Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Nanostores MCP

NPM · NANOSTORES-MCP · SCANNED SEP 20

Debug and analyze Nanostores apps with AI: scan stores, monitor runtime events, and search docs.

Available components

−1 this week 94 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security98
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • 46 of 132 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to Valyay/nanostores-mcp). View diagnostics → Pass
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 151 days ago).Pass
  • Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability78
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 3318 tokens (~255/item across 13 items; 12 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management93
  • Stability observed for 28 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage98
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 94% of tool parameters carry a description.Partial
  • Structured output schemas are declared (92% of tools); any adoption earns full credit.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 12 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 14 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

How do I install the Nanostores MCP server?

Nanostores MCP runs locally as an npm package, launched with npx -y nanostores-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · nanostores-mcp

# add to Claude Code
claude mcp add valyay-nanostores-mcp -- npx -y nanostores-mcp
// .cursor/mcp.json
{
  "mcpServers": {
    "valyay-nanostores-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "nanostores-mcp"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "valyay-nanostores-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "nanostores-mcp"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add valyay-nanostores-mcp -- npx -y nanostores-mcp
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "valyay-nanostores-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "nanostores-mcp"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add valyay-nanostores-mcp --command npx --arg -y --arg nanostores-mcp
# ~/.hermes/config.yaml
mcp_servers:
  valyay-nanostores-mcp:
    command: "npx"
    args: ["-y", "nanostores-mcp"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "valyay-nanostores-mcp": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "nanostores-mcp"
      ]
    }
  }
}
# add to Vellum
assistant mcp add valyay-nanostores-mcp -t stdio -c npx -a -y nanostores-mcp
// mcp.json
{
  "mcpServers": {
    "valyay-nanostores-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "nanostores-mcp"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 19 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.

  • 17 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.

  • 15 Sept 26 −3
    • Stability: pass → 0.77 functional
  • 14 Sept 26 0
    • Stability: 0.97 → pass security
  • 13 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.

  • 11 Sept 26 +1
    • Security disclosure: unverified → pass functional
  • 10 Sept 26 0
    • Security disclosure: pass → unverified functional
  • 9 Sept 26 −2
    • Stability: pass → 0.83 functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Sept 2026 · Analysed npm/nanostores-mcp@0.1.2

Provenance Verified

A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.

Result Verified
Ecosystem npm
Reason Verified
Discovered via Registry attestation endpoint
Source repo Valyay/nanostores-mcp
Certificate issuer https://token.actions.githubusercontent.com
Certificate SAN https://github.com/Valyay/nanostores-mcp/.github/workflows/publish.yml@refs/tags/v0.1.2
Rekor log index 1352230971
Predicate type https://slsa.dev/provenance/v1
Subject digest sha512:5b5cf58004096dd28e372456535cc51f9b1ac33acf5c0e931affb991fbcfa96fbc2c216d23eace056d8987316e16ec633aa46d313b8e7e2471b86d9ec

Background: How many MCP packages publish verified provenance →

Dependencies 132 packages
Packages resolved 132
Stale 46
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 12 exposed · ~1,578 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
nanostores_clear_cache ~71

Use this when scan results seem stale or after making file changes that the server may not have detected. Clears the cached project index so the next nanostores_scan_project call performs a fresh scan.

NameTypeReqDescription
rootUristringWorkspace root to clear cache for. Omit to clear all roots.

No output schema declared.

No examples provided.

nanostores_docs_search ~191

Find Nanostores documentation by topic or store kind. Use query for free-text search across guides, API references, and best practices. Use storeKind to get docs relevant to a specific store type (atom, map, computed, etc.). Combine both to search within store-relevant pages. To read full page content, use the nanostores://docs/page/{id} resource. Example: {query: "persistent storage"} or {storeKind: "computed"} or {query: "batched", storeKind: "computed"}.

NameTypeReqDescription
limitnumberMaximum number of results
querystringSearch query for documentation. Required unless storeKind is provided.
storeKindstringFind docs relevant to this store type. Can be used alone or with query.
tagsarrayFilter by tags (e.g., ['react', 'persistent'])
NameTypeReqDescription
querystring
resultsarrayyes
storeKindstring

No examples provided.

nanostores_find_noisy_stores ~112

Use this when investigating performance issues or excessive re-renders. Returns stores ranked by activity — frequent changes, many action calls — to pinpoint bottlenecks. Example: {limit: 10} or {windowMs: 30000, compact: true}.

NameTypeReqDescription
compactbooleanReturn TOON-encoded compact table for lower token cost
limitnumberNumber of stores to return
windowMsnumberTime window in milliseconds (from now back)
NameTypeReqDescription
storesarrayyes
summarystringyes

No examples provided.

nanostores_ping ~39

Use this when you need to verify the MCP server is alive or check whether the runtime logger bridge is connected.

NameTypeReqDescription
messagestring
NameTypeReqDescription
loggerBridgeobject
messagestringyes

No examples provided.

nanostores_project_outline ~92

Use this for a quick overview of Nanostores usage in the project — store kind distribution, top directories, and hub stores ranked by connectivity. Returns a compact summary instead of full store/subscriber lists (same scan data, smaller response). Use nanostores_scan_project when you need the complete list of stores and relations.

NameTypeReqDescription
projectRootstringProject root path (uses default if omitted)
NameTypeReqDescription
coOccurringPairsarrayyes
hubsarrayyes
rootDirstringyes
storeKindsobjectyes
topBlindSpotsarrayyes
topDirsarrayyes
topSemanticAnomaliesarrayyes
totalsobjectyes
unreferencedStoresarrayyes

No examples provided.

nanostores_runtime_coverage ~96

Compare static analysis graph with runtime event data to find stores declared in the static graph but not observed in this runtime session, and stores seen at runtime but absent from the static graph (dynamic or unscanned). Use after running the app to verify instrumentation completeness. Example: {} or {projectRoot: "/path/to/project"}.

