Unfragile

io.github.SavirincPublished by GitHub account Savirincv0.11.0Updated Nov 3, 2026

Search 2.2M tool actions for agents and robots, every result labelled. Find, verify, passports.

VerifiedSTDIODesktop onlyWeb Search & ScrapingDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Searches a 2.2M-action index of tools, MCP servers, APIs and CLIs, returning labelled, signed results and trust verdicts before an assistant installs or…

What you can do
  • Find the tool action that performs a task, by meaning and keyword search over 2.2 million actions
  • Get one verified software record for a need, with evidence, install snippet and alternatives, or a ranked list
  • Verify a tool, MCP server or package before use and get a verdict of trusted, caution, unverified or flagged
  • Resolve one intent into a record, verdict and invocation snippet in a single call
  • Fetch the raw Ed25519-signed trust passport for a record, or read live index statistics
When to use it
Useful when an assistant has to pick a tool, MCP server or package for a task and should check it before installing or calling it, or when you want a labelled shortlist rather than a guess.
Requirements
Runs locally via npx as a Node.js package and calls the public Unfragile API over the network. No account or key is required; optional environment variables set the API base URL, extra headers, a monitoring label, or a key for higher rate limits.
Before you install
Queries and targets are sent to the third-party Unfragile API. Verdicts are advisory: unverified or unchecked results should be reviewed first, and flagged ones avoided. The optional API key and custom headers are passed through the environment. The bundled CLI can block installs based on a verdict, and its force override is logged.

Installation

In SourceWeft

  1. Open Unfragile in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@unfragile/mcp-server

Search for everything an agent can invoke. Every result labelled. For humans, agents and robots.

Unfragile is the neutral search layer for developers, agents and robots. This package gives any MCP client (Claude Code, Claude Desktop, Cursor, Windsurf, Cline, your own runtime) seven tools over the Unfragile index: 2.2 million tool actions read from MCP servers, APIs, CLIs, SDKs, models, robots and devices, each checked by machine and labelled with what the check found.

  • Labelled, never softened. Every result carries one of: verified and signed · official · found in code, not yet checked · demo or tutorial · failed its last check. Labels are the instruments' verdict; no ranking, model or payment changes them.
  • Signed. Verified records carry an Ed25519 trust passport you can verify offline against the published public key.
  • Honest no. When nothing fits, unfragile_find says so and asks one question back. Retrieval and ranking are deterministic; the one language model in the system writes the single-sentence pick behind answer: true and may only choose among labelled results.
  • Free, no key. Every tool calls the public API at unfragile.ai.

Guides: for agents · for developers · for robots · API reference

Install

One line on a machine with Claude Code (prints the configuration block on any other machine):

bash
curl -fsSL https://unfragile.ai/install.sh | sh

Claude Code

bash
claude mcp add unfragile -- npx -y @unfragile/mcp-server

Claude Desktop, Cursor, Windsurf, Cline, any MCP client

Add to the client's MCP configuration (Claude Desktop: ~/Library/Application Support/Claude/claude_desktop_config.json; Cursor: .cursor/mcp.json; Windsurf: ~/.codeium/windsurf/mcp_config.json):

json
{  "mcpServers": {    "unfragile": {      "command": "npx",      "args": ["-y", "@unfragile/mcp-server"]    }  }}

Tools

ToolWhat it does
unfragile_findThe headline call. Arguments: task, limit (1–20), answer (boolean). The tool ACTION that does a task, across 2.2 million actions. Meaning search and word search fused, ranked by measured trust, reranked. Every result labelled. answer: true adds one definite pick with its reasoning, or an honest no with one question back.
unfragile_answerOne verified software record for a need, with evidence (tier, score, signed passport, freshness, adoption), a paste-ready install snippet and honest alternatives, or an honest no.
unfragile_searchA ranked list of software records with per-record evidence, for when a list beats the single pick.
unfragile_verifyVerify before invoke. A conservative verdict for a target, trusted · caution · unverified · flagged, with the signed passport attached. Never invoke a flagged target; treat unverified as review-first. Unknown is never safe.
unfragile_resolveOne intent in; one record, verdict, signed passport and invocation snippet out, in a single call.
unfragile_passportThe raw Ed25519-signed trust passport for a record, for programmatic policy checks, verifiable offline.
unfragile_statsLive index numbers by door type.

