io.github.worklore/worklore

Est-ce que io.github.worklore/worklore est sûr ?

Au dernier audit MCP Hub, le serveur MCP « io.github.worklore/worklore » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 8 outils

• check_capability≈ 775 tokens

  Disclose what an agent Skill or worklore story CAN DO before you run it: a capability tier T0-T4 bound to a content sha256, with findings that carry file:line evidence, PLUS a separate list of behavioral red flags (prompt-injection / deception / exfiltration-intent / safety-bypass phrasings) for a human to review. This is blast-radius disclosure and triage, never a 'safe' verdict. Prefer a `url` over pasting a file: a skill on GitHub (github.com or raw.githubusercontent.com, up to 200 KB) needs no sign-in, and you do not have to copy the whole file into the call. Other URLs need a signed-in session. If you paste `text`, also pass `expected_sha256` (the file's sha256, e.g. `shasum -a 256 SKILL.md`): a copy that changed on the way is reported instead of scanned. `received` says exactly what was scanned.

  Paramètres, retour & exemple (3)

  Paramètres

  • url · string · optionnel
    A URL to fetch and scan. GitHub URLs need no sign-in; a github.com/…/blob/… link works.
  • text · string · optionnel
    The skill/story text to scan.
  • expected_sha256 · string · optionnel
    sha256 (hex) of the file you mean, when you paste `text`. A mismatch is an error, not a scan.

  Exemple d'appel

  {"name": "check_capability", "arguments": {"url": "texte", "text": "texte", "expected_sha256": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"tier": "T0", "sha256": "texte", "findings": [], "received": {}, "endpoints": [], "behavioral": [], "disclaimer": "texte", "tier_label": "Inert — no scanned capability strings; instructional text only", "behavioral_note": "texte", "scanner_version": "texte"}}

• edit_story≈ 685 tokens

  Revise a worklore story the signed-in account PUBLISHED — only its author can edit it. Call get_story first, then show the human a before/after diff of your change and get their EXPLICIT approval before calling this; never edit on your own initiative. Send the COMPLETE revised story as `markdown` (frontmatter + '# title' + narrative + '## Reproduce this'), not a fragment. Keep the frontmatter `date` exactly as it is: it records when the work happened, and a revision never moves it. Say what kind of edit this is: 'rephrase' (same claims, better wording), 'addition' (new detail, nothing was wrong), or 'correction' (something in the story was WRONG — a step, a claim, a result). If anything was wrong, it is a correction: never hide a correction as a rephrase. A correction requires a one-line `note` saying what was wrong, and notifies everyone who reported reproducing the story. `source` optionally credits what prompted the revision (an https URL). The new text REPLACES the old (worklore keeps no copy of earlier text), while a record of this revision — when, what kind, the note — is appended to the story's public history.

  Paramètres, retour & exemple (5)

  Paramètres

  • kind · string · optionnel · rephrase | addition | correction
    rephrase (default) — same claims, reworded; addition — new detail, nothing was wrong; correction — something was wrong (requires `note`, notifies reproducers).
  • note · string · optionnel
    One line on what changed (max 500 chars). Required for a correction: what was wrong.
  • slug · string · requis
    The slug of the story to revise (one the signed-in account wrote).
  • source · string · optionnel
    Optional https URL crediting what prompted the revision (a comment, an issue, an article).
  • markdown · string · requis
    The complete revised story markdown, frontmatter included, with the original `date` unchanged.

  Exemple d'appel

  {"name": "edit_story", "arguments": {"slug": "texte", "markdown": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"url": "texte", "slug": "texte", "notified": 1, "revision": {}, "visibility": "texte"}}

• get_story≈ 478 tokens

  Fetch one worklore story by slug — its full markdown (narrative + the 'Reproduce this' contract your agent would run) WITH its capability disclosure attached (tier + findings), so you see what it can do before applying it. Read the capability first; run check_capability on the live artifacts before executing. After you apply the story to the user's task, call report_reproduction with an honest result to record it.

  Paramètres, retour & exemple (1)

  Paramètres

  • slug · string · requis
    The story slug (from search_stories / a worklore URL).

