Contentrain
NPM · @CONTENTRAIN/MCP · 2 COMPONENTS · SCANNED SEP 20
Git-native content governance for AI agents — 27 deterministic MCP tools over stdio and HTTP.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security88
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known medium-severity CVE affects svelte 4.2.20, a direct dependency. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 41 of 137 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency97
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to Contentrain/ai). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 1 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability70
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3303 tokens (~150/item across 22 items; 22 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management97
- Stability observed for 29 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 99% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 5 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 23 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the Contentrain MCP server?
Contentrain runs locally as an npm package, launched with npx -y @contentrain/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @contentrain/mcp
claude mcp add contentrain-contentrain -- npx -y @contentrain/mcp
{
"mcpServers": {
"contentrain-contentrain": {
"command": "npx",
"args": [
"-y",
"@contentrain/mcp"
]
}
}
} {
"servers": {
"contentrain-contentrain": {
"command": "npx",
"args": [
"-y",
"@contentrain/mcp"
]
}
}
} codex mcp add contentrain-contentrain -- npx -y @contentrain/mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"contentrain-contentrain": {
"type": "local",
"command": [
"npx",
"-y",
"@contentrain/mcp"
],
"enabled": true
}
}
} openclaw mcp add contentrain-contentrain --command npx --arg -y --arg @contentrain/mcp
mcp_servers:
contentrain-contentrain:
command: "npx"
args: ["-y", "@contentrain/mcp"] {
"McpServers": {
"contentrain-contentrain": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@contentrain/mcp"
]
}
}
} assistant mcp add contentrain-contentrain -t stdio -c npx -a -y @contentrain/mcp
{
"mcpServers": {
"contentrain-contentrain": {
"command": "npx",
"args": [
"-y",
"@contentrain/mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 19 Sept 26 +22
- Known CVEs: unverified → fail ▼ security
- Malware scan: unverified → pass ▲ security
- Dependency health: unverified → 0.87 ▲ functional
- 18 Sept 26 −22
- Known CVEs: fail → unverified ▼ security
- Malware scan: pass → unverified ▼ security
- Stability: 0.87 → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Dependency health: 0.87 → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Capabilities: pass → unverified ▼ functional
- Schema quality: Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. functional
- Package version: 3.4.2 → 3.5.0 functional
- Package version: 3.4.2 → 3.4.3 functional
- 17 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 15 Sept 26 +20
- Known CVEs: unverified → fail ▼ security
- Malware scan: unverified → pass ▲ security
- Dependency health: unverified → 0.87 ▲ functional
- Stability: pass → 0.80 functional
- 14 Sept 26 −22
- Known CVEs: fail → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Malware scan: pass → unverified ▼ security
- Stability: 0.97 → unverified ▼ security
- Stability: 0.97 → pass security
- Capabilities: pass → unverified ▼ functional
- Dependency health: 0.86 → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. functional
- Package version: 3.4.1 → 3.4.2 functional
- 13 Sept 26 +14
- Malware scan: unverified → pass ▲ security
- Stability: pass → 0.97 functional
- 12 Sept 26 +1
- Stability: 0.97 → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Stability: 0.97 → pass security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. functional
- Package version: 3.3.4 → 3.4.1 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/@contentrain/mcp@3.5.0
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | Contentrain/ai |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/Contentrain/ai/.github/workflows/release.yml@refs/heads/main |
| Rekor log index | 2886271925 |
| Predicate type | https://slsa.dev/provenance/v1 |
| Subject digest | sha512:0b8f8af9cc889a8dc8942776f5f54fcb20b313df10c2e5667667c555e246e166faa393c89cdb9f3b1f3feee2a09a45651bbfa6d05b63ea1ea5d1e77c4 |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 6 findings
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-crpf-4hrx-3jrp | CVE-2026-27125 | medium | yes | |
| GHSA-f7gr-6p89-r883 | CVE-2026-27121 | medium | yes | |
| GHSA-m56q-vw4c-c2cp | CVE-2026-27122 | medium | yes | |
| GHSA-phwv-c562-gvmh | CVE-2026-27901 | medium | yes | |
| GHSA-pr6f-5x2q-rwfp | CVE-2026-42599 | medium | yes | |
| GHSA-rcqx-6q8c-2c42 | CVE-2026-42573 | medium | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 137 packages
| Packages resolved | 137 |
|---|---|
| Stale | 41 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
contentrain_apply ~232
Apply normalize operations. Two modes: "extract" writes agent-approved strings to Contentrain content files (source untouched), "reuse" patches source files with agent-provided replacement expressions. DRY RUN (default, dry_run:true): validates inputs, resolves conflicts, and returns a full preview — NO changes to disk or git. EXECUTE (dry_run:false): writes files to disk, commits to a branch, and requires branch health check to pass. Recommended workflow: always run dry_run first, review the preview, then call again with dry_run:false to execute. Normalize operations always use review workflow (never auto-merge).
| Name | Type | Req | Description |
|---|---|---|---|
| dry_run | boolean | – | Defaults to preview mode (dry_run:true). Set dry_run:false to execute after reviewing the preview. |
| extractions | array | – | Extract mode: content extractions |
| mode | string | yes | Apply mode: extract (content creation) or reuse (source patching) |
| patches | array | – | Reuse mode: patches to apply (max 100) |
| scope | object | – | Reuse mode: scope (model or domain required) |
No output schema declared.
