Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

tc39-mcp

NPM · TC39-MCP · 2 COMPONENTS · SCANNED SEP 20

Independent MCP server for the TC39 specs (ECMA-262 + ECMA-402): clauses, search, diffs, history.

0 this week 97 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security98
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • 31 of 95 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to xyzzylabs/tc39-mcp). View diagnostics → Pass
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 11 days ago).Pass
  • Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability88
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (excellent).Pass
  • Tool/resource definitions use about 7163 tokens (~51/item across 139 items; 19 tools + 120 resources), lean.Pass
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
  • No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 99% of tool parameters carry a description.Partial
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 19 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 21 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

How do I install the tc39-mcp server?

tc39-mcp runs locally as an npm package, launched with npx -y tc39-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · tc39-mcp

# add to Claude Code
claude mcp add xyzzylabs-tc39-mcp -- npx -y tc39-mcp
// .cursor/mcp.json
{
  "mcpServers": {
    "xyzzylabs-tc39-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "tc39-mcp"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "xyzzylabs-tc39-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "tc39-mcp"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add xyzzylabs-tc39-mcp -- npx -y tc39-mcp
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "xyzzylabs-tc39-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "tc39-mcp"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add xyzzylabs-tc39-mcp --command npx --arg -y --arg tc39-mcp
# ~/.hermes/config.yaml
mcp_servers:
  xyzzylabs-tc39-mcp:
    command: "npx"
    args: ["-y", "tc39-mcp"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "xyzzylabs-tc39-mcp": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "tc39-mcp"
      ]
    }
  }
}
# add to Vellum
assistant mcp add xyzzylabs-tc39-mcp -t stdio -c npx -a -y tc39-mcp
// mcp.json
{
  "mcpServers": {
    "xyzzylabs-tc39-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "tc39-mcp"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 20 Sept 26 0
    • Stability: 0.97 → pass security
  • 19 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.

  • 17 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.

  • 15 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.

  • 14 Sept 26 −3
    • Stability: pass → 0.80 functional
  • 13 Sept 26 0
    • Stability: 0.97 → pass security
  • 12 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.

  • 10 Sept 26 +8
    • Judged manipulation: unverified → pass security
    • Schema quality: unverified → excellent functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Sept 2026 · Analysed npm/tc39-mcp@0.6.3

Provenance Verified

A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.

Result Verified
Ecosystem npm
Reason Verified
Discovered via Registry attestation endpoint
Source repo xyzzylabs/tc39-mcp
Certificate issuer https://token.actions.githubusercontent.com
Certificate SAN https://github.com/xyzzylabs/tc39-mcp/.github/workflows/release.yml@refs/tags/v0.6.3
Rekor log index 2758045138
Predicate type https://slsa.dev/provenance/v1
Subject digest sha512:980ed2f809c414526091d2bf1fbdba110683f87cbdb3951d485be38761338f38209726c78a2d9da9207ffcd237cd6abb2a7f8506c008ab78c4111d78e

Background: How many MCP packages publish verified provenance →

Dependencies 95 packages
Packages resolved 95
Stale 31
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 19 exposed · ~3,852 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
clause.get ~195

Fetch a parsed TC39 clause as structured JSON: metadata, signature, algorithm steps, notes, cross-refs, and outward citations to external specs (Unicode, IETF, WHATWG). `spec` selects '262' (default) or '402'. `edition` defaults to `latest` (current stable release on both specs — es2026 today).

NameTypeReqDescription
editionstringEdition within the chosen spec. ECMA-262: es2016 … es2026, main. ECMA-402: es2016 … es2026, main. Aliases: latest, draft, next.
idstringyesSpec clause id, e.g. 'sec-tonumber' (262) or 'sec-intl.numberformat' (402).
specstringWhich TC39 spec to read: '262' (core language, default) or '402' (Internationalization API).

No output schema declared.

No examples provided.

clause.list ~265

List parsed spec clauses with optional filters (kind, section prefix, has_algorithm). Returns lightweight rows {id, aoid, title, number, kind, algorithms}; follow up with clause.get for detail. `spec` selects '262' or '402'.

NameTypeReqDescription
editionstringEdition within the chosen spec. ECMA-262: es2016 … es2026, main. ECMA-402: es2016 … es2026, main. Aliases: latest, draft, next.
has_algorithmbooleanIf true, return only clauses with at least one `<emu-alg>`.
kindstringFilter by clause kind (e.g. 'op', 'sdo', 'built-in function', 'concrete method').
limitintegerMax clauses returned. The full spec has ~3000 clauses; the default is a safe slice.
sectionstringFilter to clauses whose section number starts with this prefix, e.g. '22.2' for RegExp or '15' for the Locale-aware operations in ECMA-402.
specstringWhich TC39 spec to read: '262' (core language, default) or '402' (Internationalization API).

