com.adrianczuczka/mason
NPM · MASON-CONTEXT · SCANNED SEP 20
Engineering decisions, change impact, documentation audits, and CI evidence for coding assistants.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 46 of 130 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency97
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to adrianczuczka/mason). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 2 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability68
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3819 tokens (~173/item across 22 items; 22 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management90
- Stability observed for 27 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage97
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 90% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 22 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 23 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the com.adrianczuczka/mason MCP server?
com.adrianczuczka/mason runs locally as an npm package, launched with npx -y mason-context. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · mason-context
claude mcp add com-adrianczuczka-mason -- npx -y mason-context
{
"mcpServers": {
"com-adrianczuczka-mason": {
"command": "npx",
"args": [
"-y",
"mason-context"
]
}
}
} {
"servers": {
"com-adrianczuczka-mason": {
"command": "npx",
"args": [
"-y",
"mason-context"
]
}
}
} codex mcp add com-adrianczuczka-mason -- npx -y mason-context
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"com-adrianczuczka-mason": {
"type": "local",
"command": [
"npx",
"-y",
"mason-context"
],
"enabled": true
}
}
} openclaw mcp add com-adrianczuczka-mason --command npx --arg -y --arg mason-context
mcp_servers:
com-adrianczuczka-mason:
command: "npx"
args: ["-y", "mason-context"] {
"McpServers": {
"com-adrianczuczka-mason": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"mason-context"
]
}
}
} assistant mcp add com-adrianczuczka-mason -t stdio -c npx -a -y mason-context
{
"mcpServers": {
"com-adrianczuczka-mason": {
"command": "npx",
"args": [
"-y",
"mason-context"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 19 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 17 Sept 26 −3
- Stability: pass → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Stability: pass → 0.80 functional
- Package version: 0.6.0 → 0.18.0 functional
- Package version: 0.17.4 → 0.18.0 functional
- 16 Sept 26 0
- Stability: 0.97 → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Stability: 0.97 → pass security
- Tool coverage: 97% → 90% ▼ functional
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Package version: 0.16.3 → 0.17.4 functional
- 15 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 10 Sept 26 +8
- Known CVEs: unverified → pass ▲ security
- Dependency health: unverified → 0.83 ▲ functional
- Stability: pass → 0.80 functional
- 9 Sept 26 +5
- Known CVEs: pass → unverified ▼ security
- Stability: 0.97 → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Malware scan: unverified → pass ▲ security
- Stability: 0.97 → pass security
- Dependency health: 0.83 → unverified ▼ functional
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Package version: 0.16.1 → 0.16.3 functional
- Package version: 0.16.1 → 0.16.2 functional
- 8 Sept 26 −15
- Malware scan: pass → unverified ▼ security
- Package version: 0.12.0 → 0.16.1 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/mason-context@0.18.0
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | adrianczuczka/mason |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/adrianczuczka/mason/.github/workflows/publish.yml@refs/tags/v0.18.0 |
| Rekor log index | 2875591638 |
| Predicate type | https://slsa.dev/provenance/v1 |
| Subject digest | sha512:7d41c37bcf991f6398acef6c40e02841eb276faf4dc62d4404c1eda1d9580617195c95992fa1a51e29f65599453163bc859d26dae6564d308d0ffa8fb |
Background: How many MCP packages publish verified provenance →
Dependencies 130 packages
| Packages resolved | 130 |
|---|---|
| Stale | 46 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
analyze_project ~60
Run git history analysis on a codebase. Returns commit convention patterns, stale directories, and frequently changed files. These are aggregate stats across hundreds of commits that would be expensive to compute manually.
| Name | Type | Req | Description |
|---|---|---|---|
| dir | string | yes | Absolute path to the project root directory |
No output schema declared.
