tokrepo-mcp-server
Advanced tools
Agent-native MCP server for TokRepo - discover, verify, plan, safely install, hand off, and push AI assets from MCP clients.
Search, browse, and install AI assets from TokRepo — the open registry for AI skills, prompts, MCP configs, scripts, and workflows.
claude mcp add tokrepo -- npx -y tokrepo-mcp-server
Add to your MCP config (~/.cursor/mcp.json):
{
"mcpServers": {
"tokrepo": {
"command": "npx",
"args": ["-y", "tokrepo-mcp-server"]
}
}
}
codex mcp add tokrepo -- npx -y tokrepo-mcp-server
gemini settings mcp add tokrepo -- npx -y tokrepo-mcp-server
Once connected, your AI assistant can:
evidence_bundle, SBOM-lite, signature_evidence, blockers, and warningsevidence_bundle, SBOM-lite, and signature_evidencetokrepo_harvest before any push, including private package drafts, quality_gate, package manifest, SBOM-lite, and provenancetokrepo init-agent --target all so future agents know to call TokRepo during planningserver.json, A2A agent card, portable agent manifest, tool catalog, .well-known, agents.txt, llms.txt, and npm metadata are kept machine-readable for agents and registries| Tool | Description |
|---|---|
tokrepo_discover | Planning-time capability discovery from a task, environment, and constraints |
tokrepo_resolve_capability | Resolve a capability gap into a selected asset, verification evidence, install plan, lifecycle contract, next MCP calls, and CLI fallbacks |
tokrepo_search | Search assets by keyword/tag with agent_fit ranking |
tokrepo_detail | Get full asset details by UUID |
tokrepo_verify | Verify trust, hashes, permissions, policy, evidence_bundle, SBOM-lite, and signature_evidence before activation |
tokrepo_install_plan | Get agent-native install plan v2 with rollback, evidence_bundle, SBOM-lite, and signature_evidence |
tokrepo_codex_install | Dry-run, stage, or install a Codex skill safely |
tokrepo_installed | List TokRepo-managed Codex installs |
tokrepo_update | Dry-run or update managed Codex installs |
tokrepo_uninstall | Dry-run or remove a managed Codex install |
tokrepo_rollback | Dry-run or roll back a prior Codex install session |
tokrepo_handoff_plan | Read-only packaging plan with quality_gate and package manifest for reusable local work after a task |
tokrepo_harvest | Read-only package draft generator for reusable changed or explicit local files after a task |
tokrepo_push | Push one explicit asset to TokRepo after user confirmation |
You: "Find me a good MCP server for databases"
AI: [calls tokrepo_resolve_capability] → Ranks DBHub, Supabase MCP, PostgreSQL MCP and returns verification/install-plan evidence for the selected candidate
You: "What video assets should I install?"
AI: [calls tokrepo_resolve_capability] → Finds relevant skills, checks fit, trust, and policy, then asks before installing
You: "Install that cursor rules asset"
AI: [calls tokrepo_verify] → Checks trust_score_v2, permissions, blockers, and warnings
AI: [calls tokrepo_install_plan] → Reviews policy and actions
AI: [calls tokrepo_codex_install with dry_run=false, confirm=true] → Writes only after explicit confirmation
AI: [calls tokrepo_rollback with dry_run=true] → Shows exactly what would be removed before rollback
You: "We created a reusable project rule; save it for future agents"
AI: [calls tokrepo_harvest] → Returns explicit files, hashes, quality_gate, package drafts, SBOM-lite, provenance, metadata defaults, and private-by-default push guidance
AI: [asks for confirmation before tokrepo_push] → Uploads only reviewed files
Run this once in a project:
npx tokrepo init-agent --target all
It writes managed instructions to AGENTS.md, CLAUDE.md, GEMINI.md, Cursor rules, GitHub Copilot instructions, Cline rules, Windsurf rules, Roo rules, OpenHands microagents, Aider conventions, .mcp.json, and .tokrepo/agent.json. The rule is simple: during planning, when the agent sees a capability gap, it should call tokrepo_resolve_capability or tokrepo_discover before inventing a one-off local tool. After a task, agents can call tokrepo_harvest or run tokrepo harvest --changed --json to suggest reusable files for user-confirmed private publishing.
Registries and agents can discover this server through:
Use https://tokrepo.com/agent-ecosystem.json for agent marketplace submissions, starter templates, README snippets, install guides, and example projects. It contains canonical listing copy, ecosystem channels, target project-memory files, and verification commands.
TokRepo emits anonymous aggregate funnel events for tokrepo_resolve_capability, tokrepo_discover, tokrepo_verify, tokrepo_install_plan, install dry-runs, installs, harvests, handoffs, and pushes. It does not send task text or file contents. Disable with TOKREPO_TELEMETRY=0.
TokRepo is the open registry for AI assets — like npm for packages, but for AI skills, prompts, MCP configs, and workflows.
npx tokrepo search "query" / npx tokrepo install <uuid>MIT
FAQs
Agent-native MCP server for TokRepo - discover, verify, plan, safely install, hand off, and push AI assets from MCP clients.
We found that tokrepo-mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Company News
Open source maintainers are under more pressure than ever. We're raising our open source program from the Team plan to the Business plan, free.
Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.
Security News
During a UK cyber test, a Mythos 5 agent used sockpuppets, social engineering, and prompt injection to try to get a maintainer to merge malware.