Mcp Server — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Mcp Server (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A Model Context Protocol server that exposes ExecuFunction tools to IDE clients like Cursor, Claude Desktop, and VS Code.
mcp:* (or specific scopes like projects:read, tasks:write)#### Claude Desktop
Edit ~/Library/Application Support/Claude/claude_desktop_config.json:
{
"mcpServers": {
"execufunction": {
"command": "npx",
"args": ["@execufunction/mcp-server"],
"env": {
"EXF_API_URL": "https://execufunction.com",
"EXF_PAT": "exf_pat_your_token_here"
}
}
}
}#### Cursor
Add to your Cursor MCP settings:
{
"execufunction": {
"command": "npx",
"args": ["@execufunction/mcp-server"],
"env": {
"EXF_API_URL": "https://execufunction.com",
"EXF_PAT": "exf_pat_your_token_here"
}
}
}#### VS Code
Configure in your MCP extension settings.
After configuration, restart your IDE to load the MCP server.
| Tool | Description | Mutates |
|---|---|---|
project_list | List all projects with status filtering | No |
project_create | Create a new project | Yes |
project_update | Update project name, summary, status, emoji | Yes |
project_archive | Archive a project (destructive) | Yes |
project_get_context | Get full project context (tasks, notes, signals) | No |
| Tool | Description | Mutates |
|---|---|---|
task_list | List tasks with project/status/phase/effort filters | No |
task_get | Get a single task with full details | No |
task_create | Create a new task with priority, phase, effort, acceptance criteria | Yes |
task_update | Update task fields (title, status, priority, phase, effort, scope) | Yes |
task_delete | Delete a task (destructive) | Yes |
task_complete | Mark a task as complete | Yes |
task_link_code | Link a task to a code file/commit | Yes |
| Tool | Description | Mutates |
|---|---|---|
note_list | List notes with type and project filters | No |
note_get | Get a single note with full content | No |
note_search | Semantic search across knowledge base | No |
note_create | Create a new note (markdown) | Yes |
note_update | Update note title, content, or type | Yes |
note_delete | Delete a note (destructive) | Yes |
| Tool | Description | Mutates |
|---|---|---|
people_search | Search contacts | No |
| Tool | Description | Mutates |
|---|---|---|
calendar_list_events | List calendar events for a date range | No |
calendar_create_event | Create a new calendar event | Yes |
calendar_update_event | Update a calendar event | Yes |
calendar_delete_event | Delete a calendar event (destructive) | Yes |
| Tool | Description | Mutates |
|---|---|---|
codebase_list | List indexed repositories | No |
codebase_register | Register a new repository for indexing | Yes |
codebase_status | Check indexing status and stats | No |
codebase_snapshot_status | Get latest index snapshot for a repository | No |
codebase_materialize_snapshot | Download a snapshot archive | No |
codebase_index | Full index: scan and upload all files | Yes |
codebase_index_incremental | Incremental index: git-aware, changed files only | Yes |
codebase_delete | Delete a repository and all indexed data (destructive) | Yes |
codebase_search | Semantic search across indexed code | No |
| Tool | Description | Mutates |
|---|---|---|
code_who_knows | Find experts for a code area | No |
code_compute_expertise | Refresh the expertise index | Yes |
code_history | Get commit history for a repository | No |
git_blame_symbol | Run git blame on a local file range | No |
| Tool | Description | Mutates |
|---|---|---|
code_memory_store | Store a fact about the codebase | Yes |
code_memory_search | Search stored code facts | No |
code_memory_list | List all stored code memories | No |
code_memory_delete | Delete a code memory (destructive) | Yes |
| Tool | Description | Mutates |
|---|---|---|
vault_list | List vault entries (metadata only) | No |
vault_create | Store a new encrypted secret | Yes |
vault_read | Decrypt and read a secret (audit-logged) | No |
vault_update | Update vault entry metadata | Yes |
vault_search | Search vault entries by name/description | No |
| Tool | Description | Mutates |
|---|---|---|
entity_graph | Traverse the entity relationship graph | No |
schema_introspect | Discover the full data model and entity types | No |
| Tool | Description | Mutates |
|---|---|---|
upload_document | Upload a PDF, Markdown, or text file into Knowledge | Yes |
DATASETS_ENABLED=true)| Tool | Description | Mutates |
|---|---|---|
dataset_list | List datasets | No |
dataset_create | Create a dataset | Yes |
dataset_query | Query records by filters/sorts | No |
dataset_mutate | Create/update/delete records (destructive) | Yes |
dataset_schema_modify | Add/update/delete fields (destructive) | Yes |
dataset_summarize | Summarize schema and sample rows | No |
dataset_facets | Value distributions for fields | No |
dataset_quality_check | Null rates, duplicates, uniqueness violations | No |
dataset_aggregate | Grouped metrics (count, avg, sum, etc.) | No |
dataset_bucket | Bucket numeric/date fields into ranges | No |
dataset_rank | Rank records by sorts or weighted formula | No |
dataset_analyze | Generate natural-language insights | No |
dataset_compare | Compare metrics across segments | No |
dataset_export | Export records as CSV | No |
dataset_join_rows | Self-join with alias-scoped fields | No |
dataset_compute_fields | Compute derived columns (lag, diff, rolling) | No |
dataset_timeseries | Time series analysis with transforms | No |
dataset_materialize_result | Save derived result as a new dataset | Yes |
dataset_plot_result | Validate chart payload from derived result | No |
DATASET_ONTOLOGY_ENABLED=true)| Tool | Description | Mutates |
|---|---|---|
object_find | Find objects by type and property filters | No |
object_links | Traverse graph links for an object | No |
object_action_run | Run a declarative action on an object (destructive) | Yes |
User prompt: "Get context for my auth project and create a task to fix the token refresh bug"
Tools invoked:
project_list — Lists projects to find the auth projectproject_get_context — Retrieves tasks, notes, and signals for the projecttask_create — Creates a new task with title, description, and project linkageResult: The AI reads existing project context (open tasks, recent notes) to avoid duplicates, then creates a well-scoped task linked to the correct project.
User prompt: "Find where we handle webhook signature verification"
Tools invoked:
codebase_search — Searches indexed code for "webhook signature verification"Result: Returns ranked code chunks with file paths, line numbers, and surrounding context. The AI can then read the matched files to answer follow-up questions.
User prompt: "Search for our deployment process and create a note summarizing the steps"
Tools invoked:
note_search — Searches the knowledge base for "deployment process"code_memory_search — Searches stored code facts for deployment-related memoriesnote_create — Creates a new note with a markdown summary of the deployment stepsResult: The AI synthesizes information from existing notes and code memories into a single reference note, linked to the relevant project.
The server also exposes project context bundles as MCP resources:
exf://projects/{id}/context - Full context bundle for a project| Variable | Required | Description |
|---|---|---|
EXF_API_URL | Yes | ExecuFunction API URL |
EXF_PAT | Yes | Personal Access Token |
# Install dependencies
npm install
# Run in development mode
npm run dev
# Test with MCP Inspector
npm run inspect
# Build for production
npm run build| Scope | Description |
|---|---|
mcp:* | All MCP operations (recommended for IDE use) |
projects:read | Read project data |
projects:write | Create/update projects |
tasks:read | Read tasks |
tasks:write | Create/update/complete tasks |
knowledge:read | Search/read notes |
knowledge:write | Create notes |
calendar:read | View calendar/free slots |
calendar:write | Create calendar events |
people:read | Search/view contacts |
people:write | Create/update contacts |
Make sure you've configured the env section in your MCP client config.
exf_pat_npm run inspect to test the server directlyMIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.