Inistate MCP
NPM · INISTATE-MCP · 2 COMPONENTS · SCANNED AUG 3
MCP server for the Inistate platform: module discovery, entry management, and activity submission.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security87
- No malware found by supply-chain analysis.Pass
- Only part of the dependency tree could be resolved (97 of 98), so this covers what we could see, not the whole tree.Partial
- No install/post-install scripts declared.Pass
- Only part of the dependency tree could be resolved (97 of 98), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (Apache-2.0).Pass
- Actively maintained (last published 38 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability79
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 4060 tokens (~156/item across 26 items; 21 tools + 5 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
- Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage94
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 83% of tool parameters carry a description.Partial
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
npm · inistate-mcp
claude mcp add inistate-inistate-mcp -- npx -y inistate-mcp
codex mcp add inistate-inistate-mcp -- npx -y inistate-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"inistate-inistate-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"inistate-mcp"
],
"enabled": true
}
}
} openclaw mcp add inistate-inistate-mcp --command npx --arg -y --arg inistate-mcp
mcp_servers:
inistate-inistate-mcp:
command: "npx"
args: ["-y", "inistate-mcp"] {
"mcpServers": {
"inistate-inistate-mcp": {
"command": "npx",
"args": [
"-y",
"inistate-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 2 Aug 26 +26
- Provenance: fail → unverified ▼ security
- Install scripts: pass → unverified ▼ security
- Known CVEs: unverified → partial ▲ security
- Malware scan: unverified → pass ▲ security
- Maintenance: pass → unverified ▼ functional
- License: pass → unverified ▼ functional
- Dependency health: unverified → partial ▲ functional
- Stability: unverified → 0.23 ▲ functional
- Licence: Apache-2.0 functional
- 1 Aug 26 −11
- Known CVEs: partial → unverified ▼ security
- Dependency health: partial → unverified ▼ functional
- 31 Jul 26 +5
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 30 Jul 26 −31
- Known CVEs: partial → unverified ▼ security
- Malware scan: pass → unverified ▼ security
- Dependency health: partial → unverified ▼ functional
- 29 Jul 26 +30
- Provenance: unverified → fail ▼ security
- Install scripts: unverified → pass ▲ security
- Known CVEs: unverified → partial ▲ security
- Maintenance: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- License: unverified → pass ▲ functional
- Schema quality: unverified → excellent ▲ functional
- Licence: Apache-2.0 functional
- 27 Jul 26 50
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 3 Aug 2026 · Analysed npm/[email protected]
Provenance none
Ecosystem: npm · Outcome: none
Dependencies 97 packages
97 packages in the resolved dependency tree · 97 deprecated · 30 stale.
The dependency tree was only partially resolved, so these counts may be incomplete.
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
confirm_upload Confirm Upload ~123
Confirm a presigned upload after the PUT to uploadUrl succeeded. The server verifies the object in S3 and returns { url, filename, mimeType, size } — url is the /s/ path usable as a File/Image field value. Returns 400 if the file is not in S3 (ensure the PUT completed first).
| Name | Type | Req | Description |
|---|---|---|---|
| s3Key | string | yes | The s3Key returned from request_upload_url. |
| workspaceId | string|number | — | Workspace ID. Omit if set via env or set_workspace; required in stateless/remote mode. |
No output schema declared.
No examples provided.
create_module Create Module ~210
Create a new module. Supports workflow modules (states, activities, flows) and record list modules (fields only). Requires Administrator, Consultant, or Workspace Admin role. Validates internally with the same rules as validate_design and returns structured errors without creating anything — a separate validate_design call beforehand is optional. See inistate://schema/configure for field types, color palette, and design rules.
| Name | Type | Req | Description |
|---|---|---|---|
| activities | array | — | Custom activities. Omit for record list modules. |
| description | string | — | — |
| flows | array | — | State transition rules. Omit for record list modules. |
| icon | string | — | Emoji identifier |
| information | array | — | Field definitions. Items matched by id on update enable renaming. |
| name | string | yes | Module name |
| states | array | — | Workflow states. Omit for record list modules. |
| workspaceId | string|number | — | Workspace ID. Omit if set via env or set_workspace; required in stateless/remote mode. |
No output schema declared.
