# io.github.DrBaher/contract-ops-mcp (npm · contract-ops-mcp)

One MCP server for the contract-ops suite: all nine local-first CLIs as agent tools.

- Trust score: 78/100 (medium)
- Change this week: +32
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `contract-ops-mcp`: 78/100 (this document), [markdown](https://verifymcp.io/servers/drbaher-contract-ops-mcp/contract-ops-mcp.md), [page](https://verifymcp.io/servers/drbaher-contract-ops-mcp/contract-ops-mcp)

## Channel facts

- Registry: `npm`
- Package: `contract-ops-mcp`
- Version: `0.3.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 86/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 97/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to DrBaher/contract-ops-mcp).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 18 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 71/100
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 3122 tokens (~62/item across 50 items; 50 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 99% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add drbaher-contract-ops-mcp -- npx -y contract-ops-mcp
```

### Codex

```bash
codex mcp add drbaher-contract-ops-mcp -- npx -y contract-ops-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "drbaher-contract-ops-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "contract-ops-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add drbaher-contract-ops-mcp --command npx --arg -y --arg contract-ops-mcp
```

### Hermes

```yaml
mcp_servers:
  drbaher-contract-ops-mcp:
    command: "npx"
    args: ["-y", "contract-ops-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "drbaher-contract-ops-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "contract-ops-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 78, +57)

- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [security improvement] Provenance: unverified → pass
- [security improvement] Malware scan: unverified → pass
- [security] The attested source repository moved: DrBaher/contract-ops-mcp
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Stability: unverified → 0.23
- [functional improvement] Schema quality: unverified → good
- [functional] Licence: MIT

### 2026-08-01 (score 21, +16)

- [functional improvement] Tool coverage: unverified → 100

### 2026-07-31 (score 5, −19)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 24, −22)

- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified

### 2026-07-27 (score 46)

First indexed and scored.

## MCP tools (50)

### `extract_contract` (~75 tokens)

Ingest any contract (.md/.txt/.html/.docx/.pdf) into structured JSON — parties, dates, term, governing law, a clause map, defined terms — each with a confidence + source. Deterministic, no network.

Input parameters:

- `path` (string, required): Path to the contract file (within the base dir).

### `lint_contract` (~78 tokens)

Lint one contract for internal-consistency defects — leftover placeholders, broken cross-references, undefined/unused defined terms, numbering gaps, party/date inconsistencies. Returns findings (rule, severity, line).

Input parameters:

- `fail_on` (string): Severity threshold for the exit code (default: error).
- `path` (string, required): Path to the document.

### `compare_versions` (~70 tokens)

Clause-aware drift detection between two contract versions. exitCode: 0 clean · 2 substantive drift · 3 cosmetic · 4 clauses moved · 1 I/O error.

Input parameters:

- `base` (string, required): Path to the agreed/base version.
- `candidate` (string, required): Path to the version to check.

### `fill_template` (~64 tokens)

Fill placeholders in a markdown/.docx template with parameter values (deterministic; no LLM). Returns the filled document on stdout.

Input parameters:

- `params` (object): Parameter values (snake_case keys), passed as JSON.
- `template` (string, required): Path to the template.

### `convert_to_pdf` (~54 tokens)

Convert a Word document to PDF (needs a PDF backend such as LibreOffice on the host).

Input parameters:

- `input` (string, required): Path to the .docx.
- `output` (string): Output .pdf path (optional).

### `review_nda` (~68 tokens)

Review an NDA against a house playbook — deterministic scoring with evidence per finding. Returns the structured review report (decision, risk_score, findings with evidence).

Input parameters:

- `file` (string, required): Path to the NDA.
- `playbook` (string): Path to the house playbook JSON (optional).

### `nda_setup` (~43 tokens)

One-time: generate the org NDA policy + default playbook in the workspace (needed before draft_nda / negotiate_*). Idempotent; writes config into the workspace.

### `generate_redlines` (~85 tokens)

Generate a clause-ready redline draft from a review_nda JSON report. Writes redline markdown to `out`. Deterministic; no org policy needed.

