io.github.AkashGoenka/coldstart

Est-ce que io.github.AkashGoenka/coldstart est sûr ?

Au dernier audit MCP Hub, le serveur MCP « io.github.AkashGoenka/coldstart » est classé « Vérifié ». Aucun comportement malveillant détecté au test comportemental. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Versions auditées & empreintes

Vérifiez la version que vous utilisez : son empreinte doit correspondre à celle listée ici — sinon vous n'utilisez pas la version auditée.

⚠ La dernière version publiée (2.3.4) n'a pas encore été auditée. Un nouveau pentest est programmé ; les verdicts ci-dessous portent sur les versions listées.

Vous utilisez ce serveur ? Suivez-le (créez un compte) pour être alerté dès qu'une nouvelle version paraît ou que le verdict change.

Les 8 outils

• find≈ 290 tokens

  Locate the files relevant to a task. Pass `query` = EVERY salient identifier from the task (symbol names, domain nouns, the rare token you half-remember) — not one distilled keyword. Recall is bounded by the terms you give: a one-token query cannot out-rank lookalikes, so over-supply rather than under-supply. Reach for find BEFORE Read/Grep/Glob. HOW IT WORKS: find greps every term across the repo body AND matches declared names (filenames, path segments, exported symbols), then ranks files by DISTINCT-TERM COVERAGE — the file that covers MORE of your query rises above its lookalikes. This catches body-level matches (nested defs, dynamic refs, string literals) that a declared-name index misses. OUTPUT: a ranked page. Top files get an inline preview — their indexed symbols (with line rang

  Paramètres, retour & exemple (1)

  Paramètres

  • query · string · requis
    Space-separated identifiers for the thing you are looking for — pass every salient token from the task, not one keyword. camelCase/snake_case both accepted. More discriminating tokens = sharper ranking.

  Exemple d'appel

  {"name": "find", "arguments": {"query": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• gs≈ 693 tokens

  Drill into a known file. Returns these sections as compact text: - Symbols — top-level + per-class methods (name, kind, line range, extends/implements). With cross-file callers attached per exported symbol (inline if 1 caller; newline-per-caller block if ≥2). For huge files (>20 symbols, no `match`), symbols are reordered by caller count (most-used first) and truncated to top 15. - Imports — 1-hop internal outbound dependencies (library imports stripped). - Importers — 1-hop reverse: files in this repo that import this one. With `match`, additionally lists EVERY indexed file (importer or not, any language) whose CONTENT references the matched term even when its filename does not (a registry, admin, or config file using the symbol — or a frontend file referencing a backend name). That subse

  Paramètres, retour & exemple (4)

  Paramètres

  • view · string · optionnel · full | symbols | imports | importers | callers
    Which sections to return. Default "full" = symbols (with inline callers) + imports + importers. Use one of the narrower views to halve or quarter the output when you know what you need: "symbols" (shape only, no callers), "imports" (outbound only), "importers" (inbound only), "callers" (per-symbol cross-file callers in expanded form, no symbol shape).
  • match · string · optionnel
    Filter all sections by name. Substring (case-insensitive) by default; use `|` to OR substrings (`match: "resource|tile"`); wrap in slashes for regex (`match: "/^handle/"`). Use this on large/god-files to avoid a wall of output — e.g. `match: "tile"` on a big models.py reduces output to just tile-related symbols, their callers, and matching imports/importers.
  • symbol · string · optionnel
    Deliver the BODY of the named symbol(s) inline, sliced from their indexed line range — so you read a method WITHOUT a Read at a guessed offset. Comma/pipe-separate names (`serialize,restore_state`). A bare name matches the method (`serialize` → `Graph.serialize`). Each body is followed by `callers:`/`calls:` POINTERS (file + line range) so the next hop is one more `gs --symbol` call, not a windowed Read. Use this the moment a file’s symbol list shows the method you need — it replaces the read-at-offset hunt on god-files. If the name is NOT a declared symbol (a runtime/template-injected value, a string key, a config token), it falls back to an in-tool GREP: returns the body lines where the token appears, with context — so you never shell out to grep. Overrides `view`/`match`.
  • file_path · string · requis
    Relative path to the file (e.g. "src/auth/service.ts"). Suffix matches are accepted.

