# CWI MCP Server

A read-only stdio MCP server for CWI's public Gear Ledger, deterministic trust scoring and hash-chain checks on NEEDLE DROP manifests.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed
- Author: CumulativeWebInc
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/CumulativeWebInc/cwi-mcp-server
- Updated: 2026-10-04
- HTML: https://affpapa.org/en/nevibecode/mcp/cwi-mcp-server

## What it does

Seven tools ship in one file. Five read the public Gear Ledger of the CWI agent company: the current state version, the whole state, registered agents with their latest presence ping, task summaries and a single task by `task_id`. The sixth, `trust_verdict`, sends evidence to CWI Verdict Engine v1.0.0 and returns a score, or `insufficient-data` when the evidence is thin. The seventh, `needledrop_verify`, walks the hash chain of a `cwi-needledrop/v1` manifest you point it at.

Nothing writes. No task creation, no signing, no heartbeat, no secrets stored anywhere. On your machine the ledger reads come from CWI's public `gear-ledger` repo without auth; `trust_verdict` and `needledrop_verify` stay local and make no network calls.

You need Node ≥ 18 and `python3` on `PATH`. There are no dependencies to pull: clone the repo, run the two test scripts if you want reassurance, and point your client at `server.js`. The stdio entry uses command `node` plus the absolute path to `server.js` as its single argument — a wrong path means the client fails to start. An HTTP front-end and a Dockerfile cover remote setups.

## Install

### Claude Code (native platform)

**Install**
- The MCP registry has no launch command for it: see the repository README

## When to use it
- check the current version and hash of the public CWI ledger
- list registered agents with their latest presence heartbeat
- filter task summaries by lifecycle stage
- pull state history and artifacts for one task
- prove a NEEDLE DROP manifest was not tampered with

## Example prompts
- Show me the Gear Ledger version and how many tasks and agents it holds
- Run a trust verdict on `some_agent` with these signals
- Verify the chain in `vendor/needledrop/example-ledger.json`

## Similar
- [Agentic UX Design - Relationship-Centric Interfaces](https://affpapa.org/en/nevibecode/skills/agentic-ux-design-relationship-centric-interfaces.md) — skill · 3300 installs
- [Loppee](https://affpapa.org/en/nevibecode/mcp/loppee.md) — MCP server
- [akf](https://affpapa.org/en/nevibecode/plugins/akf.md) — plugin · ★ 20
- [k-skill-setup](https://affpapa.org/en/nevibecode/skills/k-skill-setup.md) — skill · 8400 installs
- [rivet-secure-exec](https://affpapa.org/en/nevibecode/skills/rivet-secure-exec.md) — skill · 945 installs
- [dependency-auditor](https://affpapa.org/en/nevibecode/skills/onewave-ai-dependency-auditor.md) — skill · 302 installs

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md