Hashloom MCP server

by davet47·io.github.davet47/hashloom·v0.6.0

Content-addressed contracts and a verification cache that cut agent context by skipping proven code.

A92/100grade A

What users say

No reviews yet

Safety scan

A92/100

Adoption

New

2 stars

Reviews

Nobody has reviewed Hashloom yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

get_contract
Fetch one contract as a compact context packet: the contract body, its content hash, one-line signatures of its deps, and the list of callers.
get_dependents
Blast-radius query: contracts that depend on `name` (direct, or the full transitive closure), with their current hashes. Entries not yet human-reviewed carry `inferred: true` (advisory — never an error).
put_contractwrite action
Create or update a contract (validates shape, rejects unknown deps). Writes contracts/<name>.yaml and returns the new hash plus every dependent whose cached verification this change invalidates; inferred (machine-derived, unreviewed) contracts among them are flagged.
status
Project health: dirty contracts, stale verifications, cache hit-rate, and cumulative token counters for every tool response.
verify
Verify contracts against their pytest node IDs. Returns per-unit cached-pass / pass / fail with a ≤40-token failure summary. Runs pytest only for units whose (contract, impl, deps) hash key is not already green in the cache. `radius=true` widens each name to its full blast radius (itself plus every transitive dependent); the top-level `ok` is the hard pass/fail to gate on. An `inferred` list names

scanner v0.1.9 · 2026-09-20 · same rubric, same numbers if you re-run it

no findings

Code scan47 source files scanned25/25
–Live reliabilityno gateway calls yet and no remote to proben/a
–Tool poisoningtools not inspected (local package is not executed); not countedn/a
Auth qualitylocal package, no credentials required12/15
Maintenancelast push 19 days ago15/15
Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Overall 92/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

claude mcp add hashloom -- uvx hashloom

Is Hashloom MCP server safe?: Yes, by our scan: it is graded A (92/100). Read the Hashloom safety report
How do I install Hashloom?: It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.
Does Hashloom need an API key?: Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Hashloom maintained?: The last commit was 19 days ago (2026-09-01). The latest release is v0.6.0.
What can I use instead of Hashloom?: Servers from other publishers that do the same job: llmtrim MCP server.

Same job from other publishers: the closest match first, then the best rated.

llmtrim
MCP server and proxy that compresses LLM prompts, tool output, and replies to cut token cost.
not reviewed
Established
A