# buddie (pypi · buddie)

Checks AI agents' claims against primary evidence, with no model; observes only what you grant.

- Trust score: 84/100 (high trust)
- Change this week: +18
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- pypi · `buddie`: 84/100 (this document), [markdown](https://verifymcp.io/servers/tsyyan-buddie/buddie.md), [page](https://verifymcp.io/servers/tsyyan-buddie/buddie)

## Channel facts

- Registry: `pypi`
- Package: `buddie`
- Version: `2.0.8`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Supply Chain Security**: 100/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - Runs setuptools.build_meta at install time, a recognised build step with no custom scripting around it.
  - No production dependencies, so there is no dependency health to assess.
- **Provenance & Transparency**: 100/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to tsyyan/buddie).
  - Clear OSI-approved license (Apache-2.0).
  - Actively maintained (last published 3 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 55/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 2524 tokens (~315/item across 8 items; 8 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 57/100
  - Stability observed for 17 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 8 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 9 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 60/100
  - Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28.

## Install

### How do I install the buddie MCP server?

buddie runs locally as a PyPI package, launched with uvx buddie. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add tsyyan-buddie -- uvx buddie
```

### Cursor

```json
{
  "mcpServers": {
    "tsyyan-buddie": {
      "command": "uvx",
      "args": [
        "buddie"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "tsyyan-buddie": {
      "command": "uvx",
      "args": [
        "buddie"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add tsyyan-buddie -- uvx buddie
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "tsyyan-buddie": {
      "type": "local",
      "command": [
        "uvx",
        "buddie"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add tsyyan-buddie --command uvx --arg buddie
```

### Hermes

```yaml
mcp_servers:
  tsyyan-buddie:
    command: "uvx"
    args: ["buddie"]
```

### Netclaw

```json
{
  "McpServers": {
    "tsyyan-buddie": {
      "Transport": "stdio",
      "Command": "uvx",
      "Arguments": [
        "buddie"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add tsyyan-buddie -t stdio -c uvx -a buddie
```

### Other

```json
{
  "mcpServers": {
    "tsyyan-buddie": {
      "command": "uvx",
      "args": [
        "buddie"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-05 (score 84, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-11-04 (score 69, −14)

- [security regression] Malware scan: pass → unverified

### 2026-11-03 (score 83, +1)

- [functional improvement] Security disclosure: unverified → pass

### 2026-11-02 (score 82, 0)

- [functional regression] Security disclosure: pass → unverified
- [functional] Package version: 2.0.7 → 2.0.8

### 2026-11-01 (score 82, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-10-31 (score 67, +1)

- [security improvement] Malware scan: unverified → pass
- [functional] Package version: 2.0.6 → 2.0.7

### 2026-10-30 (score 66, 0)

- [functional] Package version: 2.0.5 → 2.0.6

### 2026-10-29 (score 66, −15)

- [security regression] Malware scan: pass → unverified
- [functional] Package version: 2.0.2 → 2.0.5
- [functional] Package version: 2.0.2 → 2.0.4

## MCP tools (8)

### `verify_report` (~550 tokens)

Check a report before accepting or passing it on: every quote must be in the bytes of the source it links to (verbatim), every `⚓` anchor must hold in the repos, on GitHub (pr:, ci:) or in the session transcript (run:). Returns a receipt with outcome FAIL / GAPS / PASS / EMPTY, the blocking items and a one-line summary. Only quotations in quotation marks with a link to their page in the same sentence, and ⚓ anchors in backticks, are checked: write e.g. Article 2.10 says «Юридическое лицо, присоединившее другое юридическое лицо, подлежит ответственности» ([КоАП РФ, ст. 2.10](https://www.zakonrf.info/koap/2.10/)). EMPTY means nothing was checkable, not that the text is right.