No examples provided.
contentrain_branch_delete ~99
Delete a pending contentrain (cr/*) branch that will not be merged — e.g. a branch left behind by a failed operation, or a superseded draft. Only cr/* branches can be deleted; the contentrain branch is protected. This is destructive: the branch and its unmerged commits are removed.
| Name | Type | Req | Description |
|---|---|---|---|
| branch | string | yes | The cr/* branch to delete |
| confirm | boolean | yes | Must be true to confirm deletion |
No output schema declared.
No examples provided.
contentrain_branch_list ~118
List pending contentrain (cr/*) branches with their merge status against the contentrain branch. Use this to discover branch names for contentrain_merge / contentrain_branch_delete, and to monitor branch-health limits (warning at 50, blocked at 80 unmerged).
| Name | Type | Req | Description |
|---|---|---|---|
| remote | boolean | – | Also check the git remote: annotate entries with on_remote and report remote-only cr/* leftovers. Requires network. Default: false |
| unmerged_only | boolean | – | Only list branches not yet merged into contentrain. Default: false |
No output schema declared.
No examples provided.
contentrain_bulk ~280
Batch operations on content entries. All operations are auto-committed to git. DRY RUN (dry_run:true): runs the whole operation in a throwaway worktree and reports exactly what would change — nothing is committed and no branch survives. Recommended workflow: preview with dry_run:true, review the counts, then call again to execute.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | Must be true for delete_entries (not needed while dry_run:true — a preview deletes nothing) |
| dry_run | boolean | – | Preview mode: perform the operation in a throwaway worktree and report what would change, committing nothing. Defaults to false so existing callers keep executing. |
| entry_ids | array | – | Entry IDs for update_status (collection models) or delete_entries |
| locale | string | – | Scope update_status to a single locale (i18n models only; defaults to every supported locale) |
| model | string | yes | Model ID |
| operation | string | yes | – |
| slugs | array | – | Document slugs for update_status (document models) — a document is addressed by slug, the same identity contentrain_content_save uses, not by entry ID |
| source_locale | string | – | Source locale for copy_locale operation |
| status | string | – | New status for update_status |
| target_locale | string | – | Target locale for copy_locale operation |
No output schema declared.
No examples provided.
contentrain_content_delete ~131
Delete content entries. For dictionaries, use "keys" to remove specific keys (omit to delete entire locale file). Changes are auto-committed to git — do NOT manually edit .contentrain/ files after calling this tool.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | yes | Must be true to confirm deletion |
| id | string | – | Entry ID (collection) |
| keys | array | – | Dictionary only: specific keys to remove. Omit to delete entire locale file. |
| locale | string | – | Locale code |
| model | string | yes | Model ID |
| slug | string | – | Slug (document) |
No output schema declared.
No examples provided.
contentrain_content_list ~103
List content entries (read-only). Returns data from .contentrain/ — do NOT manually create or modify content files.
| Name | Type | Req | Description |
|---|---|---|---|
| filter | object | – | Filter criteria (collection only) |
| limit | number | – | Max entries to return |
| locale | string | – | Locale code (defaults to config default) |
| model | string | yes | Model ID |
| offset | number | – | Skip N entries |
| resolve | boolean | – | Resolve relation fields to actual data |
No output schema declared.
No examples provided.
contentrain_content_save ~260
Save content entries. Entry format varies by model kind: DICTIONARY — provide "locale" and "data" (flat key-value, all string values); "id" and "slug" are ignored; data keys are the identities. COLLECTION — provide "locale" and "data"; "id" is optional (auto-generated if omitted); "slug" is ignored. DOCUMENT — provide "slug" (required), "locale", and "data"; use the "body" key inside data for markdown content. SINGLETON — provide only "locale" and "data". MEDIA FIELDS (image/video/file): for a media-library asset, pass its storage path ("media/...") or URL; in cloud mode these are automatically normalized to absolute public delivery URLs on save (in markdown bodies too), so saved content renders in a browser anywhere with no SDK — in local mode the relative path is kept as-is. For external images (e.g. a CDN or Unsplash URL), pass the URL directly; it is saved untouched. Changes are auto-committed to git — do NOT manually edit .contentrain/ files after calling this tool.
| Name | Type | Req | Description |
|---|---|---|---|
| entries | array | yes | Content entries to save |
| model | string | yes | Model ID |
No output schema declared.