No output schema declared.

No examples provided.

clause.outline ~203

Return the section tree (table of contents) for a parsed (spec, edition). `depth` caps tree depth (1 = top-level only). `under` anchors at a specific clause id so you get just its descendants. Each node carries { id, number, title, kind, children }.

NameTypeReqDescription
depthintegerMax tree depth to return. 1 = top-level only; 2 = first two levels; omitted = full tree.
editionstringEdition within the chosen spec. ECMA-262: es2016 … es2026, main. ECMA-402: es2016 … es2026, main. Aliases: latest, draft, next.
specstringWhich TC39 spec to read: '262' (core language, default) or '402' (Internationalization API).
understringOptional clause id. If set, return only descendants of this clause.

No output schema declared.

No examples provided.

proposal.get ~99

Fetch one TC39 proposal by slug (exact) or name (case-insensitive). Returns { slug, name, stage, authors, champions, url, test262_flag, source_file }. Slug is canonical — use what proposal.list returns directly.

NameTypeReqDescription
namestringyesMatch against either the proposal's slug (preferred, exact-match) or its name (case-insensitive). Slug is the canonical id — use what proposal.list returns directly.

No output schema declared.

No examples provided.

proposal.list ~254

List TC39 proposals from a parsed proposals index sourced via the loader chain (local cache → hosted Worker → bundled fallback); the index is fetched on first use and cached locally. Filter by `stage` ('0'|'1'|'2'|'2.7'|'3'|'finished'|'inactive'|'active'), `champion` (substring), or `contains` (name/slug substring). Returns lightweight rows; follow up with `proposal.get`. No auth, no subprocess.

NameTypeReqDescription
championstringCase-insensitive substring filter on the champion list.
containsstringCase-insensitive substring filter applied to the proposal name + slug.
limitintegerMax proposals returned from the filtered set.
specstringFilter to one spec's proposals: '262' (core language) or '402' (Intl). tc39/proposals tracks the two in parallel — omit to list both.
stagestringFilter to one stage: '0', '1', '2', '2.7', '3', 'finished', 'inactive', or 'active' (anything in the active README — stages 2/2.7/3).

No output schema declared.

No examples provided.

spec.about ~71

Return self-description of this MCP server: package name + version, per-snapshot pin metadata (sha, fetched_at, biblio_commit, clause_count) for every supported (spec, edition), plus test262 + proposals index headers when present. Lets callers verify freshness and reproducibility without loading the parses themselves.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

spec.crossrefs ~348

For a clause id, return its outgoing references (clauses it cites) and/or incoming references (clauses that cite it — the back-reference index the parse alone doesn't expose). Direction: 'in' | 'out' | 'both' (default). Outgoing also carries an `external` category: the clause's citations to external specs (Unicode, IETF, WHATWG) as resolvable URLs. Set `include_cross_spec: true` to also resolve outgoing references from ECMA-262 → ECMA-402 (or vice versa).

NameTypeReqDescription
directionstring'in' = clauses that reference this one (back-refs); 'out' = clauses this one references; 'both' = both.
editionstringEdition within the chosen spec. ECMA-262: es2016 … es2026, main. ECMA-402: es2016 … es2026, main. Aliases: latest, draft, next.
idstringyesSpec clause id, e.g. 'sec-tonumber' (262) or 'sec-intl.numberformat' (402).
include_cross_specbooleanIf true, outgoing references also include AOIDs that resolve to the *other* TC39 spec (262 ↔ 402). Useful for queries like 'every 262 op that calls into Intl'. Off by default because it requires load…
limitintegerMax hits returned in each direction (incoming and outgoing are limited independently).
specstringWhich TC39 spec to read: '262' (core language, default) or '402' (Internationalization API).

No output schema declared.

No examples provided.

spec.diff ~166

Clause-level diff across any two editions of one spec. Defaults: from='latest', to='main' (working draft). Reports status (identical / modified / added / removed / missing-from-both) plus a field-level diff: title, signature, step count, per-step reworded indices, notes, crossrefs. `spec` selects '262' or '402'.

NameTypeReqDescription
fromstringThe 'before' edition. Defaults to the latest stable release.
idstringyesSpec clause id.
specstringWhich TC39 spec to read: '262' (core language, default) or '402' (Internationalization API).
tostringThe 'after' edition. Defaults to the working draft (main).

No output schema declared.