No examples provided.
design_workflow Design Workflow ~165
Generate a scaffolded ModuleSchema template from a natural language description. Use when the user wants to create a new module or workflow. Design workflow: design_workflow → (complete template) → validate_design → create_module → get_module_schema(tier=extended). Load resources inistate://schema and inistate://design-guide before designing for valid field types, colors, and design rules.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | yes | Natural language description of the desired workflow. Include: entity type, lifecycle states, activities, who performs each, what data is collected. |
| industry | string | — | Industry context, free text — mapped to financial_services, healthcare, legal, hr, procurement, it_service, or general (default). Affects audit fields, confidence thresholds, actor suggestions. |
No output schema declared.
No examples provided.
download_file Download File ~118
Download a file by module name. Construct the URL from a File/Image field value: field.path = '/s/{guid}/{fileName}'. Returns a pre-signed S3 URL (1hr TTL).
| Name | Type | Req | Description |
|---|---|---|---|
| fileName | string | yes | Original filename |
| guid | string | yes | Short ID from the file URL |
| moduleName | string | yes | Module name (resolved to vectorId internally) |
| workspaceId | string|number | — | Workspace ID. Omit if set via env or set_workspace; required in stateless/remote mode. |
No output schema declared.
No examples provided.
get_entry Get Entry ~84
Read a single entry by its ID. Returns current field values, state, audit metadata, and available activities.
| Name | Type | Req | Description |
|---|---|---|---|
| entryId | string|number | yes | Entry ID |
| module | string | yes | Module name from list_modules |
| workspaceId | string|number | — | Workspace ID. Omit if set via env or set_workspace; required in stateless/remote mode. |
No output schema declared.
No examples provided.
get_entry_history Get Entry History ~121
Get the audit trail and comments for an entry. Returns chronological list of actions (create, edit, state changes, comments) with field-level change details and AI traceability context.
| Name | Type | Req | Description |
|---|---|---|---|
| entryId | string|number | yes | Entry ID to get history for |
| module | string | yes | Module name from list_modules |
| page | integer | — | Page number (0-based, 50 items per page) |
| workspaceId | string|number | — | Workspace ID. Omit if set via env or set_workspace; required in stateless/remote mode. |
No output schema declared.
No examples provided.
get_form Get Activity Form ~173
Get the form fields, current values, and options for a module activity. Call this before the FIRST submit_activity on each (module, activity) pair — the form schema is stable within a session, so reuse it for subsequent entries (per-entry current values come from get_entry/list_entries). Never fabricate form data — if required fields cannot be confidently populated, ask the user.
| Name | Type | Req | Description |
|---|---|---|---|
| activity | string | — | Activity name: create, edit, view, or any custom activity name from get_module_schema |
| entryId | string|number|null | — | Entry ID for edit/view/custom activities. Omit for create. |
| module | string | yes | Module name from list_modules |
| workspaceId | string|number | — | Workspace ID. Omit if set via env or set_workspace; required in stateless/remote mode. |
No output schema declared.
No examples provided.
get_module_canvas Get Module Canvas ~130
Get the full module definition with stable IDs. The output is round-trippable — modify and send back via update_module. Use this when modifying a module to preserve IDs for renaming. Modify workflow: list_modules → get_module_canvas → (apply changes) → validate_design → update_module. Load resource inistate://schema before modifying to know valid field types, colors, and actors.
| Name | Type | Req | Description |
|---|---|---|---|
| module | string | yes | Module name or numeric ID |
| workspaceId | string|number | — | Workspace ID. Omit if set via env or set_workspace; required in stateless/remote mode. |
No output schema declared.
No examples provided.
get_module_schema Get Module Schema ~121
Get the canvas schema for a module. Use tier=basic (default) for fields and states only. Use tier=extended to also include activities and flows. Use basic for query operations. Use extended when you need to understand available activities and state transitions.
| Name | Type | Req | Description |
|---|---|---|---|
| module | string | yes | Module name from list_modules |
| tier | string | — | basic = fields + states. extended = + activities and flows. |
| workspaceId | string|number | — | Workspace ID. Omit if set via env or set_workspace; required in stateless/remote mode. |
No output schema declared.
