# Nanostores MCP (npm · nanostores-mcp)

Debug and analyze Nanostores apps with AI: scan stores, monitor runtime events, and search docs.

- Trust score: 78/100 (medium)
- Change this week: −13
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-04

## Components

- npm · `nanostores-mcp`: 78/100 (this document), [markdown](https://verifymcp.io/servers/valyay-nanostores-mcp/nanostores-mcp.md), [page](https://verifymcp.io/servers/valyay-nanostores-mcp/nanostores-mcp)

## Channel facts

- Registry: `npm`
- Package: `nanostores-mcp`
- Version: `0.1.2`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-04.

- **Supply Chain Security**: 83/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known medium-severity CVE affects hono 4.12.33, reached via @modelcontextprotocol/sdk > hono. A fixed version is available.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (131 of 135), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 97/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to Valyay/nanostores-mcp).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 104 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 71/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 3318 tokens (~255/item across 13 items; 12 tools + 1 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 30/100
  - Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 98/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 94% of tool parameters carry a description.
  - Structured output schemas are declared (92% of tools); any adoption earns full credit.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add valyay-nanostores-mcp -- npx -y nanostores-mcp
```

### Codex

```bash
codex mcp add valyay-nanostores-mcp -- npx -y nanostores-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "valyay-nanostores-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "nanostores-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add valyay-nanostores-mcp --command npx --arg -y --arg nanostores-mcp
```

### Hermes

```yaml
mcp_servers:
  valyay-nanostores-mcp:
    command: "npx"
    args: ["-y", "nanostores-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "valyay-nanostores-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "nanostores-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-04 (score 78, −1)

- [security regression] CVE-2026-69207 affects this package: medium
- [security regression] Known CVEs: partial → fail

### 2026-08-03 (score 79, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-02 (score 78, +44)

- [security improvement] Provenance: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [security improvement] Malware scan: unverified → pass
- [security] The attested source repository moved: Valyay/nanostores-mcp
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Stability: unverified → 0.23
- [functional improvement] License: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional] Licence: MIT

### 2026-07-31 (score 34, −5)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 39, −52)

- [security regression] Install scripts: pass → unverified
- [security regression] Malware scan: pass → unverified
- [security regression] Provenance: pass → unverified
- [security regression] Known CVEs: partial → unverified
- [security] The attested source repository moved: Valyay/nanostores-mcp
- [functional regression] Maintenance: pass → unverified
- [functional regression] Dependency health: partial → unverified
- [functional regression] License: pass → unverified
- [functional] Licence: MIT

### 2026-07-27 (score 91, +48)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-26 (score 43)

First indexed and scored.

## MCP tools (12)

### `nanostores_scan_project` (~143 tokens)

Scan project for Nanostores usage

Returns the complete store/subscriber/relation index for the project. Use compact:true for a token-efficient directory-level overview (store counts by folder). Use the full mode (default) when you need to iterate over every entity or build a complete picture. Example: {compact: true} for directory overview, {force: true} to bypass cache.

Input parameters:

- `compact` (boolean): Return a compact directory-level summary instead of full store/subscriber lists. Use when you need a token-efficient overview of where stores live, not individual store details.
- `force` (boolean): Force a fresh scan, bypassing the cache.
- `rootUri` (string)

Output parameters:

- `byDir` (array)
- `errors` (array)
- `filesScanned` (number)
- `mutators` (array)
- `relations` (array)
- `root` (string)
- `stores` (array)
- `subscribers` (array)
- `totals` (object)

### `nanostores_store_summary` (~155 tokens)

Summarize a Nanostores store

Use this when you need details about a specific store — its kind, file location, direct subscribers, and first-level derived relations. Accepts store id or name. For multi-hop dependency chains use nanostores_store_subgraph instead. Example: {name: "$counter"} or {storeId: "store:src/stores.ts#$counter"}.

Input parameters:

- `file` (string): Optional relative file path to disambiguate store name.
- `name` (string): Store name. Used if storeId is not provided.
- `rootUri` (string): Project root URI or path for multi-root setups; defaults to first root.
- `storeId` (string): Exact store id. If provided, takes priority.

Output parameters:

- `derivedDependents` (object)
- `derivesFrom` (object)
- `resolution` (object)
- `store` (object)
- `subscribers` (array)

### `nanostores_clear_cache` (~71 tokens)

Clear project analysis cache

Use this when scan results seem stale or after making file changes that the server may not have detected. Clears the cached project index so the next nanostores_scan_project call performs a fresh scan.

Input parameters:

- `rootUri` (string): Workspace root to clear cache for. Omit to clear all roots.

### `nanostores_project_outline` (~92 tokens)

Get project outline

Use this for a quick overview of Nanostores usage in the project — store kind distribution, top directories, and hub stores ranked by connectivity. Returns a compact summary instead of full store/subscriber lists (same scan data, smaller response). Use nanostores_scan_project when you need the complete list of stores and relations.

Input parameters:

- `projectRoot` (string): Project root path (uses default if omitted)

Output parameters:

- `coOccurringPairs` (array)
- `hubs` (array)
- `rootDir` (string)
- `storeKinds` (object)
- `topBlindSpots` (array)
- `topDirs` (array)
- `topSemanticAnomalies` (array)
- `totals` (object)
- `unreferencedStores` (array)

### `nanostores_store_subgraph` (~214 tokens)

Get store subgraph

If your question is 'what recomputes downstream when X changes?', use nanostores_store_impact instead — it gives the ordered causal chain in one call. Use this tool only when you need both directions: upstream sources AND downstream dependents together. Returns the BFS neighborhood within a configurable radius (default 2). Start with radius=1; increase only when you need wider structural context. On highly connected hub stores (score>5 in project_outline) radius=2+ may return most of the project. Example: {name: "$cart", radius: 1} or {storeId: "store:src/stores.ts#$cart", radius: 2}.

