|---|---|---|
| apiUrl | string | – | Control-plane base URL. Configured credentials may only be used on their configured origin; defaults to https://api.thalovant.com. |
| description | string | – | Max 255 characters. |
| loginScope | string | – | Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD. |
| name | string | – | 1-128 characters. |
| runtimeGroupId | string | yes | Runtime group UUID. |
| spec | object | – | Patches replicas and container resources only. Note the replica ceiling here is 20, separate from a hub's autoscaling ceiling of 32. |
No output schema declared.
No examples provided.
thalovant_update_runtime_group_config Update Runtime Group Config ~235
Merge runtime configuration into a Thalovant runtime group. The SDK reads and deep-merges config, then writes with a revision precondition. Only explicit HTTP 412 conflicts retry, at most three attempts; older APIs fail before a write. Set merge=false for explicit unconditional replacement. personas, when provided, is REPLACED wholesale rather than merged; omit it to leave stored personas untouched. Requires hubs:read and paid hubs:write for merging; replacement needs paid hubs:write.
| Name | Type | Req | Description |
|---|---|---|---|
| apiUrl | string | – | Control-plane base URL. Configured credentials may only be used on their configured origin; defaults to https://api.thalovant.com. |
| config | object | yes | Configuration object merged into the stored configuration. Required. |
| loginScope | string | – | Optional login scope used with THALOVANT_EMAIL and THALOVANT_PASSWORD. |
| merge | boolean | – | False explicitly replaces the full configuration without a revision precondition. |
| personas | object | – | Replaces the stored personas outright. Left untouched when omitted. |
| runtimeGroupId | string | yes | Runtime group UUID. |
No output schema declared.
No examples provided.
thalovant_wait_for_event Wait For Event ~139
Wait for one named hub event using a saved identity.
| Name | Type | Req | Description |
|---|---|---|---|
| configPath | string | – | Path to a Thalovant SDK config file. |
| context | object | – | – |
| eventName | string | yes | – |
| fromEnv | boolean | – | Load the identity from Thalovant SDK environment variables. |
| identityFile | string | – | Path to a Thalovant identity JSON file. |
| profile | string | – | SDK config profile name. |
| protocol | string | – | Runtime transport protocol. |
| requestId | string | – | – |
| sessionId | string | – | – |
| timeoutMs | integer | – | – |
No output schema declared.
No examples provided.
What is the Thalovant MCP server?
Thalovant MCP is listed in the public MCP registry as io.github.thalovant/thalovant-mcp. Connect MCP clients to Thalovant control-plane and hub runtime APIs over stdio or Streamable HTTP. This page covers its npm package (@thalovant/mcp-server).
Is the Thalovant MCP server safe to use?
Thalovant MCP scores 88 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Thalovant MCP server expose?
Thalovant MCP exposes 46 tools: thalovant_config_status, thalovant_list_public_hubs, thalovant_get_public_hub, thalovant_list_hubs, thalovant_get_hub, and 41 more. Their descriptions and schemas cost roughly 9,486 tokens of context every time the server is loaded.
Is the Thalovant MCP server still maintained?
Thalovant MCP is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Thalovant MCP server under?
Thalovant MCP declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.