{"name":"io.github.davet47/hashloom","slug":"davet47-hashloom","title":"Hashloom","description":"Content-addressed contracts and a verification cache that cut agent context by skipping proven code.","url":"https://mcp.market/server/davet47-hashloom","rating":null,"grade":"A","score":92,"certified":false,"status":"active","category":"ai","tags":["ai"],"presence":{"score":20,"stars":2,"forks":0,"downloads_week":null,"last_push_at":"2026-09-01T21:08:07.000Z","license":"Apache-2.0"},"uptime":null,"claimed":false,"transport":"pypi","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/davet47/hashloom","website":null,"version":"0.6.0","remotes":[],"packages":[{"registryType":"pypi","registryBaseUrl":"https://pypi.org","identifier":"hashloom","version":"0.6.0","runtimeHint":"uvx","transport":{"type":"stdio"},"packageArguments":[{"value":"serve","type":"positional"}]}],"tools":[{"name":"get_contract","description":"Fetch one contract as a compact context packet: the contract body, its content hash, one-line signatures of its deps, and the list of callers.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_dependents","description":"Blast-radius query: contracts that depend on `name` (direct, or the full transitive closure), with their current hashes. Entries not yet human-reviewed carry `inferred: true` (advisory — never an error).","write_action":false,"price_micros":0,"input_schema":null},{"name":"put_contract","description":"Create or update a contract (validates shape, rejects unknown deps). Writes contracts/<name>.yaml and returns the new hash plus every dependent whose cached verification this change invalidates; inferred (machine-derived, unreviewed) contracts among them are flagged.","write_action":true,"price_micros":0,"input_schema":null},{"name":"status","description":"Project health: dirty contracts, stale verifications, cache hit-rate, and cumulative token counters for every tool response.","write_action":false,"price_micros":0,"input_schema":null},{"name":"verify","description":"Verify contracts against their pytest node IDs. Returns per-unit cached-pass / pass / fail with a ≤40-token failure summary. Runs pytest only for units whose (contract, impl, deps) hash key is not already green in the cache. `radius=true` widens each name to its full blast radius (itself plus every transitive dependent); the top-level `ok` is the hard pass/fail to gate on. An `inferred` list names","write_action":false,"price_micros":0,"input_schema":null}],"scan":{"score":92,"grade":"A","scanned_at":"2026-09-20T20:10:28.817Z","report":{"scannerVersion":"0.1.9","scannedAt":"2026-09-20T20:10:28.712Z","components":{"code":{"score":25,"max":25,"notes":["47 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":12,"max":15,"notes":["local package, no credentials required"]},"maintenance":{"score":15,"max":15,"notes":["last push 19 days ago"]},"identity":{"score":8,"max":10,"notes":["registry namespace matches repository owner","GitHub account older than a year"]}},"findings":[],"inputs":{"packages":[{"registryType":"pypi","identifier":"hashloom","version":"0.6.0","found":true,"license":"Apache-2.0","dependencyCount":4,"publishedAt":"2026-09-01T21:08:41.278962Z","repositoryUrl":"https://github.com/davet47/hashloom"}],"repo":{"found":true,"owner":"davet47","repo":"hashloom","archived":false,"pushedAt":"2026-09-01T21:08:07Z","stars":2,"forks":0,"openIssues":2,"ownerType":"User","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/8455555?v=4","ownerCreatedAt":"2014-08-15T06:35:20Z","license":"Apache-2.0"},"icon":{"url":null,"source":"none"},"presence":{"stars":2,"forks":0,"downloadsWeek":null,"license":"Apache-2.0","lastPushAt":"2026-09-01T21:08:07.000Z","score":20}}}},"grade_history":[],"reviews":[]}