Weavatrix
NPM · WEAVATRIX · SCANNED SEP 20
Native Weavatrix MCP: 67 read-only tools for code, local CI, n8n, Dify, agents, Mermaid, Web3.
Available components
+3 this week
87 87 Trust /100
Trust breakdown (7 categories)
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to Weavatrix/weavatrix). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 0 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability47
- AI-judged instruction clarity (fair).Partial
- Context-footprint check failed: tool/resource definitions use about 12646 tokens (~188/item across 67 items; 67 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management89
- Stability check failed: the tool surface changed between 1.9.2 and 1.17.1: 0 tool removals, 1 breaking changes, 24 additions. See how to fix → Fail
Tool Coverage82
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 45% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 67 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 68 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Install
How do I install the Weavatrix MCP server?
Weavatrix runs locally as an npm package, launched with npx -y weavatrix. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · weavatrix
# add to Claude Code
claude mcp add weavatrix-weavatrix -- npx -y weavatrix
// .cursor/mcp.json
{
"mcpServers": {
"weavatrix-weavatrix": {
"command": "npx",
"args": [
"-y",
"weavatrix"
]
}
}
} // .vscode/mcp.json
{
"servers": {
"weavatrix-weavatrix": {
"command": "npx",
"args": [
"-y",
"weavatrix"
]
}
}
} # add to Codex CLI
codex mcp add weavatrix-weavatrix -- npx -y weavatrix
// opencode.json
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"weavatrix-weavatrix": {
"type": "local",
"command": [
"npx",
"-y",
"weavatrix"
],
"enabled": true
}
}
} # add to OpenClaw
openclaw mcp add weavatrix-weavatrix --command npx --arg -y --arg weavatrix
# ~/.hermes/config.yaml
mcp_servers:
weavatrix-weavatrix:
command: "npx"
args: ["-y", "weavatrix"] // ~/.netclaw/config/netclaw.json
{
"McpServers": {
"weavatrix-weavatrix": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"weavatrix"
]
}
}
} # add to Vellum
assistant mcp add weavatrix-weavatrix -t stdio -c npx -a -y weavatrix
// mcp.json
{
"mcpServers": {
"weavatrix-weavatrix": {
"command": "npx",
"args": [
"-y",
"weavatrix"
]
}
}
} Changelog
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +11
- Stability: fail → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Known CVEs: unverified → pass ▲ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Dependency health: unverified → pass ▲ functional
- First check of Schema quality: unverified functional
- Package version: 1.16.4 → 1.17.1 functional
- 19 Sept 26 −10
- Stability: fail → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Known CVEs: pass → unverified ▼ security
- Malware scan: pass → unverified ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Dependency health: pass → unverified ▼ functional
- First check of Schema quality: unverified functional
- Package version: 1.16.0 → 1.16.4 functional
- Package version: 1.16.0 → 1.16.3 functional
- Package version: 1.16.0 → 1.16.2 functional
- Package version: 1.16.0 → 1.16.1 functional
- 18 Sept 26 +11
- Known CVEs: unverified → pass ▲ security
- Dependency health: unverified → pass ▲ functional
- 17 Sept 26 +4
- Known CVEs: pass → unverified ▼ security
- Stability: fail → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Malware scan: unverified → pass ▲ security
- Dependency health: pass → unverified ▼ functional
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- First check of Schema quality: unverified functional
- Package version: 1.14.2 → 1.16.0 functional
- Package version: 1.14.2 → 1.15.0 functional
- 16 Sept 26 −13
- Malware scan: pass → unverified ▼ security
- Stability: fail → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Schema quality: 8922 → 11067 ▼ functional
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- First check of Schema quality: unverified functional
- Package version: 1.11.0 → 1.14.2 functional
- 13 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 62 to 66.
- 11 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 56 to 59.
- 9 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 49 to 52.