Input parameters:

- `access` (string): verbatim --access for unreadable pages, e.g. 'default'
- `checks` (array): custom: these checks (quote, number, file_anchor, commit_anchor, fact_anchor, pr_anchor, ci_anchor, run_anchor, choice_anchor, work_claim, other_anchor)
- `fetch` (boolean): snapshot cited URLs not in the store yet
- `github` (boolean): ask GitHub for pr:/ci: anchors and strict GitHub citation sources
- `modules` (array): custom: these verification modules: sources (quotes, numbers), github (repo anchors, pr:, ci:), execution (run:, choice:, work claims)
- `numbers` (string): a number of a cited sentence not in its source: gap, fail or off
- `path` (string): a Markdown file to check instead of text
- `profile` (string): what to check (default: everything): developer (repo, PR, CI, run: and work claims), research (quotes and numbers), complete, or custom with modules and/or checks. What a profile leaves out is not ch…
- `receipt` (string): receipt contract of the result: v0 (default) or v1, which also says what was checked, what was not and why (scope, coverage)
- `repos` (array): repo checkouts for anchors (default: the git repo at or under the server's cwd; in Codex none, so pass the workspace path)
- `store` (string): snapshot store (default $VERBATIM_STORE or ./.verbatim)
- `text` (string): the report itself (Markdown); or give path
- `transcript` (string): Claude Code session jsonl for run: anchors

### `snap` (~92 tokens)

Snapshot URLs (bytes by sha256) so quotes can be taken from and checked against them. Call it before quoting a page, then copy the words from source_text and link the same URL.

Input parameters:

- `store` (string): snapshot store (default $VERBATIM_STORE or ./.verbatim)
- `urls` (array, required): the pages to fetch (http or https), one snapshot each; a failure is recorded too

### `source_text` (~142 tokens)

Visible text of a snapshot (URL or sha256 prefix). With grep, only the matches with context. Copy quotes from here character for character, put them in quotation marks “…” or «…», and link the snapshot's URL right after the quote in the same sentence.

Input parameters:

- `context` (integer): with grep, characters of text kept on each side of a match
- `grep` (string): a regular expression: only the matches, each with context
- `ref` (string, required): the snapshot: its URL, or a prefix of its sha256
- `store` (string): snapshot store (default $VERBATIM_STORE or ./.verbatim)

### `summary` (~188 tokens)

When no subagent is left: the summary built by code from the hook's records (what each subagent did with its receipt outcome, who was lost, the next steps with auto/ask verdicts, open PRs and red CI) and `card`, a ready AskUserQuestion input with at most three steps and «Ничего не запускать». Show `text` as is and ask with `card` unchanged; launch `auto` steps yourself and the picked ones with the anchor ⚓ choice:<summary_id>=<step>.

Input parameters:

- `queue` (boolean): add the queue's proposed rows
- `repos` (array): repo checkouts with buddie.toml for the queue (default: around the cwd)
- `session` (string): the session id (default: the one whose state changed last)
- `stale` (integer): minutes before a silent subagent is lost

### `environment_snapshot` (~284 tokens)

Before giving system-specific instructions (install commands, drivers, setup), observe the parts of this machine the task needs instead of guessing: ask only for those categories (list: true names them). buddie collects what the person granted in their local grants file and the administrator's protected policy allows; anything else comes back denied, unsupported or unavailable with the reason. A request cannot grant: there is no consent argument, and an approval of this call is not a grant. The grants file states the person's intent; an agent with their file access could edit it, so only the protected policy is a ceiling it cannot change. This tool collects diagnostics categories only, never files or reports. Each observation says what it rests on (basis); unavailable means not observed, not absent. Nothing is installed or changed.

Input parameters:

- `categories` (array): category ids, e.g. system.os, hardware.gpu, hardware.memory, software.python, software.gpu_stack (list: true for all)
- `list` (boolean): only describe the categories and what is granted; collect nothing
- `path` (string): hardware.storage, development.project, development.repository: a directory the person granted
- `task` (string): what the observation is for; kept as the caller's word, grants nothing
- `tools` (array): software.tools: names from the catalog (list: true shows it)

### `feedback_start` (~465 tokens)

Check a report and open a verification feedback chain (docs/feedback.md): buddie runs the check itself, keeps the chain and its check options in files of its own, and returns a feedback-v1 with at most one bounded action per finding. To answer it, correct only what an action names and call feedback_resolve. Feedback is advice: a verified report is not a finished task unless the requirements you state are met (state.task).

