# litmus

Grades MCP servers and skills using the open behavioral litmus methodology, A to F. Local install runs the full probe suite; hosted endpoint serves lookups only.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 8
- Author: polygraphso
- License: Apache-2.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/polygraphso/litmus
- Updated: 2026-07-20
- HTML: https://affpapa.org/en/nevibecode/mcp/litmus

## What it does

The server ships six tools. `check_server` reads a published grade in under a second, no code execution. `run_litmus` runs the full harness: connects as an agent would, fingerprints the tool surface, runs four probe categories (C-02 needs Docker; without it the grade caps at B), and returns the grade with an evidence bundle on disk. `run_skill_litmus` grades Claude Code skills with a static scan. `list_servers` returns servers with published grades, sorted descending. `request_grade` submits a paid grading request to polygraph.so. `verify_attestation` reads the onchain proof behind a published grade in EAS on Base.

The hosted endpoint at `https://polygraph.so/api/mcp` requires no install and serves three lookup tools: `check_server`, `list_servers`, `request_grade`. The stdio variant via `npx -y @polygraphso/litmus` installs the full toolset, including `run_litmus` and `run_skill_litmus`, which execute the target server's code. For Claude Code there is a plugin with two slash commands: `/polygraph:grade <server>` and `/polygraph:check <server>`. The repository also includes a GitHub Action `polygraphso/litmus@v1` that fails the build when an MCP server or skill grades D or F.

## Requirements
- Needs: Node.js (commands run via npx)
- Remote server: `https://polygraph.so/api/mcp`
- Environment variables: `POLYGRAPH_API_URL`, `NEXT_PUBLIC_POLYGRAPH_NETWORK` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

1. **Platform CLI: remote server**
```bash
claude mcp add --transport http litmus https://polygraph.so/api/mcp
```

2. **Platform CLI**
```bash
claude mcp add --env POLYGRAPH_API_URL=<POLYGRAPH_API_URL> --env NEXT_PUBLIC_POLYGRAPH_NETWORK=<NEXT_PUBLIC_POLYGRAPH_NETWORK> --transport stdio litmus -- npx -y @polygraphso/litmus
```
Replace <…> with your own values

### Codex

1. **Platform CLI: remote server**
```bash
codex mcp add litmus --url https://polygraph.so/api/mcp
```

2. **Platform CLI**
```bash
codex mcp add litmus --env POLYGRAPH_API_URL=<POLYGRAPH_API_URL> --env NEXT_PUBLIC_POLYGRAPH_NETWORK=<NEXT_PUBLIC_POLYGRAPH_NETWORK> -- npx -y @polygraphso/litmus
```
Replace <…> with your own values

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "litmus": {
            "url": "https://polygraph.so/api/mcp"
        }
    }
}
```
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "litmus": {
            "command": "npx",
            "args": [
                "-y",
                "@polygraphso/litmus"
            ],
            "env": {
                "POLYGRAPH_API_URL": "<POLYGRAPH_API_URL>",
                "NEXT_PUBLIC_POLYGRAPH_NETWORK": "<NEXT_PUBLIC_POLYGRAPH_NETWORK>"
            }
        }
    }
}
```
Replace <…> with your own values

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "litmus": {
            "type": "http",
            "url": "https://polygraph.so/api/mcp"
        }
    }
}
```
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "litmus": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "@polygraphso/litmus"
            ],
            "env": {
                "POLYGRAPH_API_URL": "<POLYGRAPH_API_URL>",
                "NEXT_PUBLIC_POLYGRAPH_NETWORK": "<NEXT_PUBLIC_POLYGRAPH_NETWORK>"
            }
        }
    }
}
```
Replace <…> with your own values

### Gemini CLI

1. **Platform CLI: remote server**
```bash
gemini mcp add -t http litmus https://polygraph.so/api/mcp
```

2. **Platform CLI**
```bash
gemini mcp add -e POLYGRAPH_API_URL=<POLYGRAPH_API_URL> -e NEXT_PUBLIC_POLYGRAPH_NETWORK=<NEXT_PUBLIC_POLYGRAPH_NETWORK> litmus npx -y @polygraphso/litmus
```
Replace <…> with your own values

## When to use it
- check an MCP server before install using the open methodology
- grade a server or skill A to F directly from your agent
- list servers with published grades, sorted by quality
- fail a CI build when a dependency grades D or F
- read the blockchain attestation of a published grade on Base

## Example prompts
- Check the grade for `npm/@modelcontextprotocol/server-filesystem` in the polygraph.so index
- Run the full litmus harness for `github/owner/repo` and return the grade with evidence
- Show me the first 10 MCP servers with grade A

## Similar
- [cosmos-vulnerability-scanner](https://affpapa.org/en/nevibecode/skills/cosmos-vulnerability-scanner.md) — skill · 5300 installs
- [dependency-scan](https://affpapa.org/en/nevibecode/skills/dependency-scan.md) — skill · 355 installs
- [solidity-security](https://affpapa.org/en/nevibecode/skills/solidity-security.md) — skill · 15382 installs
- [ci-cd-security](https://affpapa.org/en/nevibecode/skills/ci-cd-security.md) — skill · 7900 installs
- [agentic-actions-auditor](https://affpapa.org/en/nevibecode/skills/agentic-actions-auditor.md) — skill · 6700 installs
- [security-engineer](https://affpapa.org/en/nevibecode/agents/security-engineer.md) — subagent · 3243 installs

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md