# hotedit (npm · hotedit)
Open HTML reports in the browser and edit them live while the person watches, or by hand.
- Trust score: 70/100 (medium)
- Change this week: 0
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05
## Components
- npm · `hotedit`: 70/100 (this document), [markdown](https://verifymcp.io/servers/thewhey-brian-hotedit/hotedit.md), [page](https://verifymcp.io/servers/thewhey-brian-hotedit/hotedit)
## Channel facts
- Registry: `npm`
- Package: `hotedit`
- Version: `0.5.0`
- Transport: `stdio`
## Trust breakdown
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)
Scored 2026-11-05.
- **Supply Chain Security**: 99/100
- No malware found by supply-chain analysis.
- No known CVEs affecting this package version or its production dependencies.
- No install/post-install scripts declared.
- 3 of 10 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 45/100
- Source repository is publicly reachable at the declared URL.
- Provenance check failed: no build-provenance attestation is published.
- Clear OSI-approved license (MIT).
- Actively maintained (last published 13 days ago).
- Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 74/100
- AI-judged instruction clarity (good).
- Tool/resource definitions use about 391 tokens (~97/item across 4 items; 4 tools + 0 resources), lean.
- Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
- Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).
- 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
- We read all 4 captured tool definition(s), and no name or description among them implies an irreversible operation.
- An AI judge read all 5 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.
**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
## Install
### How do I install the hotedit MCP server?
hotedit runs locally as an npm package, launched with npx -y hotedit. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
### Claude
```bash
claude mcp add thewhey-brian-hotedit -- npx -y hotedit
```
### Cursor
```json
{
"mcpServers": {
"thewhey-brian-hotedit": {
"command": "npx",
"args": [
"-y",
"hotedit"
]
}
}
}
```
### VS Code
```json
{
"servers": {
"thewhey-brian-hotedit": {
"command": "npx",
"args": [
"-y",
"hotedit"
]
}
}
}
```
### Codex
```bash
codex mcp add thewhey-brian-hotedit -- npx -y hotedit
```
### opencode
```json
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"thewhey-brian-hotedit": {
"type": "local",
"command": [
"npx",
"-y",
"hotedit"
],
"enabled": true
}
}
}
```
### OpenClaw
```bash
openclaw mcp add thewhey-brian-hotedit --command npx --arg -y --arg hotedit
```
### Hermes
```yaml
mcp_servers:
thewhey-brian-hotedit:
command: "npx"
args: ["-y", "hotedit"]
```
### Netclaw
```json
{
"McpServers": {
"thewhey-brian-hotedit": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"hotedit"
]
}
}
}
```
### Vellum
```bash
assistant mcp add thewhey-brian-hotedit -t stdio -c npx -a -y hotedit
```
### Other
```json
{
"mcpServers": {
"thewhey-brian-hotedit": {
"command": "npx",
"args": [
"-y",
"hotedit"
]
}
}
}
```
## Changelog
Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.
### 2026-10-23 (score 70, +15)
- [security improvement] Malware scan: unverified → pass
### 2026-10-22 (score 55)
First indexed and scored.
## MCP tools (4)
### `open` (~69 tokens)
Open an HTML file in hotedit so the person can watch and edit it in their browser. Returns the page URL. Call this before outline/read/edit when the page isn't open yet.
Input parameters:
- `browser` (boolean): open the browser (default true)
- `file` (string, required): path of the HTML file
### `outline` (~76 tokens)
List the elements of the page as an indented tree: [id] tag#id.class “text…”. Use the ids with read. Ids change when elements are added, removed or moved, so call outline again after such edits.
Input parameters:
- `file` (string): path of the HTML file; optional when only one page is open
### `read` (~79 tokens)
The exact HTML source of one element (by id from outline), as it is in the file. Copy text from here into edit's `find`. Long data: URLs are shortened and can't be edited.
Input parameters:
- `file` (string): path of the HTML file; optional when only one page is open
- `id` (integer, required): element id from outline
### `edit` (~122 tokens)
Replace text in the HTML file: `find` must appear exactly once (add surrounding context to make it unique) unless `all` is true. The change is saved and shown to the user immediately. Use it for text, attributes, styles, inserted or removed elements, and chart data in