Nicktools Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Nicktools Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A knowledge graph MCP server for research with source provenance. 55 operations across 5 meta-tools, a four-tier web capture pipeline, and a self-documenting session system — all backed by Neo4j.
Built over 15 days through 41 human-AI collaboration sessions. Includes a proof-of-concept knowledge graph (5,276 nodes, 9,699 relationships) from real investigative research.
Most memory and research tools for LLMs store text in flat files or vector databases. Claims accumulate without attribution. Sources are read but never archived. Context is lost between sessions. When you need to verify something you wrote last week, you're back to searching.
nicktools takes a different approach: the knowledge graph is the primary research output. Every entity links to sources via evidence edges. Every source is archived with provenance tracking. Every session is recoverable from the graph. When Claude's context window resets, the system remembers what already failed and what was already found.
graph(operation, params) → 10 ops Entity CRUD, relationships, evidence, graph analytics
research(operation, params) → 18 ops Web capture, archiving, source management
entry(operation, params) → 5 ops Lifestream entries, session tracking, phase management
core(operation, params) → 22 ops Scripts, files, system utilities, session health
query(cypher, database) → Direct Neo4j Cypher with EXPLAIN-based safetyKey capabilities:
SUPPORTED_BY edges. Sources are archived locally and submitted to the Wayback Machine. git clone https://github.com/yourusername/nicktools.git
cd nicktools
cp .env.example .env NEO4J_PASSWORD=your_password_hereSee .env.example for optional settings: workspace path, Wayback Machine credentials, public records API keys.
pip install -r requirements.txtIn the Neo4j Browser or cypher-shell, create two databases:
CREATE DATABASE nicktools IF NOT EXISTS;
CREATE DATABASE lifestream IF NOT EXISTS;The knowledge graph database name defaults to corcoran — override it in .env with NICKTOOLS_GRAPH_DB=your_name. The lifestream database name is lifestream by default (override with NICKTOOLS_ENTRY_DB).
APOC triggers: The server auto-configures APOC triggers on first startup. These create domain, tag, and temporal chain edges automatically when you create lifestream entries. No manual trigger setup needed — just make sure APOC is installed.
PYTHONUTF8=1 as a system environment variable before running the server. Python defaults to cp1252 on Windows, which crashes on non-ASCII output: [System.Environment]::SetEnvironmentVariable("PYTHONUTF8", "1", "User")Restart your terminal after setting this. Not needed on Linux/macOS.
python server.py --testThis checks Neo4j connectivity, database existence, APOC availability, and basic tool dispatch. On a fresh install with empty databases, all 16 core operations should pass.
For Claude Desktop, add to your MCP configuration:
{
"mcpServers": {
"nicktools": {
"command": "python",
"args": ["path/to/nicktools/server.py"]
}
}
}The server starts in stdio mode and exposes all 5 meta-tools. Call any tool with operation="help" to get full documentation.
┌──────────────────────────────────────────┐
│ 5 Meta-Tools (MCP) │
│ graph · research · entry · core · query │
└───────────────┬──────────────────────────┘
│ TOOL_REGISTRY dispatch
┌───────────────▼──────────────────────────┐
│ 55 Tool Operations │
│ tools/graph/ · research/ · workflow/ · │
│ core/ │
└───────────────┬──────────────────────────┘
│ importlib.reload (~28ms)
┌───────────────▼──────────────────────────┐
│ Library Layers (lib/) │
│ L0: paths, db, io, schema, patterns │
│ L1: urls, entries, capture, browsing │
│ L2: sources, archives, write_engine │
└───────────────┬──────────────────────────┘
│
┌───────────────▼──────────────────────────┐
│ Neo4j Databases │
│ Knowledge Graph + Lifestream │
└──────────────────────────────────────────┘Adding a new tool operation costs zero MCP configuration changes — drop a Python file in tools/{group}/, add one line to the registry, and the dispatcher handles the rest. Tool modules reload on every call (~28ms), so edits take effect immediately without server restart.
For details: Architecture · Structure Map
Developed and tested on Windows only. The server and library code are pure Python and should work on Linux/macOS, but the browsing pipeline (Chrome CDP, nodriver) and some path handling have only been tested on Windows. The run_command operation defaults to PowerShell. Cross-platform testing has not been done.
No automated test suite. The --test flag runs a basic connectivity check, not a comprehensive test suite. Testing has been manual across 41 development sessions. Individual operations are well-exercised through real use, but there are no unit tests or CI.
Session intelligence requires Cowork mode. The audit watcher, session detection, and context recovery features depend on Cowork's audit.jsonl files and session filesystem layout. Without Cowork, the core tools (graph, research, entry, query) work normally, but session_health, session_recover, and watcher_status are unavailable.
Browsing tiers 2-3 require Chrome installed. The four-tier capture pipeline falls back to Chrome CDP and Chrome CLI when HTTP + readability fails. If Chrome isn't installed, these tiers are skipped and the pipeline falls through to Wayback CDX (Tier 4) for JS-rendered pages.
VPN can interfere with captures. VPN hooks can intercept Chrome's loopback connections and block Wayback Machine submissions. If you use a VPN, consider split tunneling for Python.
Neo4j Enterprise required for multi-database. Community Edition supports only one user database plus the system database. If using Community Edition, you'll need to put the knowledge graph and lifestream in the same database (which requires schema changes to avoid label collisions).
No Docker image. Deployment is manual (clone + pip install + Neo4j). A containerized deployment is not yet available.
Skills are not packaged. The research-draft, research-verify, graph-commit, and system-dev skills are designed for the development environment and reference internal paths. Adapting them for a new installation requires editing the skill files.
The proof-of-concept graph is domain-specific. The included Corcoran example demonstrates the data model, but adapting nicktools to a new research domain requires modifying lib/schema.py (entity types), lib/urls.py (source classification), and lib/audit_parser.py (domain keywords). See the Customization Guide.
The examples/corcoran/ directory contains a knowledge graph exported from real investigative research into the Corcoran Group real estate brokerage. 5,276 nodes across 14 types (Person, Agent, Organization, Event, Property, Source, and more) with 9,699 relationships. PII has been redacted.
Load it into Neo4j to explore how nicktools structures research data: evidence chains, entity resolution, geographic taxonomy, and temporal tracking.
tools/graph/USAGE.md, tools/research/USAGE.md, etc.) with routing guides and parameter documentation. Or call any tool with operation="help" for inline docs.See requirements.txt for pinned versions.
MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.