Input parameters:

- `mode` (string): Redline format (default classic).
- `out` (string, required): Output path for the redline markdown.
- `review_json` (string, required): Path to a saved review_nda JSON report.

### `draft_nda` (~211 tokens)

Draft a new NDA from a built-in template into `out` (markdown; optional .docx). Deterministic. If placeholders are missing the result lists them — fill and retry. Needs nda_setup first.

Input parameters:

- `disclosing_party` (string): Disclosing party (one-way).
- `effective_date` (string): Effective date.
- `governing_law` (string): Governing law.
- `out` (string, required): Output markdown path.
- `out_docx` (string): Optional Word .docx output path.
- `party_a` (string): Party A name (mutual).
- `party_a_address` (string): Party A address (mutual).
- `party_b` (string): Party B name (mutual).
- `party_b_address` (string): Party B address (mutual).
- `purpose` (string, required): Purpose / deal description.
- `receiving_party` (string): Receiving party (one-way).
- `template` (string): Which built-in template (default mutual).

### `negotiate_status` (~38 tokens)

Show a negotiation's rounds, per-clause status, and signatures. Read-only.

Input parameters:

- `state` (string, required): Path to the negotiation state file.

### `negotiate_review` (~45 tokens)

Review the latest negotiation round against your policy. Read-only.

Input parameters:

- `as` (string): Which side's policy view.
- `state` (string, required): Path to the negotiation state file.

### `negotiate_diff` (~62 tokens)

Clause-by-clause changes between two negotiation rounds (defaults to the last two). Read-only.

Input parameters:

- `from_round` (string): From round number.
- `state` (string, required): Path to the negotiation state file.
- `to_round` (string): To round number.

### `negotiate_analyze` (~43 tokens)

Post-hoc negotiation dashboard: trajectory, per-clause winners, source breakdown, outcome. Read-only.

Input parameters:

- `state` (string, required): Path to the negotiation state file.

### `negotiate_validate` (~41 tokens)

Integrity check on a negotiation state file: schema + hash-chain + per-round shape. Read-only.

Input parameters:

- `state` (string, required): Path to the negotiation state file.

### `negotiate_init` (~149 tokens)

Start a negotiation: draft from a template + parties, SIGN as Party A, and write the state file. Signs a negotiating commitment. Needs nda_setup first.

Input parameters:

- `effective_date` (string): Effective date.
- `governing_law` (string): Governing law.
- `out` (string, required): Output path for the negotiation state file.
- `party_a_address` (string): Party A address.
- `party_a_name` (string): Party A name.
- `party_b_address` (string): Party B address.
- `party_b_name` (string): Party B name.
- `purpose` (string, required): Purpose / deal description.
- `template` (string): Which built-in template (default mutual).

### `negotiate_counter` (~127 tokens)

Sign a counter-round with amendments — either from a JSON amendments file you provide, or deterministic --auto with a stance. Signs a negotiating commitment.

Input parameters:

- `amendments_file` (string): Path to a JSON amendments file (drafted by you).
- `as` (string): Which side you're countering as.
- `auto` (boolean): Use the deterministic auto-amender instead of an amendments file.
- `out` (string): Optional output path for the round.
- `stance` (string): Deterministic stance when using auto.
- `state` (string, required): Path to the negotiation state file.

### `negotiate_accept` (~58 tokens)

Accept the current negotiated text, SIGNING convergence on your side. Signs a binding acceptance.

Input parameters:

- `as` (string): Which side.
- `out` (string): Optional output path.
- `state` (string, required): Path to the negotiation state file.

### `negotiate_finalize` (~88 tokens)

Finalize a converged negotiation: emit the final .md and .docx. The legal SIGNATURE stays with the human — no e-signature is applied here; hand off to sign-cli.

Input parameters:

- `out_docx` (string, required): Final .docx output path.
- `out_md` (string, required): Final markdown output path.
- `state` (string, required): Path to the negotiation state file.

### `template_vault_find` (~36 tokens)

Search the template vault by category, tag, jurisdiction, or keyword. Read-only.

Input parameters:

- `query` (string, required): Search query.

