io.github.GuangminJu/mellos-mapping
NPM · MELLOS-MAPPING
Live layered dependency map for bottom-up development, drawn by the agent in a terminal pane.
Available components
Last scanned (5 hours ago)
Scores higher than 90% of npm servers
Category Developer Tools
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to GuangminJu/mellos-mapping). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 9 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability53
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 3034 tokens (~379/item across 8 items; 8 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage87
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 61% of tool parameters carry a description.Partial
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "mmap_remove" implies "remove" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 9 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 17 Oct 26 +1
- Stability: 0.93 → pass security
- 16 Oct 26 −1
- Stability: pass → 0.93 functional
- 14 Oct 26 +39
- Injection markers: unverified → pass ▲ security
- Stability: unverified → pass ▲ security
- Tool coverage: unverified → 100 ▲ functional
- MCP protocol: unverified → pass ▲ functional
- 13 Oct 26 −38
- Stability: 0.93 → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- First check of Schema quality: unverified functional
- Package version: 0.27.1 → 0.28.0 functional
- 12 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 11 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 90. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
- 4 Oct 26 −3
- Stability: pass → 0.80 functional
- 3 Oct 26 +1
- Stability: 0.97 → pass security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 23 Oct 2026 · Analysed npm/mellos-mapping@0.28.0
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | GuangminJu/mellos-mapping |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/GuangminJu/mellos-mapping/.github/workflows/publish-npm.yml@refs/heads/main |
| Rekor log index | 3243000913 |
| Predicate type | SLSA build provenance https://slsa.dev/provenance/v1 |
| Subject digest | sha512:16bad352954b92bde86ad242375d007eda8ae46986addb9ac8a709a4fecb79183a4b687be3fb5e8062a37d72f046a05693231d5dae5bb70c131a5104c |
Background: How many MCP packages publish verified provenance →
Dependencies 0 packages
| Packages resolved | 0 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
mmap_batch Commit a single-page transaction ~141
Atomically combine additions, updates and removals on ONE page. Checks the final graph, so a coordinated move or edge replacement needs no intermediate saves. Read IDs and revision with mmap_read first. Cross-page deletion is excluded.
| Name | Type | Req | Description |
|---|---|---|---|
| expectedRevision | string | – | Revision from mmap_read; absent requires a new page. A stale revision returns CONFLICT. |
| operations | array | yes | – |
| page | string | – | page (parallel map) this call targets; omit for the default page. A new conversation is not a new effort. Read existing pages with mmap_read first; reuse the same page for continued work. Create a ne… |
No output schema declared.
No examples provided.
mmap_declare Declare map structure ~462
Grow the Mellos map: set the title and diagram kind, add layer bands, lanes and groups (labeled subsystems within ONE band — declare them when a single band grows crowded, roughly five or more nodes in that band; a group must be a strict subset of its band, and a map spread thin across many bands needs none), add nodes, add dependency edges. Declare the missing design after reading existing pages with mmap_read; reuse verified nodes. Edges must point strictly downward (a node may only use nodes on lower layers); the batch is all-or-nothing. Title and kind can also be changed with mmap_update; this legacy form remains supported. Revising what already exists (moving, renaming, relabeling, clearing) is mmap_update.
| Name | Type | Req | Description |
|---|---|---|---|
| context | object | – | – |
| edges | array | – | – |
| expectedRevision | string | – | Revision from mmap_read; absent requires a new page. A stale revision returns CONFLICT. |
| groups | array | – | – |
| kind | string | – | diagram kind. dev (default) = the live progress ledger with status skins. The rest are documentation diagrams rendered neutrally: architecture (layered components; also fits call graphs and module de… |
| lanes | array | – | vertical columns crossing all bands; declaration order = left-to-right |
| layers | array | – | – |
| nodes | array | – | – |
| page | string | – | page (parallel map) this call targets; omit for the default page. A new conversation is not a new effort. Read existing pages with mmap_read first; reuse the same page for continued work. Create a ne… |
| title | – | – | map title, e.g. the feature being built; null removes it |
No output schema declared.
