Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

io.github.contextium-io/mcp-server

NPM · @CONTEXTIUM/MCP-SERVER · SCANNED SEP 20

Your team's knowledge, always in context. SOPs, coding standards, and workflows for Claude.

0 this week 75 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security98
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • 58 of 143 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency19
  • Repository check failed: the declared repository URL returned HTTP 404. See how to fix → View diagnostics → Fail
  • Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 40 days ago).Pass
  • Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability72
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 10643 tokens (~154/item across 69 items; 69 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management87
  • Stability observed for 26 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage98
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 95% of tool parameters carry a description.Partial
Tool Safety75
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • 0 of 7 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "delete" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
  • An AI judge read all 69 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

How do I install the io.github.contextium-io/mcp-server server?

io.github.contextium-io/mcp-server runs locally as an npm package, launched with npx -y @contextium/mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · @contextium/mcp-server

# add to Claude Code
claude mcp add contextium-io-mcp-server -- npx -y @contextium/mcp-server
// .cursor/mcp.json
{
  "mcpServers": {
    "contextium-io-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@contextium/mcp-server"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "contextium-io-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@contextium/mcp-server"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add contextium-io-mcp-server -- npx -y @contextium/mcp-server
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "contextium-io-mcp-server": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@contextium/mcp-server"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add contextium-io-mcp-server --command npx --arg -y --arg @contextium/mcp-server
# ~/.hermes/config.yaml
mcp_servers:
  contextium-io-mcp-server:
    command: "npx"
    args: ["-y", "@contextium/mcp-server"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "contextium-io-mcp-server": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "@contextium/mcp-server"
      ]
    }
  }
}
# add to Vellum
assistant mcp add contextium-io-mcp-server -t stdio -c npx -a -y @contextium/mcp-server
// mcp.json
{
  "mcpServers": {
    "contextium-io-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@contextium/mcp-server"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 20 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.

  • 18 Sept 26 −3
    • Stability: pass → 0.80 functional
  • 17 Sept 26 +1
    • Stability: 0.97 → pass security
  • 15 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.

  • 13 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.

  • 11 Sept 26 −3
    • Stability: pass → 0.80 functional
  • 10 Sept 26 +1
    • Stability: 0.97 → pass security
  • 9 Sept 26 −1
    • Stability: pass → 0.97 functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Sept 2026 · Analysed npm/@contextium/mcp-server@1.10.12

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Dependencies 143 packages
Packages resolved 143
Stale 58
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 69 exposed · ~10,643 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
project ~175

DEPRECATED — phases are now DB-backed. Use list_phases (replaces get_next_phase), update_phase_status(phaseId, "done") (replaces mark_phase_complete), and load_workflow (replaces load_session/close_session).

NameTypeReqDescription
actionstringyesLegacy file-based harness. get_next_phase: oldest pending phase FILE; mark_phase_complete: re-tag the phase FILE status:pending → status:passing and archive it; close_session: tag session log as clos…
phaseFileIdstringPhase file ID (action=mark_phase_complete)
sessionLogFileIdstringSession log file ID (action=close_session)
workflowIdstringyesWorkflow ID
workspaceIdstringWorkspace ID (uses default if omitted)

No output schema declared.

No examples provided.

record_lesson ~248

Record a lesson learned — something that went wrong and how it was fixed — into the workspace Lessons Learned library, so the same mistake can be avoided on THIS and any OTHER project. Call this when you hit and resolve a non-obvious bug, a broken assumption, a footgun, or a fix that took real effort to find. Do NOT use it for routine notes or ideas (use capture_idea) or for reusable reference knowledge (use create_skill). Pass `project` so the lesson can be filtered back to its origin; omit it only for genuinely global lessons.

