MCP.Market

Toolcairn MCP server

by neurynae·io.github.neurynae/toolcairn-mcp·v1.0.0·3 stars
No reviews yet

MCP server for tool discovery: find, compare, and verify tools across 35+ registries.

B78/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B78/100

full report

Adoption
New

3 stars

Reviews

Write one

Nobody has reviewed Toolcairn yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Toolcairn tools (15, 3 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • check_compatibility

    Check compatibility between two tools with version-aware matching. When both tools have declared dependency metadata (npm peerDependencies, PyPI requires_dist, etc.) the handler evaluates range constraints directly and returns a version_checks array plus runtime_requirements. Pass optional tool_a_version / tool_b_version to evaluate specific versions (e.g. "is next@14 compatible with react@17?").

  • check_issue

    LAST RESORT \u2014 check GitHub Issues for a known error after 4+ retries and docs review.

  • classify_prompt

    Classify a developer prompt to determine if ToolCairn tool search is needed. Returns a structured classification prompt for the agent to evaluate.

  • compare_tools

    Compare two tools head-to-head using health signals, graph relationships, and community data.

  • get_stack

    Build a complementary tool stack for a project use case. For best results, call refine_requirement first with classification "stack_building", evaluate its decomposition_prompt to get sub-needs, then pass each {sub_need_type, keyword_sentence} object as a sub_needs entry. This lets get_stack keyword-match per layer (e.g. "web-framework", "database", "auth") instead of one broad search. Falls back

  • read_project_config

    Read .toolcairn/config.json from disk and return the structured project snapshot: project metadata, confirmed tools, stale tools, pending evaluations, and last audit entry. Auto-migrates v1.0 configs to v1.1 on first read.

  • refine_requirement

    Decompose a vague user use-case into specific, searchable tool requirements.

  • report_outcome

    Report the outcome of using a tool recommended by ToolCairn (fire-and-forget).

  • search_tools

    Search for the best tool for a specific need using a natural language query. Initiates a guided discovery session with clarification questions when needed.

  • search_tools_respondwrite action

    Submit clarification answers for an in-progress tool search session and receive refined results.

  • suggest_graph_updatewrite action

    Suggest a new tool, relationship, use case, or health update to the ToolCairn graph.

  • toolcairn_auth

    Manage your ToolCairn authentication. Use "login" to authenticate via browser (unlocks higher rate limits), "status" to check current auth state, or "logout" to revert to anonymous mode.

  • toolcairn_init

    Bootstrap ToolCairn for the current project. Walks every workspace, parses manifests across 12 ecosystems, classifies tools against the ToolCairn graph, and writes .toolcairn/config.json + audit-log.jsonl atomically. Returns setup_steps for CLAUDE.md / .mcp.json / .gitignore (agent applies those).

  • update_project_configwrite action

    Apply a mutation to .toolcairn/config.json (add_tool / remove_tool / update_tool / add_evaluation). The server atomically rewrites config.json and appends a new line to audit-log.jsonl under a cross-process lock. Requires project_root.

  • verify_suggestion

    Validate agent-suggested tools against the ToolCairn graph.

Public scan report

scanner v0.1.9 · 2026-09-27 · same rubric, same numbers if you re-run it

1 medium
  • Code scan3 source files scanned20/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 88 days ago12/15
  • Maintainer identityregistry namespace matches repository owner7/10

Findings (1)

  • mediumeval / new Function usedexec.eval
    dist/index.js: …&&(l=this.opts.code.process(l,t));let g=new Function(`${qs.default.self}`,`${qs.default.scope…
Overall 78/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Toolcairn compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
78/100
higher than 57% of 48,255 servers
Tools
15
the typical server has 7
Tools that change things
20%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
3
more than 80% of 28,688 servers

What its tools let an agent do: 12 read · 3 change

Install Toolcairn in Claude Code, Cursor or VS Code

Runs npx -y @neurynae/toolcairn-mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add toolcairn-mcp -- npx -y @neurynae/toolcairn-mcp
Add to Cursor

What the publisher says

From the Toolcairn repository's README, as published. We do not edit it. Read it on GitHub

@neurynae/toolcairn-mcp

Source for @neurynae/toolcairn-mcp on npm. Install via the package, not from this repo.

ToolCairn is an MCP server that connects your AI coding agent to a continuously-updated graph of 30,000+ open-source tools across npm, PyPI, Cargo, Maven, Go, Composer, RubyGems, NuGet, Homebrew, and 35+ more registries. Search, compare, build stacks, and check version compatibility — all from inside Claude Code, Cursor, or any MCP-compatible client.

Concrete example. Your agent receives "I need a fast HTTP client for Node" → it calls search_tools → ToolCairn returns ranked candidates with maintenance and community signals, alternatives, and a warning if the top pick has questionable activity. No more guessing from blog posts and stale tutorials.

The MCP server runs locally as a stdio child of your agent. Tool calls travel over MCP to this package, which proxies the network-bound ones to the ToolCairn Cloud API and handles the local-only ones (project scan, config, audit log) on disk.

Why ToolCairn?

Plain web search and LLM training data are insufficient for tool selection — knowledge cutoffs miss latest releases, search engines surface tutorials over authoritative ranking, and version-compatibility answers live in scattered issue threads.

ToolCairn fixes this with three things you can't get from raw registry APIs:

  • Graph-aware ranking — recommendations consider how tools relate to each other (dependencies, integrations, replacements, conflicts), not just popularity.
  • Version-aware compatibility — declared peer ranges and cross-registry version metadata give you "Next.js 14 needs React 18.x" instead of "they're both popular, probably fine?"
  • A continuous learning loop — every accepted, rejected, or replaced recommendation feeds back into the graph, so quality improves with use.

Quick Start

Step 1. Create a free account at toolcairn.neurynae.com/signup.

Step 2. Add to your MCP config and restart your agent:

{
  "mcpServers": {
    "toolcairn": {
      "command": "npx",
      "args": ["@neurynae/toolcairn-mcp"]
    }
  }
}

Step 3. A browser window opens for sign-in on first start. Once you confirm, all tools are available immediately — no further setup.

Requires Node.js 22+.

Setup — Claude Code

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Toolcairn: common questions

Is Toolcairn MCP server safe?
Mostly: it is graded B (78/100). Read the Toolcairn safety report
How do I install Toolcairn?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Toolcairn need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Toolcairn maintained?
The last commit was 125 days ago (2026-07-02). The latest release is v1.0.0.
How does Toolcairn compare with other MCP servers?
safety score 78/100 (higher than 57% of 48,255 servers); tools 15 (the typical server has 7); tools that change things 20% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.