# chartlink

> Charts and tables for AI agents with live-updating embed links. No account: signup returns a key.

- name: io.github.oscarleoo/chartlink
- version: 0.1.2
- connection class: R2 (oauth_consent_once)
- trust: 94/100
- quality: 79/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/io.github.oscarleoo%2Fchartlink
- tools: https://api.protogrid.dev/v1/servers/io.github.oscarleoo%2Fchartlink/tools

**An agent can connect after a one-time OAuth consent by a human.** Remote endpoint behind OAuth 2. Tokens stay with the agent; the registry only exposes the authorization metadata.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "chartlink": {
      "type": "http",
      "url": "https://chartlink.app/mcp",
      "headers": {
        "Authorization": "Bearer ${CHARTLINK_TOKEN}"
      }
    }
  }
}
```

Placeholders to fill: `${CHARTLINK_TOKEN}`.

## Trust

- hygiene: 100
- liveness: 100
- freshness: 85
- provenance: 90
- drivers: +repository +namespace-matches-repo +website +reachable +uptime-100% ~updated-34d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 79/100 (good)

### protocol: n/a (weight 25)

- n/a `protocol.modern`, `protocol.stateless`, `protocol.transport`, `protocol.list_ttl`: no remote answered a protocol handshake (not probed yet, unreachable, or local-only)

### authorization: 83 (weight 15)

- pass `auth.prm`: Protected Resource Metadata (RFC 9728) published
- pass `auth.as_metadata`: authorization server metadata reachable
- warn `auth.cimd`: only Dynamic Client Registration, deprecated in 2026-07-28 in favour of CIMD
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 86 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 8 of 8 tools declare readOnlyHint or destructiveHint
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: create_from_template (idempotentHint); whoami (destructiveHint); get_template (destructiveHint); …
- pass `tools.token_cost`: about 2,772 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 75 (weight 15)

- warn `stability.changes`: 6 tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: 67 (weight 15)

- pass `deps.known_vulns`: no known advisory in 98 resolved packages
- fail `deps.mcp_sdk_version`: @modelcontextprotocol/sdk 1.30.1 has 1 known advisory (GHSA-6qxp-vccf-f47h); update @modelcontextprotocol/sdk to 1.31.0 or later
- pass `deps.resolvable`: chartlink-mcp@0.1.2 resolved: 98 packages

- tools: 8, about 2,772 tokens to load them all
- tool set hash: 70e5c0d2209b1b82eb59f9d4c14d98f4
- tools last changed: 2026-10-02T17:25:25.489Z
- badge: [![protogrid quality](https://protogrid.dev/badge/io.github.oscarleoo/chartlink.svg)](https://protogrid.dev/servers/io.github.oscarleoo/chartlink)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-02 `create_edit_link` removed
  - Returns a URL opening the visual tweak panel for ONE chart (text, colors, spacing, label nudges) with no login. PUBLISH FIRST: the editor saves and republishes a published chart, it cannot publish a draft. Scope: view, tweak, and republish that chart only — never delete, never spend credits, nothing else in the workspace. OFFER THIS whenever the human's request is aesthetic fine-tuning: handing over the wheel beats a nudge-by-nudge back-and-forth. The secret is shown once; links don't expire and can be revoked with revoke_edit_link.
- 2026-10-02 `signup` removed
  - Creates a workspace and returns its API key (shown ONCE — keep it). Works on a keyless connection; every other tool needs the key. Then put the key where your client keeps it (plugin api_key setting, the Authorization header, or CHARTLINK_API_KEY for the npx bridge) and reconnect.
- 2026-09-30 `publish_asset` changed (inputSchema)
- 2026-09-29 `update_asset` changed (inputSchema)
- 2026-09-29 `create_from_template` changed (inputSchema)
- 2026-09-29 `check_template_data` changed (inputSchema)

Full history: https://api.protogrid.dev/v1/servers/io.github.oscarleoo%2Fchartlink/changes

## Dependencies

- npm chartlink-mcp@0.1.2: resolved, 97 dependencies, MCP SDK @modelcontextprotocol/sdk 1.30.1
  - GHSA-6qxp-vccf-f47h (high) in `` @modelcontextprotocol/sdk@1.30.1 ``, direct, fixed in `` 1.31.0 ``, advisory summary: "MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server" https://osv.dev/vulnerability/GHSA-6qxp-vccf-f47h

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0.

## Remotes

- https://chartlink.app/mcp (streamable-http, auth oauth2, reachable true, uptime30d 1)

## Packages

- npm chartlink-mcp@0.1.2 secrets: CHARTLINK_API_KEY

## Tools (8)

- `check_template_data`: Matches every region value against the template's geography and reports unmatched values with the closest real codes, how many regions would stay grey, and the scale the map would use. No key needed. Use it when unsure of the codes; then create_from_template with the same data and knobs.
- `create_from_template`: The template's design, your data, your words. `knobs` are the template's settings (get_template shows the schema): theme light|dark|editorial, dataType gradient|buckets|categories and surroundings true|false (then waterColor, landColor) for maps, title/description/source/brand {text, fontFamily, fontSize, color}, backgroundColor, and the scale knobs for the dataType (colormap and direction, range, breaks or classes, categoryColors/categoryOrder). data = {columns: [{id, type}], rows: [[…]]}: use the template's column ids, or exactly two columns (region first, value second) for a map. publish: true makes the URLs live in the same call. A success means it validated AND rendered — look at the preview. Region values that match nothing come back as a 400 listing each with its closest real codes, before anything is made — no separate check needed. `config` is the advanced path: the engine's settings, merged after the knobs.
- `get_template`: Read this before create_from_template. Returns the template with `contract`: its looks (theme × dataType × surroundings), the knobs JSON Schema, the columns with their roles, the region-code convention with three real codes and a lookup URL, what each dataType expects of the value column, and a complete example call whose shape you copy. Takes an id, the page slug, or the page address as on chartlink.app/maps — sweden/municipalities, us/texas/counties, london/wards — so you can skip list_templates when you know the place.
- `list_templates`: Templates are named by the NEED they answer (need, asks, tags), each with urls.png (show it to your human) and `columns`: the column ids your data must supply. Pass q with what the person asked for — "map of brazil's states", "ranked bars with flags", "change between two years" — and the list comes back ranked; take the first. Then create_asset with template: <id> and your data — the whole design comes along. Any chart id you were shown works as a template too, not only these.
- `publish_asset`: Makes the draft live. Returns urls: paste urls.embedIframe on iframe platforms; on Substack insert urls.png as an image and link it to urls.page. Pinned history: urls.png + '?v=N'.
- `submit_feedback`: If a capability is missing, a schema fights you, or docs are wrong: record it here so the owner can fix it. One report per distinct issue, with a real description — reports get fixed same-day when they say what you tried, what you expected, and what happened (title-only reports can't be acted on).
- `update_asset`: configPatch is DEEP-MERGED: objects merge recursively, arrays replace wholesale, null clears a key — send only what changes. To REMOVE keys (drop document.aspect, delete one of texts[]) pass `config` instead: it REPLACES the whole config (get_asset returns the current one to edit). `data` (if given) replaces rows wholesale. Requires expectedVersion from the last envelope; on 409 re-merge onto the returned `current`. Updating does NOT publish by default — pass publish: true to publish in the same call, or call publish_asset separately.
- `whoami`: Returns key name + workspace. Call this first — non-destructive auth check. Everything you write is stamped createdBy/updatedBy = key name.