@ashlr/lexicon

MCPcommunity

v0.5.4io.github.ashlraiUnknownUpdated 6d agonpm GitHub

Fixes the names and jargon speech-to-text gets wrong before your agent acts on a dictated prompt.

Works in

ClaudeCursorCopilotGemini

Inferred from the transports this listing declares (stdio). A client not listed here hasn’t been ruled out — it just isn’t something Forge can confirm.

Automatically indexed from public sources. Not yet verified by the developer on Forge.Claim this listing →

1GitHub stars

6d agoLast update

Package

Authorio.github.ashlrai

LicenseUnknown

Version0.5.4

Sourcenpm+mcp-registry

npm@ashlr/lexicon

GitHubashlrai/lexicon

SBOMCycloneDX 1.6 ↓

Trust Status

B

60/100Good

✓Listed in Forge index+10/10

—Publisher identity verified+0/20

→ Publisher: run `forge publish` from the package repo to claim ownership

—Ed25519 publish signature+0/5

→ Included automatically when the publisher runs `forge publish`

—Domain verification+0/5

→ Publisher: host /.well-known/forge.json on the package homepage with { "publisher": "<github-login>" }

—npm Trusted Publishing (Sigstore)+0/5

→ Publish from GitHub Actions with --provenance so the attestation binds this package to this repo

—npm maintainer match+0/5

→ Earned once your identity is verified above and that login is an npm maintainer of this package

✓CVE scan · clean+30/30

✓Static analysis · clean+20/20

Paste into Claude Code, Cursor, or any AI assistant to fix all gaps

StatusCommunity-indexed

PublisherUnverified

SignatureUnsigned

Domain—

Provenance—

Dependencies✓ 60 resolved+ · none vulnerable

Tool surface24 tools · 2 privileged

Security scan✓ Cleanv0.5.4 · 5d agoHow well does this scan work?

EvalsNone

IndexedSep 28, 2026

Verification confirms publisher identity (repo ownership), not code safety. The security scan covers known CVEs and suspicious install scripts.

Tools

24 tools · 2 privileged

Statically extracted from the published packagev0.5.4 · 5d ago

Read out of the source npm actually ships, at scan time. The package was never executed. Tools registered dynamically at runtime, or hidden inside bundled or minified code, can be missed — so this is a floor on the tool surface, not a complete census of it.

Filter toolsPrivileged only

pbcopypbpaste / pbcopy (macOS)

pbpaste / pbcopy (macOS)

No input schema was published for this tool.

xclipxclip -selection clipboard -o / -i (X11)

xclip -selection clipboard -o / -i (X11)

No input schema was published for this tool.

xselxsel --clipboard --output / --input (X11)

xsel --clipboard --output / --input (X11)

No input schema was published for this tool.

powershellNo description published

This tool published no description. Forge does not invent one.

injectedinjected read/write

injected read/write

No input schema was published for this tool.

harvest_repoScan a repository for proper nouns an STT engine is likely to mangle: package and dependency names, git authors, README brands, the project directory.

Scan a repository for proper nouns an STT engine is likely to mangle: package and dependency names, git authors, README brands, the project directory.

No input schema was published for this tool.

suggest_termsPropose new aliases, terms and never-words from the user's voice history, usage and repo.

Propose new aliases, terms and never-words from the user's voice history, usage and repo.

No input schema was published for this tool.

apply_suggestionApply a suggestion returned by suggest_terms after the user accepted it: 'alias' merges the alias into the term, 'term' adds the term (aliases auto-suggested when none given),

Apply a suggestion returned by suggest_terms after the user accepted it: 'alias' merges the alias into the term, 'term' adds the term (aliases auto-suggested when none given),

No input schema was published for this tool.

list_packsList the starter packs shipped with the lexicon (developer, ai, business, voice-tools: curated names with the misspellings STT produces for them) and which are already installed.

List the starter packs shipped with the lexicon (developer, ai, business, voice-tools: curated names with the misspellings STT produces for them) and which are already installed.

No input schema was published for this tool.

add_packInstall one starter pack from list_packs into the global lexicon (or the project .lexicon.yaml with scope: project).

Install one starter pack from list_packs into the global lexicon (or the project .lexicon.yaml with scope: project).

No input schema was published for this tool.

import_dictionaryImport a dictionary the user already has (Wispr Flow CSV, Superwhisper JSON, macOS Text Replacement plist, espanso YAML, plain text 'Canonical: alias1, alias2', generic CSV, or a lexicon JSON/YAML) into the lexicon.

Import a dictionary the user already has (Wispr Flow CSV, Superwhisper JSON, macOS Text Replacement plist, espanso YAML, plain text 'Canonical: alias1, alias2', generic CSV, or a lexicon JSON/YAML) into the lexicon.

No input schema was published for this tool.

lexicon_doctorAnswers "is lexicon set up for this user, and what is the one command that fixes it" in a single call.

Answers "is lexicon set up for this user, and what is the one command that fixes it" in a single call.

No input schema was published for this tool.

install_clientprivilegedRegister the lexicon MCP server (and, for Claude Code, its hooks) in an agent client's config: claude, codex, cursor, windsurf, gemini, vscode or claude-desktop.

Register the lexicon MCP server (and, for Claude Code, its hooks) in an agent client's config: claude, codex, cursor, windsurf, gemini, vscode or claude-desktop.

No input schema was published for this tool.

setup_lexiconOne-shot onboarding: seed the lexicon with the user's company and name, register the MCP server and hooks in their agent clients, optionally harvest the repo and install the local API as a login service.

One-shot onboarding: seed the lexicon with the user's company and name, register the MCP server and hooks in their agent clients, optionally harvest the repo and install the local API as a login service.

No input schema was published for this tool.

serve_statusCheck whether the local lexicon API (`lexicon serve`, used by the browser extension, Claude Desktop, Shortcuts and the menu bar app) is running on 127.0.0.1:41733.

Check whether the local lexicon API (`lexicon serve`, used by the browser extension, Claude Desktop, Shortcuts and the menu bar app) is running on 127.0.0.1:41733.

No input schema was published for this tool.

normalize_transcriptFix the proper nouns speech-to-text got wrong, using this user's personal lexicon of names, brands, acronyms and identifiers.

Fix the proper nouns speech-to-text got wrong, using this user's personal lexicon of names, brands, acronyms and identifiers.

No input schema was published for this tool.

add_termTeach the lexicon a name, so dictation is corrected to it from now on.

Teach the lexicon a name, so dictation is corrected to it from now on.

No input schema was published for this tool.

remove_termprivilegedDelete a term from the user's lexicon by canonical spelling (case-insensitive).

Delete a term from the user's lexicon by canonical spelling (case-insensitive).

No input schema was published for this tool.

list_termsList the user's lexicon terms, global and project merged. Optional case-insensitive substring filter over canonical

List the user's lexicon terms, global and project merged. Optional case-insensitive substring filter over canonical

No input schema was published for this tool.

export_lexiconExport the merged lexicon in a format for another tool: 'claude-md' (markdown for CLAUDE.md / system prompts), 'markdown', 'text', 'wispr', 'superwhisper', 'whisper-prompt', 'openai', 'macos', 'espanso', 'deepgram', 'assemblyai', 'azure', 'google', 'csv', or raw 'json'.

Export the merged lexicon in a format for another tool: 'claude-md' (markdown for CLAUDE.md / system prompts), 'markdown', 'text', 'wispr', 'superwhisper', 'whisper-prompt', 'openai', 'macos', 'espanso', 'deepgram', 'assemblyai', 'azure', 'google', 'csv', or raw 'json'.

No input schema was published for this tool.

learn_correctionRecord that the user corrected a spelling: they meant `meant`, but the transcript or you wrote `heard`.

Record that the user corrected a spelling: they meant `meant`, but the transcript or you wrote `heard`.

No input schema was published for this tool.

suggest_canonicalLook up what a garbled word was probably meant to be.

Look up what a garbled word was probably meant to be.

No input schema was published for this tool.

lexicon_statsCounts of terms and aliases, total hits, the most-used terms, terms that never fired, and a per-file breakdown of the merged lexicon.

Counts of terms and aliases, total hits, the most-used terms, terms that never fired, and a per-file breakdown of the merged lexicon.

No input schema was published for this tool.

trust_projectManage trust for a repo's .lexicon.yaml, which is merged only after the user approves it (it can inject text into every session).

Manage trust for a repo's .lexicon.yaml, which is merged only after the user approves it (it can inject text into every session).

No input schema was published for this tool.

23 of 24 tools published a description.

Tool names and descriptions are written by the publisher and shown verbatim as inert text. They are the strings an MCP client passes to a model, so Forge scans them for prompt-injection patterns — any finding appears with the security scan above. “Privileged” is a keyword match on the tool name, not an audit of what the tool does: a benign-sounding name can still do anything.

About

Fixes the names and jargon speech-to-text gets wrong before your agent acts on a dictated prompt.

Keywords

mcp

Alternatives

Comparing tool surfaces…

Tools exposed

24 tools · 2 privileged · observed 2026-09-28 by static extraction. A tool surface is what one scan read on one day, not a live capability list.

pbcopy
xclip
xsel
powershell
injected
harvest_repo
suggest_terms
apply_suggestion
list_packs
add_pack
import_dictionary
lexicon_doctor
install_clientpriv
setup_lexicon
serve_status
normalize_transcript
add_term
remove_termpriv
list_terms
export_lexicon
learn_correction
suggest_canonical
lexicon_stats
trust_project

Linked names open Forge’s index of every entry observed exposing that tool. Browse all indexed tools.

Dependency tree

What one Forge scan resolved from npm metadata on 2026-09-28 — observed resolution, not a publisher declaration.

60 packages resolved · 6 direct · none carrying advisories Resolution stops at depth 4 and 60 packages.

zod4.6.5
yaml2.9.1
commander15.0.0
double-metaphone2.0.1
fastest-levenshtein1.0.16
@modelcontextprotocol/sdk1.31.017 dependencies
- ajv8.20.0+2 not drawn2 dependencies
  - fast-deep-equal3.1.3
  - fast-uri3.1.8
- zod4.6.5shown above
- cors2.8.6+2 not drawn
- hono4.13.10
- jose6.2.12
- express5.2.1+27 not drawn1 dependency
  - content-type1.0.5
- raw-body3.0.2+4 not drawn
- ajv-formats3.0.11 dependency
  - ajv8.20.0shown above+2 not drawn
- cross-spawn7.0.6+3 not drawn
- eventsource3.0.71 dependency
  - eventsource-parser3.1.1
- content-type1.0.5shown above
- pkce-challenge5.0.1
- @hono/node-server2.1.1
- json-schema-typed8.0.2
- eventsource-parser3.1.1shown above
- express-rate-limit8.7.0+2 not drawn
- zod-to-json-schema3.25.2

The crawl stopped at the 60-package limit. The rest of the tree was never resolved.

36 more resolved packages are not drawn here (display cap: 24). Every dependency carrying an advisory is drawn regardless of the cap. Full inventory (CycloneDX SBOM)

Declared but not resolved

57 declared dependencies never landed in the tree. They are missing from Forge's resolution, not from the package.

package cap reached: 57

ip-address ^10.2.0 — required by express-rate-limit@8.7.0package cap reached
side-channel ^1.1.1 — required by qs@6.16.0package cap reached
es-define-property ^1.0.1 — required by qs@6.16.0package cap reached
wrappy 1 — required by once@1.4.0package cap reached
debug ^4.4.3 — required by send@1.2.1package cap reached
encodeurl ^2.0.0 — required by send@1.2.1package cap reached
escape-html ^1.0.3 — required by send@1.2.1package cap reached
etag ^1.8.1 — required by send@1.2.1package cap reached
fresh ^2.0.0 — required by send@1.2.1package cap reached
http-errors ^2.0.1 — required by send@1.2.1package cap reached
mime-types ^3.0.2 — required by send@1.2.1package cap reached
ms ^2.1.3 — required by send@1.2.1package cap reached

+45 more not listed. The counts by reason above cover all of them.

Not followed: peerDependencies. This tree covers runtime dependencies only, so anything those pull in was never resolved.