No examples provided.
contentrain_describe ~83
Get full schema of a single model (read-only). Do NOT manually create content files — use contentrain_content_save instead.
| Name | Type | Req | Description |
|---|---|---|---|
| include_sample | boolean | – | Include one sample entry |
| locale | string | – | Locale for sample content (default: config default locale) |
| model | string | yes | Model ID (e.g. "blog-post", "hero") |
No output schema declared.
No examples provided.
contentrain_describe_format ~47
Describes the Contentrain content file format for any language/platform. Returns a comprehensive specification of the file structure, JSON formats, markdown conventions, meta files, and locale strategies.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
contentrain_doctor ~107
Project health report (read-only). Returns structured checks: git, node, .contentrain/ structure, model parse, orphan content, branch pressure, SDK freshness. Pass `usage: true` for a deeper analysis of content-key references in source files (unused keys, duplicate dictionary values, locale coverage). Local-filesystem only — unavailable over remote providers.
| Name | Type | Req | Description |
|---|---|---|---|
| usage | boolean | – | Run the heavier usage-analysis branch (unused keys, duplicate values, missing locales). Default: false. |
No output schema declared.
No examples provided.
contentrain_init ~96
Initialize .contentrain/ structure. Changes are auto-committed to git — do NOT manually create .contentrain/ files.
| Name | Type | Req | Description |
|---|---|---|---|
| domains | array | – | Content domains. Default: auto-suggested |
| locales | array | – | Supported locales. Default: ["en"] |
| stack | string | – | Framework stack (nuxt, next, astro, svelte, react-vite, other). Auto-detected if omitted. |
No output schema declared.
No examples provided.
contentrain_merge ~183
Merge a review-mode branch into contentrain. Local git operation — no external platform needed. Merges the feature branch into the contentrain branch, advances the base branch via update-ref, selectively syncs .contentrain/ files to the working tree, and prunes the merged branch. Target by exact "branch" name, or resolve by "model" (+ optional "locale"/"latest").
| Name | Type | Req | Description |
|---|---|---|---|
| branch | string | – | Exact branch name to merge (e.g. cr/content/blog-post/...). Omit to resolve by model. |
| confirm | boolean | yes | Must be true to confirm the merge |
| latest | boolean | – | When multiple branches match the model, merge the most recently committed one. |
| locale | string | – | Narrow model resolution to a locale. |
| model | string | – | Resolve the branch by model id (e.g. "blog-post"). |
No output schema declared.
No examples provided.
contentrain_model_delete ~61
Delete a model and its content/meta. Changes are auto-committed to git — do NOT manually edit .contentrain/ files.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | yes | Must be true to confirm deletion |
| model | string | yes | Model ID to delete |
No output schema declared.
No examples provided.
contentrain_model_save ~327
Create or update a model definition. Changes are auto-committed to git — do NOT manually edit .contentrain/ files after calling this tool.
| Name | Type | Req | Description |
|---|---|---|---|
| content_path | string | – | Framework-relative path for content files (e.g. "content/blog", "locales"). When set, content is written here instead of .contentrain/content/ |
| description | string | – | Model description |
| domain | string | yes | Content domain (e.g. "blog", "marketing", "system") |
| fields | object | – | Field definitions (not needed for dictionary) |
| i18n | boolean | yes | Whether this model supports localization |
| id | string | yes | Model ID (kebab-case, e.g. "blog-post") |
| kind | string | yes | Model kind |
| locale_strategy | string | – | How locale is encoded in file names. Default: "file" |
| locales | array | – | The project locales this model's content covers — a subset of config.locales.supported. Omit it (the default) and the model covers every supported locale, which is what validation checks parity again… |
| name | string | yes | Human-readable name |
| title_field | string | yes | Name of the field shown as an entry's title in listings, pickers and relation references. Must name a field on this model whose type is string, text, slug, email, url, code, markdown or richtext. Dic… |
No output schema declared.
No examples provided.
contentrain_reconcile ~209
Reconcile a diverged contentrain ↔ base-branch pair with a content-aware three-way merge. DRY RUN (default, dry_run:true): reports what would merge and which conflicts need a decision — touches nothing. EXECUTE (dry_run:false): performs the merge as a two-parent commit on contentrain and fast-forwards the base branch. Everything one side changed merges mechanically (entry-, key-, term+locale-level); only the same item changed differently on both sides becomes a conflict. Answer conflicts by passing resolutions (from the dry-run ids) and running again — a resolution whose values changed since the dry-run is dropped and the conflict re-reported. Recommended workflow: always run dry_run first, review the summary and conflicts, then execute.
| Name | Type | Req | Description |
|---|---|---|---|
| dry_run | boolean | – | Defaults to preview mode (dry_run:true). Set dry_run:false to execute after reviewing the preview. |
| resolutions | array | – | Decisions for conflicts reported by a previous dry-run, matched by id |
No output schema declared.
