Atlas / MCP servers / thenavidm / slipway

slipwaySAFE

Name: slipway
Author: thenavidm

mcp/thenavidm/slipway

MCP server by thenavidm · agent tools · ai agents · claude code · Audited 2026-10-11

TypeScript framework for MCP servers and CLIs, for Claude Code, Codex and AI agents. Describe each tool once and Slipway ships both, with write safety, typed results and release checks built in.

Verdict

SAFE

Grade

Trust score

89 /100

Exposed tools

56 26r · 24w · 6d

Transport

—

License

Apache-2.0

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://www.npmjs.com/package/@thenavidm/slipway) [](https://github.com/thenavidm/slipway/actions/workflows/ci.yml) [](./LICENSE) [](https://youtube.com/@thenavidm?sub_confirmation=1) [](https://x.com/thenavidm) [](https://linkedin.com/in/thenavidm)

TypeScript framework for MCP servers and CLIs, for Claude Code, Codex and AI agents. Describe each tool once and Slipway ships it as an MCP server tool and a command line command, with write safety, typed results and release checks built in.

The two surfaces cannot drift apart. They are generated from the same tool list, and every call on either one runs through the same code: the same validation, the same guard, the same errors.

Built and maintained by Navid Moazzez.

Two ways to use it

Every server built on Slipway ships both, from one definition like this:

import { defineTool, slipway, z } from "@thenavidm/slipway";

const deleteNote = defineTool({
name: "delete_note",
title: "Delete a note",
description: "Delete a note forever. There is no undo and no trash.",
input: z.object({ id: z.number().int().describe("The note id.") }),
risk: "destructive",
positional: ["id"],
summary: ({

Read from source at commit b63ed3e246f4OBSERVED · 2026-10-11

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add slipway --env SOME_API_KEY=${SOME_API_KEY} -- npx -y @thenavidm/[email protected]

claude-desktop

{
  "mcpServers": {
    "slipway": {
      "command": "npx",
      "args": [
        "-y",
        "@thenavidm/[email protected]"
      ],
      "env": {
        "SOME_API_KEY": "${SOME_API_KEY}"
      }
    }
  }
}

Exposed tools (56)

26 read · 24 write · 6 destructive. Blast radius: 6 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`add_note`	write	Add a note to the list.
`api_post`	write	Post something.
`api_put`	write	Put something.
`api_raw`	destructive	Call any method of the API. A GET only reads; a POST writes, and a DELETE cannot be undone.
`book`	read	Book one slot on the calendar at a given time.
`chart`	read	Render the number of notes as a tiny PNG chart image.
`create_note`	write	Create a new note with a title and body text. Returns the new note.
`create_post`	write	Publish a post.
`create_topic`	write	Create a topic in a forum group, as the account.
`delete_media`	destructive	Delete one media file.
`delete_note`	destructive	Delete a note for good.
`delete_post`	destructive	Delete a post.
`draft`	write	Save a draft only you can see.
`drop_all`	destructive	Drop every record in the account, with no undo.
`export_all`	read	Export every note as one JSON document. Counts against the monthly export quota.
`export_archive`	read	Export every video
`get_book`	read	Read one book by its id, with its blurb.
`get_media_item`	read	Fetch a single media item by id. To reach anything else, use start_pick_session.
`get_note`	read	Read one note by its id.
`get_post`	write	Read one post by its id.
`get_thing`	read	Gets it.
`huge`	read	A tool whose input schema is far too large to load cheaply.
`imagine`	read	Generate four images from a prompt, which costs GPU time from the plan.
`import_media`	write	Import a media file from a URL.
`list_books`	read	List books in the catalog, two at a time, optionally by one author.
`list_jobs`	read	List recent generation jobs, newest first.
`list_notes`	read	List every note, newest first.
`list_posts`	read	List the posts.
`local_search`	read	Search the records synced to this machine from ${listed}. Fast, offline, and costs no API calls. If nothing is found, or the data may be old, run local_sync first.
`local_sync`	write	Copy every record one of ${listed} lists to this machine, page by page, so local_search can find them offline. Runs in the background, since a long list takes a while.
`mute_account`	read	Mute an account for a while, or for good when no duration is given.
`peek`	read	Look at one job by its id.
`photo_info`	read	Everything known about specific items, by uuid.
`ping`	read	Answer pong, to prove the server is alive and answering.
`probe`	read	Return the client
`publish`	write	Publish a post for everyone to see.
`publish_staged`	write	Publish a post that was staged earlier, by its container id.
`read_post`	write	Read a post back.
`refund_order`	write	Refund an order in full, which sends the money back to the buyer at once.
`remove`	destructive	Remove one item for good.
`rename_book`	write	Change a book
`rename_note`	write	Change a note
`render_video`	write	Start rendering a video from a title. Rendering runs on the service and takes a while.
`reply`	read	Reply in a chat.
`rerun_job`	write	Submit the same job again with the same settings.
`save_post`	write	Save a post as a draft, or publish it, which everyone can read at once.
`send_message`	write	Send a private message, which cannot be unsent.
`set_fields`	write	Set custom fields on a post, by name, to the values given.
`set_title`	write	Set the title on one item, by its uuid.
`slow_report`	read	Build a report that takes a long time, for testing timeouts.
`start_nothing`	write	Start a job but forget to say which one, for testing a broken service.
`start_pick_session`	write	Open a picker so the user can choose photos from their library.
`summarize`	read	Summarize every note.
`twice`	read	A tool that carries the same definitions twice in its input schema.
`vary_image`	read	Make variations of one generated image.
`whoami`	read	Say which account the server acts as.

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	PASS
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (2 observation(s))
Network: declared (1 observation(s))
Shell: none-observed
Dependencies: not all pinned
Secrets in source: none-found

Findings (8)

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

api_raw, delete_media, delete_note, delete_post, drop_all, remove

Why it matters. 6 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius