# tok (pypi · tok-lang)

Model BPMN processes and DMN decisions as text: check, export, import, simulate, evaluate.

- Trust score: 48/100 (low)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- pypi · `tok-lang`: 48/100 (this document), [markdown](https://verifymcp.io/servers/tok-lang-bpm-tok/tok-lang.md), [page](https://verifymcp.io/servers/tok-lang-bpm-tok/tok-lang)

## Channel facts

- Registry: `pypi`
- Package: `tok-lang`
- Version: `1.0.3`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Supply Chain Security**: 50/100
  - Malware scan not yet available for this package.
  - No known CVEs affecting this package version or its production dependencies.
  - Runs maturin at install time, a recognised build step with no custom scripting around it.
  - No production dependencies, so there is no dependency health to assess.
- **Provenance & Transparency**: 48/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (GPL-3.0-or-later).
  - Actively maintained (last published 5 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 40/100
  - 0% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 1699 tokens (~130/item across 13 items; 8 tools + 5 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 99/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 95% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Tool Safety**: 75/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "eval" implies "eval" and declares readOnlyHint instead, contradicting what its own name says it does.
  - An AI judge read all 10 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### How do I install the tok MCP server?

tok runs locally as a PyPI package, launched with uvx tok-lang. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add tok-lang-bpm-tok -- uvx tok-lang
```

### Cursor

```json
{
  "mcpServers": {
    "tok-lang-bpm-tok": {
      "command": "uvx",
      "args": [
        "tok-lang"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "tok-lang-bpm-tok": {
      "command": "uvx",
      "args": [
        "tok-lang"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add tok-lang-bpm-tok -- uvx tok-lang
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "tok-lang-bpm-tok": {
      "type": "local",
      "command": [
        "uvx",
        "tok-lang"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add tok-lang-bpm-tok --command uvx --arg tok-lang
```

### Hermes

```yaml
mcp_servers:
  tok-lang-bpm-tok:
    command: "uvx"
    args: ["tok-lang"]
```

### Netclaw

```json
{
  "McpServers": {
    "tok-lang-bpm-tok": {
      "Transport": "stdio",
      "Command": "uvx",
      "Arguments": [
        "tok-lang"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add tok-lang-bpm-tok -t stdio -c uvx -a tok-lang
```

### Other

```json
{
  "mcpServers": {
    "tok-lang-bpm-tok": {
      "command": "uvx",
      "args": [
        "tok-lang"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-05 (score 48, −15)

- [security regression] Malware scan: pass → unverified

### 2026-11-03 (score 63, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-11-02 (score 48)

First indexed and scored.

## MCP tools (8)

### `check` (~237 tokens)

Check a tok model

Check a tok document and list its diagnostics (code, severity, line, element, message), as `tok check --json`. Every layer is checked: tokens, statements, references, BPMN 2.0 rules, the Camunda 8 profile of executable documents, decisions, FEEL and simulation parameters. A document with errors is a successful call with errors > 0; fix the errors and check again. Codes are explained in the reference topic 'diagnostics'.

Input parameters:

- `bpmn` (boolean): Also check the BPMN 2.0 rules of the exported model (E, W, L codes).
- `class` (string): BPMN 2.0.2 conformance class to check against; elements outside it are R075.
- `lang` (string): Language of diagnostics and reports.
- `level` (string): Teaching level: the elements the document may use (spec §13).
- `path` (string): Path of a .tok file, read by the server (relative to its working directory). Give either text or path.
- `text` (string): The tok document. Give either text or path.

Output parameters:

- `bpmn_class` (string)
- `diagnostics` (array)
- `errors` (integer)

### `check_bpmn` (~306 tokens)

Check a BPMN file

Check BPMN 2.0 XML, from tok or from any modelling tool, with the BPMN rules of the tok checker, as `tok check FILE.bpmn --json`: every finding has a code, a severity, the line and the id of its element and a message. steps requires every element name to start with the step number of a process description (K01); description, the text of that description, reports steps without an element and elements without a step (K02, K03); camunda adds the Camunda 8 profile of executable models (C codes; with path, forms and decisions are looked for in the file's folder). XML with errors is a successful call with errors > 0. Codes are explained in the reference topic 'diagnostics'.

Input parameters:

- `camunda` (boolean): Also check the Camunda 8 profile of executable models (C codes).
- `description` (string): The process description whose table lists the steps (its first column holds the step numbers); checks that every step is in the model (K02, K03).
- `lang` (string): Language of diagnostics and reports.
- `path` (string): Path of a .bpmn file, read by the server (relative to its working directory). Give either xml or path.
- `steps` (boolean): Element names start with step numbers (K01).
- `xml` (string): The BPMN 2.0 XML. Give either xml or path.

Output parameters:

- `diagnostics` (array)
- `errors` (integer)

### `fmt` (~101 tokens)

Format a tok model

Print a tok document in its canonical form, as `tok fmt`. The document must have no syntax errors. The result is the text only; write it to the file yourself.

Input parameters:

- `lang` (string): Language of diagnostics and reports.
- `path` (string): Path of a .tok file, read by the server (relative to its working directory). Give either text or path.
- `text` (string): The tok document. Give either text or path.

