# io.github.thuupx/lunge (npm · lunge-mcp)

Agent-native API client: execute/test REST/GraphQL/WS/SSE with assertions, extraction, collections

- Trust score: 67/100 (medium)
- Change this week: +23
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `lunge-mcp`: 67/100 (this document), [markdown](https://verifymcp.io/servers/thuupx-lunge/lunge-mcp.md), [page](https://verifymcp.io/servers/thuupx-lunge/lunge-mcp)

## Channel facts

- Registry: `npm`
- Package: `lunge-mcp`
- Version: `1.3.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 88/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (104 of 108), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (104 of 108), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 10 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 71/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 2743 tokens (~124/item across 22 items; 22 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 23/100
  - Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 90/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 69% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add thuupx-lunge -- npx -y lunge-mcp
```

### Codex

```bash
codex mcp add thuupx-lunge -- npx -y lunge-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "thuupx-lunge": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "lunge-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add thuupx-lunge --command npx --arg -y --arg lunge-mcp
```

### Hermes

```yaml
mcp_servers:
  thuupx-lunge:
    command: "npx"
    args: ["-y", "lunge-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "thuupx-lunge": {
      "command": "npx",
      "args": [
        "-y",
        "lunge-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 67, +3)

- [functional improvement] Stability: unverified → 0.23

### 2026-08-02 (score 64, +40)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Schema quality: unverified → good
- [functional] Licence: MIT

### 2026-08-01 (score 24, +5)

- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] MCP protocol: unverified → pass

### 2026-07-31 (score 19, −7)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 26, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-27 (score 44)

First indexed and scored.

## MCP tools (22)

### `http_request` (~214 tokens)

HTTP request

REST/HTTP request with auth, assertions, {{var}} extraction. Returns token-efficient summary.

Input parameters:

- `assert` (array): e.g. [{status:200},{jsonpath:'$.x',equals:1},{timeMs:{lt:500}}].
- `auth` (object)
- `body`: Request body (object=json, string=text).
- `bodyType` (string): Default json.
- `env` (string): Environment name for variable resolution.
- `extract` (object): Capture vars: { token: '$.token' }. Use via {{token}} later.
- `followRedirects` (boolean)
- `headers` (object)
- `method` (string): HTTP method (default GET).
- `query` (object)
- `timeoutMs` (integer)
- `url` (string, required): Full URL. May contain {{variables}}.
- `verbosity` (string): summary (default, token-efficient), headers, or full. Auto-downgraded to summary when extract is set.

### `graphql_request` (~213 tokens)

GraphQL request

GraphQL query/mutation over HTTP. Supports {{var}} extraction. Note: `ok` reflects HTTP status only (200 = ok). GraphQL-level errors are returned in `graphqlErrors` — always check both. Use extract with $.data.* for success data and $.errors.* for error details.

Input parameters:

- `assert` (array): e.g. [{status:200},{jsonpath:'$.x',equals:1},{timeMs:{lt:500}}].
- `auth` (object)
- `env` (string)
- `extract` (object): Capture vars: { token: '$.data.login.accessToken' }.
- `headers` (object)
- `query` (string, required): GraphQL query/mutation document.
- `timeoutMs` (integer)
- `url` (string, required): GraphQL endpoint URL.
- `variables` (object)
- `verbosity` (string): summary (default, token-efficient), headers, or full. Auto-downgraded to summary when extract is set.

### `ws_session` (~188 tokens)

WebSocket session (bounded)

Connect WS, send messages, collect frames until stop condition. Returns summarized batch. Frame shape: {type:'text'|'binary', text:string, json:object|null}. Assertions: anyFrame {jsonpath,equals} matches any frame; frameCount {gte/lte/eq}. Example: assert=[{anyFrame:{jsonpath:'$.type',equals:'text'}},{frameCount:{gte:1}}].

Input parameters:

- `assert` (array): e.g. [{anyFrame:{jsonpath:'$.type',equals:'ack'}},{frameCount:{gte:1}}]
- `collect` (object)
- `env` (string)
- `headers` (object)
- `send` (array): Messages to send after connecting.
- `subprotocols` (array)
- `url` (string, required): ws:// or wss:// URL.
- `verbosity` (string)

### `sse_session` (~164 tokens)

SSE session (bounded)

Subscribe to SSE, collect events until stop condition. Returns summarized batch with assertions. Event shape: {event:string, data:string, id:string|null, json:object|null}. Assertions: anyEvent {jsonpath,equals} matches any event; eventCount {gte/lte/eq}. Example: assert=[{anyEvent:{jsonpath:'$.event',equals:'notification'}},{eventCount:{gte:1}}].

