tok
PYPI · TOK-LANG
Model BPMN processes and DMN decisions as text: check, export, import, simulate, evaluate.
Available components
Last scanned (4 hours ago)
Scores higher than 46% of PyPI servers
Category Developer Tools
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security50
- Malware scan not yet available for this package.Unverified
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs maturin at install time, a recognised build step with no custom scripting around it. View diagnostics → Pass
- No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (GPL-3.0-or-later).Pass
- Actively maintained (last published 5 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability40
- 0% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Fail
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 1699 tokens (~130/item across 13 items; 8 tools + 5 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage99
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 95% of tool parameters carry a description.Partial
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "eval" implies "eval" and declares readOnlyHint instead, contradicting what its own name says it does. See how to fix → Fail
- An AI judge read all 10 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 −15
- Malware scan: pass → unverified ▼ security
- 3 Nov 26 +15
- Malware scan: unverified → pass ▲ security
- 2 Nov 26 48
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed pypi/tok-lang@1.0.3
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | pypi |
| Reason | No attestation published |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | maturin |
Background: Why install scripts are a supply-chain risk →
Dependencies 0 packages
| Packages resolved | 0 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
check Check a tok model ~237
Check a tok document and list its diagnostics (code, severity, line, element, message), as `tok check --json`. Every layer is checked: tokens, statements, references, BPMN 2.0 rules, the Camunda 8 profile of executable documents, decisions, FEEL and simulation parameters. A document with errors is a successful call with errors > 0; fix the errors and check again. Codes are explained in the reference topic 'diagnostics'.
| Name | Type | Req | Description |
|---|---|---|---|
| bpmn | boolean | – | Also check the BPMN 2.0 rules of the exported model (E, W, L codes). |
| class | string | – | BPMN 2.0.2 conformance class to check against; elements outside it are R075. |
| lang | string | – | Language of diagnostics and reports. |
| level | string | – | Teaching level: the elements the document may use (spec §13). |
| path | string | – | Path of a .tok file, read by the server (relative to its working directory). Give either text or path. |
| text | string | – | The tok document. Give either text or path. |
| Name | Type | Req | Description |
|---|---|---|---|
| bpmn_class | string | yes | – |
| diagnostics | array | yes | – |
| errors | integer | yes | – |
No examples provided.
check_bpmn Check a BPMN file ~306
Check BPMN 2.0 XML, from tok or from any modelling tool, with the BPMN rules of the tok checker, as `tok check FILE.bpmn --json`: every finding has a code, a severity, the line and the id of its element and a message. steps requires every element name to start with the step number of a process description (K01); description, the text of that description, reports steps without an element and elements without a step (K02, K03); camunda adds the Camunda 8 profile of executable models (C codes; with path, forms and decisions are looked for in the file's folder). XML with errors is a successful call with errors > 0. Codes are explained in the reference topic 'diagnostics'.
| Name | Type | Req | Description |
|---|---|---|---|
| camunda | boolean | – | Also check the Camunda 8 profile of executable models (C codes). |
| description | string | – | The process description whose table lists the steps (its first column holds the step numbers); checks that every step is in the model (K02, K03). |
| lang | string | – | Language of diagnostics and reports. |
| path | string | – | Path of a .bpmn file, read by the server (relative to its working directory). Give either xml or path. |
| steps | boolean | – | Element names start with step numbers (K01). |
| xml | string | – | The BPMN 2.0 XML. Give either xml or path. |
| Name | Type | Req | Description |
|---|---|---|---|
| diagnostics | array | yes | – |
| errors | integer | yes | – |
No examples provided.
eval Evaluate a decision ~169
Evaluate a decision of a tok document for input values, as `tok eval`. In languages 0.7 and 1.0 the decision is evaluated with everything it requires and values are given by the FEEL names of input data; in earlier languages the decision table alone is evaluated over its input columns. Values are JSON (numbers, text, booleans, null, lists, objects as contexts).
| Name | Type | Req | Description |
|---|---|---|---|
| decision | string | yes | Identifier of the decision. |
| lang | string | – | Language of diagnostics and reports. |
| path | string | – | Path of a .tok file, read by the server (relative to its working directory). Give either text or path. |
| text | string | – | The tok document. Give either text or path. |
| values | object | – | Input name → value. |
| Name | Type | Req | Description |
|---|---|---|---|
| value | – | yes | The value of the decision as JSON. |
No examples provided.
export Export a tok model ~246
Export a checked tok document and return the contents of the files `tok export` writes: BPMN 2.0 XML with diagram layout (NAME.bpmn), its SVG picture (NAME.svg), DMN files of the decisions (with NAME.drd.svg pictures in languages 0.7 and 1.0) and Camunda form files (ID.form). With path, the layout sidecar FILE.tok.layout next to the file is used. A document with errors is a tool error listing them.