The command line: verify before you install

The same package ships an unfragile command.

bash
# Check a target before installing (exit code 1 = flagged, stop)npx -p @unfragile/mcp-server unfragile verify npm:postmark-mcp
# Guard a real install: verifies the target first, blocks on FLAGGEDnpx -p @unfragile/mcp-server unfragile guard -- claude mcp add pg -- npx -y @scope/pg-mcp

guard extracts the install target from a claude mcp add / npx / uvx command, verifies it, and blocks a flagged verdict (unless --force, which is logged). Every verdict is Ed25519-signed. If verification is unreachable the CLI says so and treats the target as UNVERIFIED; it never fails silently open.

Ask your agent

  • "Find the tool that refunds a Stripe payment and tell me its label."
  • "Which action turns off the living room lights? Verified ones only."
  • "Verify npm:some-mcp-package before installing it."
  • "Get the signed trust passport for the pick."
  • "How big is the index right now?"

The rules

  1. Labels are the instruments' verdict. Read the label before acting on a result.
  2. Never invoke a failed or flagged target. Treat found in code, not yet checked as review-first.
  3. An honest no is an answer. Do not fill the gap with a guess.
  4. Cite the passport. A verified result's url is its signed passport.

Rankings are never for sale. Vendors may pay to have their own record checked sooner, never to change an answer or a label.

How it works

Every tool calls the free public Unfragile API: /api/v1/find, /api/answer, /api/v1/search, /api/v1/verify, /api/v1/resolve, /api/v1/passport, /api/v1/stats. The search runs on Unfragile's own GPU: a meaning index and a word index over the actions, fused and reranked, with trust as a measured nudge, never a label change. How we check.

Environment variables

VariableDescriptionDefault
UNFRAGILE_API_URLAPI base URLhttps://unfragile.ai
UNFRAGILE_MONITORName your monitoring or test traffic: it is measured, never used to train the ranking—
UNFRAGILE_HEADERSExtra request headers as JSON, e.g. {"x-team":"qa"}—
UNFRAGILE_API_KEYOptional key for higher rate limits (CLI guard)(none)

Links

License

MIT

Source: README.md at commit e215b0d

Tools

7

unfragile_answer

THE headline call: describe what you need and get ONE verified answer from the Unfragile corpus — fresh (crawled weekly), tested (machine-verified with honest tiers), signed (Ed25519 trust passport) — plus a paste-ready install snippet and honest alternatives. Same question, same answer (stored per question for 24 h). It names one product only when it does the task and was checked by us, through its maker's own door when there is one; otherwise an honest 'no confident answer' — trust the abstention.

Parametersqueryrequired

unfragile_find

Find the tool ACTION that does what you need, across 2.2 million actions read from MCP servers, APIs, CLIs, SDKs, models, robots and devices. Say the task in plain words ('refund a payment', 'move the robot arm home', 'what's on my calendar tomorrow'); meaning search + word search, fused and ranked by measured trust. Every result carries its label: verified and signed · official · checked: not enough evidence yet · found in code, not yet checked · demo or tutorial · failed its last check. Never invoke a 'failed' result; treat 'checked' and 'found in code' as review-first.

Parameterskindtaskrequiredlimitnamedanswerintentsearch

unfragile_verify

Verify a tool, MCP server, or package BEFORE invoking or installing it. Returns a conservative verdict — trusted | caution | unverified | flagged — with the record's Ed25519-signed trust passport attached (verifiable offline against https://unfragile.ai/api/v1/trust-passport-public-key). RULE: never invoke or install a `flagged` target; treat `unverified` as review-first.

Parameterstargetrequired

unfragile_resolve

Agent-runtime resolution: one intent in, one verified record out — with verdict, Ed25519-signed passport, and a paste-ready invocation snippet in a single call. Returns an honest abstention when nothing qualifies.

Parametersintentrequired

unfragile_passport

Fetch the raw Ed25519-signed trust passport JSON for a record (by record page slug, record id, or npm package). For programmatic policy checks; verify offline against the published public key.

Parametersslugrequired

unfragile_stats

Live census of the verified corpus with honest tiers: listed, machine-verified, signed passports, official records, by envelope.

Takes no parameters.

Version history

5
  1. v0.11.0LatestNov 1, 2026
  2. v0.10.3Nov 1, 2026
  3. v0.10.2Oct 31, 2026
  4. v0.9.1Oct 29, 2026
  5. v0.3.2Sep 16, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts
  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts