Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

com.adrianczuczka/mason

NPM · MASON-CONTEXT

Engineering decisions, change impact, documentation audits, and CI evidence for coding assistants.

Available components

+2 this week 83 Trust /100

Last scanned (2 hours ago)

Scores higher than 76% of npm servers

Category Developer Tools

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security81
  • No malware found by supply-chain analysis.Pass
  • CVE check failed: a known high-severity CVE affects markdown-it 14.3.1, a direct dependency. A fixed version is available. View diagnostics → Fail
  • No install/post-install scripts declared.Pass
  • 47 of 162 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency97
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to adrianczuczka/mason). View diagnostics → Pass
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 5 days ago).Pass
  • Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability63
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 2760 tokens (~230/item across 12 items; 12 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management73
  • Stability observed for 22 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage99
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 98% of tool parameters carry a description.Partial
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 12 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 13 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 5 Nov 26 +2
    • Stability: fail → 0.73 functional
    • Package version: 0.22.0 → 0.24.0 functional
  • 2 Nov 26 0
    • Package version: 0.22.0 → 0.24.0 functional
  • 31 Oct 26 +15
    • CVE-2026-118773 affects this package: high ▼ security
    • CVE-2026-118764 affects this package: high ▼ security
    • Malware scan: unverified → pass ▲ security
  • 30 Oct 26 −15
    • Malware scan: pass → unverified ▼ security
    • Package version: 0.23.1 → 0.24.0 functional
  • 29 Oct 26 0
    • Dependency health: partial → 0.88 functional
  • 28 Oct 26 0
    • Dependency health: 0.87 → partial functional
  • 24 Oct 26 +1
    • CVE-2023-54404 affects this package: high ▼ security
  • 23 Oct 26 −1

    No change was recorded against any check on this day. Stability & Change Management went from 55 to 51.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Analysed npm/mason-context@0.24.0

Provenance Verified

A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.

Result Verified
Ecosystem npm
Reason Verified
Discovered via Registry attestation endpoint
Source repo adrianczuczka/mason
Certificate issuer https://token.actions.githubusercontent.com
Certificate SAN https://github.com/adrianczuczka/mason/.github/workflows/publish.yml@refs/tags/v0.24.0
Rekor log index 3597378114
Predicate type SLSA build provenance https://slsa.dev/provenance/v1
Subject digest sha512:d7a8eb7dc9d2c05043a212dfbf0804b5c1527719c40b4e5426bf2d5491b8c87a0c7514e8a100426136dca90bf969d2e73e938d0f407824842c630a3ad

Background: How many MCP packages publish verified provenance →

Vulnerabilities 7 findings
ID CVE Severity Vector Fix available
GHSA-3g3m-2fjr-6pw4 CVE-2026-118773 medium yes
GHSA-gfr2-rv44-r23c CVE-2026-111758 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes
GHSA-r7fv-28h4-cvq7 CVE-2026-111759 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes
GHSA-vfgh-jcmw-g37q CVE-2026-111766 low CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L yes
GHSA-g3hv-75wg-m249 CVE-2026-118764 medium yes
GHSA-r4xh-jqrq-34v2 medium CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L yes
GHSA-mrhx-c7xc-m3w5 CVE-2023-54404 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes

Background: What a vulnerability scan can and cannot prove →

Dependencies 162 packages
Packages resolved 162
Stale 47
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 12 exposed · ~2,529 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
get_context ~208

Assemble task context: matching decisions with rationale, approval, owner, sources, last review, and freshness, plus related tests, file impact, and any available map entries. Map verification is rechecked against sampled source contents; stale or unknown verification requires a fresh review, and recordedVerdict preserves the historical verdict. Proposals are suggestions; legacy records are unreviewed; accepted decisions are constraints subject to freshness. No initialization or map required. Pass task and optional files. map.status and diagnostics preserve missing or invalid knowledge. Impact covers up to three unique files, expanding directory anchors.

NameTypeReqDescription
dirstringyesAbsolute path to the project root directory
filesarray–Optional file paths already known to be involved (e.g. from a diff or stack trace). Entries containing them are boosted above pure text matches.
taskstringyesThe task, bug, or change request in natural language — e.g. 'add rate limiting to the API client' or a ticket description

No output schema declared.

No examples provided.

get_impact ~96

Trace historical co-change partners, related tests, and references with evidence: resolved imports, explicit paths, or uncertain name candidates. Candidates are not proven dependencies. Deterministic and read-only; no initialization or concept map required.

NameTypeReqDescription
dirstringyesAbsolute path to the project root directory
filesarrayyesFile paths or names to analyze (e.g., ['WeatherRepository.kt'] or ['src/services/auth.ts'])

No output schema declared.

No examples provided.

get_snapshot ~95

Return the optional feature-to-file architecture map with drift and trust evidence. Map verification is rechecked against sampled source contents; stale or unknown verification requires a fresh review, and recordedVerdict preserves the historical verdict. If no map exists, returns exists:false and points to decision context. Decision capture, get_context, and get_impact still work. No initialization required.

