notavibe
dev.notavibe/mcpnotavibe.devstreamable-httpv0.1.0Scanned
Ranks open-source projects on maintenance, not popularity. Check your dependencies.
4 tools: 4 only read.
- Reads private data · 2
- Reads text others write · 0
- Can send data out · 0
- 1 finding
Anlyon alternative
Run the operations that matter as governed actions.
Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.
Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.
Import an OpenAPI spec →Tools
Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.
4 tools
Only reads 4Show 4 read-only tools
compare_projectsReturn the public profiles of two catalog projects side by side, identified by host and two owner/repo slugs.Reads private dataNo findings
Why it is in this group
- The name "compare_projects" says "compare": a word for reading.
What it can reach
- private-dataThe description's first sentence says "return" and "repo": it reads repositories.
Description, as the server wrote it Return the public profiles of two catalog projects side by side, identified by host and two owner/repo slugs. The response presents each project's facts and health bands; it draws no conclusion and names no winner. The pair is refused when either project is unavailable or has insufficient measured signals. Read-only. Serves catalog schema v1.
get_listsList the public curated lists in the notavibe catalog, or return the public members of one list identified by owner handle and list slug.No findings
Why it is in this group
- The name "get_lists" says "get": a word for reading.
Description, as the server wrote it List the public curated lists in the notavibe catalog, or return the public members of one list identified by owner handle and list slug. Only public lists and their publishable members are returned. Read-only. Serves catalog schema v1.
get_projectReturn the public profile of one catalog project, identified by host and either an owner/repo slug or a numeric repository id.Reads private dataNo findings
Why it is in this group
- The name "get_project" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "return" and "repo": it reads repositories.
Description, as the server wrote it Return the public profile of one catalog project, identified by host and either an owner/repo slug or a numeric repository id. Both host and one of slug or id are required; a call missing them is refused as an invalid argument and names what is missing, which is distinct from the not-found given for a well-formed lookup that matched nothing. This resolves any project the catalog holds, including one below the discovery floor that search does not return. The profile carries the claim state, verification or generation provenance, the six vocabulary dimensions, the five health-signal bands, license and package-registry facets, and staleness. Health signals are reported as bands, not raw measures; no person-derived counts are included. Read-only. Serves catalog schema v1.
search_projectsSearch the notavibe catalog of open-source projects.1 finding
Why it is in this group
- The name "search_projects" says "search": a word for reading.
Findings
- Info
The description is 2,766 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...hythm and contribution-breadth health bands. Read-only. Serves catalog schema v1."
Description, as the server wrote it Search the notavibe catalog of open-source projects. The query matches project name, project description, and the category, ecosystem, kind, runtime and license_family vocabulary facets; free-form repository topics are not matched. A facet match adds a project to the results and does not affect its position in them: results are ordered by how closely the query matches name and description, then by published health signals. Every word of the query must match. A project's description is generated from its facets until its maintainer claims it and writes their own, so a query describing what a project does, such as "http router" or "date parsing", matches only where those words appear in a project name, in a claimed description, or among the words a facet value matches; a project name or a category, kind or ecosystem word is what a generated entry reliably matches. The catalog currently covers one ecosystem: javascript-typescript. category, ecosystem, kind, runtime, license_family and topics are also exact filters. Every filter supplied is applied, and a filter combines with the query rather than replacing it: query with ecosystem returns only projects that match the text AND carry that ecosystem. A filter narrows the result set and never changes the order. category, ecosystem, kind, runtime and license_family accept only values from this catalog's managed vocabulary; a value outside it is refused and the refusal names the accepted values, so it is never returned as an empty result. topics is an open set, so any topic is accepted and an unrecognised one simply matches nothing. The full vocabulary is available from the catalog facet enumeration. The response echoes the filters that were applied. Search returns projects at or above this catalog's discovery floor — a repository whose measured activity is too low to be ranked is held out of search even though the catalog holds it and has signals for it. A call with a query also returns projects in the settling hold, a waiting period a new or changed entry serves before it can be ranked. A call with filters and no query lists ranked projects only, so it excludes projects in the settling hold. An empty result therefore means that nothing matched among the projects that call can return, which is not the same as the catalog having no such project: a project known by name can still be retrieved by exact identity with get_project. At most 100 results are returned; the response field truncated is true when more matched and the list was cut at 100, and no total is reported. Returns compact result rows: repository host and numeric id, slug, name, description, claim state, category, and the maintenance-rhythm and contribution-breadth health bands. Read-only. Serves catalog schema v1.
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
No private-data, untrusted-input, outbound path in this server alone: no tool is tagged untrusted-input or outbound.
- Reads private data2
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write0
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out0
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Findings
Matches of fixed checks, with the text they matched.
- Infosearch_projects
The description is 2,766 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...hythm and contribution-breadth health bands. Read-only. Serves catalog schema v1."
History
Changes to its tool definitions and to its remote endpoint, newest first.
No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.
Install
Pinned to version 0.1.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http notavibe https://notavibe.dev/mcpclaude mcp add --transport http notavibe https://notavibe.dev/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__notavibe__search_projects",
"mcp__notavibe__get_project",
"mcp__notavibe__compare_projects",
"mcp__notavibe__get_lists"
],
"ask": [],
"deny": []
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as notavibe. Review it before you use it.
Capability tags behind 2 rules
- mcp__notavibe__get_project private-data
- mcp__notavibe__compare_projects private-data
Pin
Keep the decision: fail CI when the tools change, follow every change, or show a badge.
Pin in CI
Fail a build when the tools you reviewed are not the tools the server serves today.
curl -s "https://anlyon.dev/api/v1/servers/dev.notavibe/mcp/verify?hash=41834b4240e9aa47ebcc779f4d9692a30abdb4aa8bf4d762bafd651c50baa3c6" | jq -e '.changed == false'Pinned hash 41834b4240e9, from Oct 27, 2026, 22:18 UTC.
Watch
Get told when its tools change: a new tool, a new description, a new class.
https://anlyon.dev/servers/dev.notavibe/mcp/changes.xmlAn Atom feed. Works in any feed reader or Slack's RSS app.
Badge
[](https://anlyon.dev/servers/dev.notavibe/mcp)Source: MCP Registry. Synced Oct 27, 2026, 23:17 UTC.