No examples provided.

spec.global_search ~146

Run spec.search across both ECMA-262 and ECMA-402 in one call and interleave results by score. Each hit is tagged with the spec it came from. Useful when you don't know which spec defines the symbol (e.g. `Canonicalize` is 262, `CanonicalizeLocaleList` is 402).

NameTypeReqDescription
limitintegerTotal hits across both specs combined.
querystringyesSearch text. Matched against clause id, aoid, and title across both specs (and step text when search_steps is true).
search_stepsbooleanAlso match against algorithm step text. Slower + noisier; off by default.

No output schema declared.

No examples provided.

spec.grammar ~284

Query standalone `<emu-grammar>` productions from the spec's lexical / syntactic grammar (§11-15 in 262). Three modes: { nonterminal: 'X' } returns every production for X; { contains: 'Y' } returns productions whose RHS or non-terminal name contains Y; neither returns a list of all non-terminals with their production counts. Set include_sdo:true to also surface SDO-attached grammar headers.

NameTypeReqDescription
containsstringFilter to productions whose RHS lines or non-terminal name contain this substring (case-insensitive).
editionstringEdition within the chosen spec. ECMA-262: es2016 … es2026, main. ECMA-402: es2016 … es2026, main. Aliases: latest, draft, next.
include_sdobooleanIf true, also include productions captured as SDO algorithm headers. Off by default — most callers want the standalone lexical/syntactic grammar definitions.
limitintegerMax productions (or non-terminal groups in list mode) returned.
nonterminalstringFilter to productions defining this non-terminal (exact match). Example: 'BindingIdentifier'.
specstringWhich TC39 spec to read: '262' (core language, default) or '402' (Internationalization API).

No output schema declared.

No examples provided.

spec.history ~192

Recent commits in the vendored spec checkout that touched a clause's `id="..."` token. Uses git pickaxe (`-S`) so it catches clause creation, deletion, and edits to the opening tag reliably; interior-text-only edits won't show. Returns SHA, date, author, subject per commit. `spec` selects '262' or '402'.

NameTypeReqDescription
editionstringEdition within the chosen spec. ECMA-262: es2016 … es2026, main. ECMA-402: es2016 … es2026, main. Aliases: latest, draft, next.
idstringyesSpec clause id.
limitintegerMax commits returned from the vendored spec checkout's git log.
specstringWhich TC39 spec to read: '262' (core language, default) or '402' (Internationalization API).

No output schema declared.

No examples provided.

spec.sdo_index ~250

Index Syntax-Directed Operations by the grammar production they handle. SDOs are abstract operations (Evaluation, BoundNames, etc.) with one `<emu-alg>` per production. Default by='production' returns { [production]: [{ sdo, id, title }] }; by='sdo' returns { [sdo title]: [productions] }. `filter` substring-narrows keys; `spec` selects '262' or '402'.

NameTypeReqDescription
bystringIndex direction. 'production' (default) groups SDO definitions by the production they handle. 'sdo' groups productions by which SDO defines them.
editionstringEdition within the chosen spec. ECMA-262: es2016 … es2026, main. ECMA-402: es2016 … es2026, main. Aliases: latest, draft, next.
filterstring
limitintegerCap the number of groups returned. Each group can still hold many entries.
specstringWhich TC39 spec to read: '262' (core language, default) or '402' (Internationalization API).

No output schema declared.

No examples provided.

spec.search ~214

Search the parsed spec by clause id / aoid / title (and step text when search_steps is true). Returns lightweight hits ranked by match quality — the entry point when you don't know the exact clause id. `spec` selects '262' or '402'. Follow up with clause.get.

NameTypeReqDescription
editionstringEdition within the chosen spec. ECMA-262: es2016 … es2026, main. ECMA-402: es2016 … es2026, main. Aliases: latest, draft, next.
limitintegerMax ranked hits returned.
querystringyesSearch text. Matched against clause id, aoid, and title (and step text when search_steps is true).
search_stepsbooleanAlso match against algorithm step text. Slower + noisier; off by default.
specstringWhich TC39 spec to read: '262' (core language, default) or '402' (Internationalization API).

No output schema declared.

No examples provided.

spec.snapshots ~109

List every (spec, edition, sha, fetched_at) snapshot this server has parsed. Use to discover what historical SHAs you can query via `at: "<sha>"`, or to verify reproducibility across server versions. Optional `spec` / `edition` filters.

NameTypeReqDescription
editionstringFilter to one edition (concrete name like 'main' or 'es2025'). Omit for all.
specstringFilter to one spec. Omit for both.

No output schema declared.