Diagnostics
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/weavatrix@1.17.1
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | Weavatrix/weavatrix |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/Weavatrix/weavatrix/.github/workflows/release.yml@refs/tags/v1.17.1 |
| Rekor log index | 2899900507 |
| Predicate type | https://slsa.dev/provenance/v1 |
| Subject digest | sha512:ed4e3e9332a80f16365a9210bc872b2ed9afa55d22db9182e64dfa1ef3e9ea5428bff769c018abcc433c083e14d06d30f1dafc21641296863c7a82d8e |
Background: How many MCP packages publish verified provenance →
Dependencies 0 packages
| Packages resolved | 0 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
MCP tools
· 67 exposed
· ~12,630 tokens
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
Tool
Tokens
agent_change_impact ~169
Compare two supplied MCP catalog snapshots and report contract changes, adapter compensation, and declared consumers.
| Name | Type | Req | Description |
|---|---|---|---|
| after | string | yes | Repository-relative catalog snapshot used as the current contract |
| before | string | yes | Repository-relative catalog snapshot used as the previous contract |
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| max_results | integer | – | – |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
No output schema declared.
No examples provided.
agent_context ~167
Bounded agent-package context: declared bindings, source fragments, and explicit authorization gaps.
| Name | Type | Req | Description |
|---|---|---|---|
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| label | string | yes | – |
| max_related | integer | – | – |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
| task | string | – | What the caller intends to change or inspect; used only to keep the bounded context on that question |
No output schema declared.
No examples provided.
agent_inventory ~161
List Agent Plugins, Skills, and MCP server bindings from local package files without launching them.
| Name | Type | Req | Description |
|---|---|---|---|
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| max_results | integer | – | – |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
| path | string | – | Repository-relative plugin, skill, or MCP config path fragment; omit to list every recognized package file |
No output schema declared.
No examples provided.
agent_trace ~146
Show the declared origin, profile, transforms, and package bindings for one plugin, skill, or MCP server.
| Name | Type | Req | Description |
|---|---|---|---|
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| label | string | yes | – |
| max_related | integer | – | – |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
No output schema declared.
No examples provided.
architecture_inventory ~130
Observed packages, production folders, and typed edges. Not a style label and not the starter contract.
| Name | Type | Req | Description |
|---|---|---|---|
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
No output schema declared.
No examples provided.
build_graph ~127
Workspace, target and runner topology from manifest evidence.
| Name | Type | Req | Description |
|---|---|---|---|
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| max_members | integer | – | – |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
No output schema declared.
No examples provided.
change_impact ~229
Read-only Git change impact at symbol granularity when a baseline exists.
| Name | Type | Req | Description |
|---|---|---|---|
| base | string | – | – |
| base_ref | string | – | – |
| depth | integer | – | – |
| diff | string | – | – |
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| files | array | – | – |
| head_ref | string | – | – |
| max_nodes | integer | – | – |
| max_references | integer | – | – |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
| precision | string | – | – |
| target | string | – | Deprecated alias for a single path in files; equivalent to files:[target]. Errors when both are present and disagree |
| timeout_ms | integer | – | – |
No output schema declared.
No examples provided.
ci_restrictions ~207
Local GitHub Actions jobs, literal check invocations, configured restrictions and unobserved enforcement.
| Name | Type | Req | Description |
|---|---|---|---|
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| max_results | integer | – | – |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
| scenario | object | – | Optional local scenario. For pull_request, branch means the base branch. No secrets or credentials. |
| scope | string | – | – |
| token_budget | integer | – | Approximate output ceiling in tokens (serialized bytes / 4); result arrays are trimmed from the tail to fit and the report states what was dropped |
No output schema declared.
No examples provided.
context_bundle ~352
Task-aware source bundle with category quotas and dedup.
| Name | Type | Req | Description |
|---|---|---|---|
| column | integer | – | 1-based source column of the occurrence to resolve |
| context_lines | integer | – | – |
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| include_classified | boolean | – | – |
| intent | string | – | Walk and context quota bias. Question text can also set this; exact seeds stay exact |
| label | string | – | – |
| line | integer | – | 1-based source line of the occurrence to resolve |
| max_reexports | integer | – | – |
| max_references | integer | – | Cap on returned relationship edges (default 50) |
| max_related | integer | – | – |
| max_source_files | integer | – | – |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
| path | string | – | Repository-relative file containing the occurrence |
| precision | string | – | – |
| scip_path | string | – | Repository-relative SCIP index already on disk; never generated or spawned. Defaults to index.scip or .scip/index.scip when present |
| timeout_ms | integer | – | – |
| token_budget | integer | – | Approximate output ceiling in tokens; relationships and related source trim first and the target symbol's own source is never dropped - a budget below the target itself is an explicit error |
No output schema declared.
