io.github.xiaoxuzhu303-prog/harmony-mcp
NPM · @YUJIAMEI/HARMONY-MCP · SCANNED SEP 21
AI copilot for WeChat Mini Program - compile-fix, size analysis, compliance. 20 tools.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 96 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency19
- Repository check failed: the declared repository URL returned HTTP 404. See how to fix → View diagnostics → Fail
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 106 days ago).Pass
- Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability89
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2908 tokens (~103/item across 28 items; 28 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management97
- Stability observed for 29 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 28 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the io.github.xiaoxuzhu303-prog/harmony-mcp server?
io.github.xiaoxuzhu303-prog/harmony-mcp runs locally as an npm package, launched with npx -y @yujiamei/harmony-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @yujiamei/harmony-mcp
claude mcp add xiaoxuzhu303-prog-harmony-mcp -- npx -y @yujiamei/harmony-mcp
{
"mcpServers": {
"xiaoxuzhu303-prog-harmony-mcp": {
"command": "npx",
"args": [
"-y",
"@yujiamei/harmony-mcp"
]
}
}
} {
"servers": {
"xiaoxuzhu303-prog-harmony-mcp": {
"command": "npx",
"args": [
"-y",
"@yujiamei/harmony-mcp"
]
}
}
} codex mcp add xiaoxuzhu303-prog-harmony-mcp -- npx -y @yujiamei/harmony-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"xiaoxuzhu303-prog-harmony-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"@yujiamei/harmony-mcp"
],
"enabled": true
}
}
} openclaw mcp add xiaoxuzhu303-prog-harmony-mcp --command npx --arg -y --arg @yujiamei/harmony-mcp
mcp_servers:
xiaoxuzhu303-prog-harmony-mcp:
command: "npx"
args: ["-y", "@yujiamei/harmony-mcp"] {
"McpServers": {
"xiaoxuzhu303-prog-harmony-mcp": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@yujiamei/harmony-mcp"
]
}
}
} assistant mcp add xiaoxuzhu303-prog-harmony-mcp -t stdio -c npx -a -y @yujiamei/harmony-mcp
{
"mcpServers": {
"xiaoxuzhu303-prog-harmony-mcp": {
"command": "npx",
"args": [
"-y",
"@yujiamei/harmony-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 21 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 19 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
- 17 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 16 Sept 26 −3
- Stability: pass → 0.80 functional
- 15 Sept 26 0
- Stability: 0.97 → pass security
- 14 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
- 10 Sept 26 −2
- Stability: pass → 0.83 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 21 Sept 2026 · Analysed npm/@yujiamei/harmony-mcp@0.4.2
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 96 packages
| Packages resolved | 96 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
harmony_file_pull 从设备拉取文件 ~79
从鸿蒙设备拉取文件到本地指定路径。当用户说「把设备上的文件拉下来」时调用。
| Name | Type | Req | Description |
|---|---|---|---|
| localPath | string | yes | 本地目标路径 |
| remotePath | string | yes | 设备上的源文件路径 |
| target | string | – | 目标设备 connectKey（多设备时必填） |
No output schema declared.
No examples provided.
harmony_file_push 推送文件到设备 ~82
将本地文件推送到鸿蒙设备的指定路径。当用户说「把文件传到设备上」时调用。
| Name | Type | Req | Description |
|---|---|---|---|
| localPath | string | yes | 本地文件的绝对路径 |
| remotePath | string | yes | 设备上的目标路径 |
| target | string | – | 目标设备 connectKey（多设备时必填） |
No output schema declared.
No examples provided.
harmony_install 安装 HAP 包 ~98
将 HAP 安装包安装到指定鸿蒙设备。当用户说「装到设备上」「安装这个 hap」时调用。安装前建议先用 harmony_list_devices 确认目标设备。多设备时必须指定 target。
| Name | Type | Req | Description |
|---|---|---|---|
| hapPath | string | yes | HAP 安装包的绝对路径 |
| target | string | – | 目标设备 connectKey（多设备时必填，来自 harmony_list_devices） |
No output schema declared.
No examples provided.
harmony_list_devices 鸿蒙设备列表 ~76
列出当前已连接的鸿蒙设备和模拟器（connectKey、状态、类型）。当用户问「有哪些鸿蒙设备」或在执行其他鸿蒙操作前需要确认目标设备时调用。多设备场景下，其他鸿蒙工具需要用此处返回的 connectKey 指定 target。
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
harmony_log 查看设备日志 ~99
抓取设备最近的 hilog 日志（默认最近 200 行）。当用户说「看看日志」「设备上报什么错了」时调用。可用 keyword 过滤。
| Name | Type | Req | Description |
|---|---|---|---|
| keyword | string | – | 按关键词过滤日志（可选） |
| lines | number | – | 抓取的日志行数（默认 200） |
| target | string | – | 目标设备 connectKey（多设备时必填） |
No output schema declared.
