MCP Sequential Thinking

Findings (6)

• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  mcp@2.1.1: 4 known vulnerabilities

  GHSA-5h93-6whr-6q8j, GHSA-84m7-p3x7-pcfv, GHSA-rwrf-2pqf-9j8j, GHSA-w4fh-qvv9-3v23

  uv.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  starlette@0.45.2: 7 known vulnerabilities

  PYSEC-2026-161, PYSEC-2026-1941, PYSEC-2026-1942, PYSEC-2026-2280, PYSEC-2026-2281 +2 more

  uv.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  opentelemetry-api@1.44.0: 1 known vulnerability

  GHSA-xcq7-p3pf-p88h

  uv.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  pytest@8.3.5: 1 known vulnerability

  PYSEC-2026-1845

  uv.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  Reads environment variables not listed in the manifest

  GITHUB_EVENT_NAME, GITHUB_REF_NAME, SMOKE_SOURCE_CHECKOUT

Network activity

Tools exposed (11)

• create_session

  Start a local plaintext working log. No mandatory reasoning phases.

• add_step

  Store one note with optional provenance or revision; URLs are not fetched.

• list_sessions

  Find a previous session. Cursor is the last ID from the preceding page. version counts accepted mutations, not notes: it is the value to pass as expected_version, and says nothing about how many steps a session holds. Read the session to count those.

• read_session

  Read bounded notes and caller-supplied completion; follow cursor for more. Every response names the view it used. Omitting view reads the resume view, or the steps view when kind, step_id or content_offset asks for a filter the resume view cannot apply; asking for both at on

• finalize_session

  Store an explicit completion at the expected version; infer no conclusions.

• delete_session

  Delete this session's active DB records; backups/exports survive. No secure erasure.

• process_thought

  Record one thought in the sequential-thinking audit trail. Validates and stores the thought (stage name, revision/branch consistency, per-line uniqueness of thought_number), then returns structural analysis: stage-order warnings, thoughts that are lexically related to this one, and

• generate_summary

  Summarize the recorded thinking process. Deprecated legacy workflow; prefer read_session for explicit sessions. Includes the actual thought content (excerpts per stage), aggregated challenged assumptions, open branches without a concluding thought, and revision chains, plus structu

• clear_history

  Delete all active database records in the local legacy session. Exports and backups remain; this is not secure erasure. Export first if needed. Returns: Status message with the number of thoughts that were cleared.

• export_session

  Export session_id to a file; omitted ID selects deprecated legacy format. Explicit sessions preserve IDs, branches, sources and completion in a worklog-session archive. Retry keys are excluded; use snapshots for full backup. file_path is confined to the storage directory's exports/

• import_session

  Import a session archive with its matching session_id; existing IDs conflict. Omitted session_id uses deprecated legacy import, REPLACING legacy history. Explicit archives preserve IDs and do not restore retry keys. file_path is confined to the storage directory's exports/ subdirec