No examples provided.
coverage_map ~171
Ingest LCOV, Istanbul, Tarpaulin, or LLVM reports onto graph nodes. Does not run tests. A missing report is unmeasured, not 0%. Quality writes `.weavatrix/coverage/lcov.info`.
| Name | Type | Req | Description |
|---|---|---|---|
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
| path | string | – | – |
| top_n | integer | – | – |
No output schema declared.
No examples provided.
cross_repo_git ~192
Parallel histories, shared commits, or diffs across named local repositories.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | – |
| base_ref | string | – | – |
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| first_parent | boolean | – | – |
| head_ref | string | – | – |
| left | string | – | – |
| max_commits | integer | – | – |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
| repositories | array | yes | – |
| revision | string | – | – |
| right | string | – | – |
No output schema declared.
No examples provided.
diagram_context ~169
Bounded Mermaid context: source fragments, explicit bindings, and gaps that remain unproven.
| Name | Type | Req | Description |
|---|---|---|---|
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| label | string | yes | – |
| max_related | integer | – | – |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
| task | string | – | What the caller intends to change or inspect; used only to keep the bounded context on that question |
No output schema declared.
No examples provided.
diagram_inventory ~150
List Mermaid flowchart diagrams, native elements, and explicit sidecar bindings.
| Name | Type | Req | Description |
|---|---|---|---|
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| max_results | integer | – | – |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
| path | string | – | Repository-relative Mermaid file, Markdown fence, or path fragment |
No output schema declared.
No examples provided.
diagram_trace ~172
Walk declared_architecture arrows inside one Mermaid diagram without treating them as production Calls.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | Opaque page token from a previous diagram_trace page.next_cursor; format v1:<offset> |
| depth | integer | – | – |
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| label | string | yes | – |
| max_nodes | integer | – | – |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
No output schema declared.
No examples provided.
dify_context ~170
Bounded Dify context for one node: proven consumers, selector sites, and explicit gaps.
| Name | Type | Req | Description |
|---|---|---|---|
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| label | string | yes | – |
| max_related | integer | – | – |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
| task | string | – | What the caller intends to change or inspect; used only to keep the bounded context on that question |
No output schema declared.
No examples provided.
dify_inventory ~157
List Dify apps, nodes, modes, and analysis bounds from exported YAML.
| Name | Type | Req | Description |
|---|---|---|---|
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| max_results | integer | – | – |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
| path | string | – | Repository-relative Dify YAML file or path fragment; omit to list every recognized export |
No output schema declared.
No examples provided.
dify_trace ~174
Upstream and downstream Dify port flow, selectors, and typed data relations.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | Opaque page token from a previous dify_trace page.next_cursor; format v1:<offset> |
| depth | integer | – | – |
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| label | string | yes | – |
| max_nodes | integer | – | – |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
No output schema declared.
No examples provided.
explain_architecture_violation ~125
Explain one active contract violation.
| Name | Type | Req | Description |
|---|---|---|---|
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| fingerprint | string | yes | – |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
No output schema declared.
No examples provided.
explain_restriction ~156
Explain one local restriction with its invocation, applicability and evidence limits.
| Name | Type | Req | Description |
|---|---|---|---|
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| id | string | yes | – |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
| scenario | object | – | Optional local scenario. For pull_request, branch means the base branch. No secrets or credentials. |
No output schema declared.
No examples provided.
find_dead_code ~202
Conservative unreferenced-symbol review queue.
| Name | Type | Req | Description |
|---|---|---|---|
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| include_classified | boolean | – | – |
| include_tests | boolean | – | – |
| kinds | array | – | – |
| min_confidence | integer | – | Evidence tiers: 25 = whole unreferenced file, 50 = exported symbol nothing reaches, 85 = private symbol nothing references. Bounded static analysis never reaches 100 |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
| path | string | – | – |
| top_n | integer | – | – |
No output schema declared.
No examples provided.
find_duplicates ~261
Deterministic Type-1/2/3 clone families.
| Name | Type | Req | Description |
|---|---|---|---|
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| include_boilerplate | boolean | – | – |
| include_classified | boolean | – | – |
| include_declarative | boolean | – | High-recall by default; false suppresses data-only catalogs but retains model, schema, and contract clones |
| include_strings | boolean | – | Also compare multi-line string payloads - inline SQL, templates, embedded scripts - which the code pass sees as a single token |
| include_tests | boolean | – | – |
| min_similarity | number | – | 0..1 is a fraction; values above 1 through 100 are percentages |
| min_tokens | integer | – | – |
| mode | string | – | – |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
| top_n | integer | – | – |
No output schema declared.
