Log inSubmit server
Weavatrix Online logo

Weavatrix Online

Guards source-free graph synchronization and provides endpoint, advisory, malware, and architecture tools over MCP.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Weavatrix Online

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "weavatrix-online": {
      "command": "npx",
      "args": [
        "-y",
        "weavatrix-online@0.3.4"
      ],
      "env": {
        "WEAVATRIX_SYNC_URL": "YOUR_VALUE_HERE",
        "WEAVATRIX_SYNC_TOKEN": "YOUR_VALUE_HERE"
      }
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Values are written into the snippet above so you can paste it as is. They never leave your browser.

We couldn’t confirm it starts correctly

The install command installed and started the server, which then stopped for configuration (such as an API key) that our sandbox does not have — expected for servers that connect to your account.

npx -y weavatrix-online@0.3.4

Process exited before answering initialize.

This is an experimental automated check and can have false negatives — missing environment variables, a slow cold install, etc. It doesn’t necessarily mean something’s wrong. Last checked 6d ago.

Overview

weavatrix-online MCP server connects a local Weavatrix graph runtime to Weavatrix Cloud or compatible customer-controlled endpoints. It exposes seven MCP tools for endpoint discovery, advisory refresh, local vulnerability and malware review, architecture contracts, and guarded synchronization. Reach for it when remote endpoint workflows are needed while repository analysis stays local and uploads require explicit approval. It runs as a Node.js stdio MCP process and does not synchronize data merely by starting.

Use cases

  • Check endpoint capabilities before a remote workflow
  • Refresh OSV advisories and scan dependency inventory locally
  • Review installed dependencies for bounded malware indicators
  • Pull owner-approved architecture contracts
  • Preview and explicitly approve a source-free graph sync

Key features

  • Seven MCP tools for network and local workflows
  • Source-free, allowlisted graph synchronization
  • Five-minute confirmation tokens with payload hashing
  • OSV advisory refresh and local vulnerability matching
  • Bounded static dependency malware review
  • Architecture-contract retrieval and validation

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked Today

Recent health check succeeded.

8/8 checks healthy over the last 42d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 22h ago via OSV.dev · weavatrix-online@0.3.4 (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars1Stargazers on the source repository.
npm downloads257Package downloads in the last 30 days.
Last commit2mo agoMost recent push to the default branch.
Install checkRunsOur sandbox started it; it then asked for an API key or config.
Directory activity2 viewsConfig copies, upvotes, and views on AllMCPs.

How Weavatrix Online works

What weavatrix-online does

The weavatrix-online MCP server adds network-facing workflows to a local Weavatrix graph without exporting repository source. It connects to Weavatrix Cloud or compatible self-hosted endpoints for capability discovery, advisory retrieval, architecture-contract retrieval, and approved graph synchronization.

The public profile contains seven tools. Three support network or remote workflows: online_status, refresh_advisories, and pull_architecture_contract. Four operate locally or enforce the upload boundary: scan_dependency_vulnerabilities, scan_dependency_malware, preview_sync, and sync_graph.

The local runtime creates or reads the repository graph, while the Online package exposes only its own tools. Core and Refactor tools are not re-exported. Use the separate Weavatrix Core package when all graph work must remain local, or Refactor when guarded source changes are required.

How it works

The weavatrix-online MCP server starts with a repository path as its first positional argument. An existing graph can be supplied as an additional path. It communicates with MCP clients over stdio and uses a pinned npm release when launched with npx.

Starting the process does not send repository data. preview_sync builds the bounded, source-free payload locally, calculates its hash, displays destination and payload details for inspection, and returns a short-lived confirmation token. sync_graph will send data only when the token still matches the same repository, graph, destination, and payload. The token expires after five minutes, and changes to those inputs invalidate the approval.

The synchronization payload can contain bounded graph topology and selected derived evidence. It excludes source bodies, snippets, absolute host paths, environment values, credentials, Git remotes, and fields outside the wire allowlist. Source-free does not mean anonymous, so the repository identity and displayed upload details still need review.

Setup and configuration

Install or run the pinned package directly:

Terminal
npx -y weavatrix-online@0.3.4 C:\path\to\repository

For a configured MCP client, use npx as the command and pass the package version and repository path as arguments. The documented configurations cover Codex and Claude Desktop. A portable plugin bundle is also provided for Cursor, Codex, Claude, and Grok; Grok is not listed as a supported client slug in this catalog.

Set WEAVATRIX_SYNC_URL for Cloud or compatible self-hosted synchronization. Authenticated Cloud endpoints use WEAVATRIX_SYNC_TOKEN; the token should come from runtime secret storage rather than Git, a committed environment file, logs, or checked-in client configuration. WEAVATRIX_CAPABILITIES_URL and WEAVATRIX_ARCHITECTURE_URL can override the default capability and architecture-contract endpoints. WEAVATRIX_PRECISION controls local semantic precision and accepts lsp or de.

Tools and capabilities

  • online_status discovers endpoint capabilities, payload versions, limits, and authentication mode without repository evidence.
  • refresh_advisories inventories exact dependency coordinates, queries OSV, validates responses, and atomically updates the local cache.
  • scan_dependency_vulnerabilities checks the current dependency inventory against cached advisory evidence.
  • scan_dependency_malware performs bounded static review of installed dependency files.
  • pull_architecture_contract retrieves and validates the owner-approved target for the active opaque repository ID.
  • preview_sync creates the exact allowlisted payload and its approval token without making a network request.
  • sync_graph negotiates capabilities and sends only the payload approved by preview_sync.

Limitations and notes

The vulnerability scanner does not independently retrieve advisories; missing, stale, partial, or mismatched cache coverage remains NOT_CHECKED or PARTIAL. Malware findings require review and are not compromise verdicts.

Every non-loopback destination must use HTTPS, while HTTP is restricted to loopback development. Credentials cannot be embedded in URLs. Uploads require capability negotiation, a matching preview, dry_run: false, and a valid confirmation token. A rejected or unavailable endpoint leaves the graph local.

The package requires Node.js 18 or newer. It is an optional network extension, not a replacement for the local Weavatrix product or the Refactor extension. The project is licensed under MIT.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Weavatrix Online

weavatrix-online is an MCP server that connects a local Weavatrix graph runtime to Weavatrix Cloud or compatible self-hosted endpoints. Its tools discover endpoint capabilities, refresh OSV advisories, scan vulnerabilities and dependency files, retrieve architecture contracts, preview uploads, and perform explicitly approved graph synchronization.

Run `npx -y weavatrix-online@0.3.4` followed by the repository path. The package starts a stdio MCP server and accepts an optional existing graph path. Node.js 18 or newer is required.

It requires `preview_sync` before `sync_graph`. The preview hashes the exact bounded payload and returns a five-minute token; synchronization requires that token, matching inputs, capability negotiation, and `dry_run: false`.

Yes, Cursor can load the provided local plugin bundle from `~/.cursor/plugins/local/weavatrix-online`.

Related MCP servers

All in Legal All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewWeavatrix Online AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/weavatrix-online?style=directory)](https://allmcps.com/mcp/weavatrix-online)
HTML Embed
<a href="https://allmcps.com/mcp/weavatrix-online"><img src="https://allmcps.com/api/badge/weavatrix-online?style=directory" alt="Weavatrix Online on AllMCPs" /></a>