Stellify MCP Server (Stellify-Software-Ltd/stellify-mcp) is an MCP server listed on the M8ven Trust Index. It scores 52 out of 100, grade D. It declares 68 tools. No publisher has claimed this listing.
Enables AI assistants to incrementally build Laravel and Vue.js applications by creating file structures, methods, and code through natural conversation.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
Stellify-Software-Ltd
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
load_toolsEnable a group of situational tools that are kept OUT of the default set to save context (they cost tokens on every turn). Call this ONCE with the group(s) you need and those tools become available to call. Groups: "editing" (surgical statement-level edits + granular inspection: save_/create_method/…
get_stellify_framework_apiGet Stellify Framework API reference with full type signatures. Import from "stellify-framework". Returns composables (useForm, useAuth, etc.) with options/returns, utilities (Http, Collection, etc.) with methods/staticMethods, and validation rules. Each item includes summary, type signatures, and…
get_projectGet active project. Returns uuid, name, branches, and directories array.
create_fileCreate an empty file shell in a Stellify project. Returns file UUID. For PHP: type='class', 'model', 'controller', or 'middleware'. CONSTRAINT: API controllers must `return response()->json(...)` — a bare array/string leaves the response null and the API route 404s. For Vue: type='js', extension='v…
create_methodCreate a method in a file. Pass 'body' to include implementation. Async auto-detected from `await`. For significant methods, include context fields.
add_method_bodyAPPEND code to the end of an existing method that already has statements. (For a NEW method use create_method with its 'body' param. To REPLACE / CHANGE what a method does, use replace_method_body — do NOT delete and recreate the method.) Nested code is handled: the parser tracks brace/bracket/paren…
replace_method_bodyReplace what an existing method does — IN PLACE. Clears the method's current statements and re-parses your new code into fresh ones, KEEPING the method's UUID, name and parameters, so file.data, routes and click handlers stay wired. This is the surgical, cheap way to CHANGE a method: do NOT delete_m…
rename_variableRename EVERY occurrence of a variable within one method, atomically. This is the safe way to rename: editing a single variable clause only changes that ONE occurrence (occurrences are independent references, like retyping one occurrence in a text editor), which leaves the others behind and breaks th…
save_methodUpdate a method's properties. Use add_method_body to append code. For significant changes, include context fields: summary, rationale, references, decisions.
search_methodsSearch for methods in the project by name or within a specific file
search_attributesFind available PHP 8 attributes in Laravel (name, namespace, target, expected args) before adding them to files/methods. Three modes: no params → list categories (eloquent, queue, routing, …); category only → all attributes in it (e.g. eloquent → Fillable, Hidden, …); query → search names (e.g. "fil…
analyze_attributesAudit PHP 8 attribute usage across a project. Three modes: usage (default) → all attributes used + counts (optional file_type filter); missing → files of a file_type lacking a required attribute (e.g. FormRequests missing FailOnUnknownFields); search → files where an attribute contains a value (e.g.…
delete_methodDelete a method from a file by UUID. This permanently removes the method and all its code. Requires both the file UUID and method UUID.
get_methodGet a method by UUID. Returns the method data including its parameters and body.
search_filesSearch for files in the project by name or type
create_routeCreate a route/page. For API routes, you MUST pass BOTH controller AND controller_method UUIDs to wire execution. IMPORTANT: Both 'controller' (file UUID) and 'controller_method' (method UUID) are required together for API routes to execute code. Without both, the route won't run any code. Route p…
get_routeGet a route/page by UUID. Returns route details including name, path, and attached elements. Use this to look up a route you created or to find existing routes in the project.
save_routeUpdate a route/page. Wire to controller with both controller and controller_method UUIDs. For significant routes, include context fields.
delete_routeDelete a route/page from the project by UUID. This permanently removes the route. WARNING: This is destructive and cannot be undone. Any elements attached to this route will be deleted also.
search_routesSearch for routes/pages in the project by name. Use this to find existing routes before creating new ones. Returns paginated results with route details including UUID, name, path, and type. Use the returned UUID with html_to_elements (page parameter) or get_route for full details.
create_elementCreate a UI element. Provide page (route UUID) for root elements, or parent (element UUID) for children. **s-slot elements (for layouts):** Use type='s-slot' to create a slot placeholder in a layout. When a page uses the layout via `<x-layout-name>`, the page's children are injected where the s-slo…
update_elementUpdate a UI element. Data object: tag, classes, text, event handlers (method UUIDs), classBindings. Set 'name' on root elements to create Blade views (e.g. name="notes.index" → view('notes.index')). Slots: set 'name' on an s-slot to define a slot (name="default" is the default); set 'slot' on an el…
get_elementGet a single element by UUID. Returns the element data with all its attributes.
get_element_treeGet an element with all its descendants (children, grandchildren, etc.) as a hierarchical tree structure.
delete_elementDelete an element and all its children (CASCADE). Returns the count of deleted elements.
search_elementsSearch for elements in the project. Useful for finding elements by name, type, or content. Note: To reorder elements, use update_element to modify the parent element's 'data' array with the new order of child UUIDs.
html_to_elementsConvert HTML to Stellify elements. SILENT GOTCHA: non-ASCII text is mangled by DOMDocument (£→£, em-dash→â) — use ASCII, prefer SVG over emoji, or set such text afterwards with update_element. (@event handlers like @click/@keyup.enter ARE captured on creation — you do NOT need to re-set them; pass…
get_statementGet a statement by UUID. Returns the statement data including its clauses (code tokens).
create_statementCreate empty statement (step 1 of 2). Call add_statement_code next. Prefer create_statement_with_code for single call.
create_statement_with_codeCreate a statement with code in one call. Preferred over two-step create_statement + add_statement_code. Pass 'types' to specify TypeScript types for variables. The assembler infers the full type from code structure: - `ref([])` + type "Todo" → outputs `const todos: Ref<Todo[]>` - `ref(0)` + type "…
add_statement_codeAdd code to an existing statement. This is step 2 of 2 - call this AFTER create_statement. **ALTERNATIVE:** Use create_statement_with_code for a single-call approach that combines both steps. The statement must already exist (created via create_statement). This parses and stores the code. Example…
delete_statementDelete a statement from a file by UUID. This permanently removes the statement (import, variable, ref, etc.).
save_statementUpdate an existing statement. Use this to modify statement properties after creation. Always pass the containing method (and file, if known): when the statement lives in reused-by-reference code, this lets the platform fork just the edited statement into your project and leave the shared original un…
save_fileFinalize a file. Full replacement - call get_file first to update existing files. Required: uuid, name, type. For significant changes, include context fields: summary, rationale, references, decisions.
get_fileGet a file by UUID with all its metadata, methods, and statements.
delete_fileDelete a file from the project by UUID. This permanently removes the file and all its methods/statements. WARNING: This is destructive and cannot be undone. Make sure the file is not referenced elsewhere before deleting.
get_directoryGet a directory by UUID to see its contents. Use this to inspect directories returned by get_project. The project's data array contains directory UUIDs. Returns the directory name and list of files/subdirectories inside it.
create_directoryCreate a new directory for organizing files. Common directories: - 'js' for JavaScript/Vue files - 'css' for stylesheets - 'components' for reusable components IMPORTANT: Check existing directories first using get_project and get_directory before creating new ones.
save_directoryUpdate an existing directory. Use this to rename or modify directory properties.
broadcast_element_commandPush real-time UI updates via WebSocket. Use for SHOW/DISPLAY/DEMONSTRATE requests. Actions: update (modify element), create (ephemeral element), batch (multiple updates), delete. Changes are EPHEMERAL (not saved). For persistent changes, use update_element or html_to_elements.
create_resourcesScaffold a CRUD resource in ONE call: Model + Migration (+ Controller, + optional Service, + optional route files) from fields + relationships. MANDATORY: you MUST call search_code BEFORE this tool, every time — even for a small, fully-specified feature on an empty project ("it's quick to just build…
search_codeSearch the reusable-code library for an existing, proven unit that matches a requirement, ranked by fit. This is the RETRIEVE-don't-regenerate path: before scaffolding a feature from scratch with create_resources/create_file, search here first — a matching unit can be cloned in one call with reuse_c…
reuse_codeREFERENCE a reusable unit into your ACTIVE project — the canonical code is linked in place, never copied. Each reused file becomes a thin local shell whose methods resolve to the canonical originals at assembly time, so the code you get is byte-identical to the proven source and costs nothing to car…
list_forksList the curated FORK VARIANTS of a canonical unit — approved forks that descend from it, ranked by adoption. When a search_code candidate reports variants > 0, call this with its uuid to see the alternatives: each carries a summary, the submitter's NOTE (their case for why this take is useful), and…
variant_countsBULK check which of a set of units have curated fork alternatives — the cheap "badge" query. Pass the uuids you're working with (file/method) and get back a compact { uuid: count } map with only the non-zero entries. This is uuid→int, NO fork data — use it to decide which units are worth a list_fork…
get_contributionsReport the user's OWN contribution stats — how their shared code is being reused across the library. Use when they ask "has my code been reused?", "what have I earned?", or "how are my contributions doing?". Returns { total_reuses (times a stranger's project referenced your units), projects (distinc…
see_divergencesSee how PEERS changed the canonical code your project references — the reasoned divergences other projects made from units you reference ("someone on this code changed it, here's why"). Use it when adapting reused code: before you re-implement a change to a referenced unit, check whether another pro…
explain_divergenceExplain a divergence you just made — attach the WHY to a referenced unit your project forked. When you edit code that was referenced (not authored) here, copy-on-write forks a private copy; call this right after so other projects on the same canonical unit can see why you changed it (and, later, ado…
adopt_divergenceAdopt a peer's divergence — take their change to a unit you reference. Re-points your project's reference from the canonical unit to the peer's forked version, a granular swap that leaves the rest of the file untouched; the diverger earns on adoption. Use after see_divergences when a peer's reasoned…
submit_codeOffer a file or method the user OWNS into the shared reusable-code library for curator review. Use this when the user has built something reusable and wants to contribute it (e.g. "submit this", "share this with the library", "offer this for reuse"). REFERENCE MODEL: the user keeps ownership — appro…
run_codeExecute a method in sandboxed environment. Requires file and method UUIDs. Returns output, success, error, and optional benchmark data. CONSTRAINT: the sandbox blocks literal http://|https:// strings (exfiltration guard) — build any URL (success_url, redirects, webhooks) with the url('/path') helper…
run_migrationApply a migration against the project's tenant database (creates/updates tables). Migrations need elevated Schema/DDL privileges that run_code forbids, so they have a dedicated runner. Pass the migration file UUID (returned by create_resources). Run this after create_resources to actually create the…
run_testsRun every test in a studio test file (type 'test') and return per-test results: pass/fail, failure message, location, duration. Use this to prove code you've built or reused actually works. Runs are wrapped in a database transaction and rolled back — tests never permanently mutate project data. AUTH…
publishBundle a Vue component tree into an ESM loader served at /esm and attach its import-map to a page route, so the component renders in the browser without the editor. Pass the entry file UUID (the app.js mount file) and the route UUID of the page that hosts it. Run this after building a Vue component …
request_capabilityLog a missing framework-level capability. Creates a ticket in the Stellify backlog.