Input parameters:

- `assert` (array): e.g. [{anyEvent:{jsonpath:'$.type',equals:'tick'}},{eventCount:{gte:1}}]
- `collect` (object)
- `env` (string)
- `headers` (object)
- `url` (string, required): SSE endpoint URL.
- `verbosity` (string)

### `inspect_response` (~220 tokens)

Inspect a stored response

Drill into a stored response by handle without re-running the request. Use jsonpath to pull only the slice you need. Supports RFC 9535 filters ($.items[?@.id==1]) and slices ($.items[0:5]). Use double quotes in filters. Omit jsonpath to return the full stored body — for graphql_introspect this is the enriched `schema` (so $.queries, $.mutations, $.inputTypes work directly); for ws_session it's the `frames` array; for sse_session it's the `events` array; otherwise it's the parsed bodyJson/bodyText.

Input parameters:

- `handle` (string, required): responseHandle from a prior tool call.
- `jsonpath` (string): RFC 9535 JSONPath. Filters need double quotes: [?@.name=="x"]. Omit for full body.
- `maxItems` (integer): Cap array elements returned (default 50). Excess shown as truncation marker.
- `maxStr` (integer): Cap string length in chars (default 2000).

### `set_env` (~65 tokens)

Set environment variables

Create/update named env. Values may be {value, secret:true}. Use via {{name}}.

Input parameters:

- `name` (string, required): Environment name, e.g. 'dev'.
- `vars` (object, required): Map of variables. Use { value, secret: true } to mark secrets.

### `list_envs` (~36 tokens)

List environments

List env names and (masked) variables of the active or specified one.

Input parameters:

- `name` (string): Show variables for this env.

### `list_collections` (~41 tokens)

List collections

Find collection files (.yaml/.yml/.json) under a directory.

Input parameters:

- `dir` (string): Directory to scan. Defaults to the current working directory.

### `run_collection` (~95 tokens)

Run a collection

Run declarative collection file. Threads extracted vars between steps. Optional JUnit XML export.

Input parameters:

- `env` (string): Environment to resolve variables from.
- `junitPath` (string): Write a JUnit XML report to this path.
- `only` (array): Only run steps with these ids.
- `path` (string, required): Path to the collection file.
- `tags` (array): Only run steps having any of these tags.

### `import_curl` (~76 tokens)

Import a curl command

Parse curl into structured request. Optionally execute it.

Input parameters:

- `curl` (string, required): The full curl command, e.g. "curl -X POST https://... -H '...' -d '...'".
- `execute` (boolean): If true, run the parsed request and return the result.
- `verbosity` (string)

### `graphql_introspect` (~73 tokens)

GraphQL introspection

Introspect GraphQL endpoint, return summarized schema with field signatures (args + return types) and input types.

Input parameters:

- `auth` (object)
- `env` (string)
- `headers` (object)
- `timeoutMs` (integer)
- `url` (string, required): GraphQL endpoint URL.

### `ws_open` (~82 tokens)

Open persistent WebSocket

Open long-lived WS, return handle. Use ws_send/ws_recv/ws_close to interact.

Input parameters:

- `env` (string)
- `headers` (object)
- `send` (array): Messages to send immediately after connecting.
- `subprotocols` (array)
- `url` (string, required): ws:// or wss:// URL. May contain {{variables}}.

### `ws_send` (~64 tokens)

Send WebSocket message

Send a single message on a persistent WebSocket connection opened with ws_open.

Input parameters:

- `handle` (string, required): Handle returned by ws_open.
- `json`: Send as a JSON message (mutually exclusive with text).
- `text` (string): Send as a raw text message.

### `ws_recv` (~74 tokens)

Receive WebSocket frames

Drain buffered frames from persistent WS. Blocks up to maxDurationMs for first frame.

Input parameters:

- `handle` (string, required): Handle returned by ws_open.
- `maxDurationMs` (integer): Max wait for the first frame (default 1000ms).
- `maxMessages` (integer): Max frames to drain (default 50).

### `ws_close` (~31 tokens)

Close persistent WebSocket

Close a persistent WebSocket connection and release its handle.

Input parameters:

- `handle` (string, required): Handle returned by ws_open.

### `save_request` (~215 tokens)

Save request to collection

Persist last ad-hoc request (or explicit spec) as a new step in a collection file. Params: path (required, .json/.yaml/.yml), id (optional, step id), type (optional, http|graphql|ws|sse), request (optional, explicit spec; defaults to last call's request), assert, extract, tags, name (optional, set collection name). Returns {saved, path, stepId, stepCount} or isError if no prior request and no explicit request.