  Exemple d'appel

  {"name": "gs", "arguments": {"file_path": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• kb_search≈ 270 tokens

  Search the repo's NOTEBOOK — durable notes past agents wrote after finishing tasks here (file purposes, cross-file flows, traps/lessons, established absences). Try this BEFORE find when the task might have been seen before: a hit can answer outright or point straight at the right files, skipping a search. Pass plain task words (symptoms work: "logout loop after refresh"), symbol names, or file names. Results are inlined in full with a freshness stamp computed against the CURRENT code: [fresh] = the cited file is byte-identical to when the note was verified; [evidence changed: <path>] = that file drifted since — re-verify before relying on it (and correct the note if it proved wrong: `coldstart kb write`). Absence notes ("there is no X") are re-checked live. No hits or an empty notebook →

  Paramètres, retour & exemple (1)

  Paramètres

  • query · string · requis
    Plain task words, symptoms, symbol names, or file names. Same over-supply rule as find: pass every salient token.

  Exemple d'appel

  {"name": "kb_search", "arguments": {"query": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• kb_lookup≈ 291 tokens

  Read everything the NOTEBOOK knows at ONE exact address — the file you are about to edit. Address-keyed, not concept-keyed: unlike kb_search (fuzzy, ranked), this filters notes by exact anchor path, so it is exhaustive at that path. Returns the file note's facets, every cross-file flow that passes THROUGH this file, and lessons/absences anchored here — each with a live freshness stamp against the current code. Reach for this the moment you have DECIDED on a file and are about to modify it: it surfaces the flow you might break, the absence you are about to violate, the rationale for the code's shape. A clean result ("nothing known here") is itself a positive signal — proceed. Anything marked [evidence changed: <path>] drifted since it was verified; re-verify before relying on it, and corre

  Paramètres, retour & exemple (2)

  Paramètres

  • path · string · requis
    Exact repo-relative path of the file (e.g. "src/auth/service.ts").
  • symbol · string · optionnel
    Optional top-level symbol name to narrow the lookup to notes anchored at that symbol.

  Exemple d'appel

  {"name": "kb_lookup", "arguments": {"path": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• kb_write≈ 816 tokens

  Save or correct NOTEBOOK notes after finishing real work here — you have the files in context, so no future agent is better placed to record what you learned. Write a file note (what a file is for), a flow note (how a task spans files), or an absence lesson (a confirmed "there is no X"). Pass `specs` (an ARRAY of specs) to write ALL your notes in ONE call — malformed notes are reported together instead of one hiding the rest, and the result ends with a coverage line naming any worked files still without a note; pass `spec` (a single object) for a one-off. Also the tool to FIX or RETRACT a note you used that proved wrong: `op: "put"` replaces; `op: "retract"` with `target: {kind: "note"}` removes the whole note (or `target: {kind: "anchor"|"alias"|"facet"|"invariant"|"behavior"|"feature", k

  Paramètres, retour & exemple (6)

  Paramètres

  • into · string · optionnel
    Phase-2 answer: merge this write into the existing note with this id (from a prior `candidates` response).
  • spec · object · optionnel
    A single note spec (JSON object). Fields: type, title, summary, identityAliases (stable — unions forever), incidentAliases (this write's symptom words — replaced by the next write that changes summary/body, omit if this write isn't about an incident), anchors:[{path,symbols?}], and type-specific fields (facets/character for file; steps/verified for flow; kind/scope/body for lesson). REQUIRED for the note to be findable at all — file-single: identityAliases + anchors[].symbols; file-hub: identityAliases + facets[].symbol; flow: identityAliases + steps + verified; lesson: scope.terms. A note missing these is written but unreachable: identityAliases are the only STABLE search surface besides the exact title (incidentAliases are optional — symptom words for a write that describes one, replaced by the next such write, never required), and anchor symbols are the only channel that answers a query typed as an identifier. Omit `id` on a new flow/lesson to trigger the reuse gate. Use `specs` instead to write several notes at once.
  • agent · string · optionnel
    Optional agent id (given in a capture prompt, alongside session). Selects THIS agent stream's durable worklist for the coverage line so a subagent does not clear the main agent's list. Defaults to "main".
  • specs · array · optionnel
    The capture path: an ARRAY of note specs (each the same shape as `spec`), written in ONE call. Order flows before the file notes that reference them. Well-formed notes are written; malformed ones are reported together (not atomic — a bad note never silences a good one); the result ends with a coverage line naming any worked file still without a note. Prefer this over many single-`spec` calls.
  • is_new · boolean · optionnel
    Phase-2 answer: declare this a genuinely new concept, bypassing the candidate matches from a prior `candidates` response.
  • session · string · optionnel
    Optional session id (given in a capture prompt). Enables the flow-evidence check: a flow whose step files this session never actually read gets a warning.

