TokRepo — AI Asset Registry

io.github.henu-wangPublished by GitHub account henu-wangv2.16.1Updated Oct 24, 2026

TokRepo MCP: tokrepo_discover, tokrepo_verify, tokrepo_install_plan for reusable AI assets.

VerifiedSTDIODesktop onlyDeveloper Tools Security & Monitoring AI & ML

Server details

Identifier: io.github.henu-wang/tokrepo-mcp-server
Transport: STDIO
Runtime: Desktop only
Trust: Verified
Published: Sep 16, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified the GitHub account henu-wang for this listing. That does not show the account is the product's maker.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.henu-wang%2Ftokrepo-mcp-server.svg)](https://sourceweft.com/mcp/io.github.henu-wang%2Ftokrepo-mcp-server?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

TokRepo MCP lets an assistant search a registry of reusable AI assets, verify their trust evidence, plan and manage installs, and prepare assets for publishing.

What you can do: Search and browse the TokRepo registry of skills, prompts, MCP configs, scripts and agents, with details and dependency edges by asset ID or keyword, and turn a task or capability gap into ranked candidates with match reasons and install commands. Verify trust before activation: content and install-plan hashes, permission envelope, policy, trust score, evidence bundle, SBOM-lite, signature evidence, blockers and warnings. Get install plans with policy decisions, rollback and verification, then dry-run, stage, install, list, update, uninstall or roll back managed Codex installs. Prepare reusable local work after a task: read-only handoff packaging plans and harvest drafts of changed or named,
When to use it: Use it when an assistant should look for an existing skill, prompt, MCP config or workflow before building a one-off tool, or when you want trust checks and a rollback plan before installing a third-party AI asset. Also useful for turning finished project work into a reusable package draft.
Requirements: Runs locally over stdio, typically via npx with Node.js 18 or newer. Needs an internet connection because it queries the tokrepo.com API. No accounts, API keys or headers are declared. The optional init-agent command writes instruction files into a project.

Before you install

Installing, updating, uninstalling and rolling back Codex installs write to local files; installs are dry-run by default and risky assets need staging or explicit approval. Harvest and handoff read local files, and push uploads an asset to TokRepo only after user confirmation. Anonymous aggregate funnel events are sent unless TOKREPO_TELEMETRY is set to 0; task text and file contents are stated not to be sent.

Installation

In SourceWeft

Open TokRepo — AI Asset Registry in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

TokRepo MCP Server

Agent-native MCP server for TokRepo: session bootstrap, capability discovery, search/detail, trust verification, install planning, Codex staging, lifecycle inspection/update/uninstall/rollback, handoff/harvest planning, and human-confirmed publishing of reusable AI assets.

[npm] [License: MIT]

Quick Start

Claude Code

Cursor / Windsurf

Add to your MCP config (~/.cursor/mcp.json):

json

{  "mcpServers": {    "tokrepo": {      "command": "npx",      "args": ["-y", "tokrepo-mcp-server"]    }  }}

{  "mcpServers": {    "tokrepo": {      "command": "npx",      "args": ["-y", "tokrepo-mcp-server"]    }  }}

OpenAI Codex / Gemini CLI

bash

codex mcp add tokrepo -- npx -y tokrepo-mcp-servergemini settings mcp add tokrepo -- npx -y tokrepo-mcp-server

codex mcp add tokrepo -- npx -y tokrepo-mcp-servergemini settings mcp add tokrepo -- npx -y tokrepo-mcp-server

What It Does

Once connected, your AI assistant can:

