# weavatrix-online [Health: Active]

**Category:** ⚖️ Legal  
**Repository:** https://github.com/Weavatrix/weavatrix-online  
**GitHub Stars:** 1  
**npm Downloads (last month):** 257  
**Views:** 2  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/weavatrix-online

## Description
Weavatrix Online extension: guarded sync, advisories, malware review, architecture contracts.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "weavatrix-online": {
    "command": "npx",
    "args": ["-y","weavatrix-online@0.3.4"],
    "env": {
      "WEAVATRIX_SYNC_URL": "",
      "WEAVATRIX_SYNC_TOKEN": ""
    }
  }
}
```

**Requires environment variables:** `WEAVATRIX_SYNC_URL`, `WEAVATRIX_SYNC_TOKEN` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What weavatrix-online does

The weavatrix-online MCP server adds network-facing workflows to a local Weavatrix graph without exporting repository source. It connects to Weavatrix Cloud or compatible self-hosted endpoints for capability discovery, advisory retrieval, architecture-contract retrieval, and approved graph synchronization.

The public profile contains seven tools. Three support network or remote workflows: `online_status`, `refresh_advisories`, and `pull_architecture_contract`. Four operate locally or enforce the upload boundary: `scan_dependency_vulnerabilities`, `scan_dependency_malware`, `preview_sync`, and `sync_graph`.

The local runtime creates or reads the repository graph, while the Online package exposes only its own tools. Core and Refactor tools are not re-exported. Use the separate Weavatrix Core package when all graph work must remain local, or Refactor when guarded source changes are required.

## How it works

The weavatrix-online MCP server starts with a repository path as its first positional argument. An existing graph can be supplied as an additional path. It communicates with MCP clients over stdio and uses a pinned npm release when launched with `npx`.

Starting the process does not send repository data. `preview_sync` builds the bounded, source-free payload locally, calculates its hash, displays destination and payload details for inspection, and returns a short-lived confirmation token. `sync_graph` will send data only when the token still matches the same repository, graph, destination, and payload. The token expires after five minutes, and changes to those inputs invalidate the approval.

The synchronization payload can contain bounded graph topology and selected derived evidence. It excludes source bodies, snippets, absolute host paths, environment values, credentials, Git remotes, and fields outside the wire allowlist. Source-free does not mean anonymous, so the repository identity and displayed upload details still need review.

## Setup and configuration

Install or run the pinned package directly:

```text
npx -y weavatrix-online@0.3.4 C:\path\to\repository
```

For a configured MCP client, use `npx` as the command and pass the package version and repository path as arguments. The documented configurations cover Codex and Claude Desktop. A portable plugin bundle is also provided for Cursor, Codex, Claude, and Grok; Grok is not listed as a supported client slug in this catalog.

Set `WEAVATRIX_SYNC_URL` for Cloud or compatible self-hosted synchronization. Authenticated Cloud endpoints use `WEAVATRIX_SYNC_TOKEN`; the token should come from runtime secret storage rather than Git, a committed environment file, logs, or checked-in client configuration. `WEAVATRIX_CAPABILITIES_URL` and `WEAVATRIX_ARCHITECTURE_URL` can override the default capability and architecture-contract endpoints. `WEAVATRIX_PRECISION` controls local semantic precision and accepts `lsp` or `de`.

## Tools and capabilities

- `online_status` discovers endpoint capabilities, payload versions, limits, and authentication mode without repository evidence.
- `refresh_advisories` inventories exact dependency coordinates, queries OSV, validates responses, and atomically updates the local cache.
- `scan_dependency_vulnerabilities` checks the current dependency inventory against cached advisory evidence.
- `scan_dependency_malware` performs bounded static review of installed dependency files.
- `pull_architecture_contract` retrieves and validates the owner-approved target for the active opaque repository ID.
- `preview_sync` creates the exact allowlisted payload and its approval token without making a network request.
- `sync_graph` negotiates capabilities and sends only the payload approved by `preview_sync`.

## Limitations and notes

The vulnerability scanner does not independently retrieve advisories; missing, stale, partial, or mismatched cache coverage remains `NOT_CHECKED` or `PARTIAL`. Malware findings require review and are not compromise verdicts.

Every non-loopback destination must use HTTPS, while HTTP is restricted to loopback development. Credentials cannot be embedded in URLs. Uploads require capability negotiation, a matching preview, `dry_run: false`, and a valid confirmation token. A rejected or unavailable endpoint leaves the graph local.

The package requires Node.js 18 or newer. It is an optional network extension, not a replacement for the local Weavatrix product or the Refactor extension. The project is licensed under MIT.

_Full upstream README: https://allmcps.com/mcp/weavatrix-online/readme_