buddie
PYPI · BUDDIE
Checks AI agents' claims against primary evidence, with no model; observes only what you grant.
Available components
Last scanned (20 hours ago)
Scores higher than 64% of PyPI servers
Category Code Search and Documentation
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security50
- Malware scan not yet available for this package.Unverified
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs setuptools.build_meta at install time, a recognised build step with no custom scripting around it. View diagnostics → Pass
- No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to tsyyan/buddie). View diagnostics → Pass
- Clear OSI-approved license (Apache-2.0).Pass
- Actively maintained (last published 2 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability55
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 2524 tokens (~315/item across 8 items; 8 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management53
- Stability observed for 16 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 8 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 9 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
- Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 −14
- Malware scan: pass → unverified ▼ security
- 3 Nov 26 +1
- Security disclosure: unverified → pass ▲ functional
- 2 Nov 26 0
- Security disclosure: pass → unverified ▼ functional
- Package version: 2.0.7 → 2.0.8 functional
- 1 Nov 26 +15
- Malware scan: unverified → pass ▲ security
- 31 Oct 26 +1
- Malware scan: unverified → pass ▲ security
- Package version: 2.0.6 → 2.0.7 functional
- 30 Oct 26 0
- Package version: 2.0.5 → 2.0.6 functional
- 29 Oct 26 −15
- Malware scan: pass → unverified ▼ security
- Package version: 2.0.2 → 2.0.5 functional
- Package version: 2.0.2 → 2.0.4 functional
- 28 Oct 26 +16
- Malware scan: unverified → pass ▲ security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Nov 2026 · Analysed pypi/buddie@2.0.8
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | pypi |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | tsyyan/buddie |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/tsyyan/buddie/.github/workflows/release.yml@refs/tags/v2.0.8 |
| Rekor log index | 3637351697 |
| Predicate type | PyPI publish attestation https://docs.pypi.org/attestations/publish/v1 |
| Subject digest | sha256:d1f654f95bf5e8c3fc1f39d94bc54c92bc021f64ac6cc5632fdc6dea35d464b4 |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | setuptools.build_meta |
Background: Why install scripts are a supply-chain risk →
Dependencies 0 packages
| Packages resolved | 0 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
environment_snapshot ~284
Before giving system-specific instructions (install commands, drivers, setup), observe the parts of this machine the task needs instead of guessing: ask only for those categories (list: true names them). buddie collects what the person granted in their local grants file and the administrator's protected policy allows; anything else comes back denied, unsupported or unavailable with the reason. A request cannot grant: there is no consent argument, and an approval of this call is not a grant. The grants file states the person's intent; an agent with their file access could edit it, so only the protected policy is a ceiling it cannot change. This tool collects diagnostics categories only, never files or reports. Each observation says what it rests on (basis); unavailable means not observed, not absent. Nothing is installed or changed.
| Name | Type | Req | Description |
|---|---|---|---|
| categories | array | – | category ids, e.g. system.os, hardware.gpu, hardware.memory, software.python, software.gpu_stack (list: true for all) |
| list | boolean | – | only describe the categories and what is granted; collect nothing |
| path | string | – | hardware.storage, development.project, development.repository: a directory the person granted |
| task | string | – | what the observation is for; kept as the caller's word, grants nothing |
| tools | array | – | software.tools: names from the catalog (list: true shows it) |
No output schema declared.
No examples provided.
feedback_accept ~121
Before accepting a final report from a feedback chain: whether it is the text the chain verified. accepted is true only when the chain's disposition is verified and the report is byte for byte the chain's last accepted text; a report edited afterwards, a refused repair handed in anyway, or any report of a chain that is not verified is refused (reason). Reads the chain, checks nothing, changes nothing.
| Name | Type | Req | Description |
|---|---|---|---|
| chain | string | yes | the chain feedback_start returned (sha256:...) |
| final_text | string | yes | the final report as it is handed in |
No output schema declared.
No examples provided.
feedback_resolve ~182
Answer a chain's open feedback with one corrected text: buddie checks the corrected text itself with the chain's own check options, judges the correction (scope, no added lines but 'buddie:' disclosures, verified claims kept) and appends the decision to the chain. Returns the decision and the next feedback. A refused submission (code) changes nothing.
| Name | Type | Req | Description |
|---|---|---|---|
| chain | string | yes | the chain feedback_start returned (sha256:...) |
| corrected_text | string | yes | the corrected text |
| feedback | object | yes | the chain's open feedback-v1, as it was returned |
| original_text | string | yes | the text the feedback was made for |
| submission | object | yes | repair-submission-v1: schema_version, feedback_id, iteration, artifact_before, artifact_after (sha256 hex of the texts), execution, optional action_ref |
No output schema declared.
No examples provided.
feedback_start ~465
Check a report and open a verification feedback chain (docs/feedback.md): buddie runs the check itself, keeps the chain and its check options in files of its own, and returns a feedback-v1 with at most one bounded action per finding. To answer it, correct only what an action names and call feedback_resolve. Feedback is advice: a verified report is not a finished task unless the requirements you state are met (state.task).
