# @alignco/opensolar-mcp

Unofficial, self-hosted MCP server for the documented OpenSolar API.

- **Type:** MCP server
- **Trust:** 85/100 (A), scored on the package rubric
- **Verification:** verified (build provenance)
- **Version:** 0.1.3
- **Author:** io.github.Align-Software-Company
- **License:** MIT
- **npm:** @alignco/opensolar-mcp
- **Source:** https://github.com/Align-Software-Company/opensolar-mcp
- **Compatible clients:** claude-code, cursor, copilot, gemini (basis: transport)

## Trust

85/100 (A), scored on the package rubric
- Publisher verified: no
- Build provenance: verified attestation
- npm trusted publishing (OIDC): yes
- Install scripts: nothing suspicious found
- Prompt-injection scan: not run
- Obfuscation scan: not run
- Evidence age: 0 days

## Security scan

- **Status:** clean
- **Scanned:** 2026-10-10T22:28:23.329Z
- **Version scanned:** 0.1.3
- **CVEs:** none found by OSV at scan time

## Tools

40 declared. Statically extracted from the shipped source — a floor on the surface, not a census.
- `list_costings` — Lists one page of costings as `{ costings, page, limit }`. The only optional filter is boolean priority. Per-unit rates are omitted.
- `get_costing` — Returns one costing by id: title, description, and boolean priority. Per-unit rates are omitted.
- `delete_costing` — Removes the costing from the live org. This call is not retried.
- `list_contacts` — Lists one page of contacts as `{ contacts }`. Each contact includes `is_synthetic_email` for `@os.code` addresses. Passport, licence, and date of birth are reda
- `search_contacts`
- `get_contact` — Returns one contact by id, including `is_synthetic_email`. Passport, licence, and date of birth are redacted. Contacts have no created_date or modified_date.
- `create_contact` — Adds a person to the live org. Send only first_name, family_name, email, and phone. This call is not retried.
- `update_contact` — Updates a person in the live org. Send at least one of first_name, family_name, email, and phone. This call is not retried.
- `delete_contact` — Removes the person from the live org. This call is not retried.
- `get_event` — Returns one event by id. Adds `event_type_name` and omits `url` and `org`. Use an id from get_project events. Unknown types become `Unknown event type`.
- `list_event_types` — Returns the OpenSolar event type ids and titles, including gaps. This is a copied docs table, not an API call.
- `list_private_files` — Lists one page of private files as `{ private_files, page, limit }`. Each row is id, title, file tag titles, and project id. The download URL is omitted.
- `get_private_file` — Returns one private file by id: title, file tag titles, project id, and size when OpenSolar sent it. The download URL stays on the server. `include_contents: tr
- `create_private_file` — Creates a private file in the live org from a path confined to OPENSOLAR_UPLOAD_ROOT on this server. Uploads are disabled until that root is configured. The res
- `update_private_file` — Updates a private file title in the live org. The published sample sends only title. The download URL is omitted. This call is not retried.
- `delete_private_file` — Removes the private file from the live org. This call is not retried.
- `generate_project_document` — Creates a project document in the live org and returns the private file id. Omit format for the document type's default. pdf and csv set file_format on generate
- `get_org` — Returns the connected OpenSolar org: id, name, address, contact info, and measurement units. `verbose: true` returns the full redacted payload.
- `list_roles` — Lists roles in the connected org as `{ roles }`: id, display, email, phone, job title, and is_admin. Chat API keys are omitted.
- `get_role` — Returns one role by id: display, email, phone, job title, and is_admin. Chat API keys are omitted. Optional fieldset is list only.
- `list_payment_options` — Lists one page of payment options as `{ payment_options, page, limit }`. Optional filters are payment_type, auto_apply_enabled, and priority. `configuration_jso
- `get_payment_option` — Returns one payment option by id: title, payment type, priority, auto-apply, and archived. `configuration_json` is omitted.
- `delete_payment_option` — Removes the payment option from the live org. This call is not retried.
- `list_pricing_schemes` — Lists one page of pricing schemes as `{ pricing_schemes, page, limit }`. Optional filters are priority, auto_apply_enabled, and pricing_formula. `configuration_
- `get_pricing_scheme` — Returns one pricing scheme by id: title, formula, priority, auto-apply, and archived. `configuration_json` is omitted.
- `delete_pricing_scheme` — Removes the pricing scheme from the live org. This call is not retried.
- `list_projects` — Lists one page of projects in the connected org. Default result is `{ projects, page, limit }` with id, title, address, dates, stage, stage_milestone, and workf
- `search_projects`
- `get_project` — Returns one project by id: address, stage, stage_milestone, workflow ids, contacts, assigned role, system_count, design_available, and events. Use it for fields
- `get_project_snapshot`
- `create_project` — Creates a project in the live org. A new project can be blocked when the wallet is empty. API Access uses project-level paid entitlement while it is enabled. Th
- `update_project` — Updates address, notes, and related fields on one project in the live org. Send at least one field besides id. Stage, design, workflow, and usage are not accept
- `update_project_stage` — Sets the workflow stage on a project in the live org. Send active_stage_id with workflow_id, or stage_name. A stage title is resolved on that workflow and never
- `update_project_usage` — Sets energy consumption on a project in the live org. Only the usage object is sent. values must match the source: one integer for annual, 12, 6, or 4 integers 
- `delete_project` — Removes the project from the live org. This call is not retried.
- `get_proposal_data` — Returns proposal figures for one project: system name, annual kWh, monthly kWh, payback year, net present value, IRR, and return on investment. Requires Raw Dat
- `get_project_design`
- `list_roof_types` — Returns the OpenSolar roof type ids and titles. This is a copied docs table, not an API call.
- `list_file_tags` — Returns private-file tag titles. The title is the identifier. This is a copied docs table, not an API call.
- `list_project_systems` — Lists one page of systems for a project as `{ systems, page, limit }`. Each row has id, name, size, module count, battery kWh, annual output, and price. Not the

## Install

**Verdict: install** — No blocking findings and no open coverage gaps — safe to install as configured.
**Config** (claude-code):
```json
"{\n  \"mcpServers\": {\n    \"opensolar\": {\n      \"command\": \"npx\",\n      \"args\": [\n        \"-y\",\n        \"@alignco/opensolar-mcp\"\n      ],\n      \"env\": {\n        \"OPENSOLAR_API_TOKEN\": \"<YOUR_OPENSOLAR_API_TOKEN>\"\n      }\n    }\n  }\n}"
```
**Credentials it will ask for** (names only — Forge never holds a value):
- `OPENSOLAR_API_TOKEN` — Opensolar API Token (required)
Placeholders only. Forge never holds, brokers, or transmits a credential value — replace each <YOUR_NAME> in your own config file. Do not send a value back to Forge; no Forge endpoint accepts one.
- This entry needs 1 credential (1 required). The generated config carries placeholders, so it will fail in the editor rather than at runtime if they are left unset.

## Blast radius

Extensive blast radius — deletes data; holds an api key.
- Floor 56, ceiling 56 (tier: extensive)
- This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score.

## Machine-readable views of this entry

- Signed JSON: https://forgeregistry.com/api/v1/packages/%40alignco%2Fopensolar-mcp
- Install plan: https://forgeregistry.com/api/v1/packages/%40alignco%2Fopensolar-mcp/install-plan
- Alternatives: https://forgeregistry.com/api/v1/alternatives/%40alignco%2Fopensolar-mcp
- HTML page: https://forgeregistry.com/registry/%40alignco%2Fopensolar-mcp
- MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan`

## About this document

Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.