Nymrel

io.github.nymrel由 GitHub 账号 nymrel 发布v1.4.0更新于 Oct 29, 2026

Four public utilities plus seven OAuth-protected Remote read tools for paired Nymrel devices.

已验证Streamable HTTP可网页运行网页搜索与抓取文件与存储数据与分析

概览

AI 生成的概览

Nymrel 托管 MCP 服务器，提供四个免凭据的公开只读工具（网站审计、域名查询、高尔夫球杆距离差、短视频开场评分），以及需 OAuth 的已配对设备文件读取。

可以做什么
  • 审计公开网站的 SEO、结构化数据与 AI 可发现性，返回评分、等级与建议
  • 推荐域名并对照公开注册记录检查可用性
  • 分析一组高尔夫球杆的击球距离差
  • 对短视频文稿开场进行钩子信号评分
  • 列出已配对的 Nymrel Remote 设备，并读取、列目录、按名称或内容搜索及查看文件信息，未完成的读取可用 callId 续取
适用场景
适合需要快速、无需凭据地检查网站、域名想法、球杆配置或视频脚本开场时使用；也适合通过 OAuth 让助手读取已配对 Nymrel Remote 设备上的文件。
运行要求
远程 streamable HTTP 端点 mcp.nymrel.com，无需安装包或本地运行时。四个公开工具无需任何凭据。Remote 文件工具需要 OAuth 授权，并至少有一台已配对的 Nymrel Remote 设备。
安装前请注意
Remote 工具会读取已配对设备上的文件，请只授权愿意暴露的设备与路径。域名仅在注册记录明确显示可注册时才报告为可用，查询无结论时视为未确认可用。网站审计会把目标网址发送到 Nymrel 服务。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Nymrel，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Web executable，通过 Streamable HTTP。 远程服务在工作区中配置后即可从网页运行时运行。

交给智能体安装

把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体，或 SourceWeft 对话中。智能体会读取该服务器的安装指南，先向你展示发布者、端点和登录方式，经你同意后再把它添加到你的客户端。密钥不会写进任何命令。

阅读 https://sourceweft.com/mcp/io.github.nymrel%2Fnymrel/install.md，并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前，先告诉我它的发布者、端点和登录方式，等我确认。不要把 API 密钥写进命令或我会提交的文件；问我密钥应从哪里获取。

查看智能体所依据的安装指南

其他 MCP 客户端

把它添加到你客户端的 mcpServers 配置中。

{
  "mcpServers": {
    "nymrel": {
      "type": "http",
      "url": "https://mcp.nymrel.com/mcp"
    }
  }
}

README

Nymrel hosted MCP

Production source for https://mcp.nymrel.com/mcp.

The public server intentionally exposes four credential-free read tools:

  • nymrel_audit_website
  • nymrel_find_domain
  • nymrel_golf_bag_gap
  • nymrel_social_clip_score

The vendored client contains additional Nymrel API contracts, but the hosted entrypoint removes them from tools/list until their provider or authorization boundaries are production-ready.

Result contracts and audit app

The four public data tools publish explicit success/error output schemas. Valid upstream payloads retain their original fields and evidence. Missing or invalid measurements produce INVALID_RESULT with isError: true; safe upstream errors also carry the MCP error bit. Text and structured results agree.

NYMREL_AUDIT_UI_ENABLED=true adds the fifth anonymous, read-only tool nymrel_render_website_audit and ui://nymrel/website-audit-v1.html. This flag is off by default. First call the audit tool, then pass its successful result and the requested URL to the renderer. Rendering makes no network request and does not authenticate the provenance of caller-supplied data. The data tools remain useful without a UI. The view labels missing measurements as unknown and uses text nodes for all report content.

The hosted asset is api/assets/audit-widget.html; it is independent of the older TypeScript harness's richer signed-report format. Test the hosted asset with node scripts/audit-ui-smoke.mjs from the repository root after installing the locked Node dependencies and Playwright Chromium. CI runs this synthetic host check on Linux/Node 24. It is not a substitute for ChatGPT acceptance.

After deployment, run scripts/verify_live_contract.py --public-results to require the new output schemas. After activating the view in a review deployment, add --audit-ui; that checks the exact catalog, resource metadata, and a synthetic render. For a deployment with Remote reads active, also supply --remote-read --issuer https://nymrel-remote-production.up.railway.app (the issuer has no trailing slash). The verifier's default remains compatible with the earlier live catalog for release comparisons.

