Atlas / MCP servers / gohluke / dayze

dayzeBLOCK

mcp/gohluke/dayze-mcp

Dayze gives connected AI tools Life Context: your people, plans and memories in a private, correctable record. Hosted MCP (OAuth): https://dayze.com/api/mcp

Verdict
BLOCK
Grade
D
Trust score
69 /100
Exposed tools
14 14r · 0w · 0d
Transport
stdio · streamable-http
License
MIT
Stars
0
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://glama.ai/mcp/servers/gohluke/dayze-mcp)

Dayze gives connected AI tools Life Context: your people, plans and memories in a private, correctable record.

After you sign in, get_context_pack hands your AI the signed-in user's context (who matters, this week's plans, recent memories) over the Model Context Protocol (MCP). The public notable-people catalog (notable_*) is a separate feature and never touches your private record.

ChatGPT + iPhone first. Capture people, plans and moments in Dayze on your iPhone, then connect ChatGPT and ask about your own life. Cursor, Codex, Claude and other MCP clients use the same hosted endpoint.

Listed on LightNow: https://lightnow.ai/servers/com.dayze/life-context

[](https://lightnow.ai/servers/com.dayze/life-context)

Relationship intelligence

Dayze starts with the people in your life. Ask "When did I last see Maya, and what's next with her?" and your AI can:

  1. Resolve the person — resolve_person / get_people against your private Dayze Contacts.
  2. Show the linked moments — get_person_interactions returns the events, places and notes connected to that person.
  3. Show the evidence — explain_fact returns the source behind a claim, so the answer is traceable rather than guessed.
  4. Correct it — update_person, merge_people and the other write tools fix the record, so the next answer is right.

These four steps use the full endpoint (https://dayze.com/api/mcp). ChatGPT's compact profile is read-only: get_context_pack, get_people_context, get_events, search_dayze and related context reads, with corrections made in Dayze itself.

Connect ChatGPT

  1. ChatGPT → Settings → Connectors → add a custom connector.
  2. URL: https://dayze.com/api/mcp?tools_profile=compact
  3. Click Connect and sign in to Dayze (OA
Read from source at commit 8868d5762a1dOBSERVED · 2026-10-11
Advertisement
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code
claude mcp add dayze-mcp -- npx -y [email protected]
claude-desktop
{
  "mcpServers": {
    "dayze-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ]
    }
  }
}
03

Exposed tools (14)

14 read · 0 write · 0 destructive.

ToolRiskDescription
get_context_packreadLife Context pack for the signed-in Dayze user: identity + who matters (edges) + week calendar + semantic/recent memories. Optional query focuses memories. Requires API key or share token. Docs: https://dayze.com/docs/life-context ($0.20; API key required)
get_eventsreadUser calendar events (range: today|week|month|year|decade). Requires API key. ($0.10; API key required)
get_expensesreadList user expenses / cashflow summary. Requires API key. ($0.10; API key required)
get_life_contextreadGet the authenticated user\
get_life_graphreadLife-graph export: people nodes + person_connections edges. Optional event–people links. Requires API key. ($0.25; API key required)
get_memoriesreadUser memories from Dayze Agent. Pass query for semantic retrieval; omit for recent chronological. Requires API key. ($0.10; API key required)
get_peoplereadList Dayze Contacts (private CRM; table people). Each row includes contact_origin (personal|online|imported). Advertised name get_people is stable; hosted MCP also accepts get_contacts. Requires API key. ($0.10; API key required)
get_person_neighborhoodreadSubgraph around one person_id — profile plus all declared connections. Requires API key. ($0.15; API key required)
get_trackersreadList user trackers / habits / streaks. Requires API key. ($0.10; API key required)
notable_packreadKnowledge pack: profile + life-in-days + similar people + birthday peers (+ quality / upgrade hint). Timeline events include day_number. Best starting point for agent context. Example slug: albert-einstein. ($0.05)
notable_pack_premiumreadS-tier guaranteed pack (score≥85, timeline≥8, image, embedding). Errors if below bar. Use when you need high-quality, complete notable context. Example slug: elon-musk. ($0.10)
notable_profilereadFull notable-person profile JSON by slug. Use for bio, timeline, and metadata without similar people or life-in-days context. Example slug: taylor-swift. ($0.02)
notable_searchreadSearch the public Dayze notable-people catalog by name, occupation, or slug. Use when you need to find a person before fetching a pack. Example slug: albert-einstein. ($0.01)
searchreadSemantic search across the authenticated user life graph (events, people, memories). Requires API key. ($0.15; API key required)
04

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codePASS
L2Instruction surface (what it tells the agent)FAIL
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
declared (1 observation(s))
Shell
none-observed
Dependencies
not all pinned
Secrets in source
none-found

Findings (3)

CRITICALPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
<tool:get_context_pack>:1
Life Context pack for the signed-in Dayze user: identity + who matters (edges) + week calendar + semantic/recent memories. Optional query focuses memories. Requires API key or share token. Docs: https
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
HIGHPrompt injection · prompt.hide_from_user · CWE-94, CWE-1427
skills/dayze-life-context/SKILL.md:10
Private CRM is **Dayze Contacts**. Advertised MCP names stay `get_people` / `create_person` / `update_person` / `resolve_person` (stable for connectors). Call aliases `get_contacts` / `create_contact`
Why it matters. asks the agent to act without the user's knowledge
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@modelcontextprotocol/sdk
Why it matters. 1 dependency range(s) float
Fix. pin exact versions or ship a lockfile

Gates applied: critical_finding, instruction_override, no_behavioural_pass, undeclared_transfer.

Audited 2026-10-11 · audit v0.4.1 · source sha 8868d5762a1dfull audit observations/trust-audit/mcp-server/gohluke__dayze-mcp.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-118868d5762a1dBLOCKD69first audit
06

Questions

What is the dayze MCP server?

Dayze gives connected AI tools Life Context: your people, plans and memories in a private, correctable record. Hosted MCP (OAuth): https://dayze.com/api/mcp

What tools does dayze expose?

14 in total: 14 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is dayze safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (69/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does dayze need?

No credential environment variables were found in its source, so it appears to need none.

How does dayze run?

It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as dayze-mcp at 1.32.1.

How current is this page?

The grade is for one exact copy of the source (8868d5762a1d), read on 2026-10-11. The repository is watched and re-audited when it changes.

Advertisement