No examples provided.
find_references ~239
Occurrences of the symbol at a position or label, from the graph and an on-disk SCIP index if present.
| Name | Type | Req | Description |
|---|---|---|---|
| column | integer | – | 1-based source column of the occurrence to resolve |
| cursor | string | – | – |
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| label | string | – | – |
| line | integer | – | 1-based source line of the occurrence to resolve |
| max_results | integer | – | – |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
| path | string | – | Repository-relative file containing the occurrence |
| scip_path | string | – | Repository-relative SCIP index already on disk; never generated or spawned. Defaults to index.scip or .scip/index.scip when present |
No output schema declared.
No examples provided.
get_architecture_contract ~152
Read or preview the local target-architecture contract.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | – |
| baseline_mode | string | – | – |
| candidate_contract | object | – | – |
| confirm_token | string | – | – |
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
No output schema declared.
No examples provided.
get_community ~203
Return one community: derived subsystems by default, or weak connectivity.
| Name | Type | Req | Description |
|---|---|---|---|
| community_id | integer | yes | – |
| cursor | string | – | – |
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| hub_degree | integer | – | – |
| include_non_product | boolean | – | – |
| max_nodes | integer | – | – |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
| resolution | integer | – | – |
| view | string | – | subsystems is a derived directory projection that keeps weak bridges and shared utilities from merging modules; connectivity is the previous weak-component view |
No output schema declared.
No examples provided.
get_dependents ~174
Bounded transitive reverse blast radius.
| Name | Type | Req | Description |
|---|---|---|---|
| depth | integer | – | – |
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| include_container_importers | boolean | – | – |
| label | string | yes | – |
| max_nodes | integer | – | – |
| max_references | integer | – | – |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
| precision | string | – | – |
| timeout_ms | integer | – | – |
No output schema declared.
No examples provided.
get_neighbors ~152
Direct typed incoming and outgoing relationships.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | – |
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| label | string | yes | – |
| max_results | integer | – | – |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
| relation_filter | – | – | – |
| response_detail | string | – | – |
No output schema declared.
No examples provided.
get_node ~122
Resolve one exact graph node.
| Name | Type | Req | Description |
|---|---|---|---|
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| label | string | yes | – |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
No output schema declared.
No examples provided.
git_history ~220
Bounded direct Git history without launching git.
| Name | Type | Req | Description |
|---|---|---|---|
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| first_parent | boolean | – | – |
| include_analytics | boolean | – | – |
| max_commits | integer | – | – |
| max_pairs | integer | – | – |
| min_pair_count | integer | – | – |
| months | integer | – | – |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
| revision | string | – | – |
| token_budget | integer | – | Approximate output ceiling in tokens (serialized bytes / 4); result arrays are trimmed from the tail to fit and the report states what was dropped |
| top_n | integer | – | – |
No output schema declared.
No examples provided.
git_read_blob ~198
Bounded UTF-8 file content at an immutable Git revision or blob OID; binary blobs are refused.
| Name | Type | Req | Description |
|---|---|---|---|
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| max_bytes | integer | – | – |
| oid | string | – | – |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
| path | string | – | – |
| revision | string | – | – |
| token_budget | integer | – | Approximate output ceiling in tokens (serialized bytes / 4); result arrays are trimmed from the tail to fit and the report states what was dropped |
No output schema declared.
No examples provided.
go_to_definition ~208
Resolve the symbol at a source position to its definition without guessing by name.
| Name | Type | Req | Description |
|---|---|---|---|
| column | integer | yes | 1-based source column of the occurrence to resolve |
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| line | integer | yes | 1-based source line of the occurrence to resolve |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
| path | string | yes | Repository-relative file containing the occurrence |
| scip_path | string | – | Repository-relative SCIP index already on disk; never generated or spawned. Defaults to index.scip or .scip/index.scip when present |
No output schema declared.
No examples provided.
god_nodes ~133
Rank high-connectivity production nodes.
| Name | Type | Req | Description |
|---|---|---|---|
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| include_classified | boolean | – | – |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
| top_n | integer | – | – |
No output schema declared.