No examples provided.
harmony_ready_check 鸿蒙环境预检 ~80
一次性检测鸿蒙开发环境：HDC 路径、HDC 版本、已连接设备。返回每项 pass/warn/fail 状态和修复 SOP。在执行鸿蒙设备操作前建议先调用确认环境就绪。如果返回 NOT_READY，请根据 failedChecks 的 sop 逐项引导用户修复。
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
harmony_start 启动 Ability ~102
在指定设备上启动应用的某个 Ability（相当于预览/拉起应用）。当用户说「在设备上跑起来」「启动这个应用」时调用。需要提供 bundleName 和 abilityName。
| Name | Type | Req | Description |
|---|---|---|---|
| abilityName | string | yes | Ability 名称（如 EntryAbility） |
| bundleName | string | yes | 应用包名（bundleName） |
| target | string | – | 目标设备 connectKey（多设备时必填） |
No output schema declared.
No examples provided.
harmony_uninstall 卸载应用 ~78
从指定鸿蒙设备卸载应用（按 bundleName）。当用户说「卸载这个应用」时调用。多设备时必须指定 target。
| Name | Type | Req | Description |
|---|---|---|---|
| bundleName | string | yes | 应用包名（bundleName，如 com.example.app） |
| target | string | – | 目标设备 connectKey（多设备时必填） |
No output schema declared.
No examples provided.
wechat_audit 代码质量审计 ~96
全面代码质量审计：11 条运行时规则扫描 + A/B/C/D 评分 + 具体问题列表。当用户说「帮我检查代码质量」「项目有没有问题」时调用。返回 suggestedActions 时请按顺序修复。
| Name | Type | Req | Description |
|---|---|---|---|
| projectPath | string | yes | 小程序项目的绝对路径（支持原生项目、uni-app、Taro、mpx 源码目录） |
No output schema declared.
No examples provided.
wechat_build_npm 构建 NPM ~74
构建小程序项目的 npm 依赖。当 wechat_diagnose 返回 REBUILD_NPM 指令、或用户新安装了 npm 包后需要调用此工具。构建完成后建议重新编译验证。
| Name | Type | Req | Description |
|---|---|---|---|
| projectPath | string | yes | 小程序项目的绝对路径 |
No output schema declared.
No examples provided.
wechat_cli_login 微信登录 ~51
登录微信开发者工具（会弹出二维码，需要用户手机微信扫码确认）。当其他工具返回 NEED_LOGIN 状态时，必须先调用此工具完成登录，再重试之前的操作。
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
wechat_close_project 关闭项目 ~48
关闭当前在微信开发者工具中打开的项目。当需要切换到另一个项目时使用。
| Name | Type | Req | Description |
|---|---|---|---|
| projectPath | string | yes | 小程序项目的绝对路径 |
No output schema declared.
No examples provided.
wechat_compliance_check 合规预检 ~104
合规预检：扫描隐私 API 调用（15 条规则）、检查权限声明、推断所需类目、标注个人主体限制。发版前调用避免审核被拒。返回缺失权限 + suggestedPatch（可直接帮用户补全 permission 配置）。
| Name | Type | Req | Description |
|---|---|---|---|
| projectPath | string | yes | 小程序项目的绝对路径（支持原生项目、uni-app、Taro、mpx 源码目录） |
No output schema declared.
No examples provided.
wechat_config_validate 配置校验 ~95
校验 project.config.json 和 app.json 配置文件，检查 appid 格式、pages 为空、必填字段缺失等常见错误。当用户问「配置有没有问题」时调用。返回 suggestedActions 时请按顺序执行。
| Name | Type | Req | Description |
|---|---|---|---|
| projectPath | string | yes | 小程序项目的绝对路径（支持原生项目、uni-app、Taro、mpx 源码目录） |
No output schema declared.
No examples provided.
wechat_dependency_check 依赖检查 ~97
检查 npm 依赖状态：未构建的依赖、已知体积大户（lodash/moment 等）。当用户问「依赖有问题吗」或发版前调用。返回 suggestedActions 时请按顺序执行。
| Name | Type | Req | Description |
|---|---|---|---|
| projectPath | string | yes | 小程序项目的绝对路径（支持原生项目、uni-app、Taro、mpx 源码目录） |
No output schema declared.