No examples provided.
mmap_open Open the map pane ~674
For automatic display beside the current ChatGPT desktop conversation in Codex mode, use surface: "web-terminal", then call open_in_codex with the returned browser hostOpen object. No paste or Computer Use is needed. For the native host terminal, use surface: "codex-terminal": prepare absolute watcher commands for the current project, then ask the host to open its right terminal. This does not launch the watcher or type into that terminal. Agent exec PTYs cannot be attached using their numeric session ids. For a document panel, use surface: "markdown": generate MD + SVG files, enable automatic preview updates after successful map writes, then use the HOST file-opening tool to display the returned absolute Markdown path on the right of the current conversation. Generated does not mean visible: this server cannot open or observe the desktop side panel. For interactive maps, choose surface: "web": start or reuse a project-local web viewer and pass the returned URL to the host browser-opening tool. Markdown and terminal remain available. The default surface is "terminal", preserving the terminal workflow. Put the live map on the user's screen: a terminal pane beside this conversation that redraws on every write. Call it whenever a result says `pane: CLOSED` — and do NOT ask permission first, because a user who has set a mapping policy has already said they want to see the map. With a pane already open this RETARGETS it to `page` instead of opening a second one, so it is also how you show the user a particular page when they ask for one. It never closes a pane: taking the map off the screen belongs to the user (the `q` key in the pane, or typing `mmap` in a terminal). The reply says whether a pane actually reported itself in afterwards, not merely that a command was run. Automatic terminal opening supports Windows Terminal, tmux on Linux/macOS, and Pebrel, which splits the conversation's own pane. omp (Oh My Pi) has no side panel of its own: there the routes are this sa…
| Name | Type | Req | Description |
|---|---|---|---|
| page | string | – | page to show first — the page THIS effort lives on, the same slug you pass to the other tools. Omit only for the default page: without it a fresh pane opens on whichever page was written last, which… |
| surface | string | – | web-terminal = automatically started mmap terminal in a local browser page; codex-terminal = prepare a command for the desktop host terminal; web = local browser viewer; markdown = MD/SVG; terminal =… |
| window | boolean | – | open the map in its own "mellos-mapping" window (a new tmux window on Linux/macOS) instead of splitting this conversation's window. Pass it only when the user asked for the map separate (a second mon… |
No output schema declared.
No examples provided.
mmap_read Read and resume saved maps ~299
Read existing pages before creating a map. Returns structured IDs, revisions and bounded results. pages lists summaries; map reads page metadata/context; nodes/edges/layers/groups/lanes read editable records; neighborhood reads related nodes; changes compares saved source hashes with local files. New conversations and compacted context should resume the existing effort. mmap_view remains the picture.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | Opaque cursor; reuse the same query. Changes return CONFLICT instead of skipping records. |
| depth | integer | – | – |
| direction | string | – | – |
| fields | array | – | – |
| group | string | – | filter by group |
| id | string | – | Exact ID; missing returns NOT_FOUND. Edge IDs use from->to; default page ID is _default. |
| ids | array | – | – |
| ifRevision | string | – | Revision from mmap_read; absent requires a new page. A stale revision returns CONFLICT. |
| lane | string | – | filter by lane |
| layer | string | – | filter by layer |
| limit | integer | – | – |
| page | string | – | page (parallel map) this call targets; omit for the default page. A new conversation is not a new effort. Read existing pages with mmap_read first; reuse the same page for continued work. Create a ne… |
| query | string | – | – |
| resource | string | – | – |
| status | string | – | – |
No output schema declared.
No examples provided.
mmap_remove Revise the map ~425
Remove edges, nodes, groups and empty layer bands (in that order, all-or-nothing). Removing a node also removes every edge touching it; removing a group merely ungroups its members. Use when the ghost design turns out wrong — the map is a hypothesis, revising it is honest work. `pages` is the other scale: it DELETES whole page files, so a finished effort can be cleaned up instead of accumulating tabs forever. A bare `{pages: ["slug"]}` with no other field is the normal form; combined with map edits, the edits are applied first and the pages are deleted after. The deletion is permanent and cannot be undone, so delete only pages whose effort is over — and only ever with the user behind it. An unknown slug is refused with the project's real page list (naming a page that does not exist is a typo, not a request). The default page has no slug and is not deletable here. A node elsewhere still pointing at a deleted page with `submap` stays legal — a submap reference has no existence invariant — but it has nowhere to dive until the page comes back.
| Name | Type | Req | Description |
|---|---|---|---|
| deletePage | boolean | – | Delete the page targeted by page, including the default page; cannot be combined with other edits. |
| edges | array | – | – |
| expectedRevision | string | – | Revision from mmap_read; absent requires a new page. A stale revision returns CONFLICT. |
| groups | array | – | – |
| lanes | array | – | – |
| layers | array | – | – |
| nodes | array | – | – |
| page | string | – | page (parallel map) this call targets; omit for the default page. A new conversation is not a new effort. Read existing pages with mmap_read first; reuse the same page for continued work. Create a ne… |
| pages | array | – | pages to delete entirely, after this call's map edits; permanent |
| references | string | – | For deletePage: reject inbound submap references by default, or explicitly keep them. |
No output schema declared.