NameTypeReqDescription
fixstringyesWhat actually resolved it, specific enough to act on next time.
problemstringyesWhat went wrong and, importantly, WHY — the root cause, not just the symptom.
projectstringProject/product this came from — becomes a #project-<slug> tag for filtering. Omit only if the lesson is genuinely project-independent.
titlestringyesShort, searchable summary of the lesson (e.g. "Redis delete-then-set race made deleted libraries reappear")
workspaceIdstringWorkspace ID. Defaults to your active workspace.

No output schema declared.

No examples provided.

reorder_phases ~92

Reorder the phases in a workflow's project plan. Provide the full list of phase IDs in the desired order; the plan's sort order is updated to match.

NameTypeReqDescription
orderedIdsarrayyesPhase IDs in the desired order (typically the full set of phases for the plan).
workflowIdstringyesWorkflow ID
workspaceIdstringWorkspace ID. Defaults to your configured workspace.

No output schema declared.

No examples provided.

resolve_comment ~89

Resolve (acknowledge) a comment thread once it has been addressed — it disappears from default views everywhere (web, desktop, public share page, list_comments). Pass the ROOT comment id; the whole thread resolves. Set resolved=false to reopen.

NameTypeReqDescription
commentIdstringyesRoot comment id (from list_comments)
resolvedbooleantrue = resolve (default), false = reopen

No output schema declared.

No examples provided.

restore_library ~58

Restore a context library from trash. Must be within the 30-day restore window.

NameTypeReqDescription
libraryIdstringyesThe UUID of the library to restore
workspaceIdstringWorkspace ID (optional — uses default workspace if omitted)

No output schema declared.

No examples provided.

resume_project ~138

Resume a Contextium project from a session handoff — loads the project plan, finds the last handoff note, and briefs you so you can continue without losing context. Call this when the user says things like: "resume my project", "continue where I left off", "pick up from last session", "what was I working on", "I'm back let's continue", "carry on from yesterday", "what's next in my project".

NameTypeReqDescription
workflowIdstringWorkflow ID to resume (optional — if omitted, auto-selects if only one workflow exists)
workspaceIdstringWorkspace ID (uses default if omitted)

No output schema declared.

No examples provided.

search ~211

Find files in a workspace when you don't know their exact ID. Pick a `mode`: "text" runs a full-text search over file contents and titles; "tags" returns files carrying ALL of the given tagIds (AND logic); "files" matches by partial file name/title. Reach for search before `get` when you only know roughly what you want; use `list` with type=files instead when you just need everything in a library. Optionally narrow to one library with libraryId.

NameTypeReqDescription
libraryIdstringLimit search to a specific library
limitnumber
modestringyestext: full-text search; tags: find files matching ALL specified tags (AND logic); files: find files by partial name/title match
offsetnumber
querystringSearch query (mode=text or mode=files)
tagIdsarrayTag IDs to match (mode=tags)
workspaceIdstring

No output schema declared.

No examples provided.

share_create ~191

Create a public share link for a file so someone outside the workspace can view it. Returns the full link ONCE. accessMode "link" = anyone with the link; "restricted" = only allowlisted emails/domains (verified by emailed code). permission "view" or "download".

NameTypeReqDescription
accessModestringlink (anyone) | restricted (specific people). Default link.
allowCommentsbooleanAllow viewers to comment (after verifying their email). Default false.
allowedDomainsarrayrestricted mode: allowlisted domains, e.g. buddyboss.com
allowedEmailsarrayrestricted mode: allowlisted emails
expiresInDaysnumberOptional. Link expires after N days (omit for no expiry).
fileIdstringyesUUID of the file to share
permissionstringview | download. Default view.

No output schema declared.

No examples provided.

share_list ~40

List the active public share links for a file, with access mode, permission, and view count.

NameTypeReqDescription
fileIdstringyesUUID of the file

No output schema declared.

No examples provided.

share_revoke ~48

Revoke a public share link. The link stops working immediately.

NameTypeReqDescription
fileIdstringyesUUID of the file
shareIdstringyesShare ID (from share_list)

No output schema declared.

