Whatif MCP server

• sim_bindFree

  Record an intended connection between two stored models' declared ports — fromModel's fromPort feeding toModel's toPort — as a new content-addressed Binding, alongside sim_link's Relation graph rather than inside either model (ROADMAP.md Phase 9). This does not run anything, does not validate that either port exists or has the right direction, and does not touch either model: it is a proposal to connect, discoverable afterward via sim_edges on either model id (a from/to Relation is recorded automatically) or sim_get_binding on the id this returns. Storing the same from/to/transform twice returns the same id rather than a duplicate.

• sim_calibrateFree

  Calibrate a model against YOUR event log — the reading that meets reality. Upload CSV (case_id, activity, timestamp; the shape sim_dataset emits, activities = transition ids), and rates are learned from the observed timings: sources from inter-arrival times, services from the gap before their completions, all per hour. Instant-pickup transitions (declared rate >= 100) keep their declared rate — their observed gap is the queue wait, and learning it would destroy the calibration discipline. A transition declaring a delay (a fixed-duration timer, not a rate) is fit differently and returned in learnedDelays instead of learnedRates: the MEDIAN observed gap, in hours, written onto the transition itself since a delay has no solver-map slot — a gapCV in rateEvidence far from 0 means the log looks exponential, not fixed, and the calibration says so in a caveat rather than trusting the median anyway. Returns a NEW content-addressed model (learned rates in the solver map, learned delays on the transitions, declared values otherwise untouched, lineage recorded) plus a conformance report: fittingPercent (full replays) is the headline, worst traces named with the activities that could not fire. tokenFitness is a second, harsher reading of the same replay (raw tokens present vs. required at every step, not full-trace success) that under-reads any net with a resource pool — read fittingPercent, not tokenFitness, unless you specifically want the raw-token number. Every learned rate or delay has an entry in rateEvidence: n (gaps it rests on), gapCV (sample std dev over mean of those gaps; ~1 for exponential timings, near 0 for a true timer) and insufficient when n < 2 — n=0 yields nothing, n=1 a value with no spread. Learned values on a structure that cannot replay the traces would be numerology — read fittingPercent before trusting them.

• sim_canonicalFree

  Tell whether two differently-labelled models are actually the same net: an isomorphism-invariant id computed from the model's EXACT automorphism orbits (orbits.go), not the colour-refinement (WL) kind sim_classify falls back to when the exact search can't decide. Two models differing only by renaming places or transitions share the same canonicalId even though their content-addressed ids (from sim_get_model) differ — this is the id to compare, not the model id, when checking whether a catalog already holds this net. Also returns the non-trivial automorphism orbits and generator count the id was computed from: zero generators means the net is rigid (no symmetry at all), which is itself a fact about the net's structure. Refuses (as a tool error) when the exact search exceeds its 200,000-leaf budget — too large or too symmetric for this implementation, per orbits.go — rather than silently falling back to a weaker answer; sim_classify's own fallback covers that case for classification specifically.

• sim_classifyFree

  Discover the parameter classes of a stored model and return them as JSON-LD with empty annotation slots for you to fill in (label, comment, unit, domain, substitutes — nothing else; membership/kind/evidence are derived and settled by measurement, not yours to edit). With verify=true a shared colour is checked by exact automorphism proof where the search can decide it (settling interchangeability outright, the stronger claim), falling back to the sampled permutation experiment only where it can't — the exact search refuses past a 200,000-leaf budget on nets too large or too symmetric for it. Read the sim://docs/classification resource once for the colour-refinement caveat and the annotation contract in full.

• sim_code_to_flowFree

  Derive a Petri-net model from source code with the configured LLM (control flow, state machine, resources or concurrency focus), validate it, and store it as a NEW model you own. The same generator the /api/code-to-flow endpoint uses; refused when this deployment has no LLM provider configured. Returns the new id when the answer validates, otherwise the raw model JSON and the validation errors so you can fix and sim_create_model it by hand.

