Nanostores MCP
NPM · NANOSTORES-MCP · SCANNED AUG 3
Debug and analyze Nanostores apps with AI: scan stores, monitor runtime events, and search docs.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security87
- No malware found by supply-chain analysis.Pass
- Only part of the dependency tree could be resolved (131 of 135), so this covers what we could see, not the whole tree.Partial
- No install/post-install scripts declared.Pass
- Only part of the dependency tree could be resolved (131 of 135), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency97
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to Valyay/nanostores-mcp). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 103 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability71
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 3318 tokens (~255/item across 13 items; 12 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
- Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage98
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 94% of tool parameters carry a description.Partial
- Structured output schemas are declared (92% of tools); any adoption earns full credit.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
npm · nanostores-mcp
claude mcp add valyay-nanostores-mcp -- npx -y nanostores-mcp
codex mcp add valyay-nanostores-mcp -- npx -y nanostores-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"valyay-nanostores-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"nanostores-mcp"
],
"enabled": true
}
}
} openclaw mcp add valyay-nanostores-mcp --command npx --arg -y --arg nanostores-mcp
mcp_servers:
valyay-nanostores-mcp:
command: "npx"
args: ["-y", "nanostores-mcp"] {
"mcpServers": {
"valyay-nanostores-mcp": {
"command": "npx",
"args": [
"-y",
"nanostores-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 3 Aug 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.
- 2 Aug 26 +44
- Known CVEs: unverified → partial ▲ security
- Install scripts: unverified → pass ▲ security
- Provenance: unverified → pass ▲ security
- Malware scan: unverified → pass ▲ security
- The attested source repository moved: Valyay/nanostores-mcp security
- Maintenance: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- Stability: unverified → 0.23 ▲ functional
- License: unverified → pass ▲ functional
- Licence: MIT functional
- 31 Jul 26 −5
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 30 Jul 26 −52
- Known CVEs: partial → unverified ▼ security
- Provenance: pass → unverified ▼ security
- Install scripts: pass → unverified ▼ security
- Malware scan: pass → unverified ▼ security
- The attested source repository moved: Valyay/nanostores-mcp security
- Maintenance: pass → unverified ▼ functional
- Dependency health: partial → unverified ▼ functional
- License: pass → unverified ▼ functional
- Licence: MIT functional
- 27 Jul 26 +48
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 26 Jul 26 43
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 3 Aug 2026 · Analysed npm/[email protected]
Provenance verified
Ecosystem: npm · Outcome: verified
Reason: verified
- Source repo:
- Valyay/nanostores-mcp
- Certificate issuer:
- https://token.actions.githubusercontent.com
- Certificate SAN:
- https://github.com/Valyay/nanostores-mcp/.github/workflows/publish.yml@refs/tags/v0.1.2
- Rekor log index:
- 1352230971
- Predicate type:
- https://slsa.dev/provenance/v1
- Subject digest:
- sha512:5b5cf58004096dd28e372456535cc51f9b1ac33acf5c0e931affb991fbcfa96fbc2c216d23eace056d8987316e16ec633aa46d313b8e7e2471b86d9ec
- Discovery method:
- attestation_endpoint
Dependencies 131 packages
131 packages in the resolved dependency tree · 130 deprecated · 43 stale.
The dependency tree was only partially resolved, so these counts may be incomplete.
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
nanostores_clear_cache Clear project analysis cache ~71
Use this when scan results seem stale or after making file changes that the server may not have detected. Clears the cached project index so the next nanostores_scan_project call performs a fresh scan.
| Name | Type | Req | Description |
|---|---|---|---|
| rootUri | string | — | Workspace root to clear cache for. Omit to clear all roots. |
No output schema declared.
