Soma MCP server
RMCP runtime for provider-backed agents with CLI, REST, HTTP MCP, plugins, and scaffold support.
1 stars52 downloads/wk
Reviews
Write oneNobody has reviewed Soma yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
Soma tools
No tool declarations could be read from the package source. They show once the server is installed.
Public scan report
scanner v0.1.9 · 2026-09-24 · same rubric, same numbers if you re-run it
- Code scan3 source files scanned15/25
- –Live reliabilityno gateway calls yet and no remote to proben/a
- –Tool poisoningtools not inspected (local package is not executed); not countedn/a
- Auth qualitystatic API keys via environment variables6/15
- Maintenancelast push 3 days ago15/15
- Maintainer identitynamespace and repository owner differ; website matches verified namespace6/10
Findings (2)
- mediumnpm install lifecycle script present
install.script - mediumnpm install lifecycle script present
install.scriptpackage.json: …cripts/check-package.js --release", "postinstall": "node scripts/install.js", "test": …
How Soma compares
Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.
- Safety score
- 65/100
- higher than 20% of 48,255 servers
- GitHub stars
- 1
- more than 65% of 28,688 servers
- Downloads a week
- 52
- more than 43% of 12,191 servers with a package
Install Soma in Claude Code, Cursor or VS Code
claude mcp add soma -- docker run -i --rm ghcr.io/dinglebear-ai/soma:0.10.0
What the publisher says
From the Soma repository's README, as published. We do not edit it. Read it on GitHub
Soma
RMCP runtime for provider-backed agents with CLI, REST, HTTP MCP, plugins, and scaffold support.
API docs — rustdoc for every workspace crate plus the Redoc-rendered OpenAPI reference, deployed to GitHub Pages from main.
Soma is a batteries-included server runtime and shipping binary for bringing new agent capabilities online with as little custom Rust as possible. It locks in the production patterns that every server in the family keeps rediscovering: one compact MCP tool, stdio and Streamable HTTP transports, CLI parity, direct REST routes, auth/OAuth, observability, plugin packaging, web fallback, Docker/runtime samples, generated contracts, and release automation.
The repository can still scaffold a renamed project, but Soma is now a shipped runtime first. The default product path is to run soma in an explicit mode, drop provider files into providers/ (or point SOMAPROVIDERDIR elsewhere), and let the provider registry project those capabilities across MCP, CLI, REST, OpenAPI, Palette summaries, generated docs, and plugin metadata. Provider manifests also carry MCP-native prompt, resource, task, and elicitation metadata for the registry contract. Scaffolding is the path for creating a new distributable repo with the same locked-in runtime.
30-second path: install the soma binary -> soma status -> npx -y @dinglebear/soma mcp from an MCP client -> call the soma MCP tool through tools/call with {"action":"status"}.
Status: production RMCP runtime. Write-capable provider actions are allowed only when the provider declares them and destructive actions are gated.
Not for: an unauthenticated public gateway, a replacement for upstream service authorization, arbitrary untrusted code execution, or a multi-tenant security boundary by itself.
Contents
- Naming
- Capabilities And Boundaries
- Install
- Quickstart
- Client Configuration
- Runtime Surfaces
- MCP Tool Reference
- CLI Reference
- Configuration
- Authentication
- Safety And Trust Model
- Architecture
Naming
Soma is the runtime product first and the template/export source second. Generated projects replace these names during scaffold post-processing, but the shipped soma command is the source of truth for product behavior.
Capabilities And Boundaries
Shortened. The full README is on GitHub.
Nothing above is checked by us. What we check is on the safety report.
Soma: common questions
- Is Soma MCP server safe?
- With care: it is graded C, so read the findings first (65/100). Read the Soma safety report
- How do I install Soma?
- It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
- Does Soma need an API key?
- Yes. The registry entry asks for
SOMA_API_KEY. - Is Soma maintained?
- The last commit was 44 days ago (2026-09-21). The latest release is v0.10.0.
- How does Soma compare with other MCP servers?
- safety score 65/100 (higher than 20% of 48,255 servers); github stars 1 (more than 65% of 28,688 servers); downloads a week 52 (more than 43% of 12,191 servers with a package). Full comparison.