# mountable.io (npm · mountable-cli)

Manage persistent AI-agent filesystems. Paid hosted service; Apache-2.0 client.

- Trust score: 86/100 (high trust)
- Change this week: +2
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-07

## Components

- npm · `mountable-cli`: 86/100 (this document), [markdown](https://verifymcp.io/servers/writeitai-mountable/mountable-cli.md), [page](https://verifymcp.io/servers/writeitai-mountable/mountable-cli)

## Channel facts

- Registry: `npm`
- Package: `mountable-cli`
- Version: `0.10.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-07.

- **Supply Chain Security**: 100/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - No production dependencies, so there is no dependency health to assess.
- **Provenance & Transparency**: 97/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to writeitai/mountable).
  - Clear OSI-approved license (Apache-2.0).
  - Actively maintained (last published 0 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 68/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 2565 tokens (~150/item across 17 items; 17 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 53/100
  - Stability observed for 16 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 75/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - 0 of 5 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "delete_grant" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default.
  - An AI judge read all 18 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

## Install

### How do I install the mountable.io MCP server?

mountable.io runs locally as an npm package, launched with npx -y mountable-cli mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add writeitai-mountable -- npx -y mountable-cli mcp
```

### Cursor

```json
{
  "mcpServers": {
    "writeitai-mountable": {
      "command": "npx",
      "args": [
        "-y",
        "mountable-cli",
        "mcp"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "writeitai-mountable": {
      "command": "npx",
      "args": [
        "-y",
        "mountable-cli",
        "mcp"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add writeitai-mountable -- npx -y mountable-cli mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "writeitai-mountable": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "mountable-cli",
        "mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add writeitai-mountable --command npx --arg -y --arg mountable-cli --arg mcp
```

### Hermes

```yaml
mcp_servers:
  writeitai-mountable:
    command: "npx"
    args: ["-y", "mountable-cli", "mcp"]
```

### Netclaw

```json
{
  "McpServers": {
    "writeitai-mountable": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "mountable-cli",
        "mcp"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add writeitai-mountable -t stdio -c npx -a -y mountable-cli mcp
```

### Other

```json
{
  "mcpServers": {
    "writeitai-mountable": {
      "command": "npx",
      "args": [
        "-y",
        "mountable-cli",
        "mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-07 (score 86, 0)

- [functional regression] Schema quality: 132 → 150
- [functional] Schema quality: excellent → good
- [functional] Package version: 0.8.0 → 0.10.0

### 2026-11-05 (score 86, +1)

No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-11-02 (score 85, +1)

No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-31 (score 84, +1)

No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-29 (score 83, +1)

No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-27 (score 82, +16)

- [security improvement] Malware scan: unverified → pass

### 2026-10-26 (score 66, −15)

- [security regression] Malware scan: pass → unverified
- [functional regression] Schema quality: 886 → 1328
- [functional] Package version: 0.6.0 → 0.8.0

### 2026-10-24 (score 81, +16)

- [security improvement] Malware scan: unverified → pass

## MCP tools (17)

### `create_filesystem` (~153 tokens)

Create a filesystem and return it; its id is what tickets and mounts need. Needs a management key (mtblm_) or the login of an owner or admin; an API key gets management_key_required. org_id is optional: a key uses its own organisation, and a login with one organisation uses that one. Not idempotent, and names need not be unique: after a timeout or an unknown outcome, call list_filesystems and look for the name before creating again. Never retry blindly. On rate_limited, wait retry_after seconds before retrying.

Input parameters:

- `name` (string, required): the filesystem's name; names need not be unique
- `org_id` (string): the organisation ID; optional

### `create_mount_ticket` (~452 tokens)

Create a one-time mount ticket for a sandbox. The result is the mount session with its ticket (single use, valid for minutes) and mount_command, a convenience hint for a person. Agents must construct the documented mountable mount --ticket-stdin --json command with separately quoted arguments, not evaluate mount_command. Pass the ticket through stdin from MOUNTABLE_TICKET, never in an argument list or log. /mnt/mountable is only a default: use a caller-approved writable directory. Use an existing approved CLI; if installation is authorized, choose npm install --global --ignore-scripts mountable-cli or uv tool install mountable, then mountable version. Report setup blockers instead of using sudo or a remote shell installer. Linux mounts need FUSE. Validate the nonempty ticket and selected filesystem ID, then wait for a mounted JSON event matching the intended path, filesystem and mode before using the directory. Retries: pass your own idempotency_key and reuse it when retrying after an unknown outcome. A replay returns the existing session without a ticket. If that session is still requested, its ticket was lost: this tool revokes it and creates a new one with a fresh key, and the result names the old one as replaced_session_id. If it is active or later, the ticket was used: nothing is revoked and the tool fails with ticket_already_used; use a new idempotency_key for another mount. idempotency_conflict means an identical request is in progress. If the outcome is unknown (network_error or outcome_unknown), the error's idempotency_key is the key that request was sent with: retry with exactly that key, even if you did not choose it. On rate_limited, wait retry_after seconds before retrying.