No examples provided.
list_entries List Entries ~336
Query entries with filters, sorting, pagination. Filter keys are field display names; values are equality (simple) or operator objects (contains/startsWith/endsWith/min/max/above/below/between/after/before/empty/exists/yes/no/is/not/excludes). Use {or:[…]} for OR; multiple keys are AND-ed. Use 'me' for User-field self-match. See FilterOperators in inistate://schema/runtime for the full set. Token control: use `fields` to restrict the returned `data` to just the columns you need. For modules with many fields this can shrink the response by an order of magnitude. System fields (id, state, audit metadata, etc.) are always returned regardless.
| Name | Type | Req | Description |
|---|---|---|---|
| currentPage | integer | — | — |
| fields | array | — | Field display names (or raw field names) to include in each entry's `data`. Strongly preferred over returning everything when the module has many or large fields — prunes both DB I/O and response tok… |
| filters | object | — | — |
| module | string | yes | Module name from list_modules |
| pageSize | integer | — | Default 50, max 500 |
| search | string | — | Free-text against document ID and indexed text fields |
| sortBy | string | — | — |
| sortDirection | string | — | — |
| state | string | — | — |
| workspaceId | string|number | — | Workspace ID. Omit if set via env or set_workspace; required in stateless/remote mode. |
No output schema declared.
No examples provided.
list_modules List Modules ~70
List all discoverable modules in the current workspace. set_workspace already returns this list — call this only to refresh it or when operating stateless without set_workspace.
| Name | Type | Req | Description |
|---|---|---|---|
| workspaceId | string|number | — | Workspace ID. Omit if set via env or set_workspace; required in stateless/remote mode. |
No output schema declared.
No examples provided.
list_workspaces List Workspaces ~72
List workspaces the current user has access to. Typically the first call of a session. If exactly one workspace matches, it is selected automatically and its module list is returned — no set_workspace or list_modules needed; otherwise call set_workspace next.
| Name | Type | Req | Description |
|---|---|---|---|
| search | string | — | Optional name filter (case-insensitive) |
No output schema declared.
No examples provided.
request_upload_url Request Upload URL ~226
DEFAULT upload path for every file (up to 500MB); upload_file is only the fallback if this flow fails. Flow: 1) call this tool, 2) PUT the raw bytes to uploadUrl with Content-Type exactly matching contentType (S3 rejects mismatches with 403), 3) call confirm_upload({ s3Key }) — its returned path is the File/Image field value for submit_activity. uploadUrl expires in ~1 hour; call again on expiry.
| Name | Type | Req | Description |
|---|---|---|---|
| contentType | string | — | MIME type. Must match the Content-Type header used in the PUT request. |
| fileName | string | yes | Original filename including extension (e.g. 'report.pdf') |
| fileSize | integer | yes | File size in bytes. Must be > 0 and ≤ 500MB (524288000). |
| module | string | yes | Module name. Required — scopes the file to the module's storage folder. |
| workspaceId | string|number | — | Workspace ID. Omit if set via env or set_workspace; required in stateless/remote mode. |
No output schema declared.
No examples provided.
scaffold_module Scaffold Module from Existing Data ~65
Not available on this backend — calls return a structured capability_unavailable message. Local-runtime only; use design_workflow to draft a module here.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | — | — |
| source | string | yes | — |
| state | string | — | — |
| table | string | — | — |
No output schema declared.
No examples provided.
set_workspace Set Active Workspace ~147
Set the active workspace for the current session. The response includes the workspace's module list — go straight to list_entries / get_form / get_module_schema with those names; list_modules is only needed to refresh. In stateless/remote mode, prefer passing workspaceId directly to each tool instead. Workflow sequences after workspace is set: - Design: design_workflow → create_module (validates internally) - Execute: list_entries → get_form → submit_activity - Modify: get_module_canvas → validate_design → update_module - Query: list_entries → get_entry / get_entry_history
| Name | Type | Req | Description |
|---|---|---|---|
| workspaceId | string|number | yes | Workspace ID (or exact name) from list_workspaces |
No output schema declared.
No examples provided.
submit_activities Submit Activities (Bulk) ~320
Bulk variant of submit_activity: one module + one activity applied to many entries, each item with its own input. Use instead of N sequential submit_activity calls when creating/editing many rows — one tool turn instead of N. A per-item `ai` wholly replaces the top-level default (no partial merge). Items run sequentially fail-soft on the server: one failure does not abort the rest; per-item outcomes (success, entryId, flagged, validation details) return in `