No examples provided.

suggest_libraries ~146

Suggest existing context libraries that look relevant to a workflow you are about to create, ranked by keyword overlap between the workflow name/description and each library's name/description. Call this BEFORE create_workflow (or create type=workflow) so you can present the matches to the user and let them choose which to attach via projectIds. Nothing is auto-attached — these are suggestions only. Returns [] when no libraries score above zero.

NameTypeReqDescription
descriptionstringThe workflow description, if any — improves match quality.
namestringyesThe name of the workflow being created.
workspaceIdstringWorkspace ID. If not provided, uses your default workspace.

No output schema declared.

No examples provided.

summarize_done_phases ~120

Generate an AI summary of all done phases in a workflow's project plan, save it as a context file in the specified library, then delete the source phases. Updates the plan's last_summarized_at timestamp.

NameTypeReqDescription
libraryIdstringyesLibrary ID to save the summary file into.
summaryTitlestringyesTitle for the summary file, e.g. "Auth Rewrite — June 2026".
workflowIdstringyesWorkflow ID
workspaceIdstringWorkspace ID. Defaults to your configured workspace.

No output schema declared.

No examples provided.

update ~477

Update an existing resource in place by ID — edit a file's title, path, content, or status, or rename/reconfigure an agent, skill, workflow, or project. Only the fields you pass are changed; for files, a new version is created automatically so history is preserved. Set `type` to the resource kind and `id` to its UUID (from list/search/get). File linking (type=file): to link to another file in the SAME workspace, put //<fileId> inline in the content — use the target's UUID (from search/list/get results), not its title. The link renders as the target's title and is re-indexed on save; backlinks are automatic. To add a backlink to file B, add //<B-id> to this file's content. Remove a link by deleting its //<id> token. Only link to files that exist. Use get({ type: "file_links", id }) to inspect links and backlinks.

NameTypeReqDescription
agentIdsarrayAgent IDs (type=workflow)
changeSummarystring
contentstring
createVersionbooleanCreate version history entry (default true)
customContextstringCustom context (type=agent)
descriptionstringNew description (type=agent, workflow, project)
folderIdstring
idstringyesResource ID
isPrivatebooleanWorkflow visibility (type=workflow). true = only you, the workspace owner/admin, and explicitly-shared members can see it. false = visible to the whole team.
namestringNew name (type=agent, workflow, project)
pathstring
projectIdstringMove file to different library (type=file)
projectIdsarrayLibrary IDs (type=workflow)
skillIdsarraySkill IDs (type=workflow)
slugstringSlug (type=project)
statusstring
systemPromptstringSystem prompt (type=agent)
tagIdsarrayTag IDs (type=workflow)
titlestring
typestringyesResource type to update
workspaceIdstring

No output schema declared.

No examples provided.

update_identity ~250

Updates an existing identity by ID. Only the fields you provide are changed.

NameTypeReqDescription
alwaysDostringThings to always do.
audiencestringIntended audience.
backgroundstringBackground information.
brandColorsstringBrand colours.
brandVisualsstringVisual style description.
identityIdstringyesThe ID of the identity to update.
linkedLibraryIdsarrayContext library IDs to link.
namestringIdentity name.
neverDostringThings to never do.
recurringTopicsstringRecurring topics.
roleContextstringRole and context description.
scopestringuser: personal (only visible to you); workspace: shared with all members.
typestringIdentity type: person, company, or hybrid.
valuesPrioritiesstringValues and priorities.
voiceDescriptorsstringVoice and tone descriptors (e.g. "concise, direct, warm").
workspaceIdstringWorkspace ID. If not provided, uses your default workspace.
writingSamplesstringWriting samples.

No output schema declared.

No examples provided.

update_notification_preferences ~154

Update notification preferences for the current user — per-type toggles, email frequency, or Do Not Disturb.