No examples provided.
export_to_confluence ~186
Sync the project's concept map to Confluence as product-readable wiki pages: an index page, one page per feature (PM-language descriptions, no file paths), and a changelog page. Mason replaces managed page bodies; manual edits to those bodies are overwritten. Requires `mason_set_confluence` to have been called first.
| Name | Type | Req | Description |
|---|---|---|---|
| changelogPageTitle | string | – | Title of the changelog page (default: 'Mason — Changelog') |
| dir | string | yes | Absolute path to the project root directory |
| featurePagePrefix | string | – | Prefix for each feature page title (default: 'Feature: ') |
| indexPageTitle | string | – | Title of the index page (default: 'Mason — System Map') |
| parentPageId | string | – | Override the configured parent page ID |
| spaceKey | string | – | Override the configured space key |
No output schema declared.
No examples provided.
full_analysis ~85
One-shot orientation for a project WITHOUT a concept map (get_snapshot returned exists:false). Returns git history stats, project structure with file counts, curated code sample previews (~60 lines each), and test-to-source mapping. On a mapped project, prefer get_snapshot — it is cheaper and answers feature/architecture questions directly.
| Name | Type | Req | Description |
|---|---|---|---|
| dir | string | yes | Absolute path to the project root directory |
No output schema declared.
No examples provided.
generate_snapshot_batch ~238
Map step of the concept-map build. Returns one batch of source files (skeletons of every file in the batch plus a few deeper-read bodies for grounding), along with a system prompt instructing you to derive features and flows for ONLY this batch. Call repeatedly with the returned `nextOffset` until it is null, calling `save_partial_snapshot` between each call. Use product-natural feature names so partials merge cleanly in the reduce step.
| Name | Type | Req | Description |
|---|---|---|---|
| batchSize | integer | – | Files per batch. Defaults to 50. |
| dir | string | yes | Absolute path to the project root directory |
| files | array | – | Scope the batch walk to this explicit file list — e.g. the drift set from mason_check_drift (changedFiles + unmappedFiles). Pass the SAME list on every batch call of one refresh run. Triggers refresh… |
| offset | integer | – | 0-indexed file offset to start the batch at. Omit on the first call; pass the `nextOffset` from the previous response for subsequent calls. |
No output schema declared.
No examples provided.
get_code_samples ~91
Get previews (first ~60 lines) of representative source files from the codebase. Includes entry points, config files, hot files (frequently changed), test examples, and one file per directory for breadth. Read files natively for full content.
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | – | Maximum number of files to sample (default: 15) |
| dir | string | yes | Absolute path to the project root directory |
No output schema declared.
No examples provided.
get_context ~208
Assemble task context: matching decisions with rationale, approval, owner, sources, last review, and freshness, plus related tests, file impact, and any available map entries. Map verification is rechecked against sampled source contents; stale or unknown verification requires a fresh review, and recordedVerdict preserves the historical verdict. Proposals are suggestions; legacy records are unreviewed; accepted decisions are constraints subject to freshness. No initialization or map required. Pass task and optional files. map.status and diagnostics preserve missing or invalid knowledge. Impact covers up to three unique files, expanding directory anchors.
| Name | Type | Req | Description |
|---|---|---|---|
| dir | string | yes | Absolute path to the project root directory |
| files | array | – | Optional file paths already known to be involved (e.g. from a diff or stack trace). Entries containing them are boosted above pure text matches. |
| task | string | yes | The task, bug, or change request in natural language — e.g. 'add rate limiting to the API client' or a ticket description |
No output schema declared.
No examples provided.
get_impact ~96
Trace historical co-change partners, related tests, and references with evidence: resolved imports, explicit paths, or uncertain name candidates. Candidates are not proven dependencies. Deterministic and read-only; no initialization or concept map required.
| Name | Type | Req | Description |
|---|---|---|---|
| dir | string | yes | Absolute path to the project root directory |
| files | array | yes | File paths or names to analyze (e.g., ['WeatherRepository.kt'] or ['src/services/auth.ts']) |
No output schema declared.
No examples provided.
get_snapshot ~100
Return the optional feature-to-file architecture map with drift and trust evidence. Map verification is rechecked against sampled source contents; stale or unknown verification requires a fresh review, and recordedVerdict preserves the historical verdict. If no map exists, returns exists:false plus project structure, Git signals, and test pairs. Decision capture, get_context, and get_impact still work. No initialization required.
| Name | Type | Req | Description |
|---|---|---|---|
| dir | string | yes | Absolute path to the project root directory |
No output schema declared.
