weave (grunion-ai/weave) is an MCP server listed on the M8ven Trust Index. It scores 74 out of 100, grade C. It declares 54 tools. No publisher has claimed this listing.
Open-source, self-hosted alternative to Airtable, Fibery, Notion databases and ClickUp: a database and work management platform built for AI agents, agent-first (Claude Code, Codex, Cursor, any MCP client). Tables, relations, formulas, rollups, workflows, markdown/PDF documents, one SQLite file. REST, CLI, MCP server. Zero dependencies, MIT.
Warning. Serious findings were identified. Review the full report before connecting. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
grunion-ai
Source: github_repo_search
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
weave_schemaDescribe the whole workspace: spaces, tables, fields (with types, options, workflow states, relations, lookups, rollups, formulas), and entity counts.
weave_queryQuery entities in a table. Filters support dotted relation paths (e.g. ["Project.Name", "=", "Apollo"]). Operators: =, !=, <, <=, >, >=, contains, in, is-empty, not-empty. Combine with {and:[...]} / {or:[...]}.
weave_get_entityRead one entity in full: all field values (including computed lookups/rollups/formulas), document markdown, comments, activity.
weave_create_entityCreate an entity. values maps field names to values; relation fields accept entity names, ids, or "#publicId".
weave_update_entityUpdate entity field values by name (writable fields only; computed fields are read-only).
weave_delete_entityDelete an entity. Recoverable by default — it moves to the trash keeping its id, public id and links. Pass hard: true to purge it irreversibly (relations are unlinked cleanly).
weave_restore_entityRestore a soft-deleted entity from the trash, links intact.
weave_trashList deleted entities — one table, or the whole workspace when table is omitted.
weave_statsSummarise every column of a table in one read: numbers get filled/empty, sum, avg, median, min, max, p25, p75, range, stdev and a 10-bin histogram (raw and dressed in the column's costume); selects, multiselects, workflows, checkboxes and relations get a ranked distribution; dates get earliest, late…
weave_undoRevert the last entity mutation(s): field/doc/state/relation edits, creates, soft deletes, comments, file attachments. Schema changes and hard deletes are not undoable. Pass list:true to preview the stack without reverting.
weave_bulkOne write for a whole selection. op "set" writes values across every id; "link" links every id to targets through field; "move" re-creates each id in table by field name (same name, same type — unmatched fields, files and comments stay behind and are named in moved[].skipped) and trashes the origina…
weave_set_stateMove an entity to a workflow state (multistate field).
weave_linkLink entities through a relation field (bidirectional; inverse side updates automatically).
weave_unlinkRemove entities from a relation field, leaving both entities in place. targets takes ids, names, or "#publicId"; the inverse field on the other table follows.
weave_get_docRead an entity document as markdown. Entities can carry several document fields; omit field for the default (the table's first document field, usually "Description").
weave_set_docWrite an entity document. mode "replace" (default) or "append". field picks a document field; omit for the default.
weave_doc_revisionsA document's version history (Feature #225). Without seq: the revisions newest first as {seq, at, actor, len} — one per editing session (writes by one actor inside ten minutes fold into one). With seq: that revision with its text. field picks a document field; omit for the default.
weave_doc_restoreWrite a past revision back as the document's current text (Feature #225). An ordinary write: activity, undo and automations all see it, and the history keeps both the restored text and what it replaced.
weave_add_commentAdd a comment to an entity. Comments are their own thread on the entity page and ride the activity feed; delete one with weave_delete_comment.
weave_delete_commentDelete one comment from an entity. The comment id comes from weave_get_entity.
weave_searchUniversal search across the workspace, spaces, tables, and entities (names, documents, comments). Every result carries a stable permalink url.
weave_create_spaceCreate a space (top-level grouping of tables).
weave_create_tableCreate a table in a space (a Name text field and a Description document are added automatically). icon is `lucide:<name>` from weave_vocabulary.
weave_add_fieldAdd a field. Every type, its config keys and what it looks like in the grid: weave_vocabulary. Types: text, number, date, daterange, checkbox, toggle, url, email, select, multiselect, workflow, document, attachments, field, key, lookup, rollup, formula (relation fields use weave_add_relation). confi…
weave_check_formulaValidate a formula expression against a table BEFORE saving it — syntax, function names, field names — and, when the table has rows, preview the computed value on one real entity. The authoring loop: check → fix until ok:true → weave_add_field/weave_update_field with {expression} → read the cell bac…
weave_add_relationCreate a relation field. One targetDb: bidirectional — the inverse field is created automatically on the target table. targetDbs (a list of 2+ tables, which may include Workspace/Spaces and Workspace/Tables): a target-set (polymorphic) relation — one field whose values may point at rows of any membe…
weave_create_automationCreate an automation rule. trigger: {type: entity-created | field-updated | state-changed, field?, toState?}. actions: [{type: set-field, field, value} | {type: append-doc, text} | {type: add-comment, text}] — text supports {{FieldName}}, {{PublicId}}, {{Today}} templates.
weave_export_csvExport a table as CSV: one row per entity, one column per field, computed fields resolved. Multiselect and to-many relation cells use "; " separators.