No examples provided.
nanostores_docs_search Search Nanostores documentation ~191
Find Nanostores documentation by topic or store kind. Use query for free-text search across guides, API references, and best practices. Use storeKind to get docs relevant to a specific store type (atom, map, computed, etc.). Combine both to search within store-relevant pages. To read full page content, use the nanostores://docs/page/{id} resource. Example: {query: "persistent storage"} or {storeKind: "computed"} or {query: "batched", storeKind: "computed"}.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | — | Maximum number of results |
| query | string | — | Search query for documentation. Required unless storeKind is provided. |
| storeKind | string | — | Find docs relevant to this store type. Can be used alone or with query. |
| tags | array | — | Filter by tags (e.g., ['react', 'persistent']) |
| Name | Type | Req | Description |
|---|---|---|---|
| query | string | — | — |
| results | array | yes | — |
| storeKind | string | — | — |
No examples provided.
nanostores_find_noisy_stores Find noisy stores ~112
Use this when investigating performance issues or excessive re-renders. Returns stores ranked by activity — frequent changes, many action calls — to pinpoint bottlenecks. Example: {limit: 10} or {windowMs: 30000, compact: true}.
| Name | Type | Req | Description |
|---|---|---|---|
| compact | boolean | — | Return TOON-encoded compact table for lower token cost |
| limit | number | — | Number of stores to return |
| windowMs | number | — | Time window in milliseconds (from now back) |
| Name | Type | Req | Description |
|---|---|---|---|
| stores | array | yes | — |
| summary | string | yes | — |
No examples provided.
nanostores_ping Ping Nanostores MCP server ~39
Use this when you need to verify the MCP server is alive or check whether the runtime logger bridge is connected.
| Name | Type | Req | Description |
|---|---|---|---|
| message | string | — | — |
| Name | Type | Req | Description |
|---|---|---|---|
| loggerBridge | object | — | — |
| message | string | yes | — |
No examples provided.
nanostores_project_outline Get project outline ~92
Use this for a quick overview of Nanostores usage in the project — store kind distribution, top directories, and hub stores ranked by connectivity. Returns a compact summary instead of full store/subscriber lists (same scan data, smaller response). Use nanostores_scan_project when you need the complete list of stores and relations.
| Name | Type | Req | Description |
|---|---|---|---|
| projectRoot | string | — | Project root path (uses default if omitted) |
| Name | Type | Req | Description |
|---|---|---|---|
| coOccurringPairs | array | yes | — |
| hubs | array | yes | — |
| rootDir | string | yes | — |
| storeKinds | object | yes | — |
| topBlindSpots | array | yes | — |
| topDirs | array | yes | — |
| topSemanticAnomalies | array | yes | — |
| totals | object | yes | — |
| unreferencedStores | array | yes | — |
No examples provided.
nanostores_runtime_coverage Runtime coverage report ~96
Compare static analysis graph with runtime event data to find stores declared in the static graph but not observed in this runtime session, and stores seen at runtime but absent from the static graph (dynamic or unscanned). Use after running the app to verify instrumentation completeness. Example: {} or {projectRoot: "/path/to/project"}.
| Name | Type | Req | Description |
|---|---|---|---|
| projectRoot | string | — | Project root path (uses first configured root if omitted) |
| Name | Type | Req | Description |
|---|---|---|---|
| report | object | yes | — |
| summary | string | yes | — |
No examples provided.
nanostores_runtime_overview Get runtime overview ~96
Use this when you want a high-level health check of the running app's state management. Returns active stores, error-prone stores, unused stores, and activity patterns. Example: {} or {windowMs: 60000, compact: true}.
| Name | Type | Req | Description |
|---|---|---|---|
| compact | boolean | — | Return TOON-encoded compact table for lower token cost |
| windowMs | number | — | Time window in milliseconds (from now back) |
| Name | Type | Req | Description |
|---|---|---|---|
| errorProneStores | array | yes | — |
| noisyStores | array | yes | — |
| stats | object | yes | — |
| summary | string | yes | — |
| unmountedStores | array | yes | — |
No examples provided.
nanostores_scan_project Scan project for Nanostores usage ~143
Returns the complete store/subscriber/relation index for the project. Use compact:true for a token-efficient directory-level overview (store counts by folder). Use the full mode (default) when you need to iterate over every entity or build a complete picture. Example: {compact: true} for directory overview, {force: true} to bypass cache.
| Name | Type | Req | Description |
|---|---|---|---|
| compact | boolean | — | Return a compact directory-level summary instead of full store/subscriber lists. Use when you need a token-efficient overview of where stores live, not individual store details. |
| force | boolean | — | Force a fresh scan, bypassing the cache. |
| rootUri | string | — | — |
| Name | Type | Req | Description |
|---|---|---|---|
| byDir | array | — | — |
| errors | array | — | — |
| filesScanned | number | yes | — |
| mutators | array | — | — |
| relations | array | — | — |
| root | string | yes | — |
| stores | array | — | — |
| subscribers | array | — | — |
| totals | object | — | — |
No examples provided.
nanostores_store_activity Get store runtime activity ~180
Use this when debugging a specific store's runtime behavior — why it updates too often, what actions trigger changes, or whether it emits errors. Returns recent events, change frequency, action calls, and errors. Omit storeName to get activity across all stores. Example: {storeName: "$cart", kinds: ["change", "action-error"]} or {limit: 20, windowMs: 60000}.
| Name | Type | Req | Description |
|---|---|---|---|
| actionName | string | — | Filter events by action name |
| kinds | array | — | Filter events by kind(s) |
| limit | number | — | Max events to return |
| projectRoot | string | — | Project root path to link runtime data with static analysis |
| storeName | string | — | Store name to query (optional) |
| windowMs | number | — | Time window in milliseconds (from now back) |
| Name | Type | Req | Description |
|---|---|---|---|
| events | array | yes | — |
| stats | — | yes | — |
| storeName | string | — | — |
| summary | string | yes | — |
No examples provided.
nanostores_store_impact Get store impact chain ~189
When you need to trace what recomputes if X changes, call this once — not nanostores_store_summary on each downstream store. Returns the full ordered downstream chain in a single response: computed stores that depend on X at hop 1, their dependents at hop 2, and so on. Subscribers appear at the same hop as the store they react to. Use nanostores_store_subgraph instead when you also need upstream ancestors (BFS in both directions). Example: {name: "$isLoggedIn"} returns every computed store and subscriber that recomputes when $isLoggedIn changes, ordered by distance.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | — | Store name. Used if storeId is not provided. |
| projectRoot | string | — | Project root path (uses default if omitted) |
| storeId | string | — | Exact store id. If provided, takes priority. |
| Name | Type | Req | Description |
|---|---|---|---|
| hops | array | yes | — |
| sourceName | string | — | — |
| sourceStoreId | string | yes | — |
| summary | object | yes | — |
No examples provided.
nanostores_store_subgraph Get store subgraph ~214
If your question is 'what recomputes downstream when X changes?', use nanostores_store_impact instead — it gives the ordered causal chain in one call. Use this tool only when you need both directions: upstream sources AND downstream dependents together. Returns the BFS neighborhood within a configurable radius (default 2). Start with radius=1; increase only when you need wider structural context. On highly connected hub stores (score>5 in project_outline) radius=2+ may return most of the project. Example: {name: "$cart", radius: 1} or {storeId: "store:src/stores.ts#$cart", radius: 2}.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | — | Store name. Used if storeId is not provided. |
| projectRoot | string | — | Project root path (uses default if omitted) |
| radius | integer | — | BFS radius around the store (default 2) |
| storeId | string | — | Exact store id. If provided, takes priority. |
| Name | Type | Req | Description |
|---|---|---|---|
| centerStoreId | string | yes | — |
| edges | array | yes | — |
| nodes | array | yes | — |
| radius | number | yes | — |
| summary | object | — | — |
| warning | string | — | — |
No examples provided.
nanostores_store_summary Summarize a Nanostores store ~155
Use this when you need details about a specific store — its kind, file location, direct subscribers, and first-level derived relations. Accepts store id or name. For multi-hop dependency chains use nanostores_store_subgraph instead. Example: {name: "$counter"} or {storeId: "store:src/stores.ts#$counter"}.
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | — | Optional relative file path to disambiguate store name. |
| name | string | — | Store name. Used if storeId is not provided. |
| rootUri | string | — | Project root URI or path for multi-root setups; defaults to first root. |
| storeId | string | — | Exact store id. If provided, takes priority. |
| Name | Type | Req | Description |
|---|---|---|---|
| derivedDependents | object | yes | — |
| derivesFrom | object | yes | — |
| resolution | object | yes | — |
| store | object | yes | — |
| subscribers | array | yes | — |
No examples provided.