No examples provided.
mason_automation ~96
Inspect installed automation and observed host events, or resume/check retained documentation repair evidence across sessions. status is read-only; check saves local baselines and verification reports without editing source or approving advisories. Returns concise results with a full report path. Works without a map.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Inspect configuration and receipts, or capture/resume and verify original audit evidence. |
| dir | string | yes | Absolute path to the project directory |
No output schema declared.
No examples provided.
mason_check_drift ~148
Check how far the concept map has drifted from HEAD. Deterministic (git + filesystem, no LLM). Returns which features/flows are stale and the changed files behind them, new source files not yet mapped, ghost files (mapped but deleted), renames, and a `recommendation`: `up-to-date` (nothing to do), `incremental` (update just the stale entries via save_snapshot), or `full-rebuild` (re-run the Map-Reduce build). Call this before trusting the map in a long session, or periodically to keep the map and any synced wikis fresh.
| Name | Type | Req | Description |
|---|---|---|---|
| dir | string | yes | Absolute path to the project root directory |
No output schema declared.
No examples provided.
mason_complete_init ~99
Record assistant instruction setup locally in ignored .mason/local/project.json, with feature settings in shared .mason/config.json. Other tools work without this marker. Repeated calls preserve the original setup time and existing settings; pass confluenceConfigured only to change that setting.
| Name | Type | Req | Description |
|---|---|---|---|
| confluenceConfigured | boolean | – | Set the Confluence setup status; omit to preserve the existing value |
| dir | string | yes | Absolute path to the project root directory |
No output schema declared.
No examples provided.
mason_init ~254
Inspect this project now: returns documentation audit findings, committed-diff review findings, decision/map status, and a quickstart playbook. Quickstart and map modes are read-only and deterministic. Explicit mode: setup configures MCP, instructions and lifecycle hooks to use mason on PATH while retaining original audit evidence; use it only when the user requests setup. Optional host selects codex or claude. Optional base selects the review comparison; evidence imports CI manifests with check outcomes, commit freshness, and links to changed files and accepted decisions. mode: map returns the full Map-Reduce build workflow. Repeat calls refresh findings even after setup.
| Name | Type | Req | Description |
|---|---|---|---|
| base | string | – | Git ref for committed-diff review. Defaults to the first available main branch ref. |
| dir | string | yes | Absolute path to the project root directory |
| evidence | array | – | Repository-local CI evidence manifests to include in the review. Imports Vitest JSON, SARIF, and native-validator mason-check-json results without executing check commands. |
| host | string | – | Assistant to configure in setup mode; inferred only when unambiguous. |
| mode | string | – | Quickstart inspects without edits; map requests an architecture build; setup installs the shared onboarding flow. |
No output schema declared.
No examples provided.
mason_repair ~127
Track documentation repairs against original audit evidence. prepare saves a local baseline and returns a scoped work order; verify reads that baseline and reports resolved, unresolved, review-required, unverified, and new findings. Suppressed advisories remain unresolved. Does not edit documentation or approve decisions. No map required.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | – |
| baselinePath | string | – | Original baseline path returned by prepare; required for verify. |
| checks | array | – | Optional audit check subset for prepare. Verification always uses the original checks. |
| dir | string | yes | Absolute path to the project root directory |
No output schema declared.
No examples provided.
mason_set_confluence ~228
Configure Confluence credentials. Two-step flow: (1) call without `spaceKey` to validate the credentials and receive a list of available spaces — relay them to the user. (2) call again with the same `baseUrl`/`email`/`apiToken` plus the chosen `spaceKey` to persist. Credentials are stored in `~/.mason/config.json`. Warn the user that the API token will be visible in chat history before they paste it.
| Name | Type | Req | Description |
|---|---|---|---|
| apiToken | string | yes | API token from id.atlassian.com/manage-profile/security/api-tokens |
| baseUrl | string | yes | Confluence base URL. Accepts `acme`, `acme.atlassian.net`, or `https://acme.atlassian.net` (normalized automatically). |
| string | yes | User's Atlassian account email | |
| parentPageId | string | – | Optional parent page ID under which Mason's index page is created |
| spaceKey | string | – | Confluence space key. Omit on the first call to list available spaces. |
No output schema declared.
