io.github.contextium-io/mcp-server
NPM · @CONTEXTIUM/MCP-SERVER · SCANNED SEP 20
Your team's knowledge, always in context. SOPs, coding standards, and workflows for Claude.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 58 of 143 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency19
- Repository check failed: the declared repository URL returned HTTP 404. See how to fix → View diagnostics → Fail
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 40 days ago).Pass
- Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability72
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 10643 tokens (~154/item across 69 items; 69 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management87
- Stability observed for 26 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage98
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 95% of tool parameters carry a description.Partial
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 7 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "delete" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 69 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the io.github.contextium-io/mcp-server server?
io.github.contextium-io/mcp-server runs locally as an npm package, launched with npx -y @contextium/mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @contextium/mcp-server
claude mcp add contextium-io-mcp-server -- npx -y @contextium/mcp-server
{
"mcpServers": {
"contextium-io-mcp-server": {
"command": "npx",
"args": [
"-y",
"@contextium/mcp-server"
]
}
}
} {
"servers": {
"contextium-io-mcp-server": {
"command": "npx",
"args": [
"-y",
"@contextium/mcp-server"
]
}
}
} codex mcp add contextium-io-mcp-server -- npx -y @contextium/mcp-server
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"contextium-io-mcp-server": {
"type": "local",
"command": [
"npx",
"-y",
"@contextium/mcp-server"
],
"enabled": true
}
}
} openclaw mcp add contextium-io-mcp-server --command npx --arg -y --arg @contextium/mcp-server
mcp_servers:
contextium-io-mcp-server:
command: "npx"
args: ["-y", "@contextium/mcp-server"] {
"McpServers": {
"contextium-io-mcp-server": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@contextium/mcp-server"
]
}
}
} assistant mcp add contextium-io-mcp-server -t stdio -c npx -a -y @contextium/mcp-server
{
"mcpServers": {
"contextium-io-mcp-server": {
"command": "npx",
"args": [
"-y",
"@contextium/mcp-server"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 18 Sept 26 −3
- Stability: pass → 0.80 functional
- 17 Sept 26 +1
- Stability: 0.97 → pass security
- 15 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 11 Sept 26 −3
- Stability: pass → 0.80 functional
- 10 Sept 26 +1
- Stability: 0.97 → pass security
- 9 Sept 26 −1
- Stability: pass → 0.97 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/@contextium/mcp-server@1.10.12
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 143 packages
| Packages resolved | 143 |
|---|---|
| Stale | 58 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
project ~175
DEPRECATED — phases are now DB-backed. Use list_phases (replaces get_next_phase), update_phase_status(phaseId, "done") (replaces mark_phase_complete), and load_workflow (replaces load_session/close_session).
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Legacy file-based harness. get_next_phase: oldest pending phase FILE; mark_phase_complete: re-tag the phase FILE status:pending → status:passing and archive it; close_session: tag session log as clos… |
| phaseFileId | string | – | Phase file ID (action=mark_phase_complete) |
| sessionLogFileId | string | – | Session log file ID (action=close_session) |
| workflowId | string | yes | Workflow ID |
| workspaceId | string | – | Workspace ID (uses default if omitted) |
No output schema declared.
No examples provided.
record_lesson ~248
Record a lesson learned — something that went wrong and how it was fixed — into the workspace Lessons Learned library, so the same mistake can be avoided on THIS and any OTHER project. Call this when you hit and resolve a non-obvious bug, a broken assumption, a footgun, or a fix that took real effort to find. Do NOT use it for routine notes or ideas (use capture_idea) or for reusable reference knowledge (use create_skill). Pass `project` so the lesson can be filtered back to its origin; omit it only for genuinely global lessons.
| Name | Type | Req | Description |
|---|---|---|---|
| fix | string | yes | What actually resolved it, specific enough to act on next time. |
| problem | string | yes | What went wrong and, importantly, WHY — the root cause, not just the symptom. |
| project | string | – | Project/product this came from — becomes a #project-<slug> tag for filtering. Omit only if the lesson is genuinely project-independent. |
| title | string | yes | Short, searchable summary of the lesson (e.g. "Redis delete-then-set race made deleted libraries reappear") |
| workspaceId | string | – | Workspace ID. Defaults to your active workspace. |
No output schema declared.