install_packageInstall a foundation package into the current project. Creates routes and other resources defined in the package manifest. Returns success with installed counts, or error with code: - PACKAGE_NOT_FOUND: Package name doesn't exist - PACKAGE_NOT_INSTALLABLE: Package is disabled - ALREADY_INSTALLED: P…
list_capabilitiesList the capability catalog - libraries and services that can be enabled for the project (e.g. Sanctum, Livewire, Vue, Stripe). Each capability includes: - name, category, description - type: "composer" (PHP) or "npm" (JavaScript) - determines whether it lands in composer.json or package.json - pac…
set_capabilityEnable or disable a capability (library/service) for the current project. Enabling adds the capability to the project so its packages are emitted into composer.json / package.json at build/export time (and may enable related framework features, e.g. Livewire directives). IMPORTANT: - Use list_capa…
analyze_performanceAnalyze execution performance from logs. Types: full, slow_methods, high_query_methods, high_memory_methods, failure_rates, trend.
analyze_qualityAnalyze Laravel code for quality issues. Types: full, relationships, fillables, casts, routes. Returns actionable suggestions.
get_settingGet a setting profile by name. Returns key-value pairs accessible via config() in code.
save_settingCreate or update a setting profile. Data is merged with existing values. Access via config('name.key') in code.
save_project_metaSet the ACTIVE project's App Store card metadata — its display name and description. These are what the Constellation store card renders, so set them whenever a project is built for (or headed to) the store. Owner-only. Does NOT publish the project (listing stays a manual review) and cannot touch is…
create_projectCreate a fresh, empty project for the user and make it their ACTIVE project. Use when starting work that belongs in its own project (e.g. a new Constellation module) instead of building inside the currently open one. The current project is untouched — the active pointer is simply repointed. Owner-on…
set_active_projectSwitch the user's ACTIVE project to another project they own or have been assigned to. All other tools operate on the active project, so use this to move between projects (e.g. back to a module project to rename or extend it). Fails with 403 for projects the user has no access to.
save_moduleSet a project module's name and/or description. Modules are the named groups files/routes are organised into (created via the 'module' param on create_file/create_route); the description documents what the module provides for anyone browsing or reusing it.
delete_settingDelete a setting profile from the tenant's settings table. WARNING: This permanently removes the entire setting profile and all its values. This cannot be undone. EXAMPLE: { "name": "vote" } This removes the "vote" setting profile entirely.
get_assembled_codeGet the assembled source code for a file — the full PHP class or Vue SFC as it would render. Returns the WHOLE file, so it is the single biggest source of wasted tokens when overused. HARD RULE: do NOT call this during a build. Call it AT MOST ONCE, at the very end, as a final sanity check. Every c…
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig
Axios is vulnerable to DoS attack through lack of data size check
STELLIFY_API_TOKEN"": "your-token-here"STELLIFY_API_URL"": "https://api.stellisoft.com/v1",STELLIFY_MCP_TELEMETRY_PATHTool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
68/68 tools missing one or more hints — load_tools (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_stellify_framework_api (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_project (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +65 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
License file
No license file
Add a LICENSE file (MIT, Apache-2.0, etc.).
Tests exist
No test files found
Add tests that exercise each declared tool.
Production dependencies are patched
0 critical, 14 high severity in production deps — @modelcontextprotocol/sdk@1.0.4 (high), axios@1.7.9 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Domain consistency
npm scope @stellisoft doesn't match GitHub owner stellify-software-ltd
Use the same org name across GitHub, npm, and your homepage so users can verify the publisher.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/stellify-software-ltd/stellify-mcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check