Input parameters:

- `name` (string): Store name. Used if storeId is not provided.
- `projectRoot` (string): Project root path (uses default if omitted)
- `radius` (integer): BFS radius around the store (default 2)
- `storeId` (string): Exact store id. If provided, takes priority.

Output parameters:

- `centerStoreId` (string)
- `edges` (array)
- `nodes` (array)
- `radius` (number)
- `summary` (object)
- `warning` (string)

### `nanostores_store_impact` (~189 tokens)

Get store impact chain

When you need to trace what recomputes if X changes, call this once — not nanostores_store_summary on each downstream store. Returns the full ordered downstream chain in a single response: computed stores that depend on X at hop 1, their dependents at hop 2, and so on. Subscribers appear at the same hop as the store they react to. Use nanostores_store_subgraph instead when you also need upstream ancestors (BFS in both directions). Example: {name: "$isLoggedIn"} returns every computed store and subscriber that recomputes when $isLoggedIn changes, ordered by distance.

Input parameters:

- `name` (string): Store name. Used if storeId is not provided.
- `projectRoot` (string): Project root path (uses default if omitted)
- `storeId` (string): Exact store id. If provided, takes priority.

Output parameters:

- `hops` (array)
- `sourceName` (string)
- `sourceStoreId` (string)
- `summary` (object)

### `nanostores_ping` (~39 tokens)

Ping Nanostores MCP server

Use this when you need to verify the MCP server is alive or check whether the runtime logger bridge is connected.

Input parameters:

- `message` (string)

Output parameters:

- `loggerBridge` (object)
- `message` (string)

### `nanostores_store_activity` (~180 tokens)

Get store runtime activity

Use this when debugging a specific store's runtime behavior — why it updates too often, what actions trigger changes, or whether it emits errors. Returns recent events, change frequency, action calls, and errors. Omit storeName to get activity across all stores. Example: {storeName: "$cart", kinds: ["change", "action-error"]} or {limit: 20, windowMs: 60000}.

Input parameters:

- `actionName` (string): Filter events by action name
- `kinds` (array): Filter events by kind(s)
- `limit` (number): Max events to return
- `projectRoot` (string): Project root path to link runtime data with static analysis
- `storeName` (string): Store name to query (optional)
- `windowMs` (number): Time window in milliseconds (from now back)

Output parameters:

- `events` (array)
- `stats`
- `storeName` (string)
- `summary` (string)

### `nanostores_find_noisy_stores` (~112 tokens)

Find noisy stores

Use this when investigating performance issues or excessive re-renders. Returns stores ranked by activity — frequent changes, many action calls — to pinpoint bottlenecks. Example: {limit: 10} or {windowMs: 30000, compact: true}.

Input parameters:

- `compact` (boolean): Return TOON-encoded compact table for lower token cost
- `limit` (number): Number of stores to return
- `windowMs` (number): Time window in milliseconds (from now back)

Output parameters:

- `stores` (array)
- `summary` (string)

### `nanostores_runtime_overview` (~96 tokens)

Get runtime overview

Use this when you want a high-level health check of the running app's state management. Returns active stores, error-prone stores, unused stores, and activity patterns. Example: {} or {windowMs: 60000, compact: true}.

Input parameters:

- `compact` (boolean): Return TOON-encoded compact table for lower token cost
- `windowMs` (number): Time window in milliseconds (from now back)

Output parameters:

- `errorProneStores` (array)
- `noisyStores` (array)
- `stats` (object)
- `summary` (string)
- `unmountedStores` (array)

### `nanostores_runtime_coverage` (~96 tokens)

Runtime coverage report

Compare static analysis graph with runtime event data to find stores declared in the static graph but not observed in this runtime session, and stores seen at runtime but absent from the static graph (dynamic or unscanned). Use after running the app to verify instrumentation completeness. Example: {} or {projectRoot: "/path/to/project"}.

Input parameters:

- `projectRoot` (string): Project root path (uses first configured root if omitted)

Output parameters:

- `report` (object)
- `summary` (string)

### `nanostores_docs_search` (~191 tokens)

Search Nanostores documentation

Find Nanostores documentation by topic or store kind. Use query for free-text search across guides, API references, and best practices. Use storeKind to get docs relevant to a specific store type (atom, map, computed, etc.). Combine both to search within store-relevant pages. To read full page content, use the nanostores://docs/page/{id} resource. Example: {query: "persistent storage"} or {storeKind: "computed"} or {query: "batched", storeKind: "computed"}.

Input parameters:

- `limit` (number): Maximum number of results
- `query` (string): Search query for documentation. Required unless storeKind is provided.
- `storeKind` (string): Find docs relevant to this store type. Can be used alone or with query.
- `tags` (array): Filter by tags (e.g., ['react', 'persistent'])

Output parameters:

- `query` (string)
- `results` (array)
- `storeKind` (string)

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/valyay-nanostores-mcp/nanostores-mcp#diagnostics

## Score history

- 2026-08-04: 78
- 2026-08-03: 79
- 2026-08-02: 78
- 2026-08-01: 34
- 2026-07-31: 34
- 2026-07-30: 39
- 2026-07-28: 91
- 2026-07-27: 91
- 2026-07-26: 43

## Links

- npm package: https://www.npmjs.com/package/nanostores-mcp
- Socket report: https://socket.dev/npm/package/nanostores-mcp
- Repository: https://github.com/Valyay/nanostores-mcp
- Changelog RSS feed: https://verifymcp.io/servers/valyay-nanostores-mcp/nanostores-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/valyay-nanostores-mcp/nanostores-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/valyay-nanostores-mcp/nanostores-mcp