Nanostores MCP
NPM · NANOSTORES-MCP · SCANNED SEP 20
Debug and analyze Nanostores apps with AI: scan stores, monitor runtime events, and search docs.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 46 of 132 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to Valyay/nanostores-mcp). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 151 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability78
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3318 tokens (~255/item across 13 items; 12 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management93
- Stability observed for 28 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage98
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 94% of tool parameters carry a description.Partial
- Structured output schemas are declared (92% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 12 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 14 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the Nanostores MCP server?
Nanostores MCP runs locally as an npm package, launched with npx -y nanostores-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · nanostores-mcp
claude mcp add valyay-nanostores-mcp -- npx -y nanostores-mcp
{
"mcpServers": {
"valyay-nanostores-mcp": {
"command": "npx",
"args": [
"-y",
"nanostores-mcp"
]
}
}
} {
"servers": {
"valyay-nanostores-mcp": {
"command": "npx",
"args": [
"-y",
"nanostores-mcp"
]
}
}
} codex mcp add valyay-nanostores-mcp -- npx -y nanostores-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"valyay-nanostores-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"nanostores-mcp"
],
"enabled": true
}
}
} openclaw mcp add valyay-nanostores-mcp --command npx --arg -y --arg nanostores-mcp
mcp_servers:
valyay-nanostores-mcp:
command: "npx"
args: ["-y", "nanostores-mcp"] {
"McpServers": {
"valyay-nanostores-mcp": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"nanostores-mcp"
]
}
}
} assistant mcp add valyay-nanostores-mcp -t stdio -c npx -a -y nanostores-mcp
{
"mcpServers": {
"valyay-nanostores-mcp": {
"command": "npx",
"args": [
"-y",
"nanostores-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 19 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
- 17 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 15 Sept 26 −3
- Stability: pass → 0.77 functional
- 14 Sept 26 0
- Stability: 0.97 → pass security
- 13 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 11 Sept 26 +1
- Security disclosure: unverified → pass ▲ functional
- 10 Sept 26 0
- Security disclosure: pass → unverified ▼ functional
- 9 Sept 26 −2
- Stability: pass → 0.83 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/nanostores-mcp@0.1.2
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | Valyay/nanostores-mcp |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/Valyay/nanostores-mcp/.github/workflows/publish.yml@refs/tags/v0.1.2 |
| Rekor log index | 1352230971 |
| Predicate type | https://slsa.dev/provenance/v1 |
| Subject digest | sha512:5b5cf58004096dd28e372456535cc51f9b1ac33acf5c0e931affb991fbcfa96fbc2c216d23eace056d8987316e16ec633aa46d313b8e7e2471b86d9ec |
Background: How many MCP packages publish verified provenance →
Dependencies 132 packages
| Packages resolved | 132 |
|---|---|
| Stale | 46 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
nanostores_clear_cache Clear project analysis cache ~71
Use this when scan results seem stale or after making file changes that the server may not have detected. Clears the cached project index so the next nanostores_scan_project call performs a fresh scan.
| Name | Type | Req | Description |
|---|---|---|---|
| rootUri | string | – | Workspace root to clear cache for. Omit to clear all roots. |
No output schema declared.
No examples provided.
nanostores_docs_search Search Nanostores documentation ~191
Find Nanostores documentation by topic or store kind. Use query for free-text search across guides, API references, and best practices. Use storeKind to get docs relevant to a specific store type (atom, map, computed, etc.). Combine both to search within store-relevant pages. To read full page content, use the nanostores://docs/page/{id} resource. Example: {query: "persistent storage"} or {storeKind: "computed"} or {query: "batched", storeKind: "computed"}.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | Maximum number of results |
| query | string | – | Search query for documentation. Required unless storeKind is provided. |
| storeKind | string | – | Find docs relevant to this store type. Can be used alone or with query. |
| tags | array | – | Filter by tags (e.g., ['react', 'persistent']) |
| Name | Type | Req | Description |
|---|---|---|---|
| query | string | – | – |
| results | array | yes | – |
| storeKind | string | – | – |
No examples provided.
nanostores_find_noisy_stores Find noisy stores ~112
Use this when investigating performance issues or excessive re-renders. Returns stores ranked by activity — frequent changes, many action calls — to pinpoint bottlenecks. Example: {limit: 10} or {windowMs: 30000, compact: true}.
