Nanostores MCP (Valyay/nanostores-mcp) is an MCP server listed on the M8ven Trust Index. It scores 70 out of 100, grade C. It declares 12 tools. No publisher has claimed this listing.
The MCP server for Nanostores that scans your codebase with AST analysis to find stores, subscribers, and dependency chains, and can ingest live events to spot noisy, error-prone, or unused stores.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
Valyay
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
nanostores_scan_projectReturns the complete store/subscriber/relation index for the project. Use compact:true for a token-efficient directory-level overview (store counts by folder). Use the full mode (default) when you need to iterate over every entity or build a complete picture. Example: {compact: true} for directory o…
nanostores_store_summaryUse this when you need details about a specific store — its kind, file location, direct subscribers, and first-level derived relations. Accepts store id or name. For multi-hop dependency chains use nanostores_store_subgraph instead. Example: {name: "$counter"} or {storeId: "store:src/stores.ts#$coun…
nanostores_clear_cacheUse this when scan results seem stale or after making file changes that the server may not have detected. Clears the cached project index so the next nanostores_scan_project call performs a fresh scan.
nanostores_project_outlineUse this for a quick overview of Nanostores usage in the project — store kind distribution, top directories, and hub stores ranked by connectivity. Returns a compact summary instead of full store/subscriber lists (same scan data, smaller response). Use nanostores_scan_project when you need the compl…
nanostores_store_subgraphIf your question is 'what recomputes downstream when X changes?', use nanostores_store_impact instead — it gives the ordered causal chain in one call. Use this tool only when you need both directions: upstream sources AND downstream dependents together. Returns the BFS neighborhood within a configur…
nanostores_store_impactWhen you need to trace what recomputes if X changes, call this once — not nanostores_store_summary on each downstream store. Returns the full ordered downstream chain in a single response: computed stores that depend on X at hop 1, their dependents at hop 2, and so on. Subscribers appear at the same…
nanostores_pingUse this when you need to verify the MCP server is alive or check whether the runtime logger bridge is connected.
nanostores_store_activityUse this when debugging a specific store's runtime behavior — why it updates too often, what actions trigger changes, or whether it emits errors. Returns recent events, change frequency, action calls, and errors. Omit storeName to get activity across all stores. Example: {storeName: "$cart", kinds: …
nanostores_find_noisy_storesUse this when investigating performance issues or excessive re-renders. Returns stores ranked by activity — frequent changes, many action calls — to pinpoint bottlenecks. Example: {limit: 10} or {windowMs: 30000, compact: true}.
nanostores_runtime_overviewUse this when you want a high-level health check of the running app's state management. Returns active stores, error-prone stores, unused stores, and activity patterns. Example: {} or {windowMs: 60000, compact: true}.
nanostores_runtime_coverageCompare static analysis graph with runtime event data to find stores declared in the static graph but not observed in this runtime session, and stores seen at runtime but absent from the static graph (dynamic or unscanned). Use after running the app to verify instrumentation completeness. Example: {…
nanostores_docs_searchFind Nanostores documentation by topic or store kind. Use query for free-text search across guides, API references, and best practices. Use storeKind to get docs relevant to a specific store type (atom, map, computed, etc.). Combine both to search within store-relevant pages. To read full page conte…
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
When Vitest UI server is listening, arbitrary file can be read and executed
nanoid: non-secure generators can loop indefinitely with negative size
nanoid: Integer Overflow or Wraparound
Svelte SSR attribute spreading includes inherited properties from prototype chain
Svelte: SSR XSS via Insecure Promise Serialization in hydratable
Production dependencies are patched
0 critical, 2 high severity in production deps — nanoid@5.1.6 (high), nanoid@5.1.6 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Dev dependencies
1 critical/high in dev-only deps (does not ship to users)
Upgrade dev dependencies when convenient.
Dependency freshness
1/8 production deps stale: is-path-inside@2023-06-22 (3.2y)
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/valyay/nanostores-mcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check