Contentrain
NPM · @CONTENTRAIN/MCP · 3 COMPONENTS
Git content governance, 23 deterministic MCP tools. Hosted: docs.contentrain.io/developer/mcp-cloud
Available components
Last scanned (19 hours ago)
Scores higher than 0% of npm servers
Category Version Control
Recent critical change
CVE-2026-102828 affects this package (7 Oct 2026). See the changelog before you install this server.
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security73
- No malware found by supply-chain analysis.Pass
- CVE check failed: an unpatched critical CVE affects this package; the score is capped at 0. See how to fix → View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 41 of 134 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to Contentrain/ai). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 0 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability70
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3622 tokens (~157/item across 23 items; 23 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 99% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 5 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 24 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 −69
- Known CVEs: unverified → fail ▼ critical
- Score status: scored → failed ▼ critical
- Stability: pass → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Malware scan: unverified → pass ▲ security
- Tool coverage: 100 → unverified ▼ functional
- Capabilities: pass → unverified ▼ functional
- Dependency health: unverified → 0.87 ▲ functional
- Package version: 3.12.2 → 3.12.3 functional
- 3 Nov 26 +69
- Score status: scored → failed ▼ critical
- Known CVEs: fail → unverified ▼ security
- Malware scan: pass → unverified ▼ security
- Dependency health: 0.87 → unverified ▼ functional
- Score status: failed → scored ▲ functional
- Package version: 3.11.22 → 3.12.2 functional
- Package version: 3.11.22 → 3.12.1 functional
- Package version: 3.11.22 → 3.12.0 functional
- Package version: 3.11.22 → 3.11.24 functional
- Package version: 3.11.22 → 3.11.23 functional
- 1 Nov 26 −69
- Known CVEs: unverified → fail ▼ critical
- Score status: scored → failed ▼ critical
- Malware scan: unverified → pass ▲ security
- Dependency health: unverified → 0.87 ▲ functional
- 31 Oct 26 0
- Known CVEs: unverified → fail ▼ critical
- Score status: scored → failed ▼ critical
- Malware scan: unverified → pass ▲ security
- Dependency health: unverified → 0.87 ▲ functional
- Score status: failed → scored ▲ functional
- Package version: 3.11.19 → 3.11.22 functional
- Package version: 3.11.19 → 3.11.21 functional
- 30 Oct 26 +69
- Known CVEs: fail → unverified ▼ security
- Malware scan: pass → unverified ▼ security
- Dependency health: 0.87 → unverified ▼ functional
- Score status: failed → scored ▲ functional
- Package version: 3.11.18 → 3.11.19 functional
- 28 Oct 26 0
- Tool safety: pass → unverified ▼ security
- Stability: pass → unverified ▼ security
- Malware scan: unverified → pass ▲ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Security disclosure: fail → pass ▲ functional
- Package version: 3.11.17 → 3.11.18 functional
- 27 Oct 26 0
- Malware scan: pass → unverified ▼ security
- Package version: 3.11.16 → 3.11.17 functional
- 25 Oct 26 −68
- Known CVEs: unverified → fail ▼ critical
- Score status: scored → failed ▼ critical
- Malware scan: unverified → pass ▲ security
- Dependency health: unverified → 0.87 ▲ functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Nov 2026 · Analysed npm/@contentrain/mcp@3.12.3
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | Contentrain/ai |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/Contentrain/ai/.github/workflows/release.yml@refs/heads/main |
| Rekor log index | 3688333207 |
| Predicate type | SLSA build provenance https://slsa.dev/provenance/v1 |
| Subject digest | sha512:532f41792ca12e1d87ba6ec678dda5067968950044da9166f2b8158a83908b2de8cd3c8130592530dbe671962940f5b48529d93ace66072b228e6716e |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 11 findings
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-v5rq-49vh-5v5c | CVE-2026-102829 | critical | yes | |
| GHSA-858h-whjf-mvg5 | CVE-2026-102827 | high | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | yes |
| GHSA-g4wm-2vf7-vfgr | CVE-2026-102826 | high | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | yes |
| GHSA-x6jw-m9v5-85vh | CVE-2026-102828 | critical | yes | |
| GHSA-crpf-4hrx-3jrp | CVE-2026-27125 | medium | yes | |
| GHSA-f7gr-6p89-r883 | CVE-2026-27121 | medium | yes | |
| GHSA-m56q-vw4c-c2cp | CVE-2026-27122 | medium | yes | |
| GHSA-phwv-c562-gvmh | CVE-2026-27901 | medium | yes | |
| GHSA-pr6f-5x2q-rwfp | CVE-2026-42599 | medium | yes | |
| GHSA-rcqx-6q8c-2c42 | CVE-2026-42573 | medium | yes | |
| GHSA-mrhx-c7xc-m3w5 | CVE-2023-54404 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 134 packages
| Packages resolved | 134 |
|---|---|
| Stale | 41 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
contentrain_apply ~232
Apply normalize operations. Two modes: "extract" writes agent-approved strings to Contentrain content files (source untouched), "reuse" patches source files with agent-provided replacement expressions. DRY RUN (default, dry_run:true): validates inputs, resolves conflicts, and returns a full preview — NO changes to disk or git. EXECUTE (dry_run:false): writes files to disk, commits to a branch, and requires branch health check to pass. Recommended workflow: always run dry_run first, review the preview, then call again with dry_run:false to execute. Normalize operations always use review workflow (never auto-merge).