Input parameters:

- `filesystem_id` (string, required): the filesystem ID
- `idempotency_key` (string): a key you choose and reuse when retrying this request; a new key for each new mount
- `max_duration_seconds` (integer): the session's maximum duration in seconds; optional (default 12 hours, at most the API key's or login's expiry)
- `read_only` (boolean): mount read-only

### `delete_grant` (~143 tokens)

Remove a grant; sessions that relied on it end. Not idempotent: after an unknown outcome, call list_grants to see whether it is gone. Needs a management key (mtblm_) or the login of an owner or admin; an API key gets management_key_required. org_id is optional: a key uses its own organisation, and a login with one organisation uses that one. On rate_limited, wait retry_after seconds before retrying.

Input parameters:

- `filesystem_id` (string, required): the filesystem ID
- `grant_id` (string, required): the grant's ID, from list_grants
- `org_id` (string): the organisation ID; optional

### `delete_webhook` (~115 tokens)

Delete a webhook; deliveries to its URL stop. Not idempotent: after an unknown outcome, call list_webhooks to see whether it is gone. org_id is optional: a key uses its own organisation, and a login with one organisation uses that one. On rate_limited, wait retry_after seconds before retrying.

Input parameters:

- `filesystem_id` (string, required): the filesystem ID
- `org_id` (string): the organisation ID; optional
- `webhook_id` (string, required): the webhook ID, from list_webhooks

### `enable_webhook` (~150 tokens)

Re-enable a webhook disabled after 24 hours of failed deliveries (disabled_reason failing), once its endpoint works again; the next delivery is usually a files.resync. A webhook disabled as access_revoked cannot be re-enabled (error access_revoked): create a new one with `mountable webhooks create`. Safe to retry. org_id is optional: a key uses its own organisation, and a login with one organisation uses that one. On rate_limited, wait retry_after seconds before retrying.

Input parameters:

- `filesystem_id` (string, required): the filesystem ID
- `org_id` (string): the organisation ID; optional
- `webhook_id` (string, required): the webhook ID, from list_webhooks

### `filesystem_usage` (~93 tokens)

A filesystem's stored bytes and files against its quotas, and its traffic over 30 days. org_id is optional: a key uses its own organisation, and a login with one organisation uses that one. Read-only and safe to retry. On rate_limited, wait retry_after seconds before retrying.

Input parameters:

- `filesystem_id` (string, required): the filesystem ID
- `org_id` (string): the organisation ID; optional

### `list_api_keys` (~171 tokens)

List the organisation's API keys: id, name, filesystem_id (set for a key limited to one filesystem), expires_at and revoked; never their secrets. Creating a key is not a tool, because its answer is the key's secret: run `mountable api-keys create` or `mountable s3-keys create` (or use the SDKs) where the backend stores it. Needs a management key (mtblm_) or the login of an owner or admin; an API key gets management_key_required. org_id is optional: a key uses its own organisation, and a login with one organisation uses that one. Read-only and safe to retry. On rate_limited, wait retry_after seconds before retrying.

Input parameters:

- `org_id` (string): the organisation ID; optional

### `list_filesystems` (~88 tokens)

List the organisation's filesystems (an API key sees those it has a grant on; a management key sees all). org_id is optional: a key uses its own organisation, and a login with one organisation uses that one. Read-only and safe to retry. On rate_limited, wait retry_after seconds before retrying.

Input parameters:

- `org_id` (string): the organisation ID; optional

### `list_grants` (~128 tokens)

List a filesystem's grants: id, principal_type (member, group or api_key), principal_id and mode (ro or rw). Needs a management key (mtblm_) or the login of an owner or admin; an API key gets management_key_required. org_id is optional: a key uses its own organisation, and a login with one organisation uses that one. Read-only and safe to retry. On rate_limited, wait retry_after seconds before retrying.

Input parameters:

- `filesystem_id` (string, required): the filesystem ID
- `org_id` (string): the organisation ID; optional

### `list_mount_sessions` (~91 tokens)

List a filesystem's live mount sessions (an API key sees those it created). org_id is optional: a key uses its own organisation, and a login with one organisation uses that one. Read-only and safe to retry. On rate_limited, wait retry_after seconds before retrying.

Input parameters:

- `filesystem_id` (string, required): the filesystem ID
- `org_id` (string): the organisation ID; optional

### `list_organizations` (~44 tokens)

List the caller's mountable.io organisations (a key has exactly one). Read-only and safe to retry. On rate_limited, wait retry_after seconds before retrying.

### `list_s3_keys` (~194 tokens)

List a filesystem's S3 keys: access_key_id, name, mode, expires_at and revoked; never their secrets. The bucket is the filesystem ID at https://s3.mountable.io (path-style). Creating a key is not a tool, because its answer is the key's secret: run `mountable api-keys create` or `mountable s3-keys create` (or use the SDKs) where the backend stores it. Needs a management key (mtblm_) or the login of an owner or admin; an API key gets management_key_required. org_id is optional: a key uses its own organisation, and a login with one organisation uses that one. Read-only and safe to retry. On rate_limited, wait retry_after seconds before retrying.