NameTypeReqDescription
dirstringyesAbsolute path to the project root directory

No output schema declared.

No examples provided.

mason_automation ~108

Inspect installed automation, observed host events, pending decision records and the notification baseline, or check all retained documentation findings across sessions. status is read-only; check saves local baselines and verification reports without editing source, approving advisories or consuming pending completion notices. Returns concise results with a full report path. Works without a map.

NameTypeReqDescription
actionstringyesInspect configuration and receipts, or capture/resume and verify original audit evidence.
dirstringyesAbsolute path to the project directory

No output schema declared.

No examples provided.

mason_check_drift ~140

Check how far the concept map has drifted from HEAD. Deterministic (git + filesystem, no LLM). Returns which features/flows are stale and the changed files behind them, new source files not yet mapped, ghost files (mapped but deleted), renames, and a `recommendation`: `up-to-date` (nothing to do), `incremental` (update just the stale entries via save_snapshot), or `full-rebuild` (broad source review required). Call this before trusting the map in a long session, or when maintaining an existing map.

NameTypeReqDescription
dirstringyesAbsolute path to the project root directory

No output schema declared.

No examples provided.

mason_complete_init ~67

Record assistant instruction setup locally in ignored .mason/local/project.json, with feature settings in shared .mason/config.json. Other tools work without this marker. Repeated calls preserve the original setup time and existing settings.

NameTypeReqDescription
dirstringyesAbsolute path to the project root directory

No output schema declared.

No examples provided.

mason_init ~275

Inspect this project now: returns documentation audit findings, committed-diff review findings, decision/map status, and a quickstart playbook. Quickstart is read-only and deterministic. Explicit mode: setup validates shared configuration and activates locally without editing shared files; mode: init explicitly prepares MCP, instructions and lifecycle hooks for review and commit. Neither runs audits or prepares repairs; use only when requested. Optional host selects codex or claude. Optional base selects the review comparison; evidence imports CI manifests with check outcomes, commit freshness, and links to changed files and accepted decisions. Repeat calls refresh findings even after setup.

NameTypeReqDescription
basestring–Quickstart only: Git ref for committed-diff review. Defaults to the first available main branch ref.
dirstringyesAbsolute path to the project root directory
dryRunboolean–Init only: preview shared configuration changes without writing files.
evidencearray–Quickstart only: repository-local CI evidence manifests to include in the review. Imports Vitest JSON, SARIF, and native-validator mason-check-json results without executing check commands.
hoststring–Assistant to configure in init/setup mode; inferred only when unambiguous.
modestring–Quickstart inspects without edits; init prepares shared configuration; setup activates compatible configuration locally.

No output schema declared.

No examples provided.

review_decision ~517

Prepare a decision review: returns the claim and any operative accepted revision, provenance, the latest inspection and history event (notes shortened), changed files with hunk and line counts and anchor commits since the latest valid inspection for both sets of anchors, and a reviewToken. Request the diff (optionally for specific diffFiles), source previews or full history with include; the token is unchanged. For accepted-guidance inspection use inspectionScope operative on both prepare and inspect; pending proposals remain unassessed. Default all scope covers both revisions. After source inspection, record inspect with inspector, note and token to report no contradiction found without human acceptance. For human review, prepare with all scope, then record accept, reaffirm, or retire with its token, the authorized reviewer, and a reason. Acceptance replaces the operative revision; retirement withdraws the entire record including its proposal. Acceptance requires owner, source, readable Git HEAD, and committed anchor changes. Changed records or code invalidate the token. Identities and approvals are recorded assertions for normal PR review, not authenticated proof.

NameTypeReqDescription
actionstring–Prepare is read-only. Inspect records an agent assessment without approval; accept, reaffirm and retire require an authorized review.
diffFilesarray–For prepare with include diff: limit the diff to these changed files.
diffFromstring–For prepare only: lastReview previews changes since the latest inspection still valid for this record and scope (default); capture previews the full history since the evidence baseline.
dirstringyesAbsolute path to the project root directory
idstringyesDecision id from get_context or save_decision
includearray–For prepare only: diff returns the bounded diff since the latest valid inspection, files returns source previews, history returns all review events and the latest two inspections. Omit for a compact…
inspectionScopestring–For prepare/inspect only: all covers the full record and both anchor sets (default); operative covers only an active accepted revision, leaving a pending draft unassessed. Use the same scope when sub…
inspectorstring–Actual agent or person performing inspection; required for inspect. Does not claim human approval.
notestring–Review rationale; required for a verdict. Cite evidence for the decision.
reviewTokenstring–Token from the prepared review; rejects stale record or code revisions
reviewerstring–Identity of the actual reviewer; required for a verdict. Never invent one.

No output schema declared.

No examples provided.

save_decision ~573

Capture or revise a decision proposal as soon as the lesson is supported by evidence, without waiting for implementation or merge. Keep unimplemented remedies tentative. Include rationale, anchors, optional owner, sources, and a known actor. Compare matching get_context records and pending proposals before saving. When new evidence changes the same lesson's assumptions, scope, or recommended action, pass its existing id, including for accepted records. Preserve supported rationale and sources and replace obsolete instructions. Create a new record for a genuinely distinct lesson; skip unchanged restatements. No setup or map required. Writes a local record and preserves content history. Changes create a pending proposal while the last accepted revision remains operative; unchanged content does not re-verify or refresh it. Use review_decision for authorized acceptance or reaffirmation. A proposal cannot supersede a record with an operative accepted revision; review its replacement and retire the original separately.

NameTypeReqDescription
actorstring–Known person or agent recording this revision. Omit if unknown; do not infer from Git identity.
bodystringyesThe knowledge itself: what was tried/decided, why, and what to avoid. Must contain information NOT derivable by reading the code. Aim for 1500 characters or fewer; up to 2500 is accepted with a warni…
categorystringyes–
dirstringyesAbsolute path to the project root directory
filesarray–Repo-relative files or directory prefixes this applies to. Matching is shared by retrieval, hooks, review, and drift checking; changes flag the decision for re-verification.
forceboolean–Save even when a near-duplicate was detected
idstring–Pass the matching record's existing id when evidence changes that lesson's assumptions, scope, or recommended action, including for accepted records. Changed content becomes a proposal while the acce…
owner––Responsible person or team, when known. Null clears it. Required for acceptance.
sourcesarray–Known PR, issue, incident, discussion, or document references. Omit to preserve; [] clears. At least one is required for acceptance.
supersedesstring–Id of an unreviewed record or proposal with no accepted revision to replace. Operative accepted decisions require separate review and retirement.
titlestringyesShort, specific headline (max 80 characters). Generates a stable id on creation; revising the title keeps the existing id.

No output schema declared.

No examples provided.

save_snapshot ~188

Save a concept-to-files map as a persistent project snapshot. Maps feature names and data flows to the files that implement them. Retained for direct maintenance of legacy maps; the managed map-build workflow has been removed. Persists across conversations — future sessions can call get_snapshot to instantly find relevant files. No API key needed — you are the LLM generating the map.

NameTypeReqDescription
dirstringyesAbsolute path to the project root directory
featuresobjectyesMap of feature names to their implementing files
flowsobjectyesMap of flow names to ordered file chains
removeFeaturesarray–Feature names to delete from the existing map — for features that were renamed or no longer exist. Applied before merging; only meaningful on incremental saves.
removeFlowsarray–Flow names to delete from the existing map. Applied before merging; only meaningful on incremental saves.

No output schema declared.

No examples provided.

save_verification ~113

Record verify_snapshot verdicts using each entry’s kind and reviewToken. Missing tokens request a fresh review; changed or deleted entries return conflicts without being stamped. Entries judged ok are stamped verifiedAt; failures are flagged verificationFailed with your note and surface in get_context, get_snapshot, and mason_check_drift until corrected. Verdict notes are required for failures.

NameTypeReqDescription
dirstringyesAbsolute path to the project root directory
verdictsobjectyesEntry name → verdict, exactly as returned by verify_snapshot

No output schema declared.

No examples provided.

verify_snapshot ~149

Spot-check the concept map's CORRECTNESS (drift checks freshness; this checks entries were right to begin with). Returns a sample of entries — always the never-verified and least-recently-verified first — with skeletons of their claimed files, for you to judge whether the files actually implement what the entry claims. Report verdicts back via save_verification with each entry’s kind and reviewToken. Tokens bind the entry and bounded source evidence; changed evidence requires a fresh review. Run periodically, or after an automated refresh wrote entries no human reviewed.

NameTypeReqDescription
dirstringyesAbsolute path to the project root directory
sampleinteger–Entries to sample (default 5)

No output schema declared.

No examples provided.

Install

How do I install the com.adrianczuczka/mason MCP server?

com.adrianczuczka/mason runs locally as an npm package, launched with npx -y mason-context. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · mason-context

# add to Claude Code
claude mcp add com-adrianczuczka-mason -- npx -y mason-context
Common questions

What is the com.adrianczuczka/mason MCP server?

com.adrianczuczka/mason is an MCP server listed in the public MCP registry as com.adrianczuczka/mason. Engineering decisions, change impact, documentation audits, and CI evidence for coding assistants. This page covers its npm package (mason-context).

Is the com.adrianczuczka/mason MCP server safe to use?

com.adrianczuczka/mason scores 83 out of 100 on VerifyMCP. We recorded 7 known advisories against it as of 5 November 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the com.adrianczuczka/mason MCP server expose?

com.adrianczuczka/mason exposes 12 tools: mason_init, mason_automation, mason_complete_init, get_snapshot, get_context, and 7 more. Their descriptions and schemas cost roughly 2,529 tokens of context every time the server is loaded.

Is the com.adrianczuczka/mason MCP server still maintained?

com.adrianczuczka/mason is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the com.adrianczuczka/mason MCP server under?

com.adrianczuczka/mason declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.