ToolCairnFreshness
ToolCairn continuously indexes open-source ecosystems. New tools and version metadata roll into the catalog throughout the day; existing tools have their health, popularity, and activity signals re-checked on a rolling schedule. By the time you query a tool, its public metadata typically reflects state from the last few hours.
When something stale slips through, the response carries a credibility signal so your agent can flag it instead of pretending the data is fresh.
Reliability
- Edge-cached reads. Public lookups are served through a global edge layer, so latency is dominated by your network — not the origin.
- Graceful degradation. If a single data source is temporarily unavailable, queries still return ranked results — just without that signal contributing to the rank.
- Idempotent writes. Calls like
report_outcomeandsuggest_graph_updateare safe to retry; duplicates are deduplicated server-side. - Backoff over breakage. Rate-limit responses include a
Retry-Afterheader. SDKs and the MCP server respect it.
Security posture
The shape of the defenses, not the secret-sauce. Anything below is verifiable from the outside.
TLS everywhere
All traffic is HTTPS. HTTP requests are redirected; HSTS is set on the apex with preload eligibility.
Token-based auth
Browser sessions and API access use signed JWTs with short-lived access tokens and rotation on the server side. See HTTP API → Authentication for the contract.
Strict transport headers
The web app ships a strict Content-Security-Policy plus standard hardening headers (HSTS, X-Content-Type-Options, Referrer-Policy, Permissions-Policy). Current grade is A/A+ on third-party scanners.
Per-route rate limiting
Auth, billing, and admin paths are rate-limited at the edge with fail-closed behavior on cache failure — preventing accidental policy bypass during outages.
Provenance on releases
The npm package @neurynae/toolcairn-mcp is published with Sigstore provenance; verify the tarball against the GitHub commit that built it via npm audit signatures.
What we collect
The MCP server sends lightweight tool-call metadata to ToolCairn — tool name, duration, success or error status. This powers product analytics and service health. We do not send your prompts, your agent's response bodies, or the contents of files in your project.
Per-project state (the .toolcairn/ directory in your repo) and your sign-in credentials (at ~/.toolcairn/credentials.json, mode 0600) stay on your machine. Credentials expire 90 days after sign-in.
Responsible disclosure
Found a security issue? Please email security@neurynae.com with details. We acknowledge in 1 business day, target a fix within 7 days for high severity, and will credit you in the changelog if you wish.
For functional bugs and feature requests, open an issue on GitHub.