Before production UI activation, refresh the ChatGPT tool catalog and run evals/workflow-adoption-cases.json: data-to-view flow, text fallback, mobile, theme changes, errors, and untrusted page content. Record the deployed commit, host, timestamp, and evidence. Roll back the view by setting the flag false; roll back the full contract change by redeploying the preceding release.

Remote reads preserve their backend payloads. A pending result must contain one unambiguous, non-empty call.id or callId; malformed pending results fail closed. _meta["nymrel/readState"] supplies the resume tool and forbids resubmitting the original operation. The plugin skill bounds status checks to three per turn; the proxy itself makes one backend call and never auto-replays.

See ../docs/chatgpt-workflow-adoption-2026-09-29.md for source-backed decisions, validation, and the remaining target-host gates.

Public tool workbench

NYMREL_TOOLS_UI_ENABLED=true independently adds nymrel_open_tools and ui://nymrel/tools-v1.html. The opener accepts {} from global navigation or a thread, and returns only the four-tool catalog. No analysis runs at launch. The view uses the bundled MCP Apps SDK and calls the existing data tools on form submission. It supports fullscreen only and applies host themes and deep links. In-app preferences store only display choices in this browser; submitted inputs and results are not persisted. A separate user button adds the selected result to conversation context when that host supports it.

The flag is off by default pending host acceptance. Test with npm run test:ui from the root and the real hosted wire tests. verify_live_contract.py --tools-ui checks the exact enabled catalog, entrypoints, launch, resource, and display/CSP metadata; it composes with --audit-ui and --remote-read --issuer .... See the extension record for the plugin-family inventory and acceptance matrix.

Activation-held private handoff adapter

This source also contains a disabled-by-default adapter for two future, authenticated tools behind the same @Nymrel MCP tag:

  • nymrel_submit_private_handoff
  • nymrel_get_private_handoff_status

The public and private contracts stay separate. The four production tools remain anonymous reads. Private submit/status calls use a caller token verified by a direct FastMCP RemoteAuthProvider, then proxy the accepted /api/agent/v1/handoffs REST contract. The MCP layer does not accept bearer tokens as tool arguments, hold a shared server credential, choose projects, or grant execution authority.

Setting NYMREL_PRIVATE_HANDOFF_MCP_ENABLED=true alone does not activate the bridge. NYMREL_PRIVATE_HANDOFF_OAUTH_ISSUER must identify a Nymrel-owned, root-level HTTPS OAuth issuer whose JWKS lives at /oauth2/jwks. The edge accepts only RS256 JWTs for https://mcp.nymrel.com/mcp, then enforces the single exact scope declared by the private tool being called. The Nymrel REST API independently verifies the same claims and maps the stable provider sub to its revocation and project-allowlist policy. An unrelated provider token fails closed with 401 and is not an activation. No provider secret, production token, tester identity, or real customer content is part of source control.

The pinned FastMCP 3.4.10 integration does not leave the OpenAI-required top-level securitySchemes field to implicit framework behavior. The hosted list-tools adapter publishes that field explicitly and retains the same value under _meta for older clients. Contract tests require noauth on every public tool and the exact OAuth scope on each private tool. The adapter also returns a complete _meta["mcp/www_authenticate"] challenge when a private call lacks a valid token or scope. A target-client OAuth canary remains mandatory before production activation.

Verify

The deployable runtime is pinned to Python 3.13. Create a clean environment and install the reviewed runtime plus test tools:

powershell
py -3.13 -m venv .venv.\.venv\Scripts\python.exe -m pip install --upgrade pip==26.2.1.\.venv\Scripts\python.exe -m pip install -r requirements-test.txt.\.venv\Scripts\python.exe -m pip check.\.venv\Scripts\python.exe -m ruff check --config pyproject.toml api tests.\.venv\Scripts\python.exe -m compileall -q api.\.venv\Scripts\python.exe -m pytest tests -q.\.venv\Scripts\python.exe -m pip_audit --strict --progress-spinner off -r requirements.txt

The private adapter's synthetic-only gate is:

powershell
.\.venv\Scripts\python.exe -m pytest tests/test_private_handoff.py -q

Deploy

Link this directory to the existing nymrel-mcp Vercel project, run the tests, then deploy from this exact clean commit through the existing protected release rail. Verify tools/list and one successful call per advertised tool after the production alias is ready. A source, PR, or local-test result is not a deployment receipt.

Do not deploy the private feature until its separate consent, retention, AuthKit tenant, tester-subject, dedicated-storage, project-allowlist, and synthetic production gates are approved. Until then, production proof remains exactly four public tools.

来源：hosted-mcp/README.md，提交 153b185

工具

11

nymrel_audit_website

Audit website discoverability

Audit one public website for SEO, schema, and AI discoverability. Returns the score, grade, discoverability status, detected schema types and recommendations supplied by the audit. Results may contain only an aggregate summary; additional per-check evidence may be included. Report robots.txt, sitemap.xml, llms.txt or AI-crawler checks only when their evidence is present in the result; absent checks are unreported, not proven by an aggregate score or PASS. Preserve unmeasured checks and empty recommendations without inventing findings. This is not a ranking guarantee or a security, legal-compliance or crawler-access certification.

输入参数url必填

nymrel_golf_bag_gap

Analyse golf bag gaps

Analyse carry-distance gaps for a structured list of golf clubs. Every club needs a ``name`` and its measured ``carry_distance_yards``; ``loft_degrees`` is optional. Pass 1 to 14 clubs with unique names. The upstream rejects any other key, so send only these three.

输入参数clubs必填

nymrel_find_domain

Find domain names

Suggest domain names and check each one against public registry records. A name is only reported available when the registry clearly says it is free. When the lookup is inconclusive `availability_checked` is false and `available` is false, so read that as "not confirmed free" rather than "already taken" - some TLDs have no registry service to ask. Confirm at a registrar before buying. `brandability_score` is an opinion about the string, not a claim about how the name will perform; `brandability_factors` reports what it was computed from so you can weigh it yourself.

输入参数tldskeyword_or_concept必填

nymrel_social_clip_score

Measure a short-video hook

Measure what the opening of a short-video transcript actually does. Returns each measured signal - opening word count, whether it opens on a hook pattern, whether it addresses the viewer, curiosity signals, whether the total word count sits in the platform's range - plus `hook_score`, a 0-100 rollup of exactly those signals, and suggested edits. `target_platform` accepts `tiktok`, `instagram_reels`, `youtube_shorts`, or `x`. The `reels` and `shorts` aliases normalize to their corresponding canonical IDs, which the result echoes. Every figure describes the text the caller supplied. This does not estimate reach, views, retention or virality; those are outcomes in the world that this tool never observes. Read `signals` to see what moved the score.

输入参数target_platformtranscript_text必填

nymrel_remote_list_devices

List remote devices

Use this when the user wants to see paired Nymrel Remote devices and current reachability before working with one.

无需输入参数。

nymrel_remote_read_file

read file

Use this when the user explicitly wants Nymrel Remote to read a UTF-8 text file with optional line pagination. Select the target with the optional device argument.

输入参数path必填devicelengthoffset

nymrel_remote_list_directory

list directory

Use this when the user explicitly wants Nymrel Remote to list a directory tree with a bounded recursion depth. Select the target with the optional device argument.

输入参数path必填depthdevice

nymrel_remote_get_file_info

get file info

Use this when the user explicitly wants Nymrel Remote to return metadata for a file or directory. Select the target with the optional device argument.

输入参数path必填device

nymrel_remote_search_files

search files

Use this when the user explicitly wants Nymrel Remote to search file and directory names below an allowed path. Select the target with the optional device argument.

输入参数path必填devicepattern必填maxDepthignoreCasemaxResults

nymrel_remote_search_content

search content

Use this when the user explicitly wants Nymrel Remote to search UTF-8 file contents below an allowed path. Select the target with the optional device argument.

输入参数path必填devicepattern必填maxDepthignoreCasemaxResultsfilePatternliteralSearch

nymrel_remote_get_read_result

Get remote read result

Retrieve the result of your pending Nymrel Remote read using its callId. If a file inspection returns pending, use this tool instead of submitting that inspection again. It never starts a new device operation. If still pending, wait briefly before checking again.

输入参数callId必填

版本历史

1
  1. v1.4.0最新Oct 29, 2026

评分

已满足适用检查项的 100%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通必需25 分
  • 已声明认证方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分