No examples provided.
reorder_phases ~92
Reorder the phases in a workflow's project plan. Provide the full list of phase IDs in the desired order; the plan's sort order is updated to match.
| Name | Type | Req | Description |
|---|---|---|---|
| orderedIds | array | yes | Phase IDs in the desired order (typically the full set of phases for the plan). |
| workflowId | string | yes | Workflow ID |
| workspaceId | string | – | Workspace ID. Defaults to your configured workspace. |
No output schema declared.
No examples provided.
resolve_comment ~89
Resolve (acknowledge) a comment thread once it has been addressed — it disappears from default views everywhere (web, desktop, public share page, list_comments). Pass the ROOT comment id; the whole thread resolves. Set resolved=false to reopen.
| Name | Type | Req | Description |
|---|---|---|---|
| commentId | string | yes | Root comment id (from list_comments) |
| resolved | boolean | – | true = resolve (default), false = reopen |
No output schema declared.
No examples provided.
restore_library ~58
Restore a context library from trash. Must be within the 30-day restore window.
| Name | Type | Req | Description |
|---|---|---|---|
| libraryId | string | yes | The UUID of the library to restore |
| workspaceId | string | – | Workspace ID (optional — uses default workspace if omitted) |
No output schema declared.
No examples provided.
resume_project ~138
Resume a Contextium project from a session handoff — loads the project plan, finds the last handoff note, and briefs you so you can continue without losing context. Call this when the user says things like: "resume my project", "continue where I left off", "pick up from last session", "what was I working on", "I'm back let's continue", "carry on from yesterday", "what's next in my project".
| Name | Type | Req | Description |
|---|---|---|---|
| workflowId | string | – | Workflow ID to resume (optional — if omitted, auto-selects if only one workflow exists) |
| workspaceId | string | – | Workspace ID (uses default if omitted) |
No output schema declared.
No examples provided.
search ~211
Find files in a workspace when you don't know their exact ID. Pick a `mode`: "text" runs a full-text search over file contents and titles; "tags" returns files carrying ALL of the given tagIds (AND logic); "files" matches by partial file name/title. Reach for search before `get` when you only know roughly what you want; use `list` with type=files instead when you just need everything in a library. Optionally narrow to one library with libraryId.
| Name | Type | Req | Description |
|---|---|---|---|
| libraryId | string | – | Limit search to a specific library |
| limit | number | – | – |
| mode | string | yes | text: full-text search; tags: find files matching ALL specified tags (AND logic); files: find files by partial name/title match |
| offset | number | – | – |
| query | string | – | Search query (mode=text or mode=files) |
| tagIds | array | – | Tag IDs to match (mode=tags) |
| workspaceId | string | – | – |
No output schema declared.
No examples provided.
share_create ~191
Create a public share link for a file so someone outside the workspace can view it. Returns the full link ONCE. accessMode "link" = anyone with the link; "restricted" = only allowlisted emails/domains (verified by emailed code). permission "view" or "download".
| Name | Type | Req | Description |
|---|---|---|---|
| accessMode | string | – | link (anyone) | restricted (specific people). Default link. |
| allowComments | boolean | – | Allow viewers to comment (after verifying their email). Default false. |
| allowedDomains | array | – | restricted mode: allowlisted domains, e.g. buddyboss.com |
| allowedEmails | array | – | restricted mode: allowlisted emails |
| expiresInDays | number | – | Optional. Link expires after N days (omit for no expiry). |
| fileId | string | yes | UUID of the file to share |
| permission | string | – | view | download. Default view. |
No output schema declared.
No examples provided.
share_list ~40
List the active public share links for a file, with access mode, permission, and view count.
| Name | Type | Req | Description |
|---|---|---|---|
| fileId | string | yes | UUID of the file |
No output schema declared.
No examples provided.
share_revoke ~48
Revoke a public share link. The link stops working immediately.
| Name | Type | Req | Description |
|---|---|---|---|
| fileId | string | yes | UUID of the file |
| shareId | string | yes | Share ID (from share_list) |
No output schema declared.
No examples provided.
suggest_libraries ~146
Suggest existing context libraries that look relevant to a workflow you are about to create, ranked by keyword overlap between the workflow name/description and each library's name/description. Call this BEFORE create_workflow (or create type=workflow) so you can present the matches to the user and let them choose which to attach via projectIds. Nothing is auto-attached — these are suggestions only. Returns [] when no libraries score above zero.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | – | The workflow description, if any — improves match quality. |
| name | string | yes | The name of the workflow being created. |
| workspaceId | string | – | Workspace ID. If not provided, uses your default workspace. |
No output schema declared.
No examples provided.
summarize_done_phases ~120
Generate an AI summary of all done phases in a workflow's project plan, save it as a context file in the specified library, then delete the source phases. Updates the plan's last_summarized_at timestamp.
| Name | Type | Req | Description |
|---|---|---|---|
| libraryId | string | yes | Library ID to save the summary file into. |
| summaryTitle | string | yes | Title for the summary file, e.g. "Auth Rewrite — June 2026". |
| workflowId | string | yes | Workflow ID |
| workspaceId | string | – | Workspace ID. Defaults to your configured workspace. |
No output schema declared.
No examples provided.
update ~477
Update an existing resource in place by ID — edit a file's title, path, content, or status, or rename/reconfigure an agent, skill, workflow, or project. Only the fields you pass are changed; for files, a new version is created automatically so history is preserved. Set `type` to the resource kind and `id` to its UUID (from list/search/get). File linking (type=file): to link to another file in the SAME workspace, put //<fileId> inline in the content — use the target's UUID (from search/list/get results), not its title. The link renders as the target's title and is re-indexed on save; backlinks are automatic. To add a backlink to file B, add //<B-id> to this file's content. Remove a link by deleting its //<id> token. Only link to files that exist. Use get({ type: "file_links", id }) to inspect links and backlinks.
| Name | Type | Req | Description |
|---|---|---|---|
| agentIds | array | – | Agent IDs (type=workflow) |
| changeSummary | string | – | – |
| content | string | – | – |
| createVersion | boolean | – | Create version history entry (default true) |
| customContext | string | – | Custom context (type=agent) |
| description | string | – | New description (type=agent, workflow, project) |
| folderId | string | – | – |
| id | string | yes | Resource ID |
| isPrivate | boolean | – | Workflow visibility (type=workflow). true = only you, the workspace owner/admin, and explicitly-shared members can see it. false = visible to the whole team. |
| name | string | – | New name (type=agent, workflow, project) |
| path | string | – | – |
| projectId | string | – | Move file to different library (type=file) |
| projectIds | array | – | Library IDs (type=workflow) |
| skillIds | array | – | Skill IDs (type=workflow) |
| slug | string | – | Slug (type=project) |
| status | string | – | – |
| systemPrompt | string | – | System prompt (type=agent) |
| tagIds | array | – | Tag IDs (type=workflow) |
| title | string | – | – |
| type | string | yes | Resource type to update |
| workspaceId | string | – | – |
No output schema declared.
No examples provided.
update_identity ~250
Updates an existing identity by ID. Only the fields you provide are changed.
| Name | Type | Req | Description |
|---|---|---|---|
| alwaysDo | string | – | Things to always do. |
| audience | string | – | Intended audience. |
| background | string | – | Background information. |
| brandColors | string | – | Brand colours. |
| brandVisuals | string | – | Visual style description. |
| identityId | string | yes | The ID of the identity to update. |
| linkedLibraryIds | array | – | Context library IDs to link. |
| name | string | – | Identity name. |
| neverDo | string | – | Things to never do. |
| recurringTopics | string | – | Recurring topics. |
| roleContext | string | – | Role and context description. |
| scope | string | – | user: personal (only visible to you); workspace: shared with all members. |
| type | string | – | Identity type: person, company, or hybrid. |
| valuesPriorities | string | – | Values and priorities. |
| voiceDescriptors | string | – | Voice and tone descriptors (e.g. "concise, direct, warm"). |
| workspaceId | string | – | Workspace ID. If not provided, uses your default workspace. |
| writingSamples | string | – | Writing samples. |
No output schema declared.