Output parameters:

- `text` (string)

### `export` (~246 tokens)

Export a tok model

Export a checked tok document and return the contents of the files `tok export` writes: BPMN 2.0 XML with diagram layout (NAME.bpmn), its SVG picture (NAME.svg), DMN files of the decisions (with NAME.drd.svg pictures in languages 0.7 and 1.0) and Camunda form files (ID.form). With path, the layout sidecar FILE.tok.layout next to the file is used. A document with errors is a tool error listing them.

Input parameters:

- `formats` (array): The kinds of file to return; all when left out. 'dmn' includes the decision diagrams (.drd.svg).
- `lang` (string): Language of diagnostics and reports.
- `name` (string): Stem of the BPMN and SVG file names; default: the stem of path, or 'model'.
- `path` (string): Path of a .tok file, read by the server (relative to its working directory). Give either text or path.
- `sidecar` (boolean): Use the layout sidecar FILE.tok.layout next to path.
- `text` (string): The tok document. Give either text or path.

Output parameters:

- `files` (object): File name → content.

### `import` (~172 tokens)

Import BPMN or DMN

Convert a BPMN 2.0 XML or DMN 1.1–1.5 file to a tok document, as `tok import`. Elements tok does not keep are listed in warnings. For BPMN the diagram of the file is returned as a layout sidecar: save it as FILE.tok.layout next to the document to keep the drawing.

Input parameters:

- `flow_ids` (boolean): Keep the identifiers of sequence flows (false prints compact chains).
- `format` (string)
- `layout` (boolean): Return the layout sidecar of a BPMN file.
- `path` (string): Path of a .bpmn or .dmn file, read by the server. Give either xml or path.
- `xml` (string): The BPMN or DMN XML. Give either xml or path.

Output parameters:

- `format` (string)
- `layout` (string|null)
- `text` (string)
- `warnings` (array)

### `sim` (~222 tokens)

Simulate a tok model

Run the discrete-event simulation of a tok document, as `tok sim`: indicators (cases per end event, cycle times, waiting and processing times, resource utilization) and the report text. The same seed gives the same run. The event log and the case table are large; ask for them only when needed.

Input parameters:

- `cases` (integer): Number of cases; overrides `simulate cases=`.
- `cases_table` (boolean): Include one object per case.
- `csv` (boolean): Include the event log and the case table as CSV text.
- `lang` (string): Language of diagnostics and reports.
- `log` (boolean): Include the event log (one object per activity instance).
- `path` (string): Path of a .tok file, read by the server (relative to its working directory). Give either text or path.
- `seed` (integer): Random seed; overrides `simulate seed=`.
- `text` (string): The tok document. Give either text or path.
- `xes` (boolean): Include the event log as XES.

Output parameters:

- `cases` (array)
- `cases_csv` (string)
- `kpi` (object)
- `log` (array)
- `log_csv` (string)
- `report` (string)
- `xes` (string)

### `eval` (~169 tokens)

Evaluate a decision

Evaluate a decision of a tok document for input values, as `tok eval`. In languages 0.7 and 1.0 the decision is evaluated with everything it requires and values are given by the FEEL names of input data; in earlier languages the decision table alone is evaluated over its input columns. Values are JSON (numbers, text, booleans, null, lists, objects as contexts).

Input parameters:

- `decision` (string, required): Identifier of the decision.
- `lang` (string): Language of diagnostics and reports.
- `path` (string): Path of a .tok file, read by the server (relative to its working directory). Give either text or path.
- `text` (string): The tok document. Give either text or path.
- `values` (object): Input name → value.

Output parameters:

- `value`: The value of the decision as JSON.

### `reference` (~86 tokens)

tok language reference

The reference documentation of the tok language: 'cheatsheet' (the whole language on one page; read it before writing a model), 'spec' (the normative specification), 'diagnostics' (every diagnostic code), 'feel' (expressions), 'cli' (the tok command). The same texts are resources tok://reference/TOPIC.

Input parameters:

- `topic` (string)

Output parameters:

- `text` (string)

## Diagnostics

Captured diagnostic sections: Provenance, Install scripts, Dependencies. The full working is on the page: https://verifymcp.io/servers/tok-lang-bpm-tok/tok-lang#diagnostics

## Score history

- 2026-11-05: 48
- 2026-11-04: 63
- 2026-11-03: 63
- 2026-11-02: 48

## Common questions

### What is the tok MCP server?

tok is an MCP server listed in the public MCP registry as io.github.tok-lang-bpm/tok. Model BPMN processes and DMN decisions as text: check, export, import, simulate, evaluate. This page covers its PyPI package (tok-lang).

### Is the tok MCP server safe to use?

tok scores 48 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the tok MCP server expose?

tok exposes 8 tools: check, check_bpmn, fmt, export, import, and 3 more. Their descriptions and schemas cost roughly 1,539 tokens of context every time the server is loaded.

### Is the tok MCP server still maintained?

tok is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the tok MCP server under?

tok declares the GPL-3.0-or-later licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- PyPI project: https://pypi.org/project/tok-lang/
- Socket report: https://socket.dev/pypi/package/tok-lang
- Repository: https://github.com/tok-lang-bpm/tok
- Website: https://tok-lang-bpm.github.io/
- Changelog RSS feed: https://verifymcp.io/servers/tok-lang-bpm-tok/tok-lang.xml
- Changelog JSON feed: https://verifymcp.io/servers/tok-lang-bpm-tok/tok-lang.json
- HTML version of this page: https://verifymcp.io/servers/tok-lang-bpm-tok/tok-lang