# H2BIS ProjectBrain MCP (npm · h2bis-mcp)

Connect AI agents to H2BIS ProjectBrain - manage projects, use cases, and capabilities via MCP.

- Trust score: 68/100 (medium)
- Change this week: +24
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `h2bis-mcp`: 68/100 (this document), [markdown](https://verifymcp.io/servers/h2bis-dev-h2bis-projectbrain-mcp/h2bis-mcp.md), [page](https://verifymcp.io/servers/h2bis-dev-h2bis-projectbrain-mcp/h2bis-mcp)

## Channel facts

- Registry: `npm`
- Package: `h2bis-mcp`
- Version: `1.1.18`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 88/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (117 of 121), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (117 of 121), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 117 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 73/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 1737 tokens (~115/item across 15 items; 15 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 86/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 59% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add h2bis-dev-h2bis-projectbrain-mcp -- npx -y h2bis-mcp
```

### Codex

```bash
codex mcp add h2bis-dev-h2bis-projectbrain-mcp -- npx -y h2bis-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "h2bis-dev-h2bis-projectbrain-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "h2bis-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add h2bis-dev-h2bis-projectbrain-mcp --command npx --arg -y --arg h2bis-mcp
```

### Hermes

```yaml
mcp_servers:
  h2bis-dev-h2bis-projectbrain-mcp:
    command: "npx"
    args: ["-y", "h2bis-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "h2bis-dev-h2bis-projectbrain-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "h2bis-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 68, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-02 (score 67, +48)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] Schema quality: unverified → good
- [functional improvement] Stability: unverified → 0.23
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] License: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional] Licence: MIT

### 2026-08-01 (score 19, −7)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-31 (score 26, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-30 (score 44, +18)

- [functional regression] Dependency health: partial → unverified
- [functional improvement] Tool coverage: unverified → 100

### 2026-07-28 (score 26, −18)

- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] Dependency health: unverified → partial
- [functional] First check of Schema quality: unverified

### 2026-07-27 (score 44)

First indexed and scored.

## MCP tools (15)

### `listProjects` (~85 tokens)

List projects with optional filtering by status and pagination. Returns id, name, description, lifecycle, and stats. Use this first to discover projects, then use getProjectById for full details.

Input parameters:

- `limit` (number): Maximum number of projects to return
- `offset` (number): Number of projects to skip for pagination
- `status` (string): Filter projects by status

### `getProjectById` (~54 tokens)

Get a specific project by ID with complete details including metadata, architecture, tech stack, quality gates, domain catalog, stats, and endpoints.

Input parameters:

- `projectId` (string, required): The unique identifier of the project to retrieve

### `createProject` (~102 tokens)

Create a new software development project with metadata, tech stack, architecture details, and quality gates.

Input parameters:

- `_id` (string, required): Unique project identifier (e.g., "my-project")
- `accessControl` (object): Access control settings
- `description` (string): Project description
- `lifecycle` (string): Project lifecycle stage
- `metadata` (object): Project metadata including tech stack, architecture, standards, etc.
- `name` (string, required): Project name

### `updateProject` (~93 tokens)

Update an existing project's details, metadata, lifecycle stage, or access control settings.

Input parameters:

- `accessControl` (object): Updated access control settings
- `description` (string): Updated project description
- `lifecycle` (string): Updated project lifecycle stage
- `metadata` (object): Updated project metadata
- `name` (string): Updated project name
- `projectId` (string, required): The unique identifier of the project to update

### `upsertProjectDomainModel` (~265 tokens)

Add or replace a domain model (class/interface/DTO) in a project's domain catalog. Call this whenever you create or significantly change a TypeScript interface, class, Mongoose schema, Zod schema, or DTO while implementing a feature. Provide every field with its type, required flag, constraints, and the architectural layer (data | dto | domain | response | request | event | other). The model is upserted by name — re-calling with the same name updates it.

Input parameters:

- `addedBy` (string): Agent or user identifier who is adding/updating this model (defaults to "system-mcp")
- `description` (string): What this model represents
- `fields` (array): Field definitions for this model
- `layer` (string): Architectural layer: data=DB document, dto=transport, domain=domain object, response/request=API shapes, event=async message, other.
- `name` (string, required): Domain model name (e.g. "UserDocument", "ProjectDto"). Case-sensitive — acts as the unique key for upsert.
- `projectId` (string, required): The _id of the project that owns this domain catalog
- `usedByUseCases` (array): List of use case IDs that reference this model

### `removeProjectDomainModel` (~80 tokens)

Remove a domain model from a project's domain catalog by name. Use this when a model is deleted or renamed during refactoring.

Input parameters:

- `modelName` (string, required): Exact name of the domain model to remove (case-sensitive, e.g. "UserDocument")
- `projectId` (string, required): The _id of the project that owns the domain catalog

### `listUseCases` (~98 tokens)

List use cases with optional filtering by project and pagination. Returns id, key, name, description, status, and basic details. Use this first to discover use cases, then use getUseCaseById for full details.