| Name | Type | Req | Description |
|---|---|---|---|
| formats | array | – | The kinds of file to return; all when left out. 'dmn' includes the decision diagrams (.drd.svg). |
| lang | string | – | Language of diagnostics and reports. |
| name | string | – | Stem of the BPMN and SVG file names; default: the stem of path, or 'model'. |
| path | string | – | Path of a .tok file, read by the server (relative to its working directory). Give either text or path. |
| sidecar | boolean | – | Use the layout sidecar FILE.tok.layout next to path. |
| text | string | – | The tok document. Give either text or path. |
| Name | Type | Req | Description |
|---|---|---|---|
| files | object | yes | File name → content. |
No examples provided.
fmt Format a tok model ~101
Print a tok document in its canonical form, as `tok fmt`. The document must have no syntax errors. The result is the text only; write it to the file yourself.
| Name | Type | Req | Description |
|---|---|---|---|
| lang | string | – | Language of diagnostics and reports. |
| path | string | – | Path of a .tok file, read by the server (relative to its working directory). Give either text or path. |
| text | string | – | The tok document. Give either text or path. |
| Name | Type | Req | Description |
|---|---|---|---|
| text | string | yes | – |
No examples provided.
import Import BPMN or DMN ~172
Convert a BPMN 2.0 XML or DMN 1.1–1.5 file to a tok document, as `tok import`. Elements tok does not keep are listed in warnings. For BPMN the diagram of the file is returned as a layout sidecar: save it as FILE.tok.layout next to the document to keep the drawing.
| Name | Type | Req | Description |
|---|---|---|---|
| flow_ids | boolean | – | Keep the identifiers of sequence flows (false prints compact chains). |
| format | string | – | – |
| layout | boolean | – | Return the layout sidecar of a BPMN file. |
| path | string | – | Path of a .bpmn or .dmn file, read by the server. Give either xml or path. |
| xml | string | – | The BPMN or DMN XML. Give either xml or path. |
| Name | Type | Req | Description |
|---|---|---|---|
| format | string | yes | – |
| layout | string|null | yes | – |
| text | string | yes | – |
| warnings | array | yes | – |
No examples provided.
reference tok language reference ~86
The reference documentation of the tok language: 'cheatsheet' (the whole language on one page; read it before writing a model), 'spec' (the normative specification), 'diagnostics' (every diagnostic code), 'feel' (expressions), 'cli' (the tok command). The same texts are resources tok://reference/TOPIC.
| Name | Type | Req | Description |
|---|---|---|---|
| topic | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| text | string | yes | – |
No examples provided.
sim Simulate a tok model ~222
Run the discrete-event simulation of a tok document, as `tok sim`: indicators (cases per end event, cycle times, waiting and processing times, resource utilization) and the report text. The same seed gives the same run. The event log and the case table are large; ask for them only when needed.
| Name | Type | Req | Description |
|---|---|---|---|
| cases | integer | – | Number of cases; overrides `simulate cases=`. |
| cases_table | boolean | – | Include one object per case. |
| csv | boolean | – | Include the event log and the case table as CSV text. |
| lang | string | – | Language of diagnostics and reports. |
| log | boolean | – | Include the event log (one object per activity instance). |
| path | string | – | Path of a .tok file, read by the server (relative to its working directory). Give either text or path. |
| seed | integer | – | Random seed; overrides `simulate seed=`. |
| text | string | – | The tok document. Give either text or path. |
| xes | boolean | – | Include the event log as XES. |
| Name | Type | Req | Description |
|---|---|---|---|
| cases | array | – | – |
| cases_csv | string | – | – |
| kpi | object | yes | – |
| log | array | – | – |
| log_csv | string | – | – |
| report | string | yes | – |
| xes | string | – | – |
No examples provided.
How do I install the tok MCP server?
tok runs locally as a PyPI package, launched with uvx tok-lang. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · tok-lang
claude mcp add tok-lang-bpm-tok -- uvx tok-lang
What is the tok MCP server?
tok is an MCP server listed in the public MCP registry as io.github.tok-lang-bpm/tok. Model BPMN processes and DMN decisions as text: check, export, import, simulate, evaluate. This page covers its PyPI package (tok-lang).
Is the tok MCP server safe to use?
tok scores 48 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the tok MCP server expose?
tok exposes 8 tools: check, check_bpmn, fmt, export, import, and 3 more. Their descriptions and schemas cost roughly 1,539 tokens of context every time the server is loaded.
Is the tok MCP server still maintained?
tok is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the tok MCP server under?
tok declares the GPL-3.0-or-later licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.