| Name | Type | Req | Description |
|---|---|---|---|
| compact | boolean | – | Return TOON-encoded compact table for lower token cost |
| limit | number | – | Number of stores to return |
| windowMs | number | – | Time window in milliseconds (from now back) |
| Name | Type | Req | Description |
|---|---|---|---|
| stores | array | yes | – |
| summary | string | yes | – |
No examples provided.
nanostores_ping Ping Nanostores MCP server ~39
Use this when you need to verify the MCP server is alive or check whether the runtime logger bridge is connected.
| Name | Type | Req | Description |
|---|---|---|---|
| message | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| loggerBridge | object | – | – |
| message | string | yes | – |
No examples provided.
nanostores_project_outline Get project outline ~92
Use this for a quick overview of Nanostores usage in the project — store kind distribution, top directories, and hub stores ranked by connectivity. Returns a compact summary instead of full store/subscriber lists (same scan data, smaller response). Use nanostores_scan_project when you need the complete list of stores and relations.
| Name | Type | Req | Description |
|---|---|---|---|
| projectRoot | string | – | Project root path (uses default if omitted) |
| Name | Type | Req | Description |
|---|---|---|---|
| coOccurringPairs | array | yes | – |
| hubs | array | yes | – |
| rootDir | string | yes | – |
| storeKinds | object | yes | – |
| topBlindSpots | array | yes | – |
| topDirs | array | yes | – |
| topSemanticAnomalies | array | yes | – |
| totals | object | yes | – |
| unreferencedStores | array | yes | – |
No examples provided.
nanostores_runtime_coverage Runtime coverage report ~96
Compare static analysis graph with runtime event data to find stores declared in the static graph but not observed in this runtime session, and stores seen at runtime but absent from the static graph (dynamic or unscanned). Use after running the app to verify instrumentation completeness. Example: {} or {projectRoot: "/path/to/project"}.
| Name | Type | Req | Description |
|---|---|---|---|
| projectRoot | string | – | Project root path (uses first configured root if omitted) |
| Name | Type | Req | Description |
|---|---|---|---|
| report | object | yes | – |
| summary | string | yes | – |
No examples provided.
nanostores_runtime_overview Get runtime overview ~96
Use this when you want a high-level health check of the running app's state management. Returns active stores, error-prone stores, unused stores, and activity patterns. Example: {} or {windowMs: 60000, compact: true}.
| Name | Type | Req | Description |
|---|---|---|---|
| compact | boolean | – | Return TOON-encoded compact table for lower token cost |
| windowMs | number | – | Time window in milliseconds (from now back) |
| Name | Type | Req | Description |
|---|---|---|---|
| errorProneStores | array | yes | – |
| noisyStores | array | yes | – |
| stats | object | yes | – |
| summary | string | yes | – |
| unmountedStores | array | yes | – |
No examples provided.
nanostores_scan_project Scan project for Nanostores usage ~143
Returns the complete store/subscriber/relation index for the project. Use compact:true for a token-efficient directory-level overview (store counts by folder). Use the full mode (default) when you need to iterate over every entity or build a complete picture. Example: {compact: true} for directory overview, {force: true} to bypass cache.
| Name | Type | Req | Description |
|---|---|---|---|
| compact | boolean | – | Return a compact directory-level summary instead of full store/subscriber lists. Use when you need a token-efficient overview of where stores live, not individual store details. |
| force | boolean | – | Force a fresh scan, bypassing the cache. |
| rootUri | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| byDir | array | – | – |
| errors | array | – | – |
| filesScanned | number | yes | – |
| mutators | array | – | – |
| relations | array | – | – |
| root | string | yes | – |
| stores | array | – | – |
| subscribers | array | – | – |
| totals | object | – | – |
No examples provided.
nanostores_store_activity Get store runtime activity ~180
Use this when debugging a specific store's runtime behavior — why it updates too often, what actions trigger changes, or whether it emits errors. Returns recent events, change frequency, action calls, and errors. Omit storeName to get activity across all stores. Example: {storeName: "$cart", kinds: ["change", "action-error"]} or {limit: 20, windowMs: 60000}.