No examples provided.
graph_diff ~215
Compare the current snapshot with an immutable Git revision.
| Name | Type | Req | Description |
|---|---|---|---|
| base_ref | string | yes | – |
| detail | string | – | Aggregate edge churn by source file, target file, and relation by default; request edges for individual edge provenance |
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| head_ref | string | – | – |
| max_results | integer | – | – |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
| path | string | – | – |
| token_budget | integer | – | Approximate output ceiling in tokens (serialized bytes / 4); result arrays are trimmed from the tail to fit and the report states what was dropped |
No output schema declared.
No examples provided.
graph_stats ~126
Graph size, evidence and build freshness.
| Name | Type | Req | Description |
|---|---|---|---|
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| include_capabilities | boolean | – | – |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
No output schema declared.
No examples provided.
hot_path_review ~250
Rank functions by static complexity times resolved call fan-in.
| Name | Type | Req | Description |
|---|---|---|---|
| call_threshold | integer | – | Only functions with at least this many resolved call sites targeting them |
| cyclomatic_threshold | integer | – | Only functions with at least this many branch decisions |
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| include_classified | boolean | – | – |
| include_tests | boolean | – | – |
| loop_depth_threshold | integer | – | Only functions whose deepest loop nesting reaches this depth |
| min_score | integer | – | Floor on score = complexity_cost x (1 + resolved call fan-in), where complexity_cost = extent lines + 3 x cyclomatic + 10 x loop nesting |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
| path | string | – | – |
| top_n | integer | – | – |
No output schema declared.
No examples provided.
inspect_symbol ~253
Definition, direct relationships and source evidence by label or source position.
| Name | Type | Req | Description |
|---|---|---|---|
| column | integer | – | 1-based source column of the occurrence to resolve |
| context_lines | integer | – | – |
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| label | string | – | – |
| line | integer | – | 1-based source line of the occurrence to resolve |
| max_references | integer | – | Cap on returned relationship edges (default 50) |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
| path | string | – | Repository-relative file containing the occurrence |
| precision | string | – | – |
| scip_path | string | – | Repository-relative SCIP index already on disk; never generated or spawned. Defaults to index.scip or .scip/index.scip when present |
| timeout_ms | integer | – | – |
No output schema declared.
No examples provided.
list_communities ~187
List derived subsystems by default, or weak coupling connectivity.
| Name | Type | Req | Description |
|---|---|---|---|
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| hub_degree | integer | – | – |
| include_non_product | boolean | – | – |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
| resolution | integer | – | – |
| top_n | integer | – | – |
| view | string | – | subsystems is a derived directory projection that keeps weak bridges and shared utilities from merging modules; connectivity is the previous weak-component view |
No output schema declared.
No examples provided.
list_endpoints ~158
Inventory statically extracted HTTP endpoints, including hand-rolled req.method/pathname conditions.
| Name | Type | Req | Description |
|---|---|---|---|
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| include_classified | boolean | – | – |
| max_results | integer | – | – |
| method | string | – | – |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
| path | string | – | – |
No output schema declared.
No examples provided.
list_known_repos ~119
List repositories with an in-process graph.
| Name | Type | Req | Description |
|---|---|---|---|
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
No output schema declared.
No examples provided.
map_stacktrace ~136
Map stack-trace text onto repository files and symbols.
| Name | Type | Req | Description |
|---|---|---|---|
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| max_frames | integer | – | – |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
| text | string | yes | – |
No output schema declared.
No examples provided.
memory_context ~179
Compile bounded temporal memory context from supplied events.
| Name | Type | Req | Description |
|---|---|---|---|
| events | array | yes | StoredEvent-shaped rows (not empty objects). Each event needs metadata with at least id, stream_id, stream_version, global_position, event_type, occurred_at, recorded_at, agent_id, and session_id, pl… |
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
| request | object | yes | – |
No output schema declared.
No examples provided.
module_map ~156
Production folder map at a requested directory depth.
| Name | Type | Req | Description |
|---|---|---|---|
| depth | integer | – | Directory depth that defines one module (default 1: top-level folders) |
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| include_non_product | boolean | – | – |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
| top_n | integer | – | – |
No output schema declared.
No examples provided.
n8n_context ~173
Bounded n8n context for one node: proven dependencies, expression sites, and explicit unknowns.
| Name | Type | Req | Description |
|---|---|---|---|
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| label | string | yes | – |
| max_related | integer | – | – |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
| task | string | – | What the caller intends to change or inspect; used only to keep the bounded context on that question |
No output schema declared.
