MCP.Market

Weavatrix Online MCP server

by Weavatrix·io.github.Weavatrix/weavatrix-online·v0.3.4·1 stars
No reviews yet

Weavatrix Online extension: guarded sync, advisories, malware review, architecture contracts.

B77/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B77/100

full report

Adoption
Growing

1 stars87 downloads/wk

Reviews

Write one

Nobody has reviewed Weavatrix Online yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Weavatrix Online tools (7)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • online_status

    NETWORK / explicit Online profile: discover the configured Cloud or Enterprise endpoint capabilities without sending repository evidence.

  • preview_sync

    LOCAL CONSENT PREVIEW: serialize the exact bounded source-free payload and return a short-lived confirmation token. No network request is made.

  • pull_architecture_contract

    NETWORK / explicit Online profile: fetch the owner-approved target architecture for the active opaque repository UUID, validate it through core and cache it locally.

  • refresh_advisories

    NETWORK / explicit Online profile: inventory exact npm/PyPI/Go/Maven/Gradle/Cargo versions, query OSV, validate returned records in Online-owned code, and refresh Online's local advisory cache.

  • scan_dependency_malware

    LOCAL / explicit Online profile: bounded static heuristic review of installed dependency code. Returns review evidence and completeness only; never claims execution, credential exposure, or package compromise.

  • scan_dependency_vulnerabilities

    LOCAL / explicit Online profile: match the current exact dependency inventory against the validated Online advisory cache. Missing, stale, partial, or inventory-mismatched cache state never produces a clean zero.

  • sync_graph

    NETWORK / explicit Online profile: upload only the exact source-free payload approved through preview_sync; dry_run:false and the matching short-lived token are required.

Public scan report

scanner v0.1.10 · 2026-10-31 · same rubric, same numbers if you re-run it

no findings
  • Code scan32 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 68 days ago12/15
  • Maintainer identityregistry namespace matches repository owner7/10
Overall 77/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Weavatrix Online compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
77/100
higher than 50% of 48,255 servers
Tools
7
the typical server has 7
Tools that change things
0%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
1
more than 65% of 28,688 servers
Downloads a week
87
more than 60% of 12,191 servers with a package

What its tools let an agent do: 6 read · 1 change

Install Weavatrix Online in Claude Code, Cursor or VS Code

Runs npx -y weavatrix-online on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add weavatrix-online -- npx -y weavatrix-online
Add to Cursor

What the publisher says

From the Weavatrix Online repository's README, as published. We do not edit it. Read it on GitHub

Weavatrix Online

Take repository intelligence across a network without handing the network your repository.

The explicit network boundary of the Weavatrix ecosystem. Core and Refactor remain separate installs.

Weavatrix Online is the MIT-licensed MCP connector for Weavatrix Cloud and compatible customer-controlled endpoints. It keeps analysis local, produces an inspectable source-free payload, and requires an exact short-lived confirmation before that payload can leave the machine.

The public Online profile exposes 7 MCP tools for endpoint discovery, advisories, malware review, architecture contracts, and controlled synchronization. The local weavatrix-js graph engine is an implementation detail: its tools are not re-exported, so installing Core, Refactor, and Online together does not duplicate their catalogs in an agent's context.

Installing or starting Online does not synchronize anything. previewsync makes no network request; syncgraph accepts only the still-valid preview for the same repository, destination, payload, and graph.

Choose the right Weavatrix package

Online currently uses the JavaScript graph/runtime package internally:

weavatrix-online 0.3.4
  └─ weavatrix-js 0.3.x (internal; no Core tools re-exported)

It does not proxy the native weavatrix executable, import weavatrix-refactor, or copy either engine. Use weavatrix when the graph must remain entirely local. Use weavatrix-online when endpoint status, remotely managed architecture contracts, advisory refresh, or explicit source-free synchronization is part of the workflow.

Install and run

Plugins for Cursor, Codex, Claude, and Grok

The repository now contains one portable plugin bundle at plugins/weavatrix-online plus native marketplace manifests for all four clients. The plugin starts the pinned npm release and includes an optional, compact skill with one lazily loaded card per Online method.

codex plugin marketplace add Weavatrix/weavatrix-online --sparse .agents/plugins plugins/weavatrix-online
codex plugin add weavatrix-online@weavatrix-online

claude plugin marketplace add Weavatrix/weavatrix-online --sparse .claude-plugin plugins
claude plugin install weavatrix-online@weavatrix-online

grok plugin marketplace add Weavatrix/weavatrix-online

Cursor can load the bundle locally from ~/.cursor/plugins/local/weavatrix-online; public marketplace discovery starts after the listing is reviewed and approved.

Direct MCP launch

Run the pinned release without a global install:

npx -y weavatrix-online@0.3.4 C:\path\to\repository

The command starts a stdio MCP server. The first positional argument is the repository to analyze. An existing graph can be supplied explicitly:

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Weavatrix Online: common questions

Is Weavatrix Online MCP server safe?
Mostly: it is graded B (77/100). Read the Weavatrix Online safety report
How do I install Weavatrix Online?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Weavatrix Online need an API key?
Yes. The registry entry asks for WEAVATRIX_SYNC_TOKEN.
Is Weavatrix Online maintained?
The last commit was 72 days ago (2026-08-24). The latest release is v0.3.4.
How does Weavatrix Online compare with other MCP servers?
safety score 77/100 (higher than 50% of 48,255 servers); tools 7 (the typical server has 7); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

More from Weavatrix →