io.github.batook22/project-knowledge-mcp
NPM · PROJECT-KNOWLEDGE-MCP · SCANNED SEP 20
Cross-project knowledge graph for MCP — map features across mobile, backend, and admin codebases.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 99 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 134 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability79
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1880 tokens (~117/item across 16 items; 16 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management93
- Stability observed for 28 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "remove_project" implies "remove" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 16 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the io.github.batook22/project-knowledge-mcp server?
io.github.batook22/project-knowledge-mcp runs locally as an npm package, launched with npx -y project-knowledge-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · project-knowledge-mcp
claude mcp add batook22-project-knowledge-mcp -- npx -y project-knowledge-mcp
{
"mcpServers": {
"batook22-project-knowledge-mcp": {
"command": "npx",
"args": [
"-y",
"project-knowledge-mcp"
]
}
}
} {
"servers": {
"batook22-project-knowledge-mcp": {
"command": "npx",
"args": [
"-y",
"project-knowledge-mcp"
]
}
}
} codex mcp add batook22-project-knowledge-mcp -- npx -y project-knowledge-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"batook22-project-knowledge-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"project-knowledge-mcp"
],
"enabled": true
}
}
} openclaw mcp add batook22-project-knowledge-mcp --command npx --arg -y --arg project-knowledge-mcp
mcp_servers:
batook22-project-knowledge-mcp:
command: "npx"
args: ["-y", "project-knowledge-mcp"] {
"McpServers": {
"batook22-project-knowledge-mcp": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"project-knowledge-mcp"
]
}
}
} assistant mcp add batook22-project-knowledge-mcp -t stdio -c npx -a -y project-knowledge-mcp
{
"mcpServers": {
"batook22-project-knowledge-mcp": {
"command": "npx",
"args": [
"-y",
"project-knowledge-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 19 Sept 26 +1
- Security disclosure: unverified → fail ▼ functional
- 18 Sept 26 0
- Security disclosure: fail → unverified ▼ functional
- 17 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 16 Sept 26 −3
- Stability: pass → 0.80 functional
- 15 Sept 26 0
- Stability: 0.97 → pass security
- 14 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Sept 26 +1
- Security disclosure: unverified → fail ▼ functional
- 11 Sept 26 0
- Security disclosure: fail → unverified ▼ functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/project-knowledge-mcp@1.0.6
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 99 packages
| Packages resolved | 99 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
check_type_mapping ~96
Given a type name, find all files across all projects that define or reference it. Use this BEFORE changing a type to know exactly which files in which projects need updating. For example: check_type_mapping('stationId') returns all files in backend, mobile, and admin that use stationId.
| Name | Type | Req | Description |
|---|---|---|---|
| typeName | string | yes | Type name to search for (e.g., 'stationId', 'StationCreateDto', 'User') |
No output schema declared.
No examples provided.
export_knowledge ~69
Save the current knowledge base to the configured JSON file. Note: the knowledge base is auto-persisted after every mutation, so this call is not required to save your work. Use it as an explicit confirmation — it returns the file path so you know where the file lives before committing to git.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_architecture ~189
Explore a registered project's directory structure as a formatted tree view. Use this to understand the project layout, find relevant files, or navigate the codebase. Supports optional filtering by path keyword, and optional content highlighting to find files containing a specific keyword (marked with ★). When using highlight, set showAll=true to see the full tree with matches marked, or omit showAll (default false) to show only matching files.
| Name | Type | Req | Description |
|---|---|---|---|
| filter | string | – | Optional keyword — only show files/folders whose path contains this keyword (case-insensitive) |
| highlight | string | – | Optional keyword — scan file contents and mark files containing this keyword with ★ |
| projectName | string | yes | Name of the registered project to explore |
| showAll | boolean | – | When used with highlight: if true, show the full tree but mark matching files with ★. If false (default), only show matching files. |
No output schema declared.
No examples provided.
get_context ~155
Get rich cross-project context for a feature at a specific workflow step. Returns all relevant endpoints, screens, pages, and files across all projects. Use this before testing or implementing a feature step. Set analyzeImpact=true to also check for breaking changes across projects. Set verbose=true for full per-step breakdown (default: compact summary).
| Name | Type | Req | Description |
|---|---|---|---|
| analyzeImpact | boolean | – | If true, also run a breaking change analysis on files referenced in the context. |
| featureName | string | yes | Feature name |
| stepNumber | number | – | Workflow step number (optional — returns all steps if omitted) |
| verbose | boolean | – | If true, return full per-step breakdown with endpoints/screens/pages. If false (default), return a compact summary. |
No output schema declared.
No examples provided.
get_feature ~123
Get full details of a feature — all workflow steps with cross-project mappings. Use this to understand how a feature works end-to-end before testing or coding. Set includeHealth=true to also run a health check on the feature. Set verbose=true for full workflow step details (default: compact summary).
| Name | Type | Req | Description |
|---|---|---|---|
| includeHealth | boolean | – | If true, also run a health check and append results to the output. |
| name | string | yes | Feature name |
| verbose | boolean | – | If true, return full workflow step details. If false (default), return a compact summary. |
No output schema declared.
No examples provided.
import_knowledge ~119
Load knowledge from a JSON file. Can merge with existing data or replace it entirely. When merge=false, the current state is auto-backed up before overwriting. Set preview=true to see a diff of what would change without actually importing.
| Name | Type | Req | Description |
|---|---|---|---|
| filePath | string | yes | Absolute path to the JSON knowledge file to import |
| merge | boolean | – | If true, merge with existing data. If false, replace. |
| preview | boolean | – | If true, show a diff of what would change without actually importing. Use this to preview before applying. |
No output schema declared.
No examples provided.
register_feature ~170
Define or update a feature with its multi-project workflow steps. Each step maps what happens in mobile, backend, and admin. Steps are ordered — the AI will use this order to understand user flows. Use overwrite=true to replace an existing feature.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | yes | What this feature does end-to-end |
| name | string | yes | Feature name (e.g., 'report', 'stations', 'auth') |
| overwrite | boolean | – | If true, overwrite an existing feature with the same name. If false (default), error if feature already exists. |
| test_scenarios | array | – | List of test scenarios for this feature |
| workflow | array | yes | Ordered list of workflow steps. Each step describes what happens in mobile, backend, and/or admin at that point in the flow. |
No output schema declared.
No examples provided.
register_project ~117
Register a project (mobile, backend, admin) so the MCP knows its path and framework. Framework can be 'nestjs', 'nextjs', 'react-native', or 'auto' for auto-detection.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | – | Optional description of the project |
| framework | string | – | 'nestjs', 'nextjs', 'react-native', or 'auto' |
| name | string | yes | Short name (e.g., 'backend', 'mobile', 'admin') |
| path | string | yes | Absolute path to the project directory |
No output schema declared.
No examples provided.
register_type_mappings ~116
Register one or more type mappings between projects. Accepts either a single mapping object OR an array of mappings. For example, if 'StationCreateDto' in the backend corresponds to 'StationFormSchema' in mobile, register that mapping here. Then when you change one, you can check what else needs updating. When registering multiple mappings, this reduces 50+ tool calls to 1, providing massive token savings.
| Name | Type | Req | Description |
|---|---|---|---|
| mappings | array | yes | Array of type mapping objects to register (or pass a single mapping object directly) |
No output schema declared.
No examples provided.
remove_feature ~27
Remove a feature from the knowledge base.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | Feature name to remove |
No output schema declared.
No examples provided.
remove_project ~30
Remove a registered project from the knowledge base.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | Name of the project to remove |
No output schema declared.
No examples provided.
reverse_lookup ~122
Given a file path, find all cross-project references to it — both from the Knowledge Graph and by scanning import/require/type-usage in file contents across all registered projects. Use this before editing a file to understand its full blast radius, even when the graph is incomplete. Returns two labeled buckets: graph-registered (formally tracked) and scan-discovered (found ad hoc). Also shows which features and workflow steps reference this file.
| Name | Type | Req | Description |
|---|---|---|---|
| filePath | string | yes | Relative path to the file within its project (e.g., 'src/auth/auth.controller.ts') |
No output schema declared.
No examples provided.
scan_project ~54
Auto-discover endpoints (backend), screens (mobile), or pages (admin) from a registered project. Returns discovered items for you to link to features.
| Name | Type | Req | Description |
|---|---|---|---|
| projectName | string | yes | Name of the registered project to scan |
No output schema declared.
No examples provided.
search ~87
Search across features, endpoints, files, and screens by keyword. Searches both the in-memory knowledge graph (features, workflow steps, type mappings) AND project file contents on disk. Returns all matches with their context (feature name, step, project, or file path + snippet).
| Name | Type | Req | Description |
|---|---|---|---|
| query | string | yes | Search keyword (e.g., 'report', 'station', 'auth', 'controller') |
No output schema declared.
No examples provided.
suggest_type_mappings ~269
Auto-detect potential type mappings by scanning all registered projects for type/interface/class/enum definitions. Finds exact name matches across projects (HIGH confidence) and name-similar matches (MEDIUM confidence) by stripping common prefixes/suffixes like Dto, Schema, Form, Payload, etc. Use this to quickly populate the type mapping registry without manual discovery. Set autoRegister=true to automatically register HIGH confidence matches (exact name matches with exactly 2 occurrences).
| Name | Type | Req | Description |
|---|---|---|---|
| autoRegister | boolean | – | If true, automatically register HIGH confidence matches (exact name matches with exactly 2 occurrences). Default: false. |
| confidence | string | – | Minimum confidence level to include ('high' = exact matches only, 'medium' = exact + similar, 'all' = everything). Default: 'high'. |
| limit | number | – | Maximum number of suggestions to return (0 = no limit). Default: 10. |
| projectName | string | – | Optional — if provided, only scan this specific project for type definitions. |
| typeName | string | – | Optional — if provided, only show suggestions related to this type name (case-insensitive partial match). |
| verbose | boolean | – | If true, return full details with file paths and registration instructions. If false (default), return a compact summary. |
No output schema declared.
No examples provided.
validate_knowledge ~137
Check all registered file paths across projects, features, and type mappings to detect stale entries. Files that have been renamed, moved, or deleted will be flagged as MISSING. Use this periodically to keep the knowledge graph in sync with the actual codebase. Optionally pass a featureName to validate only files related to that specific feature. Set fix=true to automatically remove stale entries (use with caution).
| Name | Type | Req | Description |
|---|---|---|---|
| featureName | string | – | Optional — if provided, only validate files related to this feature. If omitted, validate everything. |
| fix | boolean | – | If true, automatically remove entries pointing to non-existent files. Use with caution. |
No output schema declared.
No examples provided.
What is the io.github.batook22/project-knowledge-mcp server?
io.github.batook22/project-knowledge-mcp is listed in the public MCP registry as io.github.batook22/project-knowledge-mcp. Cross-project knowledge graph for MCP, map features across mobile, backend, and admin codebases. This page covers its npm package (project-knowledge-mcp).
Is the io.github.batook22/project-knowledge-mcp server safe to use?
io.github.batook22/project-knowledge-mcp scores 82 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.batook22/project-knowledge-mcp server expose?
io.github.batook22/project-knowledge-mcp exposes 16 tools: register_project, remove_project, scan_project, register_feature, remove_feature, and 11 more. Their descriptions and schemas cost roughly 1,880 tokens of context every time the server is loaded.
Is the io.github.batook22/project-knowledge-mcp server still maintained?
io.github.batook22/project-knowledge-mcp is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.batook22/project-knowledge-mcp server under?
io.github.batook22/project-knowledge-mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.