| Name | Type | Req | Description |
|---|---|---|---|
| dry_run | boolean | – | Defaults to preview mode (dry_run:true). Set dry_run:false to execute after reviewing the preview. |
| extractions | array | – | Extract mode: content extractions |
| mode | string | yes | Apply mode: extract (content creation) or reuse (source patching) |
| patches | array | – | Reuse mode: patches to apply (max 100) |
| scope | object | – | Reuse mode: scope (model or domain required) |
No output schema declared.
No examples provided.
contentrain_branch_delete ~99
Delete a pending contentrain (cr/*) branch that will not be merged — e.g. a branch left behind by a failed operation, or a superseded draft. Only cr/* branches can be deleted; the contentrain branch is protected. This is destructive: the branch and its unmerged commits are removed.
| Name | Type | Req | Description |
|---|---|---|---|
| branch | string | yes | The cr/* branch to delete |
| confirm | boolean | yes | Must be true to confirm deletion |
No output schema declared.
No examples provided.
contentrain_branch_list ~118
List pending contentrain (cr/*) branches with their merge status against the contentrain branch. Use this to discover branch names for contentrain_merge / contentrain_branch_delete, and to monitor branch-health limits (warning at 50, blocked at 80 unmerged).
| Name | Type | Req | Description |
|---|---|---|---|
| remote | boolean | – | Also check the git remote: annotate entries with on_remote and report remote-only cr/* leftovers. Requires network. Default: false |
| unmerged_only | boolean | – | Only list branches not yet merged into contentrain. Default: false |
No output schema declared.
No examples provided.
contentrain_bulk ~221
Batch operations on content entries: copy a locale, or delete many collection entries. All operations are auto-committed to git. To publish or change status, use contentrain_content_status. DRY RUN (dry_run:true): runs the whole operation in a throwaway worktree and reports exactly what would change — nothing is committed and no branch survives. Recommended workflow: preview with dry_run:true, review the counts, then call again to execute.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | Must be true for delete_entries (not needed while dry_run:true — a preview deletes nothing) |
| dry_run | boolean | – | Preview mode: perform the operation in a throwaway worktree and report what would change, committing nothing. Defaults to false so existing callers keep executing. |
| entry_ids | array | – | Entry IDs for delete_entries (collection models) |
| model | string | yes | Model ID |
| operation | string | yes | – |
| source_locale | string | – | Source locale for copy_locale operation |
| target_locale | string | – | Target locale for copy_locale operation |
No output schema declared.
No examples provided.
contentrain_content_delete ~131
Delete content entries. For dictionaries, use "keys" to remove specific keys (omit to delete entire locale file). Changes are auto-committed to git — do NOT manually edit .contentrain/ files after calling this tool.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | yes | Must be true to confirm deletion |
| id | string | – | Entry ID (collection) |
| keys | array | – | Dictionary only: specific keys to remove. Omit to delete entire locale file. |
| locale | string | – | Locale code |
| model | string | yes | Model ID |
| slug | string | – | Slug (document) |
No output schema declared.
