Nymrel

io.github.nymrelPublished by GitHub account nymrelv1.4.0Updated Oct 29, 2026

Four public utilities plus seven OAuth-protected Remote read tools for paired Nymrel devices.

VerifiedStreamable HTTPWeb executableWeb Search & ScrapingFiles & StorageData & Analytics

Overview

AI-generated overview

Hosted Nymrel MCP server offering four free public read utilities (website audit, domain lookup, golf bag gaps, short-video hook scoring) plus OAuth-protected…

What you can do
  • Audit a public website for SEO, schema and AI discoverability, with score, grade and recommendations
  • Suggest domain names and check availability against public registry records
  • Analyse carry-distance gaps across a list of golf clubs
  • Score the opening of a short-video transcript for hook signals
  • List paired Nymrel Remote devices and read, list, search or inspect files on them, with pending reads resumed by call ID
When to use it
Useful when you want quick, credential-free checks on a website, a domain idea, a golf club set or a video script opening, or when you need an assistant to read files on a paired Nymrel Remote device through OAuth.
Requirements
Remote streamable HTTP endpoint at mcp.nymrel.com; no package or local runtime. The four public tools need no credentials. The Remote file tools require OAuth authorization and at least one paired Nymrel Remote device.
Before you install
The Remote tools read files on paired devices, so scope access to devices and paths you are willing to expose. Domain availability is only confirmed when the registry clearly says a name is free; inconclusive lookups are reported as not confirmed. Website audits send the target URL to Nymrel's service.

Installation

In SourceWeft

  1. Open Nymrel in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.nymrel%2Fnymrel/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "nymrel": {
      "type": "http",
      "url": "https://mcp.nymrel.com/mcp"
    }
  }
}

README

Nymrel hosted MCP

Production source for https://mcp.nymrel.com/mcp.

The public server intentionally exposes four credential-free read tools:

  • nymrel_audit_website
  • nymrel_find_domain
  • nymrel_golf_bag_gap
  • nymrel_social_clip_score

The vendored client contains additional Nymrel API contracts, but the hosted entrypoint removes them from tools/list until their provider or authorization boundaries are production-ready.

Result contracts and audit app

The four public data tools publish explicit success/error output schemas. Valid upstream payloads retain their original fields and evidence. Missing or invalid measurements produce INVALID_RESULT with isError: true; safe upstream errors also carry the MCP error bit. Text and structured results agree.

NYMREL_AUDIT_UI_ENABLED=true adds the fifth anonymous, read-only tool nymrel_render_website_audit and ui://nymrel/website-audit-v1.html. This flag is off by default. First call the audit tool, then pass its successful result and the requested URL to the renderer. Rendering makes no network request and does not authenticate the provenance of caller-supplied data. The data tools remain useful without a UI. The view labels missing measurements as unknown and uses text nodes for all report content.

The hosted asset is api/assets/audit-widget.html; it is independent of the older TypeScript harness's richer signed-report format. Test the hosted asset with node scripts/audit-ui-smoke.mjs from the repository root after installing the locked Node dependencies and Playwright Chromium. CI runs this synthetic host check on Linux/Node 24. It is not a substitute for ChatGPT acceptance.

After deployment, run scripts/verify_live_contract.py --public-results to require the new output schemas. After activating the view in a review deployment, add --audit-ui; that checks the exact catalog, resource metadata, and a synthetic render. For a deployment with Remote reads active, also supply --remote-read --issuer https://nymrel-remote-production.up.railway.app (the issuer has no trailing slash). The verifier's default remains compatible with the earlier live catalog for release comparisons.

Before production UI activation, refresh the ChatGPT tool catalog and run evals/workflow-adoption-cases.json: data-to-view flow, text fallback, mobile, theme changes, errors, and untrusted page content. Record the deployed commit, host, timestamp, and evidence. Roll back the view by setting the flag false; roll back the full contract change by redeploying the preceding release.

Remote reads preserve their backend payloads. A pending result must contain one unambiguous, non-empty call.id or callId; malformed pending results fail closed. _meta["nymrel/readState"] supplies the resume tool and forbids resubmitting the original operation. The plugin skill bounds status checks to three per turn; the proxy itself makes one backend call and never auto-replays.

See ../docs/chatgpt-workflow-adoption-2026-09-29.md for source-backed decisions, validation, and the remaining target-host gates.

Public tool workbench

NYMREL_TOOLS_UI_ENABLED=true independently adds nymrel_open_tools and ui://nymrel/tools-v1.html. The opener accepts {} from global navigation or a thread, and returns only the four-tool catalog. No analysis runs at launch. The view uses the bundled MCP Apps SDK and calls the existing data tools on form submission. It supports fullscreen only and applies host themes and deep links. In-app preferences store only display choices in this browser; submitted inputs and results are not persisted. A separate user button adds the selected result to conversation context when that host supports it.

The flag is off by default pending host acceptance. Test with npm run test:ui from the root and the real hosted wire tests. verify_live_contract.py --tools-ui checks the exact enabled catalog, entrypoints, launch, resource, and display/CSP metadata; it composes with --audit-ui and --remote-read --issuer .... See the extension record for the plugin-family inventory and acceptance matrix.

Activation-held private handoff adapter

This source also contains a disabled-by-default adapter for two future, authenticated tools behind the same @Nymrel MCP tag:

  • nymrel_submit_private_handoff
  • nymrel_get_private_handoff_status

The public and private contracts stay separate. The four production tools remain anonymous reads. Private submit/status calls use a caller token verified by a direct FastMCP RemoteAuthProvider, then proxy the accepted /api/agent/v1/handoffs REST contract. The MCP layer does not accept bearer tokens as tool arguments, hold a shared server credential, choose projects, or grant execution authority.

Setting NYMREL_PRIVATE_HANDOFF_MCP_ENABLED=true alone does not activate the bridge. NYMREL_PRIVATE_HANDOFF_OAUTH_ISSUER must identify a Nymrel-owned, root-level HTTPS OAuth issuer whose JWKS lives at /oauth2/jwks. The edge accepts only RS256 JWTs for https://mcp.nymrel.com/mcp, then enforces the single exact scope declared by the private tool being called. The Nymrel REST API independently verifies the same claims and maps the stable provider sub to its revocation and project-allowlist policy. An unrelated provider token fails closed with 401 and is not an activation. No provider secret, production token, tester identity, or real customer content is part of source control.

The pinned FastMCP 3.4.10 integration does not leave the OpenAI-required top-level securitySchemes field to implicit framework behavior. The hosted list-tools adapter publishes that field explicitly and retains the same value under _meta for older clients. Contract tests require noauth on every public tool and the exact OAuth scope on each private tool. The adapter also returns a complete _meta["mcp/www_authenticate"] challenge when a private call lacks a valid token or scope. A target-client OAuth canary remains mandatory before production activation.

Verify

The deployable runtime is pinned to Python 3.13. Create a clean environment and install the reviewed runtime plus test tools:

powershell
py -3.13 -m venv .venv.\.venv\Scripts\python.exe -m pip install --upgrade pip==26.2.1.\.venv\Scripts\python.exe -m pip install -r requirements-test.txt.\.venv\Scripts\python.exe -m pip check.\.venv\Scripts\python.exe -m ruff check --config pyproject.toml api tests.\.venv\Scripts\python.exe -m compileall -q api.\.venv\Scripts\python.exe -m pytest tests -q.\.venv\Scripts\python.exe -m pip_audit --strict --progress-spinner off -r requirements.txt

The private adapter's synthetic-only gate is:

powershell
.\.venv\Scripts\python.exe -m pytest tests/test_private_handoff.py -q

Deploy

Link this directory to the existing nymrel-mcp Vercel project, run the tests, then deploy from this exact clean commit through the existing protected release rail. Verify tools/list and one successful call per advertised tool after the production alias is ready. A source, PR, or local-test result is not a deployment receipt.

Do not deploy the private feature until its separate consent, retention, AuthKit tenant, tester-subject, dedicated-storage, project-allowlist, and synthetic production gates are approved. Until then, production proof remains exactly four public tools.

Source: hosted-mcp/README.md at commit 153b185

Tools

11

nymrel_audit_website

Audit website discoverability

Audit one public website for SEO, schema, and AI discoverability. Returns the score, grade, discoverability status, detected schema types and recommendations supplied by the audit. Results may contain only an aggregate summary; additional per-check evidence may be included. Report robots.txt, sitemap.xml, llms.txt or AI-crawler checks only when their evidence is present in the result; absent checks are unreported, not proven by an aggregate score or PASS. Preserve unmeasured checks and empty recommendations without inventing findings. This is not a ranking guarantee or a security, legal-compliance or crawler-access certification.

Parametersurlrequired

nymrel_golf_bag_gap

Analyse golf bag gaps

Analyse carry-distance gaps for a structured list of golf clubs. Every club needs a ``name`` and its measured ``carry_distance_yards``; ``loft_degrees`` is optional. Pass 1 to 14 clubs with unique names. The upstream rejects any other key, so send only these three.

Parametersclubsrequired

nymrel_find_domain

Find domain names

Suggest domain names and check each one against public registry records. A name is only reported available when the registry clearly says it is free. When the lookup is inconclusive `availability_checked` is false and `available` is false, so read that as "not confirmed free" rather than "already taken" - some TLDs have no registry service to ask. Confirm at a registrar before buying. `brandability_score` is an opinion about the string, not a claim about how the name will perform; `brandability_factors` reports what it was computed from so you can weigh it yourself.

Parameterstldskeyword_or_conceptrequired

nymrel_social_clip_score

Measure a short-video hook

Measure what the opening of a short-video transcript actually does. Returns each measured signal - opening word count, whether it opens on a hook pattern, whether it addresses the viewer, curiosity signals, whether the total word count sits in the platform's range - plus `hook_score`, a 0-100 rollup of exactly those signals, and suggested edits. `target_platform` accepts `tiktok`, `instagram_reels`, `youtube_shorts`, or `x`. The `reels` and `shorts` aliases normalize to their corresponding canonical IDs, which the result echoes. Every figure describes the text the caller supplied. This does not estimate reach, views, retention or virality; those are outcomes in the world that this tool never observes. Read `signals` to see what moved the score.

Parameterstarget_platformtranscript_textrequired

nymrel_remote_list_devices

List remote devices

Use this when the user wants to see paired Nymrel Remote devices and current reachability before working with one.

Takes no parameters.

nymrel_remote_read_file

read file

Use this when the user explicitly wants Nymrel Remote to read a UTF-8 text file with optional line pagination. Select the target with the optional device argument.

Parameterspathrequireddevicelengthoffset

nymrel_remote_list_directory

list directory

Use this when the user explicitly wants Nymrel Remote to list a directory tree with a bounded recursion depth. Select the target with the optional device argument.

Parameterspathrequireddepthdevice

nymrel_remote_get_file_info

get file info

Use this when the user explicitly wants Nymrel Remote to return metadata for a file or directory. Select the target with the optional device argument.

Parameterspathrequireddevice

nymrel_remote_search_files

search files

Use this when the user explicitly wants Nymrel Remote to search file and directory names below an allowed path. Select the target with the optional device argument.

ParameterspathrequireddevicepatternrequiredmaxDepthignoreCasemaxResults

nymrel_remote_search_content

search content

Use this when the user explicitly wants Nymrel Remote to search UTF-8 file contents below an allowed path. Select the target with the optional device argument.

ParameterspathrequireddevicepatternrequiredmaxDepthignoreCasemaxResultsfilePatternliteralSearch

nymrel_remote_get_read_result

Get remote read result

Retrieve the result of your pending Nymrel Remote read using its callId. If a file inspection returns pending, use this tool instead of submitting that inspection again. It never starts a new device operation. If still pending, wait briefly before checking again.

ParameterscallIdrequired

Version history

1
  1. v1.4.0LatestOct 29, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts