{"apiVersion":"v1","directorySlug":"minimal-mcp-035ef62454","title":"Minimal","description":"Secure, declarative runtimes for Claude Code, Gemini, Codex, Pi, and more. Run multiple agents safely on your stack, from a verified software supply chain.","pageUrl":"https://www.mcpbundles.com/skills/minimal-mcp-035ef62454","connectPath":"importable","connectAction":"import_server","catalogListing":false,"bundleSlug":null,"listingKind":"remote_mcp","kind":"provider","transportUrl":"https://minimal.dev/api/mcp","hostedMcpUrl":null,"toolCount":9,"toolInventoryStatus":"observed","refreshedAt":"2026-11-03T13:26:00.516172+00:00","registryName":"dev.minimal/minimal-mcp-035ef62454","registryVersion":"2026.11.3","registryEligible":true,"tools":[{"name":"search_packages","description":"Find catalog packages by name/topic text, category, and/or minimum advisory severity. Call this first when the user names a package you haven't looked up, or asks 'which packages have CRITICAL/HIGH advisories'. Returns listing-tier records (name, version, categories, advisory rollup) at the latest commit, ranked by relevance.","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","properties":{"limit":{"type":"integer","maximum":50,"minimum":1},"query":{"type":"string"},"offset":{"type":"integer","maximum":9007199254740991,"minimum":0},"category":{"type":"string"},"severity":{"enum":["CRITICAL","HIGH","MEDIUM","LOW","UNKNOWN"],"type":"string"}}},"title":"Search packages","annotations":{"readOnlyHint":true,"untrustedContentHint":true},"logicalName":"search_packages","displayName":"Search packages"},{"name":"get_package","description":"Full record for one package — description, version, dependencies, direct advisories, OpenSSF scorecard, and links. The scorecard is OpenSSF Scorecard data, not a Minimal rating: `scorecard.source` is `depsdev` or `openssf-api` when OpenSSF ran the scan and `ossf-self` when Minimal ran OpenSSF's tool itself, and `scorecard.repository` is the repository scored. `scorecard.overall` is Scorecard's 0-10 aggregate and `scorecard.checks` the raw 0-10 per-check scores (-1 = not applicable); `scorecard.d","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["name"],"properties":{"sha":{"type":"string","pattern":"^[0-9a-fA-F]{7,40}$"},"name":{"type":"string","pattern":"^[a-z0-9][a-z0-9._-]*$"}}},"title":"Get package","annotations":{"readOnlyHint":true,"untrustedContentHint":true},"logicalName":"get_package","displayName":"Get package"},{"name":"get_package_versions","description":"Version-history timeline for a package (newest first), each entry with its commit sha, version, and file/line diff stats. Call this when the user asks what versions shipped or when a version changed. Passing `sha` requires authentication, which this server cannot present yet.","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["name"],"properties":{"sha":{"type":"string","pattern":"^[0-9a-fA-F]{7,40}$"},"name":{"type":"string","pattern":"^[a-z0-9][a-z0-9._-]*$"}}},"title":"Get package version history","annotations":{"readOnlyHint":true,"untrustedContentHint":true},"logicalName":"get_package_versions","displayName":"Get package version history"},{"name":"get_advisories","description":"Security advisories affecting a package: its direct advisories plus (by default) advisories inherited through its transitive runtime dependencies. Call this when the user asks whether a package has known vulnerabilities. Pass `include_transitive: false` for direct-only.","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["name"],"properties":{"name":{"type":"string","pattern":"^[a-z0-9][a-z0-9._-]*$"},"include_transitive":{"type":"boolean"}}},"title":"Get package advisories","annotations":{"readOnlyHint":true,"untrustedContentHint":true},"logicalName":"get_advisories","displayName":"Get package advisories"},{"name":"get_dependencies","description":"The package's DIRECT build + runtime dependencies, each enriched with version, license, and active-advisory rollup as of the snapshot. Call this to inspect what a package pulls in. Floats latest unless `sha` is given. Passing `sha` requires authentication, which this server cannot present yet.","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["name"],"properties":{"sha":{"type":"string","pattern":"^[0-9a-fA-F]{7,40}$"},"name":{"type":"string","pattern":"^[a-z0-9][a-z0-9._-]*$"}}},"title":"Get package dependencies","annotations":{"readOnlyHint":true,"untrustedContentHint":true},"logicalName":"get_dependencies","displayName":"Get