• sim_comparewrite actionFree

  Run several scenarios against one model on one shared seed and return them side by side — the seed sharing is server-enforced, so differences are the scenarios, not the dice. Returns a summary by default (finals, throughput/mean/P95 metrics, contention, depletion — no time series); pass full=true for the complete trajectories, which run to hundreds of KB. A scenario carrying "summary": true stays summarized even under full=true, so one comparison can chart some scenarios and only read the rest. Unset hours default to 8, samples to 60 (the trajectory grid, which only matters under full=true — metrics are time-weighted and do not depend on it) and realizations to 16 per scenario. Each scenario can set its own "engine" (see sim_scenario / docs/engine-selection.md); comparing an "ode" run against an "ssa" one is legitimate but the shared seed only removes dice from scenarios using the same engine.

• sim_componentsFree

  List the component registry: pre-baked subnet templates (arrivals, service, hazard, inventory, decision, mailbox, datastore) with the calibration discipline baked into the arcs and rates. Each entry names its ports (places you can attach onto existing places), its params with recommended defaults, and the discipline notes explaining WHY the template is shaped the way it is. Compose them with sim_compose.

• sim_composeFree

  Instantiate a registry component into a model and store the result as a NEW content-addressed model you own (lineage recorded when composing onto an existing id). Omit id to start a model from the component alone; pass attach to fuse a component port onto one of the model's existing places (e.g. attach {"queue": "tickets_queue"} wires a hazard onto the service's queue). Prefix namespaces the created elements (defaults to the component name). Three calls build a working helpdesk: arrivals, then service attached to its queue, then hazard attached to the same queue — the result passes diagnose because the discipline is in the template.

• sim_conformanceFree

  Check how well a stored model matches an observed event log WITHOUT rewriting its rates — the read sim_calibrate bundles into calibration, offered on its own and in full: fitness (can the model replay each case?), precision (does it allow behaviour never observed?), generalization and simplicity, with per-trace diagnostics naming the activities that could not fire. Log is CSV (case_id, activity, timestamp; the shape sim_dataset emits, activities = transition ids). The log is replayed one case at a time from the model's initial marking, so the model should be the per-case workflow; a resource net whose places are shared across cases will not fit. Caveats name what the analysable net encoded lossily.

• sim_create_collectionwrite actionFree

  Mint a named Collection and return its content id. A collection carries no member list of its own — a mutable list would change the collection's own id every time something joined it, the same reason Lineage lives beside a model rather than inside it. Add members with sim_link(collectionID, "hasMember", memberID) and read them back with sim_neighbors(collectionID, "hasMember") or sim_edges(collectionID). Content-addressed: creating a collection with a name already used returns the existing id, not a new sibling.

• sim_create_modelwrite actionFree

  Store a Petri-net model (JSON with name/places/transitions/arcs) and return its content id. Models are immutable; a changed model is a new id. Structural validation rejects malformed nets with every reason at once. The model is yours: it appears only in your own listing until you dedicate it to the commons with sim_license_model, and you can remove it with sim_delete_model. Anyone you give the id to can use it either way.

• sim_crosscheckwrite actionFree

  Run every applicable READING of a model against the others and report agreement or divergence with the reason: discrete SSA means vs the continuous mean-field solve, algebraically derived conservation laws vs simulated means, and (for game-schema models) the closed-form incidence ranking vs rollouts vs exact search. Divergence is a finding, not an error — small-count mean-field gaps and the prior's threat-blindness are named as such. Trust is agreement between independent readings of one structure. Gated nets (read arc, inhibitor, reached capacity, guard) have no ODE reading to compare against at all — see docs/engine-selection.md for the four-rule decision behind which readings even apply.

• sim_datasetFree

  Generate a synthetic event log from a stored model (seeded SSA playout; case-per-arrival). Returns CSV. Deterministic: same id, same seed, same bytes.