NameTypeReqDescription
projectRootstringProject root path (uses first configured root if omitted)
NameTypeReqDescription
reportobjectyes
summarystringyes

No examples provided.

nanostores_runtime_overview ~96

Use this when you want a high-level health check of the running app's state management. Returns active stores, error-prone stores, unused stores, and activity patterns. Example: {} or {windowMs: 60000, compact: true}.

NameTypeReqDescription
compactbooleanReturn TOON-encoded compact table for lower token cost
windowMsnumberTime window in milliseconds (from now back)
NameTypeReqDescription
errorProneStoresarrayyes
noisyStoresarrayyes
statsobjectyes
summarystringyes
unmountedStoresarrayyes

No examples provided.

nanostores_scan_project ~143

Returns the complete store/subscriber/relation index for the project. Use compact:true for a token-efficient directory-level overview (store counts by folder). Use the full mode (default) when you need to iterate over every entity or build a complete picture. Example: {compact: true} for directory overview, {force: true} to bypass cache.

NameTypeReqDescription
compactbooleanReturn a compact directory-level summary instead of full store/subscriber lists. Use when you need a token-efficient overview of where stores live, not individual store details.
forcebooleanForce a fresh scan, bypassing the cache.
rootUristring
NameTypeReqDescription
byDirarray
errorsarray
filesScannednumberyes
mutatorsarray
relationsarray
rootstringyes
storesarray
subscribersarray
totalsobject

No examples provided.

nanostores_store_activity ~180

Use this when debugging a specific store's runtime behavior — why it updates too often, what actions trigger changes, or whether it emits errors. Returns recent events, change frequency, action calls, and errors. Omit storeName to get activity across all stores. Example: {storeName: "$cart", kinds: ["change", "action-error"]} or {limit: 20, windowMs: 60000}.

NameTypeReqDescription
actionNamestringFilter events by action name
kindsarrayFilter events by kind(s)
limitnumberMax events to return
projectRootstringProject root path to link runtime data with static analysis
storeNamestringStore name to query (optional)
windowMsnumberTime window in milliseconds (from now back)
NameTypeReqDescription
eventsarrayyes
statsyes
storeNamestring
summarystringyes

No examples provided.

nanostores_store_impact ~189

When you need to trace what recomputes if X changes, call this once — not nanostores_store_summary on each downstream store. Returns the full ordered downstream chain in a single response: computed stores that depend on X at hop 1, their dependents at hop 2, and so on. Subscribers appear at the same hop as the store they react to. Use nanostores_store_subgraph instead when you also need upstream ancestors (BFS in both directions). Example: {name: "$isLoggedIn"} returns every computed store and subscriber that recomputes when $isLoggedIn changes, ordered by distance.

NameTypeReqDescription
namestringStore name. Used if storeId is not provided.
projectRootstringProject root path (uses default if omitted)
storeIdstringExact store id. If provided, takes priority.
NameTypeReqDescription
hopsarrayyes
sourceNamestring
sourceStoreIdstringyes
summaryobjectyes

No examples provided.

nanostores_store_subgraph ~214

If your question is 'what recomputes downstream when X changes?', use nanostores_store_impact instead — it gives the ordered causal chain in one call. Use this tool only when you need both directions: upstream sources AND downstream dependents together. Returns the BFS neighborhood within a configurable radius (default 2). Start with radius=1; increase only when you need wider structural context. On highly connected hub stores (score>5 in project_outline) radius=2+ may return most of the project. Example: {name: "$cart", radius: 1} or {storeId: "store:src/stores.ts#$cart", radius: 2}.

NameTypeReqDescription
namestringStore name. Used if storeId is not provided.
projectRootstringProject root path (uses default if omitted)
radiusintegerBFS radius around the store (default 2)
storeIdstringExact store id. If provided, takes priority.
NameTypeReqDescription
centerStoreIdstringyes
edgesarrayyes
nodesarrayyes
radiusnumberyes
summaryobject
warningstring

No examples provided.

nanostores_store_summary ~155

Use this when you need details about a specific store — its kind, file location, direct subscribers, and first-level derived relations. Accepts store id or name. For multi-hop dependency chains use nanostores_store_subgraph instead. Example: {name: "$counter"} or {storeId: "store:src/stores.ts#$counter"}.

NameTypeReqDescription
filestringOptional relative file path to disambiguate store name.
namestringStore name. Used if storeId is not provided.
rootUristringProject root URI or path for multi-root setups; defaults to first root.
storeIdstringExact store id. If provided, takes priority.
NameTypeReqDescription
derivedDependentsobjectyes
derivesFromobjectyes
resolutionobjectyes
storeobjectyes
subscribersarrayyes

No examples provided.

Common questions

What is the Nanostores MCP server?

Nanostores MCP is listed in the public MCP registry as io.github.Valyay/nanostores-mcp. Debug and analyze Nanostores apps with AI: scan stores, monitor runtime events, and search docs. This page covers its npm package (nanostores-mcp).

Is the Nanostores MCP server safe to use?

Nanostores MCP scores 94 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Nanostores MCP server expose?

Nanostores MCP exposes 12 tools: nanostores_scan_project, nanostores_store_summary, nanostores_clear_cache, nanostores_project_outline, nanostores_store_subgraph, and 7 more. Their descriptions and schemas cost roughly 1,578 tokens of context every time the server is loaded.

Is the Nanostores MCP server still maintained?

Nanostores MCP is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the Nanostores MCP server under?

Nanostores MCP declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.