No examples provided.
contentrain_content_list ~161
List content entries (read-only). Each entry carries its publish state under "meta" — status, plus publish_at/expire_at when set — read from the listed locale's meta; singletons and dictionaries carry it at the top level. Local and remote sessions return the same shape. Change status with contentrain_content_status. Returns data from .contentrain/ — do NOT manually create or modify content files.
| Name | Type | Req | Description |
|---|---|---|---|
| filter | object | – | Filter criteria (collection only) |
| limit | number | – | Max entries to return |
| locale | string | – | Locale code (defaults to config default) |
| model | string | yes | Model ID |
| offset | number | – | Skip N entries |
| resolve | boolean | – | Resolve relation fields to actual data |
No output schema declared.
No examples provided.
contentrain_content_save ~260
Save content entries. Entry format varies by model kind: DICTIONARY — provide "locale" and "data" (flat key-value, all string values); "id" and "slug" are ignored; data keys are the identities. COLLECTION — provide "locale" and "data"; "id" is optional (auto-generated if omitted); "slug" is ignored. DOCUMENT — provide "slug" (required), "locale", and "data"; use the "body" key inside data for markdown content. SINGLETON — provide only "locale" and "data". MEDIA FIELDS (image/video/file): for a media-library asset, pass its storage path ("media/...") or URL; in cloud mode these are automatically normalized to absolute public delivery URLs on save (in markdown bodies too), so saved content renders in a browser anywhere with no SDK — in local mode the relative path is kept as-is. For external images (e.g. a CDN or Unsplash URL), pass the URL directly; it is saved untouched. Changes are auto-committed to git — do NOT manually edit .contentrain/ files after calling this tool.
| Name | Type | Req | Description |
|---|---|---|---|
| entries | array | yes | Content entries to save |
| model | string | yes | Model ID |
No output schema declared.
No examples provided.
contentrain_content_status ~243
Change the status of content entries — this is how an entry is published, unpublished or archived. Address records the way their meta is laid out: COLLECTION — "entry_ids"; DOCUMENT — "slugs"; SINGLETON and DICTIONARY — neither (one record per locale). i18n models change every supported locale unless "locale" is given. Setting status "published" validates the targeted entries first; if they have errors, nothing is committed. Records already at the requested status are reported as unchanged and not rewritten. contentrain_content_list shows each entry's current status under "meta". Changes are committed to git and follow the project's review or auto-merge workflow — do NOT manually edit .contentrain/meta files.
| Name | Type | Req | Description |
|---|---|---|---|
| entry_ids | array | – | Entry IDs (collection models only) |
| locale | string | – | Scope the change to one locale (i18n models only; defaults to every supported locale) |
| model | string | yes | Model ID |
| slugs | array | – | Document slugs (document models only) — a document is addressed by slug, the same identity contentrain_content_save uses |
| status | string | yes | New status |
No output schema declared.
No examples provided.
contentrain_describe ~83
Get full schema of a single model (read-only). Do NOT manually create content files — use contentrain_content_save instead.
| Name | Type | Req | Description |
|---|---|---|---|
| include_sample | boolean | – | Include one sample entry |
| locale | string | – | Locale for sample content (default: config default locale) |
| model | string | yes | Model ID (e.g. "blog-post", "hero") |
No output schema declared.
No examples provided.
contentrain_describe_format ~47
Describes the Contentrain content file format for any language/platform. Returns a comprehensive specification of the file structure, JSON formats, markdown conventions, meta files, and locale strategies.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
contentrain_doctor ~107
Project health report (read-only). Returns structured checks: git, node, .contentrain/ structure, model parse, orphan content, branch pressure, SDK freshness. Pass `usage: true` for a deeper analysis of content-key references in source files (unused keys, duplicate dictionary values, locale coverage). Local-filesystem only — unavailable over remote providers.
| Name | Type | Req | Description |
|---|---|---|---|
| usage | boolean | – | Run the heavier usage-analysis branch (unused keys, duplicate values, missing locales). Default: false. |
No output schema declared.