Input parameters:

- `access` (string): verbatim --access for unreadable pages, e.g. 'default'
- `checks` (array): custom: these checks (quote, number, file_anchor, commit_anchor, fact_anchor, pr_anchor, ci_anchor, run_anchor, choice_anchor, work_claim, other_anchor)
- `fetch` (boolean): snapshot cited URLs not in the store yet
- `github` (boolean): ask GitHub for pr:/ci: anchors and strict GitHub citation sources
- `iteration_limit` (integer): how many corrected texts the chain takes before it ends
- `modules` (array): custom: these verification modules: sources (quotes, numbers), github (repo anchors, pr:, ci:), execution (run:, choice:, work claims)
- `numbers` (string): a number of a cited sentence not in its source: gap, fail or off
- `path` (string): a Markdown file to check instead of text
- `profile` (string): what to check (default: everything): developer (repo, PR, CI, run: and work claims), research (quotes and numbers), complete, or custom with modules and/or checks. What a profile leaves out is not ch…
- `repos` (array): repo checkouts for anchors (default: the git repo at or under the server's cwd; in Codex none, so pass the workspace path)
- `requirements` (array): what the task needs verified: a claim of this check whose subject starts with subject_prefix must be supported
- `store` (string): snapshot store (default $VERBATIM_STORE or ./.verbatim)
- `text` (string): the report itself (Markdown); or give path
- `transcript` (string): Claude Code session jsonl for run: anchors

### `feedback_resolve` (~182 tokens)

Answer a chain's open feedback with one corrected text: buddie checks the corrected text itself with the chain's own check options, judges the correction (scope, no added lines but 'buddie:' disclosures, verified claims kept) and appends the decision to the chain. Returns the decision and the next feedback. A refused submission (code) changes nothing.

Input parameters:

- `chain` (string, required): the chain feedback_start returned (sha256:...)
- `corrected_text` (string, required): the corrected text
- `feedback` (object, required): the chain's open feedback-v1, as it was returned
- `original_text` (string, required): the text the feedback was made for
- `submission` (object, required): repair-submission-v1: schema_version, feedback_id, iteration, artifact_before, artifact_after (sha256 hex of the texts), execution, optional action_ref

### `feedback_accept` (~121 tokens)

Before accepting a final report from a feedback chain: whether it is the text the chain verified. accepted is true only when the chain's disposition is verified and the report is byte for byte the chain's last accepted text; a report edited afterwards, a refused repair handed in anyway, or any report of a chain that is not verified is refused (reason). Reads the chain, checks nothing, changes nothing.

Input parameters:

- `chain` (string, required): the chain feedback_start returned (sha256:...)
- `final_text` (string, required): the final report as it is handed in

## Diagnostics

Captured diagnostic sections: Provenance, Install scripts, Dependencies. The full working is on the page: https://verifymcp.io/servers/tsyyan-buddie/buddie#diagnostics

## Score history

- 2026-11-05: 84
- 2026-11-04: 69
- 2026-11-03: 83
- 2026-11-02: 82
- 2026-11-01: 82
- 2026-10-31: 67
- 2026-10-30: 66
- 2026-10-29: 66
- 2026-10-28: 81
- 2026-10-27: 65
- 2026-10-26: 80
- 2026-10-25: 64
- 2026-10-24: 64
- 2026-10-23: 77
- 2026-10-22: 76
- 2026-10-21: 75
- 2026-10-20: 60
- 2026-10-19: 75

## Common questions

### What is the buddie MCP server?

buddie is an MCP server listed in the public MCP registry as io.github.tsyyan/buddie. Checks AI agents' claims against primary evidence, with no model; observes only what you grant. This page covers its PyPI package (buddie).

### Is the buddie MCP server safe to use?

buddie scores 84 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the buddie MCP server expose?

buddie exposes 8 tools: verify_report, snap, source_text, summary, environment_snapshot, and 3 more. Their descriptions and schemas cost roughly 2,024 tokens of context every time the server is loaded.

### Is the buddie MCP server still maintained?

buddie is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the buddie MCP server under?

buddie declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- PyPI project: https://pypi.org/project/buddie/
- Socket report: https://socket.dev/pypi/package/buddie
- Repository: https://github.com/tsyyan/buddie
- Changelog RSS feed: https://verifymcp.io/servers/tsyyan-buddie/buddie.xml
- Changelog JSON feed: https://verifymcp.io/servers/tsyyan-buddie/buddie.json
- HTML version of this page: https://verifymcp.io/servers/tsyyan-buddie/buddie