Input parameters:

- `assert` (array)
- `extract` (object)
- `id` (string): Step id. Defaults to a generated one.
- `name` (string): Set/replace the collection name.
- `path` (string, required): Collection file path (.yaml/.yml/.json).
- `request` (object): Explicit request spec. Defaults to the last call's request.
- `tags` (array)
- `type` (string): Step type; defaults to the last request's type.

### `set_policy` (~110 tokens)

Set request policy

Configure host allow/deny lists + dry-run mode. Glob patterns: *, *.example.com. Pass an empty array to allow/deny to clear that list. Returns {policy:{allow,deny,dryRun}}.

Input parameters:

- `allow` (array): Allowed host patterns. Empty = allow any non-denied host.
- `deny` (array): Denied host patterns; takes precedence over allow. Pass [] to clear.
- `dryRun` (boolean): If true, validate requests but do not send them.

### `import_openapi` (~165 tokens)

Import OpenAPI to collection

Parse OpenAPI/Swagger (JSON/YAML) → Lunge collection. One step per operation with 2xx assertion. Params: path (required, file path), out (optional, write collection to .json/.yaml/.yml), includeTags (optional, only ops with these tags), maxSteps (optional, cap step count, default 200). Returns {ok, imported, name, steps, writtenTo}.

Input parameters:

- `includeTags` (array): Only import operations with any of these tags.
- `maxSteps` (integer): Cap the number of generated steps (default 200).
- `out` (string): Write the resulting collection to this path (.yaml/.yml/.json).
- `path` (string, required): Path to the OpenAPI/Swagger file.

### `import_har` (~166 tokens)

Import HAR to collection

Parse HAR file → Lunge collection. Splits query/headers/body. Optional 2xx filter. Params: path (required, .json HAR file), out (optional, write to .json/.yaml/.yml), only2xx (optional, only keep 2xx responses), maxSteps (optional, cap step count, default 200). Returns {ok, imported, name, steps, writtenTo}.

Input parameters:

- `maxSteps` (integer): Cap the number of generated steps (default 200).
- `only2xx` (boolean): Only include requests that returned a 2xx response.
- `out` (string): Write the resulting collection to this path (.yaml/.yml/.json).
- `path` (string, required): Path to the HAR file (.json).

### `collection_format` (~84 tokens)

Collection format reference

Return the Lunge collection format reference: top-level fields, step schema, request specs per protocol (http/graphql/ws/sse), full assertion vocabulary (status/header/jsonpath/timeMs/schema/not + matchers), WS/SSE-specific assertions, variable chaining (extract + {{var}}), and JSONPath syntax. Call this BEFORE writing explicit steps for save_collection or reviewing saved output.

### `list_history` (~98 tokens)

List request history

List all requests recorded in this session with full specs (method, url, query, headers, body, auth, assert, extract) and extracted values. Use this to review what happened before saving a multi-step collection. Each entry has an id (req_1, req_2, ...) for use with save_collection. Returns {count, entries:[{id, type, request, assert, extract, extractedValues, responseHandle}]}.

### `save_collection` (~269 tokens)

Save multi-step collection

Save multiple requests as a multi-step collection file. Params: path (required, .json/.yaml/.yml), fromHistory (optional, array of history ids from list_history — saves in specified order; omit to save ALL history), steps (optional, explicit step specs — overrides fromHistory; call collection_format first for the schema), name (optional, collection name), description (optional), vars (optional), defaults (optional). Steps preserve extraction chaining ({{var}} from earlier steps' extract). Returns {saved, path, stepCount, stepIds}.

Input parameters:

- `defaults` (object): Default settings applied to every step (e.g. {timeoutMs: 10000, headers: {Accept: 'application/json'}}).
- `description` (string): Collection description.
- `fromHistory` (array): History entry ids to save (e.g. ['req_1','req_3']). Omit to save ALL history.
- `name` (string): Collection name.
- `path` (string, required): Collection file path (.json/.yaml/.yml).
- `steps` (array): Explicit step specs. Overrides fromHistory if provided.
- `vars` (object): Collection-level variables (e.g. {baseUrl: 'https://...', apiKey: '{{env.API_KEY}}'}).

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/thuupx-lunge/lunge-mcp#diagnostics

## Score history

- 2026-08-03: 67
- 2026-08-02: 64
- 2026-08-01: 24
- 2026-07-31: 19
- 2026-07-30: 26
- 2026-07-28: 44
- 2026-07-27: 44

## Links

- npm package: https://www.npmjs.com/package/lunge-mcp
- Socket report: https://socket.dev/npm/package/lunge-mcp
- Repository: https://github.com/thuupx/lunge
- Website: https://lunge.dev/
- Changelog RSS feed: https://verifymcp.io/servers/thuupx-lunge/lunge-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/thuupx-lunge/lunge-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/thuupx-lunge/lunge-mcp