• sim_delete_modelwrite actionFree

  Delete a model you created. Refused for the curated catalog, for models you do not own, and for models already dedicated to the commons (a dedication is irrevocable).

• sim_diagnoseFree

  Test a stored model without writing a fitness test for it. Reports generic gates (mass balance, dormant sources, whether staffing has a knee, whether any knob binds), every derived control ranked by MEASURED influence on the outcome (pool/source/patience/parameter knobs, rate-knob influence is signed), the parameter classes discovered among them, and four structural readings needing no run behind them (T-invariants, siphons/traps with deadlock witnesses, CTMC lumpability, constrained lumping). Pure read. Loss/success inference and objective framing can be corrected by tagging places or declaring simulation.objective — read the sim://docs/classification resource once for how to read influence and noise, the four structural readings, and the two corrections.

• sim_diffFree

  Structural difference between two stored models: places, transitions and arcs added or removed, and surviving elements whose numbers changed (initial, capacity, rate, stages, arc weight or kind). The readout for what a builder turn, a sim_extend or a sim_refine actually changed between two ids in a lineage.

• sim_distillFree

  Distill exact search into the play scorer: fit rate multipliers for named transition groups so play's rankings agree with exact minimax, on positions sampled by random self-play and labeled by search. This is TACTICAL calibration — the counterpart of sim_calibrate, which learns rates from an event log. The division of labor is deliberate (petri-pilot experiments/ode-minimax): structure carries the tactic, and no fitting of an unmodified net's rates can express what its final state cannot separate — declare the structural prior as transitions in the model (e.g. forced-reply copies of the plays, catalyzed by the opponent's pattern) and distill the magnitudes it introduced. Zero agreement improvement is a finding about the structure, not a failed fit. Read agreementBefore/agreementAfter, not the loss: the hinge loss can overstate failure while every argmax is right.

• sim_edgesFree

  List every relation touching an entity, as either subject or object — the two-directional view datum_edges gives. A filtered scan over every stored relation rather than a maintained index: this is a simulation sandbox's model graph, not a large corpus, so scanning on each call is the honest tradeoff over a second data structure that could drift from the source of truth.

• sim_evaluateFree

  Score a player's legal next moves by NEXT-MOVE ELIMINATION (the tic-tac-toe blog technique): compute the expected objective from the given marking with all moves available, then once per candidate with that move's rate zeroed — the move whose elimination loses the most is the best move. Needs the game schema (simulation.objective + simulation.players). Ungated nets use the continuous ODE relaxation; gated nets use exact seeded SSA rollouts, and the response says which — the same rule sim_scenario's "engine" choice follows (docs/engine-selection.md).

• sim_extendFree

  Apply structural edits to a stored model and store the result as a NEW model you own, with lineage back to the original — the same vocabulary the guided builder uses behind its interview, now callable directly. Operations (JSON array, each with "op"): add_place {id, initial}, add_transition {id, guard, event}, add_arc {from, to, weight, kinetic, type}, remove_place, remove_transition, remove_arc {from, to}, set_rate {id, rate}, set_initial {id, initial}, set_capacity {id, capacity}. The edited model is validated before it is stored; a set of operations that leaves the net malformed is refused with every reason, and nothing is written. Returns the new id, the operations applied, and the structural diff.

• sim_get_bindingFree

  Fetch a stored Binding (see sim_bind) by id: which model/port feeds which, and any recorded transform.

• sim_get_modelFree

  Fetch a stored model's full Petri-net JSON by id.

• sim_invariantsFree

  Derive a model's full algebraic invariant structure: conservation laws (Farkas P-invariants — weighted place sums every run preserves, the arithmetic a trust panel should show), firing cycles (T-invariants, named per-cycle with a readable detail sentence, each tagged StructuralProof), and the siphon/trap report (every minimal siphon and trap found from the arc structure, plus deadlock witnesses — minimal siphons holding no tokens at this model's own initial marking, which proves every transition needing one permanently disabled). This is the same computation sim_diagnose's structural fields read from, not a lesser copy of it. Pure structure, no simulation; every claim holds for every trajectory from this initial marking.