No examples provided.
reduce_snapshot ~93
Reduce step of the concept-map build. Returns every partial snapshot plus a system prompt asking you to merge them into one coherent project-wide map. Resolve platform variants into single product features, dedupe near-duplicates, and ensure no file is dropped. After producing the unified map, call `save_snapshot` to persist it (this also clears the partials).
| Name | Type | Req | Description |
|---|---|---|---|
| dir | string | yes | Absolute path to the project root directory |
No output schema declared.
No examples provided.
review_advisory ~137
Prepare an assessment of an original repair advisory and its exact repository scope, then record authorized addressed, inapplicable or deferred outcomes with reviewToken, reviewer and note. Relevant changes reopen reviews; unrelated commits preserve them. Records belong in Git. Decision findings route to review_decision; this tool never approves decisions. Recorded identities are assertions, not authenticated approvals.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | – |
| baselinePath | string | yes | – |
| dir | string | yes | Absolute path to the project root |
| findingId | string | yes | – |
| note | string | – | – |
| reviewToken | – | – | – |
| reviewer | string | – | – |
No output schema declared.
No examples provided.
review_decision ~227
Prepare a decision review: returns the full record and history, any operative accepted revision, provenance, changes and previews for both sets of anchors, and a reviewToken. Then record accept, reaffirm, or retire with that token, the authorized reviewer, and a reason. Acceptance replaces the operative revision; retirement withdraws the entire record including its proposal. Acceptance requires owner, source, readable Git HEAD, and committed anchor changes. Changed records or code invalidate the token. Identities and approvals are recorded assertions for normal PR review, not authenticated proof.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | Prepare is read-only. Other actions record an explicitly authorized review. |
| dir | string | yes | Absolute path to the project root directory |
| id | string | yes | Decision id from get_context or save_decision |
| note | string | – | Review rationale; required for a verdict. Cite evidence for the decision. |
| reviewToken | string | – | Token from the prepared review; rejects stale record or code revisions |
| reviewer | string | – | Identity of the actual reviewer; required for a verdict. Never invent one. |
No output schema declared.
No examples provided.
save_decision ~515
Capture or revise a decision proposal with rationale, anchors, optional owner, sources, and a known actor. Compare matching get_context records and pending proposals before saving. When new evidence changes the same lesson's assumptions, scope, or recommended action, pass its existing id, including for accepted records. Preserve supported rationale and sources and replace obsolete instructions. Create a new record for a genuinely distinct lesson; skip unchanged restatements. No setup or map required. Writes a local record and preserves content history. Changes create a pending proposal while the last accepted revision remains operative; unchanged content does not re-verify or refresh it. Use review_decision for authorized acceptance or reaffirmation. A proposal cannot supersede a record with an operative accepted revision; review its replacement and retire the original separately.
| Name | Type | Req | Description |
|---|---|---|---|
| actor | string | – | Known person or agent recording this revision. Omit if unknown; do not infer from Git identity. |
| body | string | yes | The knowledge itself: what was tried/decided, why, and what to avoid. Must contain information NOT derivable by reading the code. Aim for 1500 characters or fewer; up to 2500 is accepted with a warni… |
| category | string | yes | – |
| dir | string | yes | Absolute path to the project root directory |
| files | array | – | Repo-relative files or directory prefixes this applies to. Matching is shared by retrieval, hooks, review, and drift checking; changes flag the decision for re-verification. |
| force | boolean | – | Save even when a near-duplicate was detected |
| id | string | – | Pass the matching record's existing id when evidence changes that lesson's assumptions, scope, or recommended action, including for accepted records. Changed content becomes a proposal while the acce… |
| owner | – | – | Responsible person or team, when known. Null clears it. Required for acceptance. |
| sources | array | – | Known PR, issue, incident, discussion, or document references. Omit to preserve; [] clears. At least one is required for acceptance. |
| supersedes | string | – | Id of an unreviewed record or proposal with no accepted revision to replace. Operative accepted decisions require separate review and retirement. |
| title | string | yes | Short, specific headline (max 80 characters). Generates a stable id on creation; revising the title keeps the existing id. |
No output schema declared.