No examples provided.
contentrain_init ~96
Initialize .contentrain/ structure. Changes are auto-committed to git — do NOT manually create .contentrain/ files.
| Name | Type | Req | Description |
|---|---|---|---|
| domains | array | – | Content domains. Default: auto-suggested |
| locales | array | – | Supported locales. Default: ["en"] |
| stack | string | – | Framework stack (nuxt, next, astro, svelte, react-vite, other). Auto-detected if omitted. |
No output schema declared.
No examples provided.
contentrain_merge ~183
Merge a review-mode branch into contentrain. Local git operation — no external platform needed. Merges the feature branch into the contentrain branch, advances the base branch via update-ref, selectively syncs .contentrain/ files to the working tree, and prunes the merged branch. Target by exact "branch" name, or resolve by "model" (+ optional "locale"/"latest").
| Name | Type | Req | Description |
|---|---|---|---|
| branch | string | – | Exact branch name to merge (e.g. cr/content/blog-post/...). Omit to resolve by model. |
| confirm | boolean | yes | Must be true to confirm the merge |
| latest | boolean | – | When multiple branches match the model, merge the most recently committed one. |
| locale | string | – | Narrow model resolution to a locale. |
| model | string | – | Resolve the branch by model id (e.g. "blog-post"). |
No output schema declared.
No examples provided.
contentrain_model_delete ~61
Delete a model and its content/meta. Changes are auto-committed to git — do NOT manually edit .contentrain/ files.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | yes | Must be true to confirm deletion |
| model | string | yes | Model ID to delete |
No output schema declared.
No examples provided.
contentrain_model_save ~327
Create or update a model definition. Changes are auto-committed to git — do NOT manually edit .contentrain/ files after calling this tool.
| Name | Type | Req | Description |
|---|---|---|---|
| content_path | string | – | Framework-relative path for content files (e.g. "content/blog", "locales"). When set, content is written here instead of .contentrain/content/ |
| description | string | – | Model description |
| domain | string | yes | Content domain (e.g. "blog", "marketing", "system") |
| fields | object | – | Field definitions (not needed for dictionary) |
| i18n | boolean | yes | Whether this model supports localization |
| id | string | yes | Model ID (kebab-case, e.g. "blog-post") |
| kind | string | yes | Model kind |
| locale_strategy | string | – | How locale is encoded in file names. Default: "file" |
| locales | array | – | The project locales this model's content covers — a subset of config.locales.supported. Omit it (the default) and the model covers every supported locale, which is what validation checks parity again… |
| name | string | yes | Human-readable name |
| title_field | string | yes | Name of the field shown as an entry's title in listings, pickers and relation references. Must name a field on this model whose type is string, text, slug, email, url, code, markdown or richtext. Dic… |
No output schema declared.
No examples provided.
contentrain_reconcile ~209
Reconcile a diverged contentrain ↔ base-branch pair with a content-aware three-way merge. DRY RUN (default, dry_run:true): reports what would merge and which conflicts need a decision — touches nothing. EXECUTE (dry_run:false): performs the merge as a two-parent commit on contentrain and fast-forwards the base branch. Everything one side changed merges mechanically (entry-, key-, term+locale-level); only the same item changed differently on both sides becomes a conflict. Answer conflicts by passing resolutions (from the dry-run ids) and running again — a resolution whose values changed since the dry-run is dropped and the conflict re-reported. Recommended workflow: always run dry_run first, review the summary and conflicts, then execute.
| Name | Type | Req | Description |
|---|---|---|---|
| dry_run | boolean | – | Defaults to preview mode (dry_run:true). Set dry_run:false to execute after reviewing the preview. |
| resolutions | array | – | Decisions for conflicts reported by a previous dry-run, matched by id |
No output schema declared.
No examples provided.
contentrain_scaffold ~95
Template-based project setup. Available templates: blog, landing, docs, ecommerce, saas, i18n, mobile. Changes are auto-committed to git.
| Name | Type | Req | Description |
|---|---|---|---|
| locales | array | – | Override locales |
| template | string | yes | Template ID: blog, landing, docs, ecommerce, saas, i18n, mobile |
| with_sample_content | boolean | – | Include sample content (default: true) |
No output schema declared.