• sim_license_modelFree

  Dedicate a model you created to the commons under CC0-1.0, CC-BY-4.0, CC-BY-SA-4.0. It then appears in every user's listing with the license shown, and the dedication is IRREVOCABLE — it cannot be changed or deleted afterwards, which is what makes it safe for others to build on. CC0-1.0 is the cleanest choice for a model: attribution terms are hard to honor for a net someone folds into a larger one.

• sim_linkFree

  Record a typed edge between any two stored entities — models, prompts, artifacts, maps, collections, or anything else addressed by a content id — with no fixed predicate vocabulary: the caller's choice, the same as datum_link ("hasMember", "cites", "supersedes", whatever the relationship actually is). Distinct from the Lineage a model/prompt/artifact already carries, which is specifically derivation (parent -> prompt -> child); a Relation is any OTHER assertion about how two entities relate, including sim_create_collection's own membership edges. Storing the same subject/predicate/object/timestamp/attribution twice returns the same id rather than a duplicate.

• sim_list_bindingsFree

  List the content id of every stored Binding.

• sim_list_modelsFree

  List the models visible to you: the curated catalog, models dedicated to the commons (their entry carries the license), and your own (marked mine). Other users' undedicated models are not listed, but any model id works with every sim_* tool — an id someone shares with you is the model.

• sim_map_getFree

  Fetch a stored Map's key->value data by id.

• sim_map_listFree

  List the content id of every stored Map.

• sim_map_putwrite actionFree

  Store a key->value lookup table as its own content-addressed entity — a generated parameter sweep, a rate table, a component registry, anything shaped as key->value rather than free text (an artifact) or a Petri net (a model). Returns its content id; the same data, even with keys inserted in a different order, returns the same id.

• sim_my_sheetsFree

  List the sheets this user has published, with their URLs.

• sim_neighborsFree

  One-hop traversal from an entity: every object reachable via a relation where it is the subject, optionally filtered to a single predicate (omit for all of them). Pass a collection's id with predicate hasMember to list its members.

• sim_optimizeFree

  Multi-objective optimisation over transition rates for a stored model: Monte Carlo samples the rate ranges, runs each combination to the horizon with the continuous engine, and returns every sample with a Pareto flag — the non-dominated set is the trade-off frontier ('which staffing is non-dominated on served vs walked out'). Continuous reading: a model with a schedule or a gate is refused with the reason (use sim_compare with explicit scenarios for those).

• sim_param_heatmapFree

  Two-rate grid for a stored model: vary two transition rates over ranges, run each combination to the horizon with the continuous engine, and return the observable's final value as a grid — 'which regime of arrivals × restock keeps the queue empty'. Continuous reading: a model with a schedule or a gate is refused with the reason.

• sim_promptFree

  Ask an LLM to derive something from a stored entity: a variant model, a report, a piece of generated code — whatever the prompt asks for. The parent's JSON rides along as context, the same way the guided builder gives its interviewer the draft. The parent is looked up as a model first, then a prompt, then an artifact, then a map — whichever resolves — and the context block is labelled by what kind it found ("## Parent model", "## Parent prompt", ...), so the LLM is never told a report is a Petri net. The prompt is stored first and content-addressed like a model, so it has an id of its own before the LLM ever answers; both the prompt and whatever came back are placed in lineage under the parent (sim_prompt as the activity), so Ancestry walks parent -> prompt -> result. A Relation{prompt, "produced", result} is recorded alongside — sim_reroll's forward index, and queryable directly via sim_edges/sim_neighbors. If the response parses and validates as a Petri-net model it is stored as a NEW model you own; otherwise the raw text is stored as an artifact. Refused if this deployment has no LLM provider configured.