Discover during planning — turn a task or capability gap into structured candidate skills, prompts, MCP configs, scripts, and workflows
Resolve capability gaps — select a candidate with verification evidence, install plan, lifecycle contract, next MCP calls, and CLI fallbacks before local build
Search public AI assets by keyword or category with agent fit signals
Browse trending assets, filter by type (MCP, Skill, Prompt, Agent, Script)
Get details — full documentation, install instructions, and metadata
Verify trust — read-only content hash, install plan hash, permission envelope, policy, trust_score_v2, evidence_bundle, SBOM-lite, signature_evidence, blockers, and warnings
Plan before install — get install plan v2 with policy decisions, rollback, verification, evidence_bundle, SBOM-lite, and signature_evidence
Safe Codex install — dry-run by default; risky assets must be staged or explicitly approved
Lifecycle control — list, update, uninstall, and roll back managed Codex installs
Post-task harvest — inspect changed or explicit local files with tokrepo_harvest before any push, including private package drafts, quality_gate, package manifest, SBOM-lite, and provenance
Project memory — pair with tokrepo init-agent --target all so future agents know to call TokRepo during planning
Discovery surfaces — official MCP server.json, A2A agent card, portable agent manifest, tool catalog, .well-known, agents.txt, llms.txt, and npm metadata are kept machine-readable for agents and registries
Funnel visibility — anonymous aggregate events show whether agents actually discover, plan, install, hand off, and push reusable assets

Available Tools

Tool	Description
`tokrepo_session_init`	Session bootstrap with high-trust assets, project memory pointer, recent handoffs, and policy pack URL
`tokrepo_discover`	Planning-time capability discovery from a task, environment, and constraints
`tokrepo_find_for_task`	Atomic find action for a concrete task; returns ranked assets, match reasons, install command, and URL
`tokrepo_resolve_capability`	Resolve a capability gap into a selected asset, verification evidence, install plan, lifecycle contract, next MCP calls, and CLI fallbacks
`tokrepo_search`	Search assets by keyword/tag with `agent_fit` ranking
`tokrepo_detail`	Get full asset details by UUID
`tokrepo_edges`	Inspect requires, extends, and co-used asset graph edges before planning installs
`tokrepo_install_plan`	Get agent-native install plan v2 with rollback, evidence_bundle, SBOM-lite, and signature_evidence
`tokrepo_verify`	Verify trust, hashes, permissions, policy, evidence_bundle, SBOM-lite, and signature_evidence before activation
`tokrepo_codex_install`	Dry-run, stage, or install a Codex skill safely
`tokrepo_installed`	List TokRepo-managed Codex installs
`tokrepo_update`	Dry-run or update managed Codex installs
`tokrepo_uninstall`	Dry-run or remove a managed Codex install
`tokrepo_rollback`	Dry-run or roll back a prior Codex install session
`tokrepo_handoff_plan`	Read-only packaging plan with quality_gate and package manifest for reusable local work after a task
`tokrepo_harvest`	Read-only package draft generator for reusable changed or explicit local files after a task
`tokrepo_push`	Push one explicit asset to TokRepo after user confirmation

Example Conversations

You: "Find me a good MCP server for databases"AI: [calls tokrepo_resolve_capability] → Ranks DBHub, Supabase MCP, PostgreSQL MCP and returns verification/install-plan evidence for the selected candidate
You: "What video assets should I install?"AI: [calls tokrepo_resolve_capability] → Finds relevant skills, checks fit, trust, and policy, then asks before installing
You: "Install that cursor rules asset"AI: [calls tokrepo_verify] → Checks trust_score_v2, permissions, blockers, and warningsAI: [calls tokrepo_install_plan] → Reviews policy and actionsAI: [calls tokrepo_codex_install with dry_run=false, confirm=true] → Writes only after explicit confirmationAI: [calls tokrepo_rollback with dry_run=true] → Shows exactly what would be removed before rollback
You: "We created a reusable project rule; save it for future agents"AI: [calls tokrepo_harvest] → Returns explicit files, hashes, quality_gate, package drafts, SBOM-lite, provenance, metadata defaults, and private-by-default push guidanceAI: [asks for confirmation before tokrepo_push] → Uploads only reviewed files