### `template_vault_get` (~48 tokens)

Resolve and return a versioned template's text by reference (e.g. nda/house-mutual). Read-only.

Input parameters:

- `ref` (string, required): Template reference: category/name[@version].

### `template_vault_list` (~58 tokens)

List templates in the vault, optionally filtered by category / tag / jurisdiction. Read-only.

Input parameters:

- `category` (string): Filter by category.
- `jurisdiction` (string): Filter by jurisdiction.
- `tag` (string): Filter by tag.

### `template_vault_info` (~36 tokens)

Show metadata for a template (category, tags, jurisdiction, versions). Read-only.

Input parameters:

- `ref` (string, required): Template reference.

### `template_vault_diff` (~51 tokens)

Unified diff between two versions of one template. Read-only.

Input parameters:

- `ref` (string, required): Template reference.
- `version_a` (string, required): First version.
- `version_b` (string, required): Second version.

### `template_vault_history` (~36 tokens)

Chronological timeline for a template: versions, swaps, and amendments. Read-only.

Input parameters:

- `ref` (string, required): Template reference.

### `template_vault_clauses` (~32 tokens)

List the clauses detected in a template. Read-only.

Input parameters:

- `ref` (string, required): Template reference.

### `template_vault_clause_library` (~41 tokens)

Find clauses that repeat across the vault (a reusable clause library). Read-only.

Input parameters:

- `threshold` (string): Similarity threshold (0-1).

### `template_vault_compare_clauses` (~60 tokens)

Compare clauses between two templates (optionally one named clause). Read-only.

Input parameters:

- `a` (string, required): First template reference.
- `b` (string, required): Second template reference.
- `clause` (string): Optional clause name to compare.

### `template_vault_stats` (~25 tokens)

Vault dashboard: template counts, coverage, and last activity. Read-only.

### `template_vault_verify` (~39 tokens)

Content-level sha256 integrity check of the vault. Read-only (never rewrites hashes).

Input parameters:

- `strict` (boolean): Fail on any mismatch.

### `template_vault_compose` (~56 tokens)

Fork a template into a new derived template in the vault. Writes a new versioned template.

Input parameters:

- `as_ref` (string, required): New template reference to create.
- `base` (string, required): Base template reference to fork from.

### `template_vault_swap` (~66 tokens)

Replace one clause in a template with the same clause from another template. Writes a new version.

Input parameters:

- `clause` (string, required): Clause name to replace.
- `from_ref` (string, required): Template reference to take the clause from.
- `target` (string, required): Template reference to modify.

### `template_vault_export` (~62 tokens)

Export a template to another format (e.g. .docx) at a workspace path.

Input parameters:

- `as` (string): Format, e.g. docx.
- `output` (string): Output file path.
- `ref` (string, required): Template reference.

### `contract_vault_query` (~60 tokens)

Query the register of signed contracts (read-only): list | find | get | show | stats | history.

Input parameters:

- `action` (string, required): Read-only action.
- `arg` (string): Argument for find/get/show/history (query or deal id).

### `contract_vault_due` (~48 tokens)

Project upcoming renewal / notice / payment deadlines from the signed-contract register.

Input parameters:

- `within` (string): Window, e.g. 30d / 90d (default 30d).

### `contract_vault_risk` (~50 tokens)

Renewal-exposure analysis: missed/imminent auto-renewal notice deadlines and expirations.

Input parameters:

- `within` (string): Window, e.g. 30d (default 30d).

### `contract_vault_obligations` (~87 tokens)

Project upcoming date/obligation actions from the register. Read-only.

Input parameters:

- `as_of` (string): As-of date (YYYY-MM-DD).
- `owner` (string): Filter by owner.
- `status` (string): Filter by status.
- `type` (string): Filter by obligation type.
- `within` (string): Window, e.g. 90d.

### `contract_vault_remind` (~76 tokens)

Obligations whose reminder window is open right now — a digest for agents/cron. Read-only.

Input parameters:

- `as_of` (string): As-of date (YYYY-MM-DD).
- `owner` (string): Filter by owner.
- `status` (string): Filter by status.
- `type` (string): Filter by type.