NameTypeReqDescription
doNotDisturbbooleanEnable Do Not Disturb mode.
doNotDisturbUntilstringISO datetime to end DND (optional).
emailEnabledbooleanMaster toggle for all notification emails.
emailFrequencystringHow often to receive email digests.
inAppEnabledbooleanMaster toggle for all in-app notifications.
preferencesobjectPer-type notification toggles, e.g. { "fileEdit": false, "mention": true }.
workspaceIdstringWorkspace ID. Defaults to configured workspace.

No output schema declared.

No examples provided.

update_phase_status ~98

Update the status of a project phase. Valid statuses: pending, in_progress, done, blocked. Use this to progress phases as work is completed. Setting a phase to "done" automatically records the completion time.

NameTypeReqDescription
phaseIdstringyesPhase ID (from list_phases or get_project)
statusstringyesNew status for the phase.
workspaceIdstringWorkspace ID. Defaults to your configured workspace.

No output schema declared.

No examples provided.

update_task ~168

Update a task title, description, or status. Works for all task types (DB tasks, phase tasks, file-backed tasks). Omit workflowId to update a task by id regardless of its workflow (the server resolves it). Use this instead of update_task_status when you also need to set a title or description.

NameTypeReqDescription
descriptionstringNew description for the task. Pass empty string to clear.
statusstringNew status for the task.
taskIdstringyesTask ID to update.
titlestringNew title for the task.
workflowIdstringWorkflow ID that owns the task. Omit to resolve the task by id regardless of its workflow.
workspaceIdstringWorkspace ID. Defaults to configured workspace.

No output schema declared.

No examples provided.

update_task_status ~194

Update the status of a task. Omit workflowId to update a task by id regardless of its workflow (the server resolves it). Updates the DB task record; for legacy file-backed workflows it instead swaps the status tag on the underlying phase file. Use in_progress when starting work, done when complete, dismissed when no longer relevant.

NameTypeReqDescription
phaseFileIdstringLegacy file-backed workflows only: link or update the phase file ID for this task. Pass null to clear the link.
prioritystringUpdate the task priority. Optional — only set when changing priority.
statusstringyesNew status for the task.
taskIdstringyesTask ID to update.
workflowIdstringWorkflow ID that owns the task. Omit to resolve the task by id regardless of its workflow.
workspaceIdstringWorkspace ID. Defaults to your configured workspace.

No output schema declared.

No examples provided.

workspace_summary ~162

Start-of-day overview / morning brief for the current user in a workspace: outstanding tasks assigned to them (overdue, due-soon and a suggested focus), plus unread notifications and @mentions — returned as compact counts, a few highlights, and a ready-to-read `brief` sentence. Call this whenever the user asks, in ANY phrasing, what they need to do or what has happened — e.g. "what needs doing today", "what's on my plate", "what should I work on", "give me a morning brief", "show me a summary", "catch me up", "anything new", "what did I miss", "how does my day look".

NameTypeReqDescription
workspaceIdstringWorkspace ID. Defaults to the configured workspace.

No output schema declared.

No examples provided.

Common questions

What is the io.github.contextium-io/mcp-server server?

io.github.contextium-io/mcp-server is listed in the public MCP registry as io.github.contextium-io/mcp-server. Your team's knowledge, always in context. SOPs, coding standards, and workflows for Claude. This page covers its npm package (@contextium/mcp-server).

Is the io.github.contextium-io/mcp-server server safe to use?

io.github.contextium-io/mcp-server scores 75 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the io.github.contextium-io/mcp-server server expose?

io.github.contextium-io/mcp-server exposes 69 tools: list, get, create, update, delete, and 64 more. Their descriptions and schemas cost roughly 10,643 tokens of context every time the server is loaded.

Is the io.github.contextium-io/mcp-server server still maintained?

io.github.contextium-io/mcp-server is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the io.github.contextium-io/mcp-server server under?

io.github.contextium-io/mcp-server declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.