No examples provided.
n8n_inventory ~158
List n8n workflows, nodes, entry points, and analysis bounds from exported JSON.
| Name | Type | Req | Description |
|---|---|---|---|
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| max_results | integer | – | – |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
| path | string | – | Repository-relative workflow file or path fragment; omit to list every recognized export |
No output schema declared.
No examples provided.
n8n_trace ~179
Upstream and downstream n8n port flow, output dependencies, and static subworkflow links.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | Opaque page token from a previous n8n_trace page.next_cursor; format v1:<offset> |
| depth | integer | – | – |
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| label | string | yes | – |
| max_nodes | integer | – | – |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
No output schema declared.
No examples provided.
open_repo ~162
Retarget to another local repository. Graphs unused for 20 minutes unload; asking for one again rescans that folder.
| Name | Type | Req | Description |
|---|---|---|---|
| build | boolean | – | – |
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| mode | string | – | – |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
| path | string | yes | – |
| precision | string | – | – |
No output schema declared.
No examples provided.
perf_attribution ~335
Correlate a measurement series with the declarations that changed between the revisions that produced it.
| Name | Type | Req | Description |
|---|---|---|---|
| direction | string | – | – |
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| include_classified | boolean | – | – |
| include_tests | boolean | – | – |
| max_revisions | integer | – | Most recent measurements to walk (default 12); each distinct revision costs one full analysis of that revision |
| measurements_file | string | yes | Repository-relative tab- or comma-separated table the caller's harness wrote; comment rows starting with # are ignored, and rows without a finite metric are reported as skipped rather than dropped |
| metric | string | yes | Column holding the measured number, for example nanoseconds per operation. The engine measures nothing itself: it correlates the caller's numbers with structural change |
| min_delta_percent | integer | – | Steps whose relative change is inside this band are reported as flat; set it from the noise floor that a repeated revision measures |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
| path | string | – | – |
| revision_column | string | – | Column holding the Git revision each measurement was taken at; unresolvable revisions are reported as skipped |
| top_n | integer | – | – |
No output schema declared.
No examples provided.
prepare_change ~131
Select architecture rules for intended changed files.
| Name | Type | Req | Description |
|---|---|---|---|
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| files | array | yes | – |
| intent | string | – | – |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
No output schema declared.
No examples provided.
propose_architecture_exception ~142
Return a reviewable exception proposal without writing it.
| Name | Type | Req | Description |
|---|---|---|---|
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| expires | string | – | – |
| fingerprint | string | yes | – |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
| reason | string | yes | – |
No output schema declared.
No examples provided.
query_graph ~277
Bounded BFS or DFS from exact seeds or a ranked question.
| Name | Type | Req | Description |
|---|---|---|---|
| augment_seeds | boolean | – | – |
| context_filter | array | – | – |
| depth | integer | – | – |
| expected_repository | string | – | Path or folder name of the repository this call is about; the call fails instead of answering when the active repository differs. Every answer also carries a repository_context block naming its root,… |
| flow_direction | string | – | – |
| include_classified | boolean | – | – |
| include_low_signal | boolean | – | – |
| intent | string | – | Walk and context quota bias. Question text can also set this; exact seeds stay exact |
| max_nodes | integer | – | – |
| mode | string | – | – |
| output_format | string | – | text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is sa… |
| question | string | – | – |
| relation_filter | – | – | – |
| seed_files | array | – | – |
| seed_symbols | array | – | – |
| token_budget | integer | – | Approximate output ceiling in tokens (serialized bytes / 4); result arrays are trimmed from the tail to fit and the report states what was dropped |
No output schema declared.
No examples provided.
Common questions
What is the Weavatrix MCP server?
Weavatrix is an MCP server listed in the public MCP registry as io.github.Weavatrix/weavatrix. Native Weavatrix MCP: 67 read-only tools for code, local CI, n8n, Dify, agents, Mermaid, Web3. This page covers its npm package (weavatrix).
Is the Weavatrix MCP server safe to use?
Weavatrix scores 87 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Weavatrix MCP server expose?
Weavatrix exposes 67 tools: graph_stats, get_node, get_neighbors, query_graph, god_nodes, and 62 more. Their descriptions and schemas cost roughly 12,630 tokens of context every time the server is loaded.
Is the Weavatrix MCP server still maintained?
Weavatrix is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Weavatrix MCP server under?
Weavatrix declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.