| Name | Type | Req | Description |
|---|---|---|---|
| access | string | – | verbatim --access for unreadable pages, e.g. 'default' |
| checks | array | – | custom: these checks (quote, number, file_anchor, commit_anchor, fact_anchor, pr_anchor, ci_anchor, run_anchor, choice_anchor, work_claim, other_anchor) |
| fetch | boolean | – | snapshot cited URLs not in the store yet |
| github | boolean | – | ask GitHub for pr:/ci: anchors and strict GitHub citation sources |
| iteration_limit | integer | – | how many corrected texts the chain takes before it ends |
| modules | array | – | custom: these verification modules: sources (quotes, numbers), github (repo anchors, pr:, ci:), execution (run:, choice:, work claims) |
| numbers | string | – | a number of a cited sentence not in its source: gap, fail or off |
| path | string | – | a Markdown file to check instead of text |
| profile | string | – | what to check (default: everything): developer (repo, PR, CI, run: and work claims), research (quotes and numbers), complete, or custom with modules and/or checks. What a profile leaves out is not ch… |
| repos | array | – | repo checkouts for anchors (default: the git repo at or under the server's cwd; in Codex none, so pass the workspace path) |
| requirements | array | – | what the task needs verified: a claim of this check whose subject starts with subject_prefix must be supported |
| store | string | – | snapshot store (default $VERBATIM_STORE or ./.verbatim) |
| text | string | – | the report itself (Markdown); or give path |
| transcript | string | – | Claude Code session jsonl for run: anchors |
No output schema declared.
No examples provided.
snap ~92
Snapshot URLs (bytes by sha256) so quotes can be taken from and checked against them. Call it before quoting a page, then copy the words from source_text and link the same URL.
| Name | Type | Req | Description |
|---|---|---|---|
| store | string | – | snapshot store (default $VERBATIM_STORE or ./.verbatim) |
| urls | array | yes | the pages to fetch (http or https), one snapshot each; a failure is recorded too |
No output schema declared.
No examples provided.
source_text ~142
Visible text of a snapshot (URL or sha256 prefix). With grep, only the matches with context. Copy quotes from here character for character, put them in quotation marks “…” or «…», and link the snapshot's URL right after the quote in the same sentence.
| Name | Type | Req | Description |
|---|---|---|---|
| context | integer | – | with grep, characters of text kept on each side of a match |
| grep | string | – | a regular expression: only the matches, each with context |
| ref | string | yes | the snapshot: its URL, or a prefix of its sha256 |
| store | string | – | snapshot store (default $VERBATIM_STORE or ./.verbatim) |
No output schema declared.
No examples provided.
summary ~188
When no subagent is left: the summary built by code from the hook's records (what each subagent did with its receipt outcome, who was lost, the next steps with auto/ask verdicts, open PRs and red CI) and `card`, a ready AskUserQuestion input with at most three steps and «Ничего не запускать». Show `text` as is and ask with `card` unchanged; launch `auto` steps yourself and the picked ones with the anchor ⚓ choice:<summary_id>=<step>.
| Name | Type | Req | Description |
|---|---|---|---|
| queue | boolean | – | add the queue's proposed rows |
| repos | array | – | repo checkouts with buddie.toml for the queue (default: around the cwd) |
| session | string | – | the session id (default: the one whose state changed last) |
| stale | integer | – | minutes before a silent subagent is lost |
No output schema declared.
No examples provided.
verify_report ~550
Check a report before accepting or passing it on: every quote must be in the bytes of the source it links to (verbatim), every `⚓` anchor must hold in the repos, on GitHub (pr:, ci:) or in the session transcript (run:). Returns a receipt with outcome FAIL / GAPS / PASS / EMPTY, the blocking items and a one-line summary. Only quotations in quotation marks with a link to their page in the same sentence, and ⚓ anchors in backticks, are checked: write e.g. Article 2.10 says «Юридическое лицо, присоединившее другое юридическое лицо, подлежит ответственности» ([КоАП РФ, ст. 2.10](https://www.zakonrf.info/koap/2.10/)). EMPTY means nothing was checkable, not that the text is right.
| Name | Type | Req | Description |
|---|---|---|---|
| access | string | – | verbatim --access for unreadable pages, e.g. 'default' |
| checks | array | – | custom: these checks (quote, number, file_anchor, commit_anchor, fact_anchor, pr_anchor, ci_anchor, run_anchor, choice_anchor, work_claim, other_anchor) |
| fetch | boolean | – | snapshot cited URLs not in the store yet |
| github | boolean | – | ask GitHub for pr:/ci: anchors and strict GitHub citation sources |
| modules | array | – | custom: these verification modules: sources (quotes, numbers), github (repo anchors, pr:, ci:), execution (run:, choice:, work claims) |
| numbers | string | – | a number of a cited sentence not in its source: gap, fail or off |
| path | string | – | a Markdown file to check instead of text |
| profile | string | – | what to check (default: everything): developer (repo, PR, CI, run: and work claims), research (quotes and numbers), complete, or custom with modules and/or checks. What a profile leaves out is not ch… |
| receipt | string | – | receipt contract of the result: v0 (default) or v1, which also says what was checked, what was not and why (scope, coverage) |
| repos | array | – | repo checkouts for anchors (default: the git repo at or under the server's cwd; in Codex none, so pass the workspace path) |
| store | string | – | snapshot store (default $VERBATIM_STORE or ./.verbatim) |
| text | string | – | the report itself (Markdown); or give path |
| transcript | string | – | Claude Code session jsonl for run: anchors |
No output schema declared.
No examples provided.
How do I install the buddie MCP server?
buddie runs locally as a PyPI package, launched with uvx buddie. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · buddie
claude mcp add tsyyan-buddie -- uvx buddie
What is the buddie MCP server?
buddie is an MCP server listed in the public MCP registry as io.github.tsyyan/buddie. Checks AI agents' claims against primary evidence, with no model; observes only what you grant. This page covers its PyPI package (buddie).
Is the buddie MCP server safe to use?
buddie scores 69 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 4 November 2026. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the buddie MCP server expose?
buddie exposes 8 tools: verify_report, snap, source_text, summary, environment_snapshot, and 3 more. Their descriptions and schemas cost roughly 2,024 tokens of context every time the server is loaded.
Is the buddie MCP server still maintained?
buddie is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the buddie MCP server under?
buddie declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.