No examples provided.
save_partial_snapshot ~173
Persist the partial concept map you derived for one batch. Call this once per batch, with the `batchId` from the `generate_snapshot_batch` response. Partials accumulate in `.mason/partial-snapshots/` and are merged in the reduce step.
| Name | Type | Req | Description |
|---|---|---|---|
| batchId | string | yes | The `batchId` returned by `generate_snapshot_batch`. |
| dir | string | yes | Absolute path to the project root directory |
| features | object | yes | Partial features for this batch only — files outside the batch will be added by other partials. |
| flows | object | yes | Partial flows whose entire chain is in this batch. Cross-batch flows are reconstructed in reduce. |
| offset | integer | yes | The `offset` returned by `generate_snapshot_batch`. Used to order partials in the reduce step. |
No output schema declared.
No examples provided.
save_snapshot ~170
Save a concept-to-files map as a persistent project snapshot. Maps feature names and data flows to the files that implement them. Persists across conversations — future sessions can call get_snapshot to instantly find relevant files. No API key needed — you are the LLM generating the map.
| Name | Type | Req | Description |
|---|---|---|---|
| dir | string | yes | Absolute path to the project root directory |
| features | object | yes | Map of feature names to their implementing files |
| flows | object | yes | Map of flow names to ordered file chains |
| removeFeatures | array | – | Feature names to delete from the existing map — for features that were renamed or no longer exist. Applied before merging; only meaningful on incremental saves. |
| removeFlows | array | – | Flow names to delete from the existing map. Applied before merging; only meaningful on incremental saves. |
No output schema declared.
No examples provided.
save_verification ~113
Record verify_snapshot verdicts using each entry’s kind and reviewToken. Missing tokens request a fresh review; changed or deleted entries return conflicts without being stamped. Entries judged ok are stamped verifiedAt; failures are flagged verificationFailed with your note and surface in get_context, get_snapshot, and mason_check_drift until corrected. Verdict notes are required for failures.
| Name | Type | Req | Description |
|---|---|---|---|
| dir | string | yes | Absolute path to the project root directory |
| verdicts | object | yes | Entry name → verdict, exactly as returned by verify_snapshot |
No output schema declared.
No examples provided.
verify_snapshot ~149
Spot-check the concept map's CORRECTNESS (drift checks freshness; this checks entries were right to begin with). Returns a sample of entries — always the never-verified and least-recently-verified first — with skeletons of their claimed files, for you to judge whether the files actually implement what the entry claims. Report verdicts back via save_verification with each entry’s kind and reviewToken. Tokens bind the entry and bounded source evidence; changed evidence requires a fresh review. Run periodically, or after an automated refresh wrote entries no human reviewed.
| Name | Type | Req | Description |
|---|---|---|---|
| dir | string | yes | Absolute path to the project root directory |
| sample | integer | – | Entries to sample (default 5) |
No output schema declared.
No examples provided.
What is the com.adrianczuczka/mason MCP server?
com.adrianczuczka/mason is an MCP server listed in the public MCP registry as com.adrianczuczka/mason. Engineering decisions, change impact, documentation audits, and CI evidence for coding assistants. This page covers its npm package (mason-context).
Is the com.adrianczuczka/mason MCP server safe to use?
com.adrianczuczka/mason scores 91 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the com.adrianczuczka/mason MCP server expose?
com.adrianczuczka/mason exposes 22 tools: mason_init, mason_automation, mason_repair, review_advisory, mason_complete_init, and 17 more. Their descriptions and schemas cost roughly 3,593 tokens of context every time the server is loaded.
Is the com.adrianczuczka/mason MCP server still maintained?
com.adrianczuczka/mason is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the com.adrianczuczka/mason MCP server under?
com.adrianczuczka/mason declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.