Elm Mcp V2 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Elm Mcp V2 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
⚠️ Personal passion project. NOT an official IBM product. Use at your own risk.
elm-mcp v2 is a single MCP server you install once. Behind the scenes it is itself a client of IBM's official engineering-ai-hub MCP server — it re-exposes the hub's tools (correct, config-aware reads/writes, OSLC linking, and SysML) and adds elm-mcp's own authoring / orchestration tools on top.
So your AI host (Bob, Claude, Cursor) connects to one server and sees the whole toolset.
┌──────────── 1 install ────────────┐
Bob ─────► │ elm-mcp v2 (this server) │
│ • elm_* authoring/orchestration │
│ • the hub's tools (federated) │
└───────────────┬───────────────────┘
│ hub token (configured once)
▼
engineering-ai-hub ──► IBM ELM| The hub | elm-mcp v2 adds | |
|---|---|---|
| Reads / search / schemas | ✅ correct, config-aware | — (we defer to it) |
| Create / update / link / changesets | ✅ correct | — (we defer to it) |
| SysML v2 models | ✅ (its big strength) | — |
| Login | ✅ gateway token | reused (one login) |
| Drafting · quality lint · interviews | — | ✅ elm_lint_requirement, … |
| Build orchestration, compliance, gap/impact reports, exports | — | ✅ (rolling in) |
The hub is the reliable scribe; elm-mcp is the opinionated author. We don't re-implement the primitives the hub already does correctly — we orchestrate them and add the authoring intelligence on top.
ELM_HUB_URL + ELM_HUB_TOKEN and the hub'stools light up alongside ours.
functional). The single install works either way.
The hub is IBM-hosted and must be provisioned for you (that's where the token comes from). v2 can't bundle it — it federates it.
No pip, no uv, no terminal commands you have to type. This works on locked-down machines: the server installs its own dependencies on first launch inside the process your host spawns — not as a command you run.
folder elm-mcp-v2-main. Keep it somewhere stable (your host runs the server from here — don't delete it).
{
"mcpServers": {
"elm-mcp-v2": {
"command": "python3",
"args": ["/path/to/elm-mcp-v2-main/run_server.py"],
"env": {
"ELM_HUB_URL": "https://your-hub-host/mcp/",
"ELM_HUB_TOKEN": "your-hub-bearer-token"
}
}
}
}"command": "/opt/anaconda3/bin/python3""command": "py"First launch self-installs mcp + httpx (~15–30s; needs PyPI access once), then instant. No ELM_HUB_TOKEN? It runs standalone with just elm-mcp's own tools. Fully air-gapped (no PyPI at all)? See bundled deps in the roadmap.
Say "update yourself" in your host (calls elm_update). It downloads the latest release from GitHub and replaces the files in the folder your host points at — no git, no manual re-download. Then fully restart your host. (Prefer doing it by hand? Re-download the ZIP and replace the folder.)
Dev /uvusers:pip install -e ., oruvx --from git+https://github.com/brettscharm/elm-mcp-v2 elm-mcp-v2, also work.
| var | meaning |
|---|---|
ELM_HUB_URL | the hub's /mcp/ endpoint |
ELM_HUB_TOKEN | bearer token for the hub gateway |
ELM_HUB_VERIFY_SSL | 1 to verify TLS (default 0 — test hubs use self-signed certs) |
Never commit the token. Keep it in your host's MCPenvblock (or a local.env, which is gitignored).
holds it open (elm_mcp_v2/hub.py).
list_tools returns our tools + the hub's (curated by _HIDE_HUB_TOOLS).call_tool runs our elm_* tools locally and forwards everything else tothe hub, streaming its content back unchanged (elm_mcp_v2/server.py).
What's here:
elm_health (federation status), elm_lint_requirement(quality gate), elm_update (in-place self-update for the download install).
run_server.py — self-heal launcher (download + point-at-a-file; installsits own deps on first launch).
Roadmap (porting elm-mcp's authoring value on top of the hub):
elm_draft_requirements / Plan-Mode deep-drill → structured draftcreate_requirement + changeset flow)elm_find_similar (semantic dedup over hub reads)elm_compliance_packet, elm_traceability_gaps, elm_change_impactexport_module_to_xlsx, charts, trace/audit reports(elm-mcp v1, the standalone server, lives at github.com/brettscharm/elm-mcp.)
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.