nuravolt
Energy intelligence platform for solar, wind and battery storage: per-inverter soiling forecasts, fault detection and RUL, BESS warranty and revenue ledger, digital twins, an operations agent with an MCP server, Iceberg/DuckDB/dbt lakehouse. Next.js + Python.
Warning. Serious findings were identified. Review the full report before connecting. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
jeffreymokumtech
Source: github_repo_search
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
nuravolt_list_plantsList the solar PV / BESS / Wind / Hybrid plants this API key has access to. Call this first to discover plant ids before any plant-scoped tool. Returns id, slug, name, asset_type, status, capacity, location.
nuravolt_list_invertersList the inverters at a plant with their model and rated capacity. ALWAYS call this before nuravolt_diagnose_inverter or nuravolt_get_inverter_classification to obtain a real inverter id — never invent ids.
nuravolt_get_soiling_forecastGet the 365-day soiling forecast for a PV plant. Returns daily predicted soiling ratio (SR), confidence bounds, and cleaning recommendations. Optionally includes rain-driven recovery events.
nuravolt_get_inverter_classificationDeterministic rule-based maintenance classification for one inverter. Returns likely cause (SOILING/SHADING/THERMAL/STRING_DEGRADATION/BYPASS_DIODE/INVERTER_DERATE/NORMAL), confidence, ETA, and recommended action. Fast and free — call before nuravolt_diagnose_inverter to get a grounded baseline.
nuravolt_diagnose_inverterRun AI diagnosis (Bedrock-backed) for a specific inverter using 30 days of digital-twin metrics. Returns severity, fault hypothesis, and recommended actions. PRECONDITION: call nuravolt_list_inverters first to obtain a real inverter id.
nuravolt_get_chartFetch a daily timeseries for a plant (or one inverter) over a range preset. Twin metrics (power_ac, temperature, voltage_dc, current_dc) return predicted vs actual; measured metrics (energy_daily, irradiance_poa/ghi, soiling_ratio, temp_ambient/module, power_dc) return daily telemetry. Returns summa…
nuravolt_get_irradiance_qualityAssess the quality of a plant's on-site irradiance measurement by comparing the on-site sensor track against the Open-Meteo reference model. Returns correlation, bias, RMSE, a monthly trend, and quality alerts (calibration drift, systematic deviation). If the result says no_data the plant has no on-…
nuravolt_get_bess_revenueReturn ancillary-services and wholesale revenue for a BESS plant over the last N days. Breakdown covers Dynamic Containment, Dynamic Moderation, Dynamic Regulation, Balancing Mechanism, Capacity Market, and wholesale arbitrage.
nuravolt_get_warranty_positionGet the BESS warranty guardian position for a battery plant: health score, state of health against the contractual capacity floor, cycle budget consumption, projected floor crossing, open violations, and the latest capacity test. Backed by the weekly audit dossier. Returns no_warranty_dossier when t…
nuravolt_get_optimizer_auditGet the dispatch strategy benchmark for a battery plant: capture ratio against a perfect foresight optimum on the same day ahead prices, revenue gap, and annualized gap. Always keep the perfect foresight framing from the returned note. Returns no_optimizer_audit when the audit job has not covered th…
nuravolt_list_ticketsList maintenance tickets with optional plant/status/priority filters. Status values: NEW, VALIDATED, ASSIGNED, IN_PROGRESS, DONE, WONT_FIX. Priority values: CRITICAL, HIGH, MEDIUM, LOW.
nuravolt_search_knowledge_baseSearch the organization's uploaded knowledge base (manuals, datasheets, runbooks, prior incident reports) for passages relevant to the query. Returns ranked excerpts with document title and chunk index for citation. Use BEFORE answering questions that depend on equipment specs, fault codes, or OEM p…
nuravolt_create_ticketCreate a maintenance/inspection ticket (status=NEW). PERSISTS to the database — the customer's ticketing queue will pick it up immediately. Provide an idempotency_key (any string) to make retries safe: replays return the original ticket id without creating a duplicate.