| Name | Type | Req | Description |
|---|---|---|---|
| actionName | string | – | Filter events by action name |
| kinds | array | – | Filter events by kind(s) |
| limit | number | – | Max events to return |
| projectRoot | string | – | Project root path to link runtime data with static analysis |
| storeName | string | – | Store name to query (optional) |
| windowMs | number | – | Time window in milliseconds (from now back) |
| Name | Type | Req | Description |
|---|---|---|---|
| events | array | yes | – |
| stats | – | yes | – |
| storeName | string | – | – |
| summary | string | yes | – |
No examples provided.
nanostores_store_impact Get store impact chain ~189
When you need to trace what recomputes if X changes, call this once — not nanostores_store_summary on each downstream store. Returns the full ordered downstream chain in a single response: computed stores that depend on X at hop 1, their dependents at hop 2, and so on. Subscribers appear at the same hop as the store they react to. Use nanostores_store_subgraph instead when you also need upstream ancestors (BFS in both directions). Example: {name: "$isLoggedIn"} returns every computed store and subscriber that recomputes when $isLoggedIn changes, ordered by distance.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | – | Store name. Used if storeId is not provided. |
| projectRoot | string | – | Project root path (uses default if omitted) |
| storeId | string | – | Exact store id. If provided, takes priority. |
| Name | Type | Req | Description |
|---|---|---|---|
| hops | array | yes | – |
| sourceName | string | – | – |
| sourceStoreId | string | yes | – |
| summary | object | yes | – |
No examples provided.
nanostores_store_subgraph Get store subgraph ~214
If your question is 'what recomputes downstream when X changes?', use nanostores_store_impact instead — it gives the ordered causal chain in one call. Use this tool only when you need both directions: upstream sources AND downstream dependents together. Returns the BFS neighborhood within a configurable radius (default 2). Start with radius=1; increase only when you need wider structural context. On highly connected hub stores (score>5 in project_outline) radius=2+ may return most of the project. Example: {name: "$cart", radius: 1} or {storeId: "store:src/stores.ts#$cart", radius: 2}.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | – | Store name. Used if storeId is not provided. |
| projectRoot | string | – | Project root path (uses default if omitted) |
| radius | integer | – | BFS radius around the store (default 2) |
| storeId | string | – | Exact store id. If provided, takes priority. |
| Name | Type | Req | Description |
|---|---|---|---|
| centerStoreId | string | yes | – |
| edges | array | yes | – |
| nodes | array | yes | – |
| radius | number | yes | – |
| summary | object | – | – |
| warning | string | – | – |
No examples provided.
nanostores_store_summary Summarize a Nanostores store ~155
Use this when you need details about a specific store — its kind, file location, direct subscribers, and first-level derived relations. Accepts store id or name. For multi-hop dependency chains use nanostores_store_subgraph instead. Example: {name: "$counter"} or {storeId: "store:src/stores.ts#$counter"}.
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | – | Optional relative file path to disambiguate store name. |
| name | string | – | Store name. Used if storeId is not provided. |
| rootUri | string | – | Project root URI or path for multi-root setups; defaults to first root. |
| storeId | string | – | Exact store id. If provided, takes priority. |
| Name | Type | Req | Description |
|---|---|---|---|
| derivedDependents | object | yes | – |
| derivesFrom | object | yes | – |
| resolution | object | yes | – |
| store | object | yes | – |
| subscribers | array | yes | – |
No examples provided.
What is the Nanostores MCP server?
Nanostores MCP is listed in the public MCP registry as io.github.Valyay/nanostores-mcp. Debug and analyze Nanostores apps with AI: scan stores, monitor runtime events, and search docs. This page covers its npm package (nanostores-mcp).
Is the Nanostores MCP server safe to use?
Nanostores MCP scores 94 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Nanostores MCP server expose?
Nanostores MCP exposes 12 tools: nanostores_scan_project, nanostores_store_summary, nanostores_clear_cache, nanostores_project_outline, nanostores_store_subgraph, and 7 more. Their descriptions and schemas cost roughly 1,578 tokens of context every time the server is loaded.
Is the Nanostores MCP server still maintained?
Nanostores MCP is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Nanostores MCP server under?
Nanostores MCP declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.