io.github.xxxoooxoxo/wiff

NPM · @XXXOOOXOXO/WIFF · SCANNED AUG 4

Deterministic, resumable multi-agent workflows across Codex, Claude, Cursor, and Kimi.

Available components

+18 this week 76 76 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security89

No malware found by supply-chain analysis.Pass
CVE check failed: a known high-severity CVE affects undici 5.29.0, reached via @cursor/sdk > @connectrpc/connect-node > undici. A fixed version is available. View diagnostics → Fail
No install/post-install scripts declared.Pass
4 of 15 dependencies flagged as unhealthy (4 deprecated). View diagnostics → Partial

Provenance & Transparency97

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Cryptographically verified build provenance (signed, bound to xxxoooxoxo/wiff). View diagnostics → Pass
Clear OSI-approved license (MIT).Pass
Actively maintained (last published 8 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability60

AI-judged instruction clarity (fair).Partial
Tool/resource definitions use about 356 tokens (~71/item across 5 items; 5 tools + 0 resources), lean.Pass
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management27

Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial

Tool Coverage85

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
56% of tool parameters carry a description.Partial

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · @xxxoooxoxo/wiff

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add xxxoooxoxo-wiff -- npx -y @xxxoooxoxo/wiff

# add to Codex CLI

codex mcp add xxxoooxoxo-wiff -- npx -y @xxxoooxoxo/wiff

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "xxxoooxoxo-wiff": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@xxxoooxoxo/wiff"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add xxxoooxoxo-wiff --command npx --arg -y --arg @xxxoooxoxo/wiff

# ~/.hermes/config.yaml

mcp_servers:
  xxxoooxoxo-wiff:
    command: "npx"
    args: ["-y", "@xxxoooxoxo/wiff"]

// mcp.json

{
  "mcpServers": {
    "xxxoooxoxo-wiff": {
      "command": "npx",
      "args": [
        "-y",
        "@xxxoooxoxo/wiff"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

4 Aug 26 +4
- CVE-2026-16728 affects this package: high ▼ security
- CVE-2026-15157 affects this package: high ▼ security
- CVE-2026-16729 affects this package: high ▼ security
- Stability: unverified → 0.27 ▲ functional
2 Aug 26 +15
- Malware scan: unverified → pass ▲ security
- Dependency health: 1.00 → 0.79 ▼ functional
1 Aug 26 −9
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
29 Jul 26 +8
- Schema quality: unverified → fair ▲ functional
28 Jul 26 +32
- CVE-2026-11525 affects this package: high ▼ security
- CVE-2026-1527 affects this package: high ▼ security
- CVE-2026-9679 affects this package: high ▼ security
- CVE-2026-1525 affects this package: high ▼ security
- CVE-2026-6733 affects this package: high ▼ security
- CVE-2026-22036 affects this package: high ▼ security
- CVE-2026-12151 affects this package: high ▼ security
- CVE-2026-2229 affects this package: high ▼ security
- CVE-2026-1526 affects this package: high ▼ security
- Known CVEs: unverified → fail ▼ security
- Install scripts: unverified → pass ▲ security
- Provenance: unverified → pass ▲ security
- The attested source repository moved: xxxoooxoxo/wiff security
- License: unverified → pass ▲ functional
- Dependency health: unverified → 1.00 ▲ functional
- Maintenance: unverified → pass ▲ functional
- Licence: MIT functional
27 Jul 26 26

First indexed and scored.

Show 3 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 4 Aug 2026 · Analysed npm/@xxxoooxoxo/[email protected]

Provenance verified

Ecosystem: npm · Outcome: verified

Reason: verified

Source repo:: xxxoooxoxo/wiff
Certificate issuer:: https://token.actions.githubusercontent.com
Certificate SAN:: https://github.com/xxxoooxoxo/wiff/.github/workflows/release.yml@refs/heads/main
Rekor log index:: 2255442884
Predicate type:: https://slsa.dev/provenance/v1
Subject digest:: sha512:b560c718f0d61e1c8ab33bbb5ce074215c5fc90d1995d25daa6042352e0a1c5e4600160d8bb4b2923189f4f7935beded34dc8246eb6bd1735b7b494ae
Discovery method:: attestation_endpoint

Vulnerabilities 12 findings

ID	CVE	Severity	Vector	Fix available
GHSA-2mjp-6q6p-2qxm	CVE-2026-1525	medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L	yes
GHSA-35p6-xmwp-9g52	CVE-2026-6733	low	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N	yes
GHSA-4992-7rv2-5pvq	CVE-2026-1527	medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N	yes
GHSA-8xcm-r25x-g524	CVE-2026-16728	medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N	yes
GHSA-g8m3-5g58-fq7m	CVE-2026-11525	low	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N	yes
GHSA-g9mf-h72j-4rw9	CVE-2026-22036	medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H	yes
GHSA-m8rv-5g2x-5cg5	CVE-2026-15157	medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N	yes
GHSA-p88m-4jfj-68fv	CVE-2026-9679	medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N	yes
GHSA-v3r7-h72x-cjcm	CVE-2026-16729	medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N	yes
GHSA-v9p9-hfj2-hcw8	CVE-2026-2229	high	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	yes
GHSA-vrm6-8vpv-qv8q	CVE-2026-1526	high	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	yes
GHSA-vxpw-j846-p89q	CVE-2026-12151	high	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	yes

Dependencies 15 packages

15 packages in the resolved dependency tree · 4 deprecated.

MCP tools — 5 exposed · ~304 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

workflow_cancel Cancel an Agent Workflow ~27

Interrupt all live agents and mark a workflow run cancelled.

Input Output Examples

Name	Type	Req	Description
runId	string	yes	—

No output schema declared.

No examples provided.

workflow_models List Workflow Agent Models ~48

List the models each agent backend (codex, claude, cursor, kimi) can run, with supported reasoning efforts. Backends that are unavailable on this machine report an error instead of models.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

workflow_start Start or Resume an Agent Workflow ~142

Launch a deterministic JavaScript workflow in the background, or resume a previous run without repeating successful unchanged agent calls. User and project preferences are loaded from Wiff config. Always pass the caller's absolute working directory as cwd.

Input Output Examples

Name	Type	Req	Description
args	—	—	JSON input exposed to the workflow as the global args value.
cwd	string	—	Absolute working directory inherited by workflow agents.
resumeFromRunId	string	—	Existing run id to resume. Script and args default to the stored values.
script	string	—	Inline workflow JavaScript. Mutually exclusive with scriptPath.
scriptPath	string	—	Absolute path or cwd-relative path to workflow JavaScript.

No output schema declared.

No examples provided.

workflow_status Read Agent Workflow Status ~36

Read the latest persisted status, phase, counters, result, and artifact paths for a workflow run.

Input Output Examples

Name	Type	Req	Description
runId	string	yes	—

No output schema declared.

No examples provided.

workflow_wait Wait for Agent Workflow Progress ~51

Wait until a workflow changes state or the timeout elapses. Call repeatedly until the run is completed, failed, cancelled, or interrupted.

Input Output Examples

Name	Type	Req	Description
runId	string	yes	—
timeoutMs	integer	—	—

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

27 Jul 4 Aug

Day	Score
27 Jul	26
28 Jul	58
29 Jul	66
31 Jul	66
1 Aug	57
2 Aug	72
3 Aug	72
4 Aug	76