nuravolt_update_ticket_statusMove a ticket forward in the workflow. Allowed transitions: NEW → VALIDATED|WONT_FIX, VALIDATED → ASSIGNED|IN_PROGRESS|WONT_FIX, ASSIGNED → IN_PROGRESS|WONT_FIX, IN_PROGRESS → DONE|WONT_FIX. Writes a TicketHistory row. Provide idempotency_key to make retries safe.
nuravolt_comment_on_ticketAdd a comment to an existing ticket. The comment is attributed to the API key (mcp_key_<id>) so it's clear in the timeline that it came from an external AI assistant. Provide idempotency_key to make retries safe.
nuravolt_schedule_reportCreate a recurring email report schedule (creates a ScheduledReport row). PERSISTS immediately. Reports send as portfolio PDFs at 07:00 UTC on the scheduled day; a plantId narrows the report to that plant. Provide idempotency_key to make retries safe.
nuravolt_approve_cleaning_schedulePersist a cleaning schedule for a PV plant (creates a CleaningSchedule row). Use this AFTER analysing soiling forecast and economics. Provide ALL three economics: estimatedEnergyRecoveredMwh, estimatedRevenueRecoveredEur, estimatedCleaningCostEur (positive). The server computes net_benefit, ROI, pay…
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
jsPDF has Local File Inclusion/Path Traversal vulnerability
jsPDF has HTML Injection in New Window paths
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used
Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
AGENT_KEY_ENV_FILEBETTER_AUTH_SECRETSession signing (openssl rand -base64 32)DEMO_EMAILDEMO_PASSWORDHOSTNAMEINTERNAL_API_SECRETSTRIPE_SECRET_KEYSelf-service billing (the demo org has enterprise entitlements without it)STRIPE_WEBHOOK_SECRETREQUESTS_CA_BUNDLESSL_CERT_FILEEARTHDATA_USERNAMEEARTHDATA_PASSWORDEARTHDATA_TOKENLAKE_BUCKETThe S3 lakehouse; LAKE_ENV=dev uses a local folderAWS_REGIONAWS_ACCESS_KEY_IDBedrock: Shams chat, briefings, alert narration, knowledge base embeddingsAWS_SECRET_ACCESS_KEYBedrock: Shams chat, briefings, alert narration, knowledge base embeddingsSTRINGS_PER_MPPTNURAVOLT_AI_CLASSIFY_ENABLEDNURAVOLT_AI_DEMO_MODENEXT_PUBLIC_APP_URLNEXT_PUBLIC_ENABLE_LEMLIST_TRACKERNEXT_PUBLIC_POSTHOG_KEYPORTDependencies
94 runtime dependencies (26 dev), 1 flagged: puppeteer-core
Tool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
17/17 tools missing one or more hints — nuravolt_list_plants (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); nuravolt_list_inverters (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); nuravolt_get_soiling_forecast (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +14 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tool inputs are validated
16/17 tool handlers declare input schemas (94%)
Declare an inputSchema with zod/joi/yup on every tool definition.
License file
No license file
Add a LICENSE file (MIT, Apache-2.0, etc.).
Tool test coverage
Only 2/17 tools referenced in tests (12%)
Write tests that reference each tool by name so every tool has at least one test.
Secrets stay with their owner
9 secrets sent to a request target we could not resolve (INTERNAL_API_SECRET → dynamic, INTERNAL_API_SECRET → dynamic) — often a configured endpoint, not necessarily third-party
Audit where credentials are sent. A NOTION_TOKEN should only reach api.notion.com — never a third-party host.
Secrets not logged
1 secret value sent to log
Redact or omit secret values from log output.
Production dependencies are patched
4 critical, 29 high severity in production deps — jspdf@3.0.1 (critical), jspdf@3.0.1 (critical)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Dev dependencies
2 critical/high in dev-only deps (does not ship to users)
Upgrade dev dependencies when convenient.
Dependency freshness
5/94 production deps abandoned (no release in 2+ years): wpapi@2022-06-29 (4.2y), parquetjs@2022-09-23 (4y), prop-types@2023-08-24 (3.1y)
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/jeffreymokumtech/nuravolt)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check