package dependencies"},{"name":"get_sbom","description":"Software bill of materials for a package — the transitive build + runtime closure and a vulnerabilities block. Default format is CycloneDX 1.5; pass `format: \"spdx\"` for SPDX 2.3. Call this when the user wants an SBOM or a full dependency closure. Floats latest unless `sha` is given. Passing `sha` requires authentication, which this server cannot present yet.","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["name"],"properties":{"sha":{"type":"string","pattern":"^[0-9a-fA-F]{7,40}$"},"name":{"type":"string","pattern":"^[a-z0-9][a-z0-9._-]*$"},"format":{"enum":["cyclonedx","spdx"],"type":"string"}}},"title":"Get package SBOM","annotations":{"readOnlyHint":true,"untrustedContentHint":true},"logicalName":"get_sbom","displayName":"Get package SBOM"},{"name":"get_attestation","description":"Build provenance for a package at the latest commit, per architecture (amd64, arm64): whether a signed SLSA provenance attestation exists for the artifact the catalog ships, the artifact sha256, builder, source commit, run id, resolved dependencies, and the result of checking each signature against keys minimal.dev holds. Call this when the user asks how a package was built or whether its build is attested. `state` is per architecture; `signed-unchecked` does not imply any signature was verified","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["name"],"properties":{"sha":{"type":"string","pattern":"^[0-9a-fA-F]{7,40}$"},"name":{"type":"string","pattern":"^[a-z0-9][a-z0-9._-]*$"}}},"title":"Get package build attestations","annotations":{"readOnlyHint":true,"untrustedContentHint":true},"logicalName":"get_attestation","displayName":"Get package build attestations"},{"name":"list_catalog_commits","description":"Recent commits on gominimal/pkgs:main (newest first) with their subjects. Call this to see what recently changed in the catalog. The sha-pinned tools need authentication this server cannot present, so a `sha` from here is not usable yet.","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","properties":{"limit":{"type":"integer","maximum":50,"minimum":1}}},"title":"List catalog commits","annotations":{"readOnlyHint":true,"untrustedContentHint":true},"logicalName":"list_catalog_commits","displayName":"List catalog commits"},{"name":"diff_catalog","description":"AUTHENTICATION REQUIRED: this server cannot present one, so every call returns an error. Do not call it. What changed in the catalog FROM `base` (older commit) TO `sha` (newer commit): packages added/removed, version upgrades, and advisory deltas. Call this when the user asks what changed between two catalog snapshots. Get shas from list_catalog_commits.","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["sha","base"],"properties":{"sha":{"type":"string","pattern":"^[0-9a-fA-F]{7,40}$"},"base":{"type":"string","pattern":"^[0-9a-fA-F]{7,40}$"}}},"title":"Diff the catalog between two commits","annotations":{"readOnlyHint":true,"untrustedContentHint":true},"logicalName":"diff_catalog","displayName":"Diff the catalog between two commits"}],"toolSource":"directory_preview","agentAction":"both","installLinks":[{"id":"cursor","label":"Cursor","href":"cursor://anysphere.cursor-deeplink/mcp/install?name=Minimal&config=eyJ1cmwiOiAiaHR0cHM6Ly9taW5pbWFsLmRldi9hcGkvbWNwIn0%3D"},{"id":"vscode","label":"VS Code","href":"vscode:mcp/install?%7B%22name%22%3A%22Minimal%22%2C%22type%22%3A%22http%22%2C%22url%22%3A%22https%3A%2F%2Fminimal.dev%2Fapi%2Fmcp%22%7D"},{"id":"vscode-insiders","label":"VS Code Insiders","href":"vscode-insiders:mcp/install?%7B%22name%22%3A%22Minimal%22%2C%22type%22%3A%22http%22%2C%22url%22%3A%22https%3A%2F%2Fminimal.dev%2Fapi%2Fmcp%22%7D"},{"id":"claude-web","label":"Claude.ai","href":"https://claude.ai/customize/connectors?modal=add-custom-connector&connectorName=Minimal&connectorUrl=https%3A%2F%2Fminimal.dev%2Fapi%2Fmcp"},{"id":"codex","label":"Codex","copyText":"codex mcp add \"Minimal\" --url \"https://minimal.dev/api/mcp\""},{"id":"chatgpt","label":"ChatGPT","href":"https://www.mcpbundles.com/docs/integrations/chatgpt"}],"catalogUrl":"https://www.mcpbundles.com/api/directory/v1/servers/minimal-mcp-035ef62454","callUrl":"https://www.mcpbundles.com/api/directory/v1/servers/minimal-mcp-035ef62454/tools/{tool}","mcpServerUrl":"https://minimal.dev/api/mcp","liveCatalogUrl":"https://www.mcpbundles.com/api/directory/v1/servers/minimal-mcp-035ef62454?live=1"}