Input parameters:

- `filesystem_id` (string, required): the filesystem ID
- `org_id` (string): the organisation ID; optional

### `list_webhooks` (~174 tokens)

List a filesystem's webhooks: url, path_prefix, state (active or disabled), disabled_reason (failing or access_revoked) and the last delivery's outcome (last_success_at, last_failure, failing_since). Needs read-write access to the filesystem. Creating a webhook and rotating its secret are not tools, because their answer is the signing secret: run `mountable webhooks create` or `rotate-secret` (or use the SDKs) where the receiving backend stores it. org_id is optional: a key uses its own organisation, and a login with one organisation uses that one. Read-only and safe to retry. On rate_limited, wait retry_after seconds before retrying.

Input parameters:

- `filesystem_id` (string, required): the filesystem ID
- `org_id` (string): the organisation ID; optional

### `revoke_api_key` (~123 tokens)

Revoke an API key; its sessions end and its calls fail. Idempotent and safe to retry. Needs a management key (mtblm_) or the login of an owner or admin; an API key gets management_key_required. org_id is optional: a key uses its own organisation, and a login with one organisation uses that one. On rate_limited, wait retry_after seconds before retrying.

Input parameters:

- `key_id` (string, required): the API key's ID, from list_api_keys
- `org_id` (string): the organisation ID; optional

### `revoke_mount_session` (~53 tokens)

Revoke a mount session; its mount stops working. Idempotent and safe to retry. On rate_limited, wait retry_after seconds before retrying.

Input parameters:

- `session_id` (string, required): the mount session ID

### `revoke_s3_key` (~142 tokens)

Revoke an S3 key; S3 refuses it within 15 seconds. Idempotent and safe to retry. Needs a management key (mtblm_) or the login of an owner or admin; an API key gets management_key_required. org_id is optional: a key uses its own organisation, and a login with one organisation uses that one. On rate_limited, wait retry_after seconds before retrying.

Input parameters:

- `access_key_id` (string, required): the S3 key's access key ID, from list_s3_keys
- `filesystem_id` (string, required): the filesystem ID
- `org_id` (string): the organisation ID; optional

### `set_grant` (~171 tokens)

Give a member, group or API key access to a filesystem, or change the mode of its grant. Sets the same grant when repeated, so it is safe to retry. Needs a management key (mtblm_) or the login of an owner or admin; an API key gets management_key_required. org_id is optional: a key uses its own organisation, and a login with one organisation uses that one. On rate_limited, wait retry_after seconds before retrying.

Input parameters:

- `filesystem_id` (string, required): the filesystem ID
- `mode` (string, required): ro or rw
- `org_id` (string): the organisation ID; optional
- `principal_id` (string, required): the member's, group's or API key's ID
- `principal_type` (string, required): member, group or api_key

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/writeitai-mountable/mountable-cli#diagnostics

## Score history

- 2026-11-07: 86
- 2026-11-06: 86
- 2026-11-05: 86
- 2026-11-04: 85
- 2026-11-03: 85
- 2026-11-02: 85
- 2026-11-01: 84
- 2026-10-31: 84
- 2026-10-30: 83
- 2026-10-29: 83
- 2026-10-28: 82
- 2026-10-27: 82
- 2026-10-26: 66
- 2026-10-25: 81
- 2026-10-24: 81
- 2026-10-23: 65
- 2026-10-22: 80

## Common questions

### What is the mountable.io MCP server?

mountable.io is an MCP server listed in the public MCP registry as io.github.writeitai/mountable. Manage persistent AI-agent filesystems. Paid hosted service; Apache-2.0 client. This page covers its npm package (mountable-cli).

### Is the mountable.io MCP server safe to use?

mountable.io scores 86 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 7 November 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the mountable.io MCP server expose?

mountable.io exposes 17 tools: create_filesystem, create_mount_ticket, delete_grant, delete_webhook, enable_webhook, and 12 more. Their descriptions and schemas cost roughly 2,485 tokens of context every time the server is loaded.

### Is the mountable.io MCP server still maintained?

mountable.io is still listed as active in the MCP registry. We last reached this channel on 7 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the mountable.io MCP server under?

mountable.io declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

### What did VerifyMCP test on the mountable.io MCP server?

VerifyMCP ran 16 checks on mountable.io, covering Malware scan, Known CVEs, Install scripts, Dependency health and 12 more. Endpoint Security and Transport & Reachability do not apply to an npm package, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.

## Links

- npm package: https://www.npmjs.com/package/mountable-cli
- Socket report: https://socket.dev/npm/package/mountable-cli
- Repository: https://github.com/writeitai/mountable
- Website: https://mountable.io/docs/mcp
- Changelog RSS feed: https://verifymcp.io/servers/writeitai-mountable/mountable-cli.xml
- Changelog JSON feed: https://verifymcp.io/servers/writeitai-mountable/mountable-cli/changelog.json
- Trust report (JSON): https://verifymcp.io/servers/writeitai-mountable/mountable-cli.json
- HTML version of this page: https://verifymcp.io/servers/writeitai-mountable/mountable-cli