### `contract_vault_at_risk` (~57 tokens)

Renewal exposure: missed / imminent auto-renewal notice deadlines and expirations. Read-only.

Input parameters:

- `as_of` (string): As-of date.
- `within` (string): Window, e.g. 30d.

### `contract_vault_review` (~42 tokens)

List register fields needing review (unidentified / LLM-derived / low-confidence). Read-only.

Input parameters:

- `threshold` (string): Confidence threshold (0-1).

### `contract_vault_verify` (~26 tokens)

Integrity check of the register (source sha256 + git state). Read-only.

### `contract_vault_export` (~73 tokens)

Export the register as csv | md | json (for spreadsheets / reports). Returns the export; writes no file. Read-only.

Input parameters:

- `expiring_before` (string): Only rows expiring before this date.
- `format` (string): Export format.
- `needs_review` (boolean): Only rows needing review.

### `contract_vault_ingest` (~63 tokens)

Register a contract into the vault from an extract_contract JSON file. Writes to the register.

Input parameters:

- `counterparty` (string): Counterparty name.
- `file` (string, required): Path to an extract_contract JSON file.
- `name` (string): Deal name.

### `contract_vault_obligation` (~94 tokens)

Track one obligation's lifecycle (status / owner / recurrence / reminder days). Writes to the register.

Input parameters:

- `deal` (string, required): Deal id.
- `id` (string, required): Obligation id.
- `owner` (string): Assign an owner.
- `recurrence` (string): Recurrence.
- `reminders` (string): Reminder lead days, e.g. 30.
- `status` (string): New status.

### `contract_vault_accept` (~74 tokens)

Mark register field(s) as manually verified (single, or bulk via a file). Writes to the register.

Input parameters:

- `deal` (string): Deal id.
- `field` (string): Field name.
- `from_file` (string): Path to a bulk-accept file.
- `value` (string): Verified value.

### `verify_signature` (~61 tokens)

Verify a signed PDF matches what was recorded for its request. (Read-only; signing itself stays human-gated behind sign-cli's own MCP.)

Input parameters:

- `path` (string, required): Path to the signed PDF.
- `request_id` (string, required): The sign request id.

### `verify_receipt` (~37 tokens)

Re-verify a portable signing receipt bundle, fully offline. Read-only.

Input parameters:

- `bundle` (string, required): Path to the receipt bundle directory.

### `audit_show` (~35 tokens)

Show the hash-chained audit log for a sign request. Read-only.

Input parameters:

- `request_id` (string, required): The sign request id.

### `catalog` (~48 tokens)

Return a CLI's full machine-readable command/flag catalog (`<cli> --catalog json`). Use this to discover the long tail beyond the curated tools.

Input parameters:

- `cli` (string, required): Which suite CLI.

### `run` (~106 tokens)

Escape hatch: run any suite CLI with raw arguments (no shell). For commands the curated tools don't cover. Call `catalog` first to learn the flags. Note: signing stays human-gated — only sign-cli's read/verify subcommands are reachable here; request-create/send/sign/approve are rejected and must go through sign-cli's own MCP with its per-signer approval tokens.

Input parameters:

- `args` (array, required): Arguments passed verbatim to the CLI.
- `cli` (string, required)

### `suite_status` (~40 tokens)

Report which suite CLIs are installed (with versions) and how to install any that are missing. Call this first if a tool reports a CLI isn't installed.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/drbaher-contract-ops-mcp/contract-ops-mcp#diagnostics

## Score history

- 2026-08-03: 78
- 2026-08-02: 78
- 2026-08-01: 21
- 2026-07-31: 5
- 2026-07-30: 24
- 2026-07-28: 46
- 2026-07-27: 46

## Links

- npm package: https://www.npmjs.com/package/contract-ops-mcp
- Socket report: https://socket.dev/npm/package/contract-ops-mcp
- Repository: https://github.com/DrBaher/contract-ops-mcp
- Changelog RSS feed: https://verifymcp.io/servers/drbaher-contract-ops-mcp/contract-ops-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/drbaher-contract-ops-mcp/contract-ops-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/drbaher-contract-ops-mcp/contract-ops-mcp