MCP.Market

When MCP server

by WhenLabs-org·io.github.WhenLabs-org/when·v0.12.3·3 stars

The WhenLabs developer toolkit — 6 tools, 7 MCP endpoints, one install.

B72/100grade B
What users say
No reviews yet
Be the first
Safety scan
B72/100

full report

Adoption
Growing

3 stars62 downloads/wk

Reviews

Write one

Nobody has reviewed When yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

When tools (1)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • aware_sync

Public scan report

scanner v0.1.9 · 2026-09-27 · same rubric, same numbers if you re-run it

1 high
  • Code scan8 source files scanned13/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 6 days ago15/15
  • Maintainer identityregistry namespace matches repository owner7/10

Findings (1)

  • highShell command built from a string (injection risk)exec.shell-concat
    dist/chunk-MBX2K33Z.js: …sterServer(name, command) { try { execSync(`claude mcp remove -s user ${name}`, { stdio: "pipe" }); } catch { …
Overall 72/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How When compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
72/100
higher than 38% of 48,255 servers
Tools
1
the typical server has 7
Tools that change things
0%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
3
more than 80% of 28,688 servers
Downloads a week
62
more than 50% of 12,191 servers with a package

What its tools let an agent do: 1 read

Install When in Claude Code, Cursor or VS Code

Runs npx -y @whenlabs/when on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add when -- npx -y @whenlabs/when
Add to Cursor

What the publisher says

From the When repository's README, as published. We do not edit it. Read it on GitHub

@whenlabs/when

Six tools. One install.

A single installable toolkit that brings six WhenLabs developer tools into your Claude Code workflow. After install, the tools are exposed over a single MCP server and Claude calls them automatically when relevant.

Install

npx @whenlabs/when install

One-time setup. The installer:

  1. Registers a single MCP server (whenlabs) in your Claude Code configuration
  2. Injects a CLAUDE.md block so Claude knows when to use each tool
  3. Cleans up any legacy velocity-mcp registration (velocity is now bundled)

The six tools

MCP tools

Eight endpoints across the six tools:

All eight are served by the single whenlabs MCP server (stdio, Node 20+). Fix/init/auxiliary commands remain available via each tool's CLI (npx @whenlabs/ --help).

CLI

when init       # Onboard a project — detect stack, bootstrap configs, run all checks
when doctor     # Run all six tools and show a unified health report
when install    # Register MCP server in Claude Code
when uninstall  # Remove MCP server

For per-tool operations, use the tool directly:

npx @whenlabs/stale scan
npx @whenlabs/envalid validate
npx @whenlabs/berth check
npx @whenlabs/aware sync
npx @whenlabs/vow scan

Manual MCP configuration

If you're not using the install command, add this to your Claude Code MCP config:

{
  "mcpServers": {
    "whenlabs": {
      "command": "npx",
      "args": ["@whenlabs/when", "when-mcp"]
    }
  }
}

License

MIT — see LICENSE

Built by Siddharth at WhenLabs

Nothing above is checked by us. What we check is on the safety report.

When: common questions

Is When MCP server safe?
Mostly: it is graded B (72/100). Read the When safety report
How do I install When?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does When need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is When maintained?
The last commit was 44 days ago (2026-09-21). The latest release is v0.12.3.
How does When compare with other MCP servers?
safety score 72/100 (higher than 38% of 48,255 servers); tools 1 (the typical server has 7); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.