  Exemple d'appel

  {"name": "get_story", "arguments": {"slug": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"slug": "texte", "title": "texte", "checks": {}, "markdown": "texte", "has_check": true, "capability": {}, "visibility": "public", "unavailable": "texte", "to_check_only": "texte", "visibility_note": "texte", "after_you_apply_this": "texte"}}

• publish_story≈ 703 tokens

  Publish a NEW worklore story as the signed-in account. worklore stories are PUBLIC and honest, so before you call this you MUST show the human the complete draft — the title, the first-person narrative, and the 'Reproduce this' contract — and get their EXPLICIT approval. Never publish on your own initiative and never invent details. Provide the full story as `markdown` (frontmatter with title/date/tags/type/reproducible, then '# title', the narrative, then '## Reproduce this' with prerequisites/inputs/steps/verify) — call get_story on an existing story first to match the format — OR provide the structured fields title + narrative (+ reproduce, tags, type, stack) and the server assembles it. SANITIZE: no secrets, employer internals, client names, or private URLs. Returns the live URL and capability tier.

  Paramètres, retour & exemple (8)

  Paramètres

  • tags · array · optionnel
    3-6 lowercase kebab tags.
  • type · string · optionnel · success | fail | proposal
    success (default), fail, or proposal — a proposal is work the author believes is right but cannot prove yet, published to get evidence or review rather than to claim a result.
  • stack · string · optionnel
    Optional: the ecosystem this story is about.
  • title · string · optionnel
    Story title (used only if `markdown` is not given).
  • markdown · string · optionnel
    The complete story markdown (frontmatter + '# title' + narrative + '## Reproduce this' contract). Preferred.
  • narrative · string · optionnel
    First-person narrative, ~150-400 words, honest (used if no `markdown`).
  • reproduce · string · optionnel
    The 'Reproduce this' contract body: prerequisites, inputs, ordered steps, verify.
  • visibility · string · optionnel · public | private
    public (default) — anyone can read and reproduce it; private — only the author can, and it appears in no feed, search, badge or link. Ask the human which they want if the draft contains anything they may not want public.

  Exemple d'appel

  {"name": "publish_story", "arguments": {"tags": [], "type": "success", "stack": "texte", "title": "texte", "markdown": "texte", "narrative": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"url": "texte", "slug": "texte", "similar": [], "capability": {}}}

• report_check≈ 396 tokens

  Record the result of a story's read-only 'Check if this applies to you' section, run in the user's own project (attributed to the signed-in account). Run ONLY that check — change nothing, apply no fix. First decide whether it applies at all: if the project does not match the check's preconditions, do NOT call this — 'not applicable' is never recorded. Otherwise report 'has_problem' or 'no_problem', honestly. One counted result per person per story; a later report replaces the earlier one. Only stories whose get_story result has has_check: true can be checked.

  Paramètres, retour & exemple (3)

  Paramètres

  • note · string · optionnel
    Optional short note: the evidence (max 300 chars).
  • slug · string · requis
    The story slug whose check you ran.
  • result · string · requis · has_problem | no_problem
    What the check found in the user's project.

  Exemple d'appel

  {"name": "report_check", "arguments": {"slug": "texte", "result": "has_problem"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"ok": true, "checks": {}, "result": "has_problem", "thanks": "texte", "counted": true, "credited": "texte"}}

• report_reproduction≈ 327 tokens

  Call this right after you apply a worklore story's steps to the user's own task, to record the reproduction (attributed to the signed-in account). Use an honest result: 'worked', 'partial' (you produced the output but it isn't verified yet), or 'failed' — all are useful. One counted report per person per story; repeats are acknowledged, not doubled. Never report a story you did not apply.

  Paramètres, retour & exemple (3)

  Paramètres

  • note · string · optionnel
    Short note (max 500 chars): which parts of the story applied to this project and which did not, plus what broke if anything. The author reads it to learn which paragraphs do work.
  • slug · string · requis
    The story slug you reproduced.
  • result · string · requis · worked | partial | failed
    How it honestly went.

  Exemple d'appel

  {"name": "report_reproduction", "arguments": {"slug": "texte", "result": "worked"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"ok": true, "thanks": "texte", "counted": true, "credited": "texte"}}

• search_stories≈ 310 tokens

  Search worklore stories by keyword across title, summary, tags and stack. Returns matches with their capability tier.

  Paramètres, retour & exemple (1)

  Paramètres

  • query · string · optionnel
    Keywords (space-separated; all must match).

  Exemple d'appel

  {"name": "search_stories", "arguments": {"query": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"count": 1, "query": "texte", "stories": [], "about_tiers": "texte"}}

• suggest_for_project≈ 307 tokens

  Given a short description of the current project (stack, what you're building, recent problems), suggest up to 3 worklore stories worth reproducing here, with why each fits and its tier.

  Paramètres, retour & exemple (1)

  Paramètres

  • context · string · requis
    Project context: stack, goal, recent TODOs/problems.

  Exemple d'appel

  {"name": "suggest_for_project", "arguments": {"context": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"note": "texte", "suggested": [], "about_tiers": "texte"}}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://worklore.dev/mcp