No examples provided.
mmap_setup Configure when maps open ~273
Get or set the mapping policy — WHEN the assistant opens a Mellos map. Call with no arguments to read it: the reply names the policy chosen for the USER (every project), the one this PROJECT overrides it with if any, and which of them is in effect. If it reports "not set", ask the USER to choose (never pick for them): always = map every structured task — workflows, designs, architecture, technical dependencies; complex = map only medium or complex tasks — several modules, a new subsystem, roughly an hour or more; on-request = map only when the user explicitly asks. Then call again with their choice to persist it. It defaults to user scope, which is the normal one — the question is about how someone works, so it is asked once ever, not once per repository. Pass scope: "project" only when the user wants THIS project to differ from that habit. The policy guides you; it never blocks the tools, and an explicit user request for a map always wins.
| Name | Type | Req | Description |
|---|---|---|---|
| policy | string | – | the user's choice to persist; omit to read the current policy |
| scope | string | – | where to record the choice: "user" (default) applies to every project this user opens; "project" overrides that for this project alone. Ignored when reading. |
No output schema declared.
No examples provided.
mmap_update Record progress and revise the map ~500
The revision tool, all-or-nothing. Record progress on nodes: in-progress when starting a node (the pane spins), done with evidence when its verification passes, regressed with evidence when a done node breaks. Revise what the ghost design got wrong: move a node to another band, join or leave a group or lane, rename a band (or re-rank it, which reorders the whole map), relabel a group or a lane. Every clearable field takes null to empty it — that is how a field is cleared, never an empty string. Bands, groups and lanes are applied before the node updates, and within one node update `layer` moves the node before its other fields. The map is a ledger: report honestly, it never blocks you.
| Name | Type | Req | Description |
|---|---|---|---|
| context | – | – | – |
| edges | array | – | – |
| expectedRevision | string | – | Revision from mmap_read; absent requires a new page. A stale revision returns CONFLICT. |
| groups | array | – | relabel or move a group; final membership must match its layer |
| kind | string | – | diagram kind. dev (default) = the live progress ledger with status skins. The rest are documentation diagrams rendered neutrally: architecture (layered components; also fits call graphs and module de… |
| laneOrder | array | – | Every lane exactly once, in display order. |
| lanes | array | – | relabel existing lanes; order and membership are untouched |
| layers | array | – | rename and/or re-rank existing bands; an item must carry a name, a rank, or both |
| page | string | – | page (parallel map) this call targets; omit for the default page. A new conversation is not a new effort. Read existing pages with mmap_read first; reuse the same page for continued work. Create a ne… |
| title | – | – | Map title; null clears |
| updates | array | – | – |
No output schema declared.
No examples provided.
mmap_view View the current map ~188
Render the current Mellos map as monochrome text — the same picture the split-pane watcher shows live. Use it to check the map state or to show it inline in conversation. Every response ends with a `pages:` line naming the pages this project actually has and which one you are looking at, so this is also how you discover whether a map exists at all and under which slugs — never probe the files.
| Name | Type | Req | Description |
|---|---|---|---|
| page | string | – | page (parallel map) this call targets; omit for the default page. A new conversation is not a new effort. Read existing pages with mmap_read first; reuse the same page for continued work. Create a ne… |
| zoom | integer | – | zoom ladder: 1 = detail (notes unfold), 0 = standard (default), -1..-3 = scaled down, -4 = overview glyphs |
No output schema declared.
No examples provided.
How do I install the io.github.GuangminJu/mellos-mapping MCP server?
io.github.GuangminJu/mellos-mapping runs locally as an npm package, launched with npx -y mellos-mapping. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · mellos-mapping
claude mcp add guangminju-mellos-mapping -- npx -y mellos-mapping
What is the io.github.GuangminJu/mellos-mapping MCP server?
io.github.GuangminJu/mellos-mapping is an MCP server listed in the public MCP registry as io.github.GuangminJu/mellos-mapping. Live layered dependency map for bottom-up development, drawn by the agent in a terminal pane. This page covers its npm package (mellos-mapping).
Is the io.github.GuangminJu/mellos-mapping MCP server safe to use?
io.github.GuangminJu/mellos-mapping scores 89 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 23 October 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.GuangminJu/mellos-mapping MCP server expose?
io.github.GuangminJu/mellos-mapping exposes 8 tools: mmap_declare, mmap_update, mmap_read, mmap_batch, mmap_remove, and 3 more. Their descriptions and schemas cost roughly 2,962 tokens of context every time the server is loaded.
Is the io.github.GuangminJu/mellos-mapping MCP server still maintained?
io.github.GuangminJu/mellos-mapping is still listed as active in the MCP registry. We last reached this channel on 23 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.GuangminJu/mellos-mapping MCP server under?
io.github.GuangminJu/mellos-mapping declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.