• sim_propose_typesFree

  Propose candidate @type values for one or more stored models, e.g. "QueueingSystem" or "ResourcePool", from each model's own Diagnosis — never from a fresh simulation this tool runs itself for the sole purpose of classifying, only from an existing measurement it reuses. Every rule is a hand-written assumption about what a shape of knobs/loss/siphons/classes tends to mean, not a structural proof or a measurement, so results are ASSUMPTION-grade until a human reviews one and applies it — apply with sim_link(id, "@type", "<Type>"), there is no separate apply tool. Pure read; nothing here is written to any model. Defaults to scanning the visible catalog (up to limit) when ids is omitted. Costs one Diagnose run per model, so limit and realizations are both capped.

• sim_publishwrite actionFree

  Publish a stored model into the signed-in user's Google Sheets: the model workbook (live formulas when honest, a refusal tab when not), a server-run scenario as data tabs, and trajectory + contention charts. Returns the sheet URL. Counts against the daily quota.

• sim_publish_appwrite actionFree

  Publish the generated application for a model you own — the single-file HTML a generator produced from the model's `view` prompt. Served at /app/<id> in a sandboxed opaque origin (no cookies, no session; only the CORS-open public API is reachable). START FROM THE RUNTIME, not from scratch: /lib/app-template.html is a working console that imports /lib/sim-console.js and composes <sim-controls>, <sim-disruptions>, <sim-net>, <sim-timeline>, <sim-trajectory> and <sim-results> — the same components the generic console at /whatif/ runs. Composing them is how an app inherits role derivation, the fungible-set collapse, the influence ranking that never filters, the contention ledger and the verbatim caveats, none of which the checks below can verify you reimplemented correctly. Root-relative /lib/ imports are allowed; off-origin ones are refused. Checks refuse an app that is empty, oversized, never references its model id, or loads external scripts/styles; behavioral correctness (does the app actually do what the view says) is on the generator and any browser gate you run.

• sim_publish_comparewrite actionFree

  Publish a multi-scenario comparison into the signed-in user's Google Sheets — sim_compare's export, the counterpart of sim_publish for a single scenario. Runs every scenario on one shared seed (the same server-enforced sharing sim_compare uses, so differences are the scenarios and not the dice) and writes a comparison table plus a trajectory chart, rather than one scenario's own data tabs. Returns the sheet URL. Counts against the same daily publish quota as sim_publish.

• sim_receiptwrite actionFree

  Run a seeded scenario and get back the result PLUS a signed run receipt: an Ed25519 certificate over (model id, scenario, result hash, service revision). Anyone can check it two ways — verify the signature offline against the embedded public key (proves this service reported this result), and POST it to /api/receipts/verify (no auth) to replay the run and confirm the result hash reproduces (proves the run is reproducible, not invented). The current signing key is at GET /api/receipts/key. Reproducibility is the bottom rung of the trust ladder receipts build: play the model, check the anchors, re-run the seed, verify the certificate.

• sim_refineFree

  Refine a model's parameter classes by editing what the model SAYS (tags on a place or transition, or assertedClasses), then re-derive. Returns a NEW model id (ids are content addresses, so the original stays reachable) plus a before/after class diff. tags can only split classes; assertedClasses declares a merge and gets re-verified and costed, never trusted blind. Read the sim://docs/classification resource once for why the two levers are not symmetric.

• sim_rerollFree

  Re-run a stored sim_prompt against the SAME parent it originally ran against — a sibling attempt, never a chain: it never derives from the previous attempt's output, only from the original parent, so rerolling ten times leaves ten independent siblings in lineage rather than a chain of ten. Reuses the original prompt's text and system unless you override them here. The original prompt and its result are left untouched; this stores a new prompt and a new result (model or artifact, same rule as sim_prompt) under Activity sim_reroll. When called with neither override and the deployment's LLM provider and model are unchanged since the original ran, the response carries a reproducibility field checked against every prior result this exact prompt has ever produced (via the same forward "produced" relation sim_edges/sim_neighbors can query directly): "verified" if this result content-matches one of them, "diverged" if it doesn't, "not verified" if there's no prior result on record yet.