No examples provided.
contentrain_scaffold ~95
Template-based project setup. Available templates: blog, landing, docs, ecommerce, saas, i18n, mobile. Changes are auto-committed to git.
| Name | Type | Req | Description |
|---|---|---|---|
| locales | array | – | Override locales |
| template | string | yes | Template ID: blog, landing, docs, ecommerce, saas, i18n, mobile |
| with_sample_content | boolean | – | Include sample content (default: true) |
No output schema declared.
No examples provided.
contentrain_scan ~260
Scan project source code for content strings. Three modes: "graph" builds import/component graph for project intelligence, "candidates" extracts string literals with pre-filtering and pagination, "summary" provides quick overview stats. Read-only — no changes to disk or git. MCP finds strings deterministically; the agent decides what is content. Recommended workflow: start with "summary" or "graph" for orientation, then paginate through "candidates" to evaluate strings.
| Name | Type | Req | Description |
|---|---|---|---|
| exclude | array | – | Additional directory names to exclude |
| include | array | – | File extensions to include. Default: .tsx, .jsx, .vue, .ts, .js, .mjs, .astro, .svelte |
| limit | number | – | Candidates mode: batch size. Default: 50 |
| max_length | number | – | Candidates mode: maximum string length. Default: 500 |
| min_length | number | – | Candidates mode: minimum string length. Default: 2 |
| mode | string | – | Scan mode. Default: candidates |
| offset | number | – | Candidates mode: pagination offset. Default: 0 |
| paths | array | – | Directories to scan (relative to project root). Default: auto-detect |
No output schema declared.
No examples provided.
contentrain_status ~37
Get full project status (read-only). Returns config, models, context. Do NOT manually edit .contentrain/ based on this output.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
contentrain_submit ~72
Push contentrain/* branches to remote. MCP is push-only — PR creation is handled by the platform. Do NOT manually push or create PRs.
| Name | Type | Req | Description |
|---|---|---|---|
| branches | array | – | Specific branch names to push (omit for all contentrain/* branches) |
| message | string | – | Optional message for the push operation |
No output schema declared.
No examples provided.
contentrain_validate ~198
Validate project content against model schemas. Detects required field violations, type mismatches, broken relations, secret leaks, i18n parity issues, and more. If fix:true, auto-fixes structural issues (canonical sort, orphan meta, missing locale files, stray non-i18n meta layout, scheduling keys an older content_save leaked into document frontmatter) and backfills a missing model title_field — do NOT manually edit .contentrain/ files.
| Name | Type | Req | Description |
|---|---|---|---|
| fix | boolean | – | Auto-fix structural issues (canonical sort, orphan meta, missing locale files, stray non-i18n meta layout, publish_at/expire_at copies an older content_save left in document frontmatter when meta hol… |
| model | string | – | Model ID to validate (omit for all models) |
No output schema declared.
No examples provided.
contentrain_vocabulary_delete ~68
Remove canonical vocabulary terms by slug. Content already using a term is not touched — the vocabulary only advises. Changes are auto-committed to git.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | yes | Must be true — this deletes canonical terms |
| terms | array | yes | Term slugs to remove |
No output schema declared.
No examples provided.
contentrain_vocabulary_save ~140
Add or update canonical vocabulary terms. Terms nest as { "term-slug": { "en": "…", "tr": "…" } } — the OUTER key is the term, the INNER key is a locale. Merges with the existing vocabulary: a term you omit is untouched. Changes are auto-committed to git — do NOT manually edit .contentrain/vocabulary.json.
| Name | Type | Req | Description |
|---|---|---|---|
| terms | object | yes | Terms keyed by kebab-case term slug, each holding its translations keyed by locale code. Example: { "sign-in": { "en": "Sign in", "tr": "Giriş yap" } } |
No output schema declared.
No examples provided.
What is the Contentrain MCP server?
Contentrain is an MCP server listed in the public MCP registry as io.github.Contentrain/contentrain. Git-native content governance for AI agents, 27 deterministic MCP tools over stdio and HTTP. This page covers its npm package (@contentrain/mcp).
Is the Contentrain MCP server safe to use?
Contentrain scores 90 out of 100 on VerifyMCP. We recorded 6 known advisories against it as of 20 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Contentrain MCP server expose?
Contentrain exposes 22 tools: contentrain_status, contentrain_describe, contentrain_describe_format, contentrain_init, contentrain_scaffold, and 17 more. Their descriptions and schemas cost roughly 3,206 tokens of context every time the server is loaded.
Is the Contentrain MCP server still maintained?
Contentrain is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Contentrain MCP server under?
Contentrain declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.