
Company News
Free Business Plan Upgrades for Open Source Maintainers
Open source maintainers are under more pressure than ever. We're raising our open source program from the Team plan to the Business plan, free.
topos-mcp
Advanced tools
Topos MCP server — structural code-quality tools (SIMPLE/COMPOSABLE/SECURE/NAVIGABLE) for AI coding agents.
Topos measures complexity, coupling, risky data flows, and agent cognitive load, then gives your agent a concrete target—from SLOP to PLATINUM.
Install · What it checks · Under the hood · Docs · Issues
Coding agents produce working code quickly. The harder question is whether the result is still easy to understand, safe to change, and well-fitted to the rest of the repository. Quality is the new currency.
Topos computes that signal from program structure—not from an LLM review or a style opinion—and returns concrete failure locations and next actions. It is fast enough to sit inside the agent loop: measure, edit, verify, repeat.
Tests check behavior. Topos checks whether the implementation is built to keep changing.
Grounded in category theory, written in Rust.
One binary. Every supported agent harness. A clean way back out.
Use the verified release installer:
curl -fsSL https://docs.krv.ai/topos/install.sh | bash
Or install with Homebrew:
brew install krv-labs/tap/topos
[!TIP] Prefer an editor-managed install? In VS Code or Cursor, search
@mcp toposin the Extensions view or choose Install MCP server. This is an alternative totopos install: your editor installs and manages the Topos MCP server for you.
topos install detects every supported MCP harness and lets you configure any—or all—of them from one interactive checklist:
topos install
┌ Which agent integrations do you want to configure?
│
│ ↑↓ move · space toggle · a all · enter confirm · esc cancel
│
│ ❯ ○ Claude Code (detected)
│ ○ Claude Desktop (detected)
│ ● Codex CLI (✓ active)
│ ● Gemini CLI (✓ active)
│ ○ GitHub Copilot CLI (detected)
│ ○ Cursor (detected)
│ ○ VS Code (detected)
│ ○ Google Antigravity (detected)
└
Restart the agents you configured, then ask:
"Use Topos to find this repository's worst structural problem, make one focused improvement, and verify the result."
[!IMPORTANT] Too many tools spray MCP servers across agent JSON files, scatter symlinks around your machine, then leave you to burn half a Claude session untangling the mess—or pull your own hair out doing it. Topos does not play that game. We follow a leave-no-trace policy:
topos statusshows every registration, whiletopos uninstallopens the same selector, previews exactly what will change, and removes everything Topos installed. If Topos makes it easy to do, it should be just as easy to undo.topos status topos uninstall
See the agent setup guide for permissions, manual configuration, and troubleshooting.
topos evaluate . -r
Topos discovers Python, Rust, JavaScript, TypeScript, C++, and Go automatically. Pass --language only when you want to narrow the run.
See Installation for platform support and alternative install paths.
Every file gets four independent verdicts:
Those verdicts roll up into one memorable quality medal without hiding which pillar failed:
| Medal | Criteria |
|---|---|
| 🏆 PLATINUM | Passes all 4 |
| 🥇 GOLD | Passes 3 of 4 |
| 🥈 SILVER | Passes 2 of 4 |
| 🥉 BRONZE | Passes 1 of 4 |
| ❌ SLOP | Passes 0, or fails to parse |
See the full metrics reference. Refactor guidance also surfaces control-flow cycles, load-bearing dependency edges, process bottlenecks, and optional Graphify knowledge-graph findings.
The four pillars are pairwise incomparable and form a sixteen-element evaluation lattice (a 4-cube); PLATINUM is their intersection. Labels below abbreviate the pillars as Simple, Composable, Sc = Secure, Navigable.
Topos is a self-contained Rust CLI and MCP server. Analysis runs locally; your source code is not sent to an external model or hosted analysis service.
| Component | Role |
|---|---|
| tree-sitter | Parses six languages and powers the native AST, CFG, CPG, PDG, and UAST representations. |
| GitNexus | Supplies the repository dependency graph scored by COMPOSABLE (topos depgraph generate). Requires npm install -g gitnexus@1.6.8. |
| Sighthound | Embedded in the MCP server for supplementary security findings; native CPG probes remain the SECURE scoring source. |
| Graphify | Optional advisory orphan and fragile-edge detection via topos graphify / topos_refactor(target="graphify"); does not affect the medal. Requires pip install graphifyy. |
The result is one agent-facing contract over several structural lenses: one score to optimize, explicit evidence for each failure, and a verification loop that can tell a real improvement from cosmetic churn.
openclaw skills install @Krv-Labs/toposhermes skills tap add Krv-Labs/topos then hermes skills install Krv-Labs/topos/toposio.github.Krv-Labs/toposTopos ships four ways:
topos CLI binary (macOS/Linux), via install.sh or a direct release download.topos-mcp, a thin bin-wheel bundling the MCP server binary (pip install topos-mcp / uvx topos-mcp), zero Python runtime.Crate layout and adapter details: docs.krv.ai/topos/architecture.
Topos is used internally at Krv Labs to manage AI-agent code output. We welcome bugs, ideas, and contributions.
Full documentation · Measures and metrics · Engineering notes
FAQs
Topos MCP server — structural code-quality tools (SIMPLE/COMPOSABLE/SECURE/NAVIGABLE) for AI coding agents.
The pypi package topos-mcp receives a total of 663 weekly downloads. As such, topos-mcp popularity was classified as not popular.
We found that topos-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Company News
Open source maintainers are under more pressure than ever. We're raising our open source program from the Team plan to the Business plan, free.

Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.

Security News
During a UK cyber test, a Mythos 5 agent used sockpuppets, social engineering, and prompt injection to try to get a maintainer to merge malware.