• sim_run_pipelinewrite actionFree

  Run a set of stored Bindings (see sim_bind) as a composed pipeline: each bound model runs through its own ordinary scenario, in topological order, with an output port's own trajectory resampled into the target's input-transition schedule. One seed and horizon shared across every model in the pipeline, same discipline sim_compare enforces within one model. Refuses a cyclic binding set, and refuses any binding whose named port does not exist with the right direction (output must be a place, input must be a transition) — this is where that check finally happens, not at sim_bind time. The result carries an explicit assumption for the seam itself: no model's own fitness gates cover whether the JOIN between them is sound. Costs one Diagnose-shaped run per model in the pipeline.

• sim_scenariowrite actionFree

  Run a seeded what-if scenario against a stored model: marking overrides, rate overrides, piecewise rate schedules, and params assignments to the model's declared structural parameters (arc weights, capacities — batch sizes and shelf sizes). Pure read — asking cannot change the model. Returns trajectory, final marking, metrics, contention, caveats and assumptions. "samples" (default 60) is the trajectory's resolution: the number of evenly spaced points from 0 to hours inclusive at which times and every place's series (mean and std_dev per point) are reported — it sizes the answer, not the run, since metrics (throughput, mean, p95, utilization, inFlight) are time-weighted over every firing and do not change with the grid. "summary": true omits the times and series arrays entirely (the keys are absent, not null) and returns just final, metrics, depleted, contended, caveats and assumptions — the verdict without the chart data, and the right form when nothing will be plotted. Transitions declaring stages (phase-type durations) run with the declared lower spread — the engine expands them structurally and reports in the model's own vocabulary. A model-declared schedule (the day shape on a transition) is honored by every run; the scenario's own schedule or rate override still wins for that transition. "engine" picks the reading: "ssa" (default, discrete Gillespie — the right choice whenever counts are small enough that variance is the answer, or a schedule is in play) or "ode" (continuous mass-action; refuses a schedule, and refuses outright rather than silently misread a model carrying a read arc, inhibitor, reached capacity, guard or non-kinetic arc — Forecast's caveats name which). See docs/engine-selection.md for the full decision rule, including why an arc weight above 1 gets a genuinely different rate law from each engine, and sim_crosscheck to run both readings side by side.

• sim_supersede_modelFree

  Mark an old version of your model as replaced by a newer one. The old id keeps working and its commons dedication (if any) stands — only the listing moves on to the successor. Both models must be yours.

• sim_verifyFree

  Verify declared properties of a stored model: deadlock-free, bounded, mutual-exclusion, invariant expressions, reachable/unreachable targets. Verdicts are proved/refuted/unknown — unknown is never a pass — and each carries a method: structural means it holds for ANY initial marking (linear algebra on the incidence matrix, the strongest claim available), exhaustive means this marking's full state space, partial means truncated (only refutations sound). Caveats name anything the analysis net could not express.

• –Code scanremote-only server, no package to scann/a
• Live reliabilityremote reachable in 501ms20/20
• Tool poisoning46 tool descriptions checked15/15
• Auth qualityopen endpoint exposes 12 write-action tools with no auth3/15
• Maintenanceno repository listed3/15
• Maintainer identityverified namespace with website, no repo4/10

Whatif: common questions

Is Whatif MCP server safe?

With care: it is graded C, so read the findings first (60/100). Read the Whatif safety report

How do I install Whatif?

It runs remotely at sim.pflow.xyz. Add it to Claude Code, Claude Desktop or Cursor with the snippets above, or call it through the mcp.market gateway without installing anything.

Does Whatif need an API key?

Not as far as the registry entry and our scan can tell: no credentials are declared or required.

Is Whatif maintained?

The latest release is v1.0.0.

Is Whatif up?

100% of our last 19 checks got an answer. We check remote servers about four times a day.

What can I use instead of Whatif?

Servers from other publishers that do the same job: treg.to MCP server.