No examples provided.

spec.symbol_resolve ~216

Resolve spec notation like `[[Prototype]]` (internal slot), `%Object.prototype%` (well-known intrinsic), or `~number~` (sigil enum) to the clauses that mention or define it. Hits ranked by occurrence count + section-prefix bumps for the canonical definition location. `spec` selects '262' or '402'.

NameTypeReqDescription
editionstringEdition within the chosen spec. ECMA-262: es2016 … es2026, main. ECMA-402: es2016 … es2026, main. Aliases: latest, draft, next.
limitintegerMax candidate clauses returned, ranked by relevance score.
notationstringyesSpec notation like `[[Prototype]]` (internal slot), `%Object.prototype%` (well-known intrinsic), or `~number~` (sigil enum).
specstringWhich TC39 spec to read: '262' (core language, default) or '402' (Internationalization API).

No output schema declared.

No examples provided.

spec.tables ~249

List or fetch parsed `<emu-table>` content. Pass `id` to get one table with full columns + rows; omit `id` to list tables (lightweight summaries) optionally filtered by caption/id substring. Authoritative source for the well-known intrinsics table (id='table-well-known-intrinsic-objects'), well-known symbols, completion record fields, etc. `spec` selects '262' or '402'.

NameTypeReqDescription
editionstringEdition within the chosen spec. ECMA-262: es2016 … es2026, main. ECMA-402: es2016 … es2026, main. Aliases: latest, draft, next.
filterstringCase-insensitive substring filter on the caption or id (list mode only).
idstringIf set, return exactly this table (full columns + rows). If omitted, list tables (lightweight rows).
limitintegerMax table summaries returned in list mode (ignored when 'id' is set).
specstringWhich TC39 spec to read: '262' (core language, default) or '402' (Internationalization API).

No output schema declared.

No examples provided.

spec.well_known_intrinsics ~209

Enumerate the well-known intrinsics (`%X%` notations) used in the spec, with each one's probable defining clause (chosen by a title-substring heuristic — see `matched_on` per hit). For the canonical 262 well-known intrinsics table, read `clause.get { id: 'sec-well-known-intrinsic-objects' }` directly.

NameTypeReqDescription
editionstringEdition within the chosen spec. ECMA-262: es2016 … es2026, main. ECMA-402: es2016 … es2026, main. Aliases: latest, draft, next.
filterstringCase-insensitive substring filter on the intrinsic name (bare, e.g. 'object.prototype').
limitintegerMax well-known intrinsics returned.
specstringWhich TC39 spec to read: '262' (core language, default) or '402' (Internationalization API).

No output schema declared.

No examples provided.

test262.get ~129

Fetch one test's source + parsed front-matter by path within the vendored tc39/test262 checkout. Pairs with test262.search — the paths it returns plug in here directly. Returns { source, front_matter, test262_sha, url } or { hint } if the path can't be resolved.

NameTypeReqDescription
pathstringyesPath within the test262 checkout, relative to the repo root. Example: 'test/built-ins/Number/prototype/toString/S15.7.4.2_A1_T01.js'. The values returned by test262.search go here directly.

No output schema declared.

No examples provided.

test262.search ~253

Search tc39/test262 for tests matching a free-text query and/or an esid (clause id, prefix-matched). test262 covers both ECMA-262 and ECMA-402. Served from a parsed test262 index sourced via the loader chain (local cache → hosted Worker → bundled fallback); the index is fetched on first use and cached locally. If no layer can produce the index the result is empty + a hint explaining the one-time local build. No auth, no subprocess.

NameTypeReqDescription
esidstringFilter to tests whose front-matter esid: starts with this prefix (case-insensitive). Prefix match catches the common case where test262 uses a more specific esid than the spec section id — e.g. `esid…
limitintegerMax ranked hits returned from the test262 index.
querystringFree-text query. Matched case-insensitively as whitespace-separated tokens (AND) across each test's description + path. Either `query` or `esid` (or both) must be supplied.

No output schema declared.

No examples provided.

Common questions

What is the tc39-mcp server?

tc39-mcp is listed in the public MCP registry as io.github.xyzzylabs/tc39-mcp. Independent MCP server for the TC39 specs (ECMA-262 + ECMA-402): clauses, search, diffs, history. This page covers its npm package (tc39-mcp).

Is the tc39-mcp server safe to use?

tc39-mcp scores 97 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the tc39-mcp server expose?

tc39-mcp exposes 19 tools: spec.about, spec.snapshots, clause.get, clause.list, clause.outline, and 14 more. Their descriptions and schemas cost roughly 3,852 tokens of context every time the server is loaded.

Is the tc39-mcp server still maintained?

tc39-mcp is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the tc39-mcp server under?

tc39-mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.