You: "Find me a good MCP server for databases"AI: [calls tokrepo_resolve_capability] → Ranks DBHub, Supabase MCP, PostgreSQL MCP and returns verification/install-plan evidence for the selected candidate
You: "What video assets should I install?"AI: [calls tokrepo_resolve_capability] → Finds relevant skills, checks fit, trust, and policy, then asks before installing
You: "Install that cursor rules asset"AI: [calls tokrepo_verify] → Checks trust_score_v2, permissions, blockers, and warningsAI: [calls tokrepo_install_plan] → Reviews policy and actionsAI: [calls tokrepo_codex_install with dry_run=false, confirm=true] → Writes only after explicit confirmationAI: [calls tokrepo_rollback with dry_run=true] → Shows exactly what would be removed before rollback
You: "We created a reusable project rule; save it for future agents"AI: [calls tokrepo_harvest] → Returns explicit files, hashes, quality_gate, package drafts, SBOM-lite, provenance, metadata defaults, and private-by-default push guidanceAI: [asks for confirmation before tokrepo_push] → Uploads only reviewed files

Make Future Agents Discover TokRepo

Run this once in a project:

It writes managed instructions to AGENTS.md, CLAUDE.md, GEMINI.md, Cursor rules, GitHub Copilot instructions, Cline rules, Windsurf rules, Roo rules, OpenHands microagents, Aider conventions, .mcp.json, and .tokrepo/agent.json. The rule is simple: during planning, when the agent sees a capability gap, it should call tokrepo_resolve_capability or tokrepo_discover before inventing a one-off local tool. After a task, agents can call tokrepo_harvest or run tokrepo harvest --changed --json to suggest reusable files for user-confirmed private publishing.

Machine-Readable Listing

Registries and agents can discover this server through:

MCP server manifest: tokrepo.com/.well-known/mcp/server.json
TokRepo manifest: tokrepo.com/.well-known/tokrepo.json
Portable agent manifest: tokrepo.com/.well-known/agent.json
A2A agent card: tokrepo.com/.well-known/agent-card.json
Tool catalog: tokrepo.com/.well-known/tool-catalog.json
Trust manifest: tokrepo.com/.well-known/tokrepo-trust.json
Default agent policy pack: tokrepo.com/policy-packs/default-agent-policy.json
Eval evidence: tokrepo.com/evals/agent-discovery.json
Multi-agent compatibility: tokrepo.com/evals/multi-agent-compatibility.json
Agent memory schema: tokrepo.com/schemas/agent-memory.schema.json
Agent evidence bundle schema: tokrepo.com/schemas/agent-evidence-bundle.schema.json
Capability resolution schema: tokrepo.com/schemas/capability-resolution.schema.json
Harvest report schema: tokrepo.com/schemas/harvest-report.schema.json
Handoff package schema: tokrepo.com/schemas/handoff-package.schema.json
Agent text entry: tokrepo.com/agents.txt
Agent instructions: tokrepo.com/agent-instructions/tokrepo.md
Agent ecosystem distribution pack: tokrepo.com/agent-ecosystem.json
LLM crawler entry: tokrepo.com/llms.txt

Use https://tokrepo.com/agent-ecosystem.json for agent marketplace submissions, starter templates, README snippets, install guides, and example projects. It contains canonical listing copy, ecosystem channels, target project-memory files, and verification commands.

TokRepo emits anonymous aggregate funnel events for tokrepo_resolve_capability, tokrepo_discover, tokrepo_verify, tokrepo_install_plan, install dry-runs, installs, harvests, handoffs, and pushes. It does not send task text or file contents. Disable with TOKREPO_TELEMETRY=0.

Why TokRepo?

TokRepo is the open registry for AI assets — like npm for packages, but for AI skills, prompts, MCP configs, and workflows.

Curated assets — quality-reviewed, not a dump
Agent-native — every asset has machine-readable install contracts
Universal — works with Claude Code, Cursor, Codex, Gemini CLI, and any MCP client
CLI available — npx tokrepo search "query" / npx tokrepo install <uuid>

Requirements

Node.js >= 18
Internet connection (queries tokrepo.com API)

License

MIT

Source: README.md at commit a02ef9e

Tools

SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

v2.16.1LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 days25 pts
Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.
Auth declared10 pts
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
License10 pts