No examples provided.
wechat_diagnose 编译诊断 ~327
触发小程序项目编译，捕获编译错误并结构化分析，给出修复建议。支持自动识别 uni-app/Taro/mpx 等跨框架项目。 如果返回 status="COMPILATION_FAILED"，你必须根据每个 error 的 agentActionHint 执行对应操作： - READ_FILE_AND_PATCH: 立刻读取 error.file 的 error.line 行附近代码，分析并修复错误 - ADD_PAGE_TO_APP_JSON: 在 app.json 的 pages 数组中添加缺失的页面路径 - REBUILD_NPM: 调用 wechat_build_npm 工具重新构建 npm - INSTALL_DEPENDENCY: 执行 npm install 安装缺失的依赖包 - FIX_CONFIG: 读取并修复对应的配置文件 - CHECK_COMPONENT_PATH: 检查组件路径和 usingComponents 配置 修复完成后，再次调用本工具验证编译是否通过，直到 status="COMPILATION_OK"。 如果 status="LOOP_LIMIT_REACHED"，你必须立即停止自动修复，将完整的错误历史展示给用户，请求人工介入。
| Name | Type | Req | Description |
|---|---|---|---|
| errorHistory | string | – | 之前各轮的错误 JSON（由 AI 累积传入） |
| projectPath | string | yes | 小程序项目的绝对路径（支持原生项目、uni-app、Taro、mpx 源码目录） |
| retryCount | number | – | 当前自动修复轮次（AI 每次重试时递增） |
No output schema declared.
No examples provided.
wechat_init_project 新建小程序项目 ~179
在指定目录创建一个标准的微信小程序项目骨架，包含 project.config.json、app.json、app.js、首页等基础文件。 支持三种模板：blank（空白项目）、tabbar（带底部导航）、subpackage（带分包结构）。 创建完成后建议调用 wechat_open_project 在开发者工具中打开。
| Name | Type | Req | Description |
|---|---|---|---|
| appid | string | – | 小程序 AppID（可选，默认使用测试号 touristappid） |
| projectName | string | – | 项目名称（可选，默认 my-miniprogram） |
| projectPath | string | yes | 要创建项目的目标目录绝对路径（目录不存在会自动创建） |
| template | string | – | 项目模板：blank（空白）、tabbar（带底部导航）、subpackage（带分包），默认 blank |
No output schema declared.
No examples provided.
wechat_open_project 打开项目 ~51
在微信开发者工具中打开指定项目。通常由自动恢复链路内部调用，用户一般不需要直接使用。
| Name | Type | Req | Description |
|---|---|---|---|
| projectPath | string | yes | 小程序项目的绝对路径 |
No output schema declared.
No examples provided.
wechat_package_size 包体积分析 ~159
分析小程序包体积，返回主包/分包体积、文件明细、三方库排行、体积炸弹警告。当用户问「包超了吗」「体积多大」时调用。 如果 useOfficialReport=true 会触发一次预览编译获取精准数据。主包超 1.5MB 时建议调用 wechat_subpackage_suggest 获取分包方案。
| Name | Type | Req | Description |
|---|---|---|---|
| projectPath | string | yes | 小程序项目的绝对路径（支持原生项目、uni-app、Taro、mpx 源码目录） |
| useOfficialReport | boolean | – | 是否使用微信官方编译报告获取精准体积（会触发一次预览编译） |
No output schema declared.
No examples provided.
wechat_page_list 页面列表 ~80
列出小程序所有页面（主包 + 分包），标注分包归属和页面总数。当用户问「有哪些页面」「页面列表」时调用。
| Name | Type | Req | Description |
|---|---|---|---|
| projectPath | string | yes | 小程序项目的绝对路径（支持原生项目、uni-app、Taro、mpx 源码目录） |
No output schema declared.
No examples provided.
wechat_preview 预览小程序 ~62
预览小程序项目，生成二维码用于手机扫码预览。如果用户只是想检查编译是否通过，应优先使用 wechat_diagnose 而非此工具。
| Name | Type | Req | Description |
|---|---|---|---|
| projectPath | string | yes | 小程序项目的绝对路径 |
No output schema declared.
No examples provided.
wechat_project_info 项目信息 ~100
读取小程序项目全貌：AppID、页面列表、分包结构、编译配置、窗口设置。当用户第一次提到一个项目时应主动调用。支持 uni-app/Taro/mpx 跨框架自动识别（所有工具共享此能力）。
| Name | Type | Req | Description |
|---|---|---|---|
| projectPath | string | yes | 小程序项目的绝对路径（支持原生项目、uni-app、Taro、mpx 源码目录） |
No output schema declared.
No examples provided.
wechat_publish 一键发版 ~172
一键发版：自动读取当前版本号并递增、构建 npm 依赖、上传代码到微信后台。调用前必须先调用 wechat_diagnose 确认编译零错误，只有编译通过才能发版，否则应先引导用户修复编译错误。 支持自动识别 uni-app/Taro/mpx 等跨框架项目。
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | – | 版本描述，如 '修复了购物车 bug' |
| projectPath | string | yes | 小程序项目的绝对路径（支持原生项目、uni-app、Taro、mpx 源码目录） |
| versionBump | string | – | 版本递增方式：patch(修复)、minor(功能)、major(大版本)，默认 patch |
No output schema declared.
No examples provided.
wechat_ready_check 全链路预检 ~138
一次性检查微信开发者工具全链路状态：CLI 路径、进程运行、登录态、服务端口、项目合法性和可预览状态。 返回每个检查项的 pass/warn/fail 状态和具体修复 SOP。 建议在执行 preview/upload/diagnose 等操作前先调用此工具确认环境就绪。 如果返回 status="NOT_READY"，你必须根据 failedChecks 中每项的 sop 字段引导用户逐一修复。
| Name | Type | Req | Description |
|---|---|---|---|
| projectPath | string | – | 可选，小程序项目路径。提供后会额外检查项目合法性 |
No output schema declared.
No examples provided.
wechat_reset_fileutils 重置文件监听 ~63
重置微信开发者工具的文件监听缓存。当开发者工具出现文件不同步、修改不生效等异常时使用。通常由自动恢复链路内部调用。
| Name | Type | Req | Description |
|---|---|---|---|
| projectPath | string | yes | 小程序项目的绝对路径 |
No output schema declared.
No examples provided.
wechat_self_test 环境自检 ~96
检测 harmony-mcp 运行环境是否就绪（CLI 路径、开发者工具进程、Node 版本等）。当用户第一次使用本工具或询问'连上了吗/能用吗'时，应主动调用此工具进行自检，并将结果用自信的口吻告知用户。本工具同时包含隐私安全声明，请在用户有安全顾虑时引用。
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
wechat_subpackage_suggest 智能分包建议 ~138
智能分包建议：分析页面依赖关系，生成分包方案 + 可直接使用的 app.json 配置片段 + 体积归因 + 预加载配置 + 分包后体积模拟。 当主包超 1.5MB 或 wechat_package_size 建议分包时调用。拿到 configSnippet 后，读取 app.json 合并 subpackages 并从 pages 中移除已分包页面。
| Name | Type | Req | Description |
|---|---|---|---|
| projectPath | string | yes | 小程序项目的绝对路径（支持原生项目、uni-app、Taro、mpx 源码目录） |
No output schema declared.
No examples provided.
wechat_upload 上传代码 ~84
上传小程序代码到微信后台。通常不需要直接调用此工具，推荐使用 wechat_publish（一键发版）来完成完整的发布流程。
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | – | 版本描述 |
| projectPath | string | yes | 小程序项目的绝对路径 |
| version | string | yes | 版本号，如 '1.0.0' |
No output schema declared.
No examples provided.
What is the io.github.xiaoxuzhu303-prog/harmony-mcp server?
io.github.xiaoxuzhu303-prog/harmony-mcp is listed in the public MCP registry as io.github.xiaoxuzhu303-prog/harmony-mcp. AI copilot for WeChat Mini Program - compile-fix, size analysis, compliance. 20 tools. This page covers its npm package (@yujiamei/harmony-mcp).
Is the io.github.xiaoxuzhu303-prog/harmony-mcp server safe to use?
io.github.xiaoxuzhu303-prog/harmony-mcp scores 81 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 21 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.xiaoxuzhu303-prog/harmony-mcp server expose?
io.github.xiaoxuzhu303-prog/harmony-mcp exposes 28 tools: wechat_cli_login, wechat_preview, wechat_upload, wechat_build_npm, wechat_open_project, and 23 more. Their descriptions and schemas cost roughly 2,908 tokens of context every time the server is loaded.
Is the io.github.xiaoxuzhu303-prog/harmony-mcp server still maintained?
io.github.xiaoxuzhu303-prog/harmony-mcp is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.xiaoxuzhu303-prog/harmony-mcp server under?
io.github.xiaoxuzhu303-prog/harmony-mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.