Tvijo DSHREM

Tvijo DSHREM MCP

Run Tvijo DSHREM as a Model Context Protocol server over stdio. Review a supplied pre-merge diff or ask a question with an explicit spending limit, inspect your account and tasks, and cancel tasks from an MCP client.

mcp-name: com.tvijo/dshrem

Listed in the MCP Registry as com.tvijo/dshrem.

Requires Node.js 20 or newer and a Tvijo account. This is an ESM JavaScript package with no build step.

A paid Tvijo account with sufficient balance or credits is required for paid MCP tasks. This MIT-licensed client is free to install, but tvijo_ask and tvijo_review spend real money from your Tvijo balance or credits, up to the max_usd you supply. Read-only tools and public wiki/catalog reads require a signed-in Tvijo account and are free.

Version 0.2.1

This release adds authenticated public wiki search/context and connector catalog search/get. Reads use the existing account sign-in, preserve source revisions and projection hashes, return untrusted data, and support cancellation without retries. The public corpus stays fixed on the service.

The existing pre-merge diff review, spending caps, client tags and opt-in local evidence tools from 0.2.0 are retained. The current npm package and MCP Registry entry are version 0.2.1.

Sign in

Run the device login command in a terminal:

npx -y tvijo-dshrem-mcp login

Open the verification URL printed in the terminal and approve the displayed user code. The command polls for approval and stores your access token in ~/.config/tvijo/mcp-token.json, with directory permissions 0700 and file permissions 0600. The saved token includes its expiry and API base. Expired tokens require a new sign-in.

Alternatively, set TVIJO_TOKEN in your MCP client's environment. It takes precedence over the saved token. Keep it private; the server does not log tokens. Within MCP, call tvijo_login_start, open its verification URL and approve the user code, then call tvijo_login_poll until it reports that you are signed in. The server remembers the challenge, so device_code may be omitted. Poll no faster than the returned interval. No token is returned by either login tool.

npx -y tvijo-dshrem-mcp logout

Logout revokes the active token and removes the saved token file. If remote revocation fails, the local file is still removed and the command reports the failure. Remove TVIJO_TOKEN from your client configuration too if you used it.

VS Code

Run device login first under the same operating-system user as the server. Add this to .vscode/mcp.json:

{

"servers": { "tvijo": { "type": "stdio", "command": "npx", "args": ["-y", "tvijo-dshrem-mcp"], "env": { "TVIJO_MAX_USD_CAP": "1" } } } }

Start the server from MCP: List Servers. This is the VS Code configuration format. Current VS Code also supports a portable configuration with a different top-level key; see the format reference.

On native Windows, replace the server's command with "cmd" and args with ["/d", "/c", "npx", "-y", "tvijo-dshrem-mcp"] to launch the npm command through the Windows command processor.

Claude Code

Run device login first, then:

claude mcp add tvijo -- npx -y tvijo-dshrem-mcp

On native Windows:

claude mcp add tvijo -- cmd /d /c npx -y tvijo-dshrem-mcp

The -- separates client options from the server command. See client configuration.

Codex

Run device login first. Add this to ~/.codex/config.toml:

[mcp_servers.tvijo]

command = "npx" args = ["-y", "tvijo-dshrem-mcp"] tool_timeout_sec = 300

[mcp_servers.tvijo.env] TVIJO_MAX_USD_CAP = "1"

On native Windows, use command = "cmd" and args = ["/d", "/c", "npx", "-y", "tvijo-dshrem-mcp"] in the same table. See client configuration.

Cursor

Run device login first. Add this to ~/.cursor/mcp.json (global) or .cursor/mcp.json (project):

{

"mcpServers": { "tvijo": { "command": "npx", "args": ["-y", "tvijo-dshrem-mcp"], "env": { "TVIJO_MAX_USD_CAP": "1" } } } }

On native Windows, use "command": "cmd" and "args": ["/d", "/c", "npx", "-y", "tvijo-dshrem-mcp"]. See client configuration.

All npm routes require Node.js 20+ on the host that runs the server. On native Windows, ~ denotes your user profile (for example %USERPROFILE%\.codex\config.toml); run login and the client as the same user, and keep the token file private using that user's filesystem permissions. WSL has its own home directory and Node installation. If device login reports a token-storage error, use a private environment token. Environment variables can be read by other processes of the same operating-system user.

Restart or reconnect your client after changing configuration. With no arguments, npx -y tvijo-dshrem-mcp starts the stdio server; --version prints the package version. The MCP login tools also work after connecting.

Tvijo Code currently has no in-editor MCP consumer. Use an external terminal client for this package. Editor delegation and bundled extension launchers are future work.

Tools

tvijo_ask requires prompt (1–20,000 characters) and a positive numeric max_usd. Optional inputs are title (up to 120 characters), model (default coding), mode (default single), and positive integer max_tokens (default 2048). The service determines which model aliases and modes are available. The request method is evidence-first.

Example tool arguments:

{ "prompt": "Explain how to make this function easier to test.", "max_usd": 0.25 }

Results include task_id, answer, spent_usd, state, and recovered. Account and task results include both JSON text and structured content.

Review a diff before merge

Export a unified diff with git diff BASE_SHA HEAD_SHA, then call tvijo_review with that text and the two commit SHAs. A review reads only the supplied diff; it has no repository access and runs no tests. It is a scoped second opinion, not a certificate.

Example input template (replace the diff and SHAs with your own):

{

"diff": "diff --git a/example.js b/example.js\n--- a/example.js\n+++ b/example.js\n@@ -1 +1 @@\n-return value;\n+return value.trim();\n", "base_sha": "1111111111111111111111111111111111111111", "head_sha": "2222222222222222222222222222222222222222", "focus": "Look for edge cases introduced by this change.", "max_usd": 0.10 }

diff is limited to 20,000 characters and optional focus to 500. Larger diffs are refused as diff_too_large; split them by path. max_usd is required and must fit the same spending cap as an ask.

The result has outcome (findings, no_findings_in_reviewed_scope, or inconclusive), optional reason, reviewed (base_sha, head_sha, files, diff_chars), findings (file, line, severity, issue, evidence), the raw service answer, and receipt (task_id, spent_usd). Unknown spending is null. Findings outside the diff are removed from the structured findings list and counted in reason. Unparseable or inconsistent answers are inconclusive; inspect the raw answer and task before requesting another paid review.

An operator-run example with its redacted result and actual receipt is pending. This template is not evidence of a completed review.

Scope and data handling

Tvijo caps what Tvijo spends per call; it does not cap the agent that calls it.

What you send (prompts, diffs, repository content the delegate reads, command output) goes to the Tvijo service as model context.

Delegated work runs where the Tvijo extension runs: your machine, or the remote host under Remote SSH.

By default calls go to dsh.tvijo.com; TVIJO_API_BASE changes that.

The delegation statement describes the extension execution location; this package version does not expose editor delegation. Processes running as your operating-system user can already read that user's files and session.

Spending cap and request recovery

`tvijo_ask` and `tvijo_review` spend real money up to `max_usd` from your Tvijo account. You must supply max_usd for each call. TVIJO_MAX_USD_CAP defaults to 1 USD per call, with an absolute ceiling of 5 USD. Values above 5 are clamped to 5; invalid or nonpositive cap settings reject calls. A request exceeding the effective cap is rejected before any network request. This is a per-call cap; several separate calls can spend more in total. Account limits still apply.

A normal ask sends one task creation and one chat request. Each task creation uses a fresh idempotency key. Paid requests are never automatically retried. If task creation is ambiguous, the server performs one read-only lookup by idempotency key and returns the task without dispatching a chat. If chat is ambiguous, it reads the existing task status. A recovered response may have answer: null or spent_usd: null when those values are unavailable; this does not mean no money was spent. Inspect the task before asking again. If lookup fails too, the error includes the known task ID or idempotency key for review.

A normal review also sends one task creation and one chat. It performs a read-only recovery lookup only after a timeout, and never repeats a paid request. Other failures return the task ID or idempotency key for manual inspection.

Every service request carries a bounded X-Tvijo-Client tag with the package version, self-reported MCP host and offer (ask, review or none). It is used for counting, never for authorisation. Terminal login has no MCP host and uses other.

Configuration

| TVIJO_API_BASE | Optional API base override; default https://dsh.tvijo.com/api/dshrem/v1. HTTPS is required except for localhost HTTP in tests. Saved tokens are used only