candor MCP server
io.github.tombaldwin/candor·v0.41.0Per-function effect analysis for agents: blast radius, what reaches the network, gate verdicts.
not scanned yet
0 stars1.2k downloads/wk
Reviews
Write oneNobody has reviewed candor yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
candor tools
No tool declarations could be read from the package source. They show once the server is installed.
How candor compares
Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.
- Safety score
- 85/100
- higher than 70% of 48,255 servers
- Downloads a week
- 1,181
- more than 95% of 12,191 servers with a package
Release history: 15 versions in the registry since 2026-09-16, latest 2026-11-04, typically one every 2 days.
Install candor in Claude Code, Cursor or VS Code
Runs npx -y candor-ts on your machine. Read the scan report first; the gateway never runs local packages.
claude mcp add candor -- npx -y candor-ts
What the publisher says
From the candor repository's README, as published. We do not edit it. Read it on GitHub
candor-ts
candor for TypeScript: per-function side effects, transitively, with a deterministic policy gate. candor-ts resolves every call through the TypeScript compiler API and reports, for each function in your project, which effects it can reach — Net, Fs, Db, Exec, Env, Clock, … — including effects inherited through any chain of calls across files, with a disclosed Unknown wherever resolution fails (a callback value, an any-typed callee — never silently pure). A candor-spec implementation, sibling of the Rust and JVM engines.
Site: candor.poly.io — the measured case in five minutes.
npm install # typescript + @types/node
node scan.mjs <project-dir> # tsconfig.json honored; tests excluded; writes
# <dir>/.candor/report.json + .callgraph.json
node scan.mjs . --policy .candor/policy # the §6.2 gate: exit 1 on violation, 2 if unreadable
node scan.mjs . --gate-json gate.json # + the structured verdict {spec, ok, violations} (§3.3)
CANDOR_BASELINE=saved.json node scan.mjs . # AS-EFF-005 guard: exit 1 if an existing fn GAINED an
# effect vs the saved report; 2 if it can't evaluate
node scan.mjs --version # installed build + spec contract (offline), + upgrade line
node query.mjs show .candor/report db.save 1 # a function's effects (match ladder)
node query.mjs where .candor/report Net 1 # direct sources vs inheritors
node query.mjs callers .candor/report db.save 1 # the blast radius (transitive callers)
node query.mjs map .candor/report 1 # module → effects overview
node query.mjs containment .candor/report # §6.1 boundary-effect dispersion (+ baseline = ratchet)
node query.mjs blindspA checked-in .candor/config (spec §3.4) replaces the env wiring — policy arch.policy / baseline / deps one per line, discovered by walking up from the scan target; relative values resolve against the config's repo, so CI is "point at the repo". A configured-but-unusable config/policy/baseline fails loud (exit 2), never silently gateless.
Shortened. The full README is on GitHub.
Nothing above is checked by us. What we check is on the safety report.
candor: common questions
- Is candor MCP server safe?
- Yes, by our scan: it is graded A (85/100). Read the candor safety report
- How do I install candor?
- It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
- Does candor need an API key?
- No secret keys are declared. It reads 1 setting from the environment.
- Is candor maintained?
- The last commit was 35 days ago (2026-09-30). The latest release is v0.41.0.
- How does candor compare with other MCP servers?
- safety score 85/100 (higher than 70% of 48,255 servers); downloads a week 1,181 (more than 95% of 12,191 servers with a package). Full comparison.