weave_import_csvImport entities from CSV text. The header row maps to field names; multiselect and to-many relation cells use "; " separators. Computed fields and Public Id/Created At/Updated At columns are ignored.
weave_attach_fileAttach a file to an entity (base64 content).
weave_vocabularyEvery closed set a configuration value comes from, and what each choice looks like on screen: field types with how they render and which config keys they take, the option color palette, the icon names, number/date formats, document kinds, relation cardinalities, workflow state categories, rollup agg…
weave_update_spaceRename a space or change its description or icon. An icon is `lucide:<name>` from weave_vocabulary or a mark character; anything else is refused.
weave_delete_spaceMove a space to the trash (recoverable — its tables and rows go dark with it). Pass hard: true to purge it and every table in it for good.
weave_restore_spaceRestore a trashed space; its tables and rows come back with it.
weave_update_tableChange a table: name, description, icon (`lucide:<name>` from weave_vocabulary or a mark character; anything else is refused), noun (what one row is called — stored as the Name field's `term`; "invoice" makes the create action read "New invoice" and the puck count "3 invoices"), hiddenFields (names …
weave_move_tableMove a table into another space. Only its home changes — every row, field and relation stays exactly as it was. Refuses when the destination already holds (or holds in its trash) a table of the same name.
weave_duplicate_tableDuplicate a table's schema into a sibling named "<name> Copy" ("Copy 2", … until free) in the same space: every field with its full config, relations rebuilt as real paired fields (an external target grows a fresh inverse; a self-relation retargets into the copy), lookups and rollups re-pointed at t…
weave_delete_tableMove a table to the trash (recoverable — its rows go dark with it). Pass hard: true to purge table and rows for good.
weave_restore_tableRestore a table out of the trash: the table, its rows and their relations come back exactly as they were.
weave_update_fieldChange a field: rename it, retype it (values are migrated), or edit its config. config keys ride their own lanes — width (px, 60 minimum, null resets to auto), description (plain text: what the value represents and how it is written; null clears; on a view field it is the description size instead), …
weave_delete_fieldDelete a field and its values from every entity of the table. Not recoverable.
weave_apply_schemaApply a whole schema document — the array weave_schema returns — creating, updating and (with allowDestructive) deleting spaces, tables and fields so the workspace matches it. dryRun returns the plan without writing. Everything weave_schema emits round-trips, including option colors, widths, icons, …
weave_viewsSaved views: a named list of blocks, each a table plus an optional where and a view kind (table or board — a board groups by the first workflow field, falling back to the first select). action: list | get | create | delete | share | unshare. Sharing mints a capability token; the /view/<token> URL re…
weave_automationsAutomations already on a table: action list | describe (rules in prose) | update | delete. Create one with weave_create_automation.
weave_activityThe activity feed: every change weave recorded, newest first. Filter by entity, table, kinds, or since (ISO timestamp); pass id to read one event in full.
weave_auditThe workspace audit log: schema and account events with their actor.
weave_workspaceThe workspace record itself. action: get | update (name — alphanumeric — and description) | logo (contentBase64 + name + mime) | clear-logo.
weave_accountsAgent and human accounts. action: list | create (name, role: reader|writer|admin — the token is returned once) | delete | require-auth (on: true|false, which turns token auth on for the whole workspace) | invite (account — a one-time passkey registration token, 15 minutes, returned once; the URL is …
weave_keysThe keystore behind `key` (credential) fields: the field holds the NAME of a secret; the secret lives encrypted in a chmod-600 file beside the workspace. action: list (names, owners, sharing) | set (name, value) | share (name, account) | unshare (name, account) | delete. No MCP tool returns a secret…
weave_filesFiles already attached to an entity: action read (returns base64 content) | delete. Attach one with weave_attach_file.
weave_registryThe meta-model registries (Workspace/Workspaces, Spaces, Tables, Fields) whose rows ARE the schema. The registry lives once, at the weave root — the default workspace — and every row carries a Workspace relation naming the workspace it describes; a member workspace reports and rebuilds its own slice…
weave_relation_mapThe workspace relation map as a mermaid diagram: every table, relation and automation.
weave_export_jsonThe whole workspace as JSON — the human-readable interchange format, and the backup to take before a destructive apply. Attachment bytes are left out unless blobs is true; `weave export` always carries them.
weave_import_jsonReplace the workspace with a JSON export. Destructive: everything not in the document is gone.
WEAVE_ACTORWEAVE_APPLET_DEFAULTSWEAVE_APPLET_PASSCODEWEAVE_APPLET_TABLEWEAVE_BACKUP_DESTWEAVE_DATAWEAVE_HOSTWEAVE_KEYSTOREWEAVE_ORIGINnames the origin it binds to. Agents keep wv_ tokens.PORTTool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
54/54 tools missing one or more hints — weave_schema (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); weave_query (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); weave_get_entity (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +51 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Readable source code
1 file are minified or bundled, which is usually build output rather than concealment
Ship unminified, readable source.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/grunion-ai/weave)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check