When MCP server
io.github.WhenLabs-org/when·v0.12.3·3 starsThe WhenLabs developer toolkit — 6 tools, 7 MCP endpoints, one install.
3 stars62 downloads/wk
Reviews
Write oneNobody has reviewed When yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
When tools (1)
write = sends, deletes, buys or postsRead from the package source without running it. The installed server may list more.
aware_sync
Public scan report
scanner v0.1.9 · 2026-09-27 · same rubric, same numbers if you re-run it
- Code scan8 source files scanned13/25
- –Live reliabilityno gateway calls yet and no remote to proben/a
- –Tool poisoningtools not inspected (local package is not executed); not countedn/a
- Auth qualitylocal package, no credentials required12/15
- Maintenancelast push 6 days ago15/15
- Maintainer identityregistry namespace matches repository owner7/10
Findings (1)
- highShell command built from a string (injection risk)
exec.shell-concatdist/chunk-MBX2K33Z.js: …sterServer(name, command) { try { execSync(`claude mcp remove -s user ${name}`, { stdio: "pipe" }); } catch { …
How When compares
Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.
- Safety score
- 72/100
- higher than 38% of 48,255 servers
- Tools
- 1
- the typical server has 7
- Tools that change things
- 0%
- typical: 0%. Fewer write tools means less an agent can break
- GitHub stars
- 3
- more than 80% of 28,688 servers
- Downloads a week
- 62
- more than 50% of 12,191 servers with a package
What its tools let an agent do: 1 read
Install When in Claude Code, Cursor or VS Code
Runs npx -y @whenlabs/when on your machine. Read the scan report first; the gateway never runs local packages.
claude mcp add when -- npx -y @whenlabs/when
What the publisher says
From the When repository's README, as published. We do not edit it. Read it on GitHub
@whenlabs/when
Six tools. One install.
A single installable toolkit that brings six WhenLabs developer tools into your Claude Code workflow. After install, the tools are exposed over a single MCP server and Claude calls them automatically when relevant.
Install
npx @whenlabs/when installOne-time setup. The installer:
- Registers a single MCP server (whenlabs) in your Claude Code configuration
- Injects a CLAUDE.md block so Claude knows when to use each tool
- Cleans up any legacy velocity-mcp registration (velocity is now bundled)
The six tools
MCP tools
Eight endpoints across the six tools:
All eight are served by the single whenlabs MCP server (stdio, Node 20+). Fix/init/auxiliary commands remain available via each tool's CLI (npx @whenlabs/ --help).
CLI
when init # Onboard a project — detect stack, bootstrap configs, run all checks
when doctor # Run all six tools and show a unified health report
when install # Register MCP server in Claude Code
when uninstall # Remove MCP serverFor per-tool operations, use the tool directly:
npx @whenlabs/stale scan
npx @whenlabs/envalid validate
npx @whenlabs/berth check
npx @whenlabs/aware sync
npx @whenlabs/vow scanManual MCP configuration
If you're not using the install command, add this to your Claude Code MCP config:
{
"mcpServers": {
"whenlabs": {
"command": "npx",
"args": ["@whenlabs/when", "when-mcp"]
}
}
}License
MIT — see LICENSE
Built by Siddharth at WhenLabs
Nothing above is checked by us. What we check is on the safety report.
When: common questions
- Is When MCP server safe?
- Mostly: it is graded B (72/100). Read the When safety report
- How do I install When?
- It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
- Does When need an API key?
- Not as far as the registry entry and our scan can tell: no credentials are declared or required.
- Is When maintained?
- The last commit was 44 days ago (2026-09-21). The latest release is v0.12.3.
- How does When compare with other MCP servers?
- safety score 72/100 (higher than 38% of 48,255 servers); tools 1 (the typical server has 7); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.