  Exemple d'appel

  {"name": "kb_write", "arguments": {"into": "texte", "spec": {}, "agent": "texte", "specs": [], "is_new": true, "session": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• kb_status≈ 172 tokens

  Notebook overview: how many notes exist (by type: file/flow/lesson), how many are flagged stale (their anchored files drifted since verification), and how many are superseded/retracted. Pass `paths` (array of repo-relative paths) to instead list the notes anchored at each of those exact paths with their freshness state — a quick "is anything known here?" check across several files at once.

  Paramètres, retour & exemple (1)

  Paramètres

  • paths · array · optionnel
    Optional repo-relative paths. When given, returns per-path anchored notes + freshness instead of the whole-notebook overview.

  Exemple d'appel

  {"name": "kb_status", "arguments": {"paths": []}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• kb_repair≈ 212 tokens

  List the notebook notes that are WRITTEN BUT UNFINDABLE — missing the fields a note cannot be retrieved without (identityAliases, anchor symbols, a flow's verified paths). Notes written before those fields were required are correct but unreachable, and this is how they get found. Returns a worklist, never a change: repairing is your work, because every gap needs a judgement about the code (which words a reader would search for, which symbols the note is actually about, which files you can honestly claim to have read). Fix each one with kb_write, passing the note's `id` — fields merge, so nothing already in the note is lost. A clean notebook returns "Nothing to repair here." Run it when the user asks to repair, fix, or clean up the notebook.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "kb_repair", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• kb_repair_aliases≈ 320 tokens

  List file/flow notes whose identityAliases may no longer describe them — a DIFFERENT problem from kb_repair: that one finds notes with NO aliases at all, this one is for aliases that exist but have gone stale (a note rewritten several times can carry words that were really symptoms of an earlier write, not stable facts). Paginated 10 notes at a time. Each entry shows the current (capped) identityAliases AND the full historical union hidden past the render cap — read both before retracting anything, because dropping a visible alias can resurface an older hidden one on the next fold. Re-read the note's code, then reconcile via kb_write (retract stale entries, re-put the rest) — never mechanically, every judgement needs the current code. End every note's kb_write with `aliasesVerified:true`

  Paramètres, retour & exemple (2)

  Paramètres

  • limit · number · optionnel
    Notes per page. Defaults to 10.
  • offset · number · optionnel
    Pagination offset (0-based). For browsing only — do NOT increment this across calls once you start marking notes aliasesVerified, since the eligible list shrinks as you go. Leave at 0 (or omit) and just call again; reviewed notes fall out automatically.

  Exemple d'appel

  {"name": "kb_repair_aliases", "arguments": {"limit": 1, "offset": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

Badge pour votre README

Ce serveur a passé le pentest comportemental. Le badge porte son nom et renvoie à cette fiche — la preuve, c'est la fiche (verdict live qu'on contrôle), pas l'image.

[![Vérifié par MCP Hub](https://dokore.fr/badge/io.github.akashgoenka--coldstart.svg)](https://dokore.fr/serveur/io.github.akashgoenka--coldstart)

<a href="https://dokore.fr/serveur/io.github.akashgoenka--coldstart"><img src="https://dokore.fr/badge/io.github.akashgoenka--coldstart.svg" alt="Vérifié par MCP Hub" height="20"></a>

Réévalué en continu : si le comportement change, le verdict tombe et le badge disparaît. Un badge qui ne pointe pas vers une fiche dokore.fr ne prouve rien. Comment ça marche

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

@cstart/coldstart@2.2.17