No examples provided.
contentrain_scan ~260
Scan project source code for content strings. Three modes: "graph" builds import/component graph for project intelligence, "candidates" extracts string literals with pre-filtering and pagination, "summary" provides quick overview stats. Read-only — no changes to disk or git. MCP finds strings deterministically; the agent decides what is content. Recommended workflow: start with "summary" or "graph" for orientation, then paginate through "candidates" to evaluate strings.
| Name | Type | Req | Description |
|---|---|---|---|
| exclude | array | – | Additional directory names to exclude |
| include | array | – | File extensions to include. Default: .tsx, .jsx, .vue, .ts, .js, .mjs, .astro, .svelte |
| limit | number | – | Candidates mode: batch size. Default: 50 |
| max_length | number | – | Candidates mode: maximum string length. Default: 500 |
| min_length | number | – | Candidates mode: minimum string length. Default: 2 |
| mode | string | – | Scan mode. Default: candidates |
| offset | number | – | Candidates mode: pagination offset. Default: 0 |
| paths | array | – | Directories to scan (relative to project root). Default: auto-detect |
No output schema declared.
No examples provided.
contentrain_status ~37
Get full project status (read-only). Returns config, models, context. Do NOT manually edit .contentrain/ based on this output.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
contentrain_submit ~70
Push cr/* branches to remote. MCP is push-only — PR creation is handled by the platform. Do NOT manually push or create PRs.
| Name | Type | Req | Description |
|---|---|---|---|
| branches | array | – | Specific branch names to push (omit for all cr/* branches) |
| message | string | – | Optional message for the push operation |
No output schema declared.
No examples provided.
contentrain_validate ~277
Validate project content against model schemas. Detects required field violations, type mismatches, broken relations, secret leaks, i18n parity issues, and more. If fix:true, auto-fixes structural issues (canonical sort, orphan meta, missing locale files, stray non-i18n meta layout, scheduling keys an older content_save leaked into document frontmatter) and backfills a missing model title_field — do NOT manually edit .contentrain/ files. Content without meta gets meta with status published, matching what delivery already serves. A fix that would change whether an entry is delivered is listed in visibility_changes and left on its branch for review instead of auto-merged.
| Name | Type | Req | Description |
|---|---|---|---|
| fix | boolean | – | Auto-fix structural issues (canonical sort, orphan meta, missing locale files, stray non-i18n meta layout, publish_at/expire_at copies an older content_save left in document frontmatter when meta hol… |
| model | string | – | Model ID to validate (omit for all models) |
No output schema declared.
No examples provided.
contentrain_vocabulary_delete ~68
Remove canonical vocabulary terms by slug. Content already using a term is not touched — the vocabulary only advises. Changes are auto-committed to git.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | yes | Must be true — this deletes canonical terms |
| terms | array | yes | Term slugs to remove |
No output schema declared.
No examples provided.
contentrain_vocabulary_save ~140
Add or update canonical vocabulary terms. Terms nest as { "term-slug": { "en": "…", "tr": "…" } } — the OUTER key is the term, the INNER key is a locale. Merges with the existing vocabulary: a term you omit is untouched. Changes are auto-committed to git — do NOT manually edit .contentrain/vocabulary.json.
| Name | Type | Req | Description |
|---|---|---|---|
| terms | object | yes | Terms keyed by kebab-case term slug, each holding its translations keyed by locale code. Example: { "sign-in": { "en": "Sign in", "tr": "Giriş yap" } } |
No output schema declared.
No examples provided.
How do I install the Contentrain MCP server?
Contentrain runs locally as an npm package, launched with npx -y @contentrain/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @contentrain/mcp
claude mcp add contentrain-contentrain -- npx -y @contentrain/mcp
What is the Contentrain MCP server?
Contentrain is an MCP server listed in the public MCP registry as io.github.Contentrain/contentrain. Git content governance, 23 deterministic MCP tools. Hosted: docs.contentrain.io/developer/mcp-cloud. This page covers its npm package (@contentrain/mcp).
What tools does the Contentrain MCP server expose?
Contentrain exposes 23 tools: contentrain_status, contentrain_describe, contentrain_describe_format, contentrain_init, contentrain_scaffold, and 18 more. Their descriptions and schemas cost roughly 3,525 tokens of context every time the server is loaded.
Is the Contentrain MCP server still maintained?
Contentrain is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Contentrain MCP server under?
Contentrain declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.