No examples provided.
update_notification_preferences ~154
Update notification preferences for the current user — per-type toggles, email frequency, or Do Not Disturb.
| Name | Type | Req | Description |
|---|---|---|---|
| doNotDisturb | boolean | – | Enable Do Not Disturb mode. |
| doNotDisturbUntil | string | – | ISO datetime to end DND (optional). |
| emailEnabled | boolean | – | Master toggle for all notification emails. |
| emailFrequency | string | – | How often to receive email digests. |
| inAppEnabled | boolean | – | Master toggle for all in-app notifications. |
| preferences | object | – | Per-type notification toggles, e.g. { "fileEdit": false, "mention": true }. |
| workspaceId | string | – | Workspace ID. Defaults to configured workspace. |
No output schema declared.
No examples provided.
update_phase_status ~98
Update the status of a project phase. Valid statuses: pending, in_progress, done, blocked. Use this to progress phases as work is completed. Setting a phase to "done" automatically records the completion time.
| Name | Type | Req | Description |
|---|---|---|---|
| phaseId | string | yes | Phase ID (from list_phases or get_project) |
| status | string | yes | New status for the phase. |
| workspaceId | string | – | Workspace ID. Defaults to your configured workspace. |
No output schema declared.
No examples provided.
update_task ~168
Update a task title, description, or status. Works for all task types (DB tasks, phase tasks, file-backed tasks). Omit workflowId to update a task by id regardless of its workflow (the server resolves it). Use this instead of update_task_status when you also need to set a title or description.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | – | New description for the task. Pass empty string to clear. |
| status | string | – | New status for the task. |
| taskId | string | yes | Task ID to update. |
| title | string | – | New title for the task. |
| workflowId | string | – | Workflow ID that owns the task. Omit to resolve the task by id regardless of its workflow. |
| workspaceId | string | – | Workspace ID. Defaults to configured workspace. |
No output schema declared.
No examples provided.
update_task_status ~194
Update the status of a task. Omit workflowId to update a task by id regardless of its workflow (the server resolves it). Updates the DB task record; for legacy file-backed workflows it instead swaps the status tag on the underlying phase file. Use in_progress when starting work, done when complete, dismissed when no longer relevant.
| Name | Type | Req | Description |
|---|---|---|---|
| phaseFileId | string | – | Legacy file-backed workflows only: link or update the phase file ID for this task. Pass null to clear the link. |
| priority | string | – | Update the task priority. Optional — only set when changing priority. |
| status | string | yes | New status for the task. |
| taskId | string | yes | Task ID to update. |
| workflowId | string | – | Workflow ID that owns the task. Omit to resolve the task by id regardless of its workflow. |
| workspaceId | string | – | Workspace ID. Defaults to your configured workspace. |
No output schema declared.
No examples provided.
workspace_summary ~162
Start-of-day overview / morning brief for the current user in a workspace: outstanding tasks assigned to them (overdue, due-soon and a suggested focus), plus unread notifications and @mentions — returned as compact counts, a few highlights, and a ready-to-read `brief` sentence. Call this whenever the user asks, in ANY phrasing, what they need to do or what has happened — e.g. "what needs doing today", "what's on my plate", "what should I work on", "give me a morning brief", "show me a summary", "catch me up", "anything new", "what did I miss", "how does my day look".
| Name | Type | Req | Description |
|---|---|---|---|
| workspaceId | string | – | Workspace ID. Defaults to the configured workspace. |
No output schema declared.
No examples provided.
What is the io.github.contextium-io/mcp-server server?
io.github.contextium-io/mcp-server is listed in the public MCP registry as io.github.contextium-io/mcp-server. Your team's knowledge, always in context. SOPs, coding standards, and workflows for Claude. This page covers its npm package (@contextium/mcp-server).
Is the io.github.contextium-io/mcp-server server safe to use?
io.github.contextium-io/mcp-server scores 75 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.contextium-io/mcp-server server expose?
io.github.contextium-io/mcp-server exposes 69 tools: list, get, create, update, delete, and 64 more. Their descriptions and schemas cost roughly 10,643 tokens of context every time the server is loaded.
Is the io.github.contextium-io/mcp-server server still maintained?
io.github.contextium-io/mcp-server is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.contextium-io/mcp-server server under?
io.github.contextium-io/mcp-server declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.