Input parameters:

- `limit` (integer): Maximum number of use cases to return
- `offset` (integer): Number of use cases to skip (for pagination)
- `projectId` (string): Filter use cases by project ID

### `getUseCaseById` (~59 tokens)

Get a specific use case by ID with complete details including functional requirements, flows, technical surface, domain model, and all other sections.

Input parameters:

- `useCaseId` (string, required): The unique identifier (_id) of the use case to retrieve

### `createUseCase` (~271 tokens)

Create a new use case with all necessary details. If projectId is provided, automatically triggers capability graph generation. Required fields: key, name, description. All other fields are optional.

Input parameters:

- `acceptanceCriteria` (array): List of acceptance criteria
- `aiDirectives` (object)
- `aiMetadata` (object)
- `businessValue` (string): Business value or justification
- `description` (string, required): Detailed description of the use case
- `errorHandling` (object)
- `flows` (array)
- `functionalRequirements` (object)
- `implementationRisk` (array)
- `interfaces` (object)
- `key` (string, required): Unique key for the use case (e.g., "UC-LOGIN")
- `name` (string, required): Name of the use case
- `normative` (boolean)
- `primaryActor` (string): Primary actor (e.g., "User", "Admin")
- `projectId` (string): Project ID to associate the use case with (triggers capability generation)
- `quality` (object)
- `relationships` (array)
- `scope` (object)
- `stakeholders` (array): List of stakeholders
- `status` (object)
- `tags` (array)
- `technicalSurface` (object)

### `updateUseCase` (~217 tokens)

Update an existing use case. All fields are optional — only provided fields will be updated. Use this for manual updates based on human input or agent analysis.

Input parameters:

- `acceptanceCriteria` (array)
- `aiDirectives` (object)
- `aiMetadata` (object)
- `businessValue` (string)
- `description` (string): Update the description
- `errorHandling` (object)
- `flows` (array)
- `functionalRequirements` (object)
- `implementationRisk` (array)
- `interfaces` (object)
- `name` (string): Update the name
- `normative` (boolean)
- `primaryActor` (string)
- `quality` (object)
- `relationships` (array)
- `scope` (object)
- `stakeholders` (array)
- `status` (object)
- `tags` (array)
- `technicalSurface` (object)
- `useCaseId` (string, required): The unique identifier (_id) of the use case to update

### `deleteUseCase` (~53 tokens)

Delete a use case (soft delete). The use case will be marked as deleted but not removed from the database.

Input parameters:

- `useCaseId` (string, required): The unique identifier (_id) of the use case to delete

### `enhanceUseCase` (~92 tokens)

Enhance a use case using AI. Fills in missing sections (flows, technical surface, domain model) based on existing data. Optionally specify enhancementType: full, partial, flows_only, or technical_only.

Input parameters:

- `enhancementType` (string): Type of enhancement to apply (default: full)
- `useCaseId` (string, required): The unique identifier (_id) of the use case to enhance with AI

### `updateUseCaseWithAI` (~102 tokens)

Update a use case with AI-driven changes based on natural language instructions. Use this when you want to make targeted changes to a use case without manually editing fields. Preserves human-reviewed sections by default.

Input parameters:

- `instructions` (string, required): Natural language instructions for AI-driven changes
- `preserveHumanEdits` (boolean): Whether to preserve human-reviewed sections
- `useCaseId` (string, required): The unique identifier (_id) of the use case to update

### `getUseCaseWithProjectContext` (~112 tokens)

Retrieve a use case together with the full development context of its owning project (architecture, tech stack, repository, coding standards, auth strategy, quality gates, deployment, external services, developed endpoints, and stats). Use this tool whenever an AI agent needs to implement a software feature from a use case, so it can align the implementation with the project's architecture and conventions.

Input parameters:

- `useCaseId` (string, required): The unique identifier (_id) of the use case to retrieve together with its full project context

### `logout` (~54 tokens)

Sign out of the H2BIS system. Revokes the server-side refresh token and deletes the locally persisted access tokens. After logging out, the next tool call will automatically open a browser for a fresh GitHub OAuth sign-in.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/h2bis-dev-h2bis-projectbrain-mcp/h2bis-mcp#diagnostics

## Score history

- 2026-08-03: 68
- 2026-08-02: 67
- 2026-08-01: 19
- 2026-07-31: 26
- 2026-07-30: 44
- 2026-07-28: 26
- 2026-07-27: 44

## Links

- npm package: https://www.npmjs.com/package/h2bis-mcp
- Socket report: https://socket.dev/npm/package/h2bis-mcp
- Repository: https://github.com/h2bis-dev/h2bis-project-brain-mcp
- Changelog RSS feed: https://verifymcp.io/servers/h2bis-dev-h2bis-projectbrain-mcp/h2bis-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/h2bis-dev-h2bis-projectbrain-mcp/h2bis-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/h2bis-dev-h2bis-projectbrain-mcp/h2bis-mcp