sigrankSAFE
SigRank MCP — AI operator evaluation and token cascade efficiency tools. The yield cascade + live leaderboard as MCP tools any agent can call. On-device token scanner + tabbed TUI dashboard. npm i -g sigrank
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
SignalAF is the public brand. SigRank is the leaderboard and proof surface. The sigrank package reads local AI session logs, derives your token cascade, and publishes to the board at signalaf.com. Four token counts only. Never prompts or code.SignalAF is the brand. SigRank proves. MO§ESTM governs.
SigRank evaluates observable AI operator token-processing patterns—not AI model quality, cognition, work quality, employee productivity, or business value.
[](https://www.npmjs.com/package/sigrank) [](https://github.com/SunrisesIllNeverSee/sigrank-mcp/actions/workflows/ci.yml) [](https://github.com/SunrisesIllNeverSee/sigrank-mcp/actions/workflows/codeql.yml) [](https://github.com/SunrisesIllNeverSee/sigrank-mcp/actions/workflows/dependency-audit.yml) [](https://github.com/SunrisesIllNeverSee/sigrank-mcp/network/dependencies) [](./LICENSE) [](https://nodejs.org) [](https://signalaf.com) [
19 read · 3 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
change | read | The change to simulate (e.g. |
check-my-efficiency | read | Use Upsilon to pull local token telemetry and compute Yield, then compare the result against the SigRank public leaderboard. Shows your class tier (ARCH+ to IGNITER) and where you rank. |
compare-with-leader | read | Fetch the top operator from the SigRank leaderboard and compare their token efficiency metrics against yours. Shows the gap and what you |
compare_operators | read | Compares two operators side-by-side with a behavioral verdict. Fetches both profiles from the board and returns their yield, leverage, velocity, class, and rank side-by-side, plus a verdict explaining who is more efficient and why in power-user language. Use this when users ask |
compare_self | read | Compares an operator |
describe_power_user | read | Returns an explanatory description of what makes an AI power user, anchored in SigRank |
diagnose_cascade | read | Analyzes your token cascade and diagnoses where you |
enroll | read | Bind THIS device to your SigRank operator so your signed token runs cascade to the live board. Paste the key from signalaf.com → Settings → |
get_best_operator | read | Returns the top N operators on the SigRank leaderboard with behavioral framing in operator-language. Wraps get_leaderboard and adds plain-language interpretation of each top operator |
get_operator | read | Fetches one operator |
get_sigrank_standard_record | read | Build Upsilon |
self_improve | read | Runs the full self-improvement cycle in one call: (1) gets your current token pillars — either from the provided text or by running tokenpull on your local logs, (2) diagnoses where you |
simulate-improvement | write | Run a what-if analysis on your token mix: |
simulate_change | read | The first PRESCRIPTIVE SigRank tool — |
submit_paste | write | Ranks a paste of token counts locally and shows the cascade result (yield, leverage, velocity, class, card). This is a PREVIEW-ONLY tool — it does not publish to the board. The board |
submit_verified | write | Publish your LOCAL token runs to the SigRank board as a VERIFIED operator — the enrolled, signed path. Reads your pillars (tokenpull), builds the canonical Schema 1.0 snapshot per window, ed25519-signs it with your device key, and POSTs to /api/v1/snapshots. Requires |
tokenpull | read | Pull your LOCAL token usage from the platform |
tokscale_breakdown | read | Show a per-model breakdown of your token usage across all platforms detected by tokscale. Models under the threshold (default 1%) are lumped into |
tokscale_competitive_intel | read | Competitive intelligence for any AI tool company. Pass a target tool (by tokscale client slug like |
tokscale_device_profile | read | Device fingerprinting: profiles this machine |
tokscale_market_share | read | Complete AI tool market share analysis from your local tokscale data. Aggregates per-model usage by client (AI tool) and computes each tool |
tokscale_model_trends | read | Model adoption trends over time from your local tokscale data. Combines monthly aggregates with per-day contribution data to build a model-level adoption timeline: each model |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (2 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (17)
repo_lib.cpython-314.pyc
.gitleaks.toml
.mcpbignore
.pre-commit-config.yaml
} from "../../analytics/cascade.mjs";
} from "../../lib/constants.mjs";
import { ALL_PLATFORMS } from "../../adapters/index.mjs";import { LEADERBOARD_METRIC } from "../../lib/constants.mjs";import { handleGetSigRankStandardRecord } from "../../tools/standard-record.mjs";anthropic: `http://127.0.0.1:${upstreamPort}`,openai: `http://127.0.0.1:${upstreamPort}`,upstreams: { anthropic: `http://127.0.0.1:${upstreamPort}`, openai: "https://api.openai.com" },next, react, react-dom, @types/node, @types/react, @types/react-dom, typescript
ccusage, tokscale, @resvg/resvg-js, gifenc
3. **Signed submission:** Ranked submissions (`submit_verified`, `watch_tokenpull` with `submit:true`) are ed25519-signed with a device-bound key generated locally at enrollment. The board verifies th
sigrank.mcpb
4. **Read tools need no auth:** No API keys, no OAuth, no account needed to read the leaderboard or operator profiles. **Enrollment requires a connect code** from signalaf.com → Settings → New key (th
Gates applied: no_behavioural_pass.
d04cd5c841f7full audit observations/trust-audit/mcp-server/sunrisesillneversee__sigrank-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | d04cd5c841f7 | SAFE | B | 89 | first audit |
Questions
What is the sigrank MCP server?
SigRank MCP — AI operator evaluation and token cascade efficiency tools. The yield cascade + live leaderboard as MCP tools any agent can call. On-device token scanner + tabbed TUI dashboard. npm i -g sigrank
What tools does sigrank expose?
22 in total: 19 read-only, 3 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is sigrank safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does sigrank need?
It reads RELAY_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does sigrank run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as sigrank at 1.0.44.
How current is this page?
The grade is for one exact copy of the source (d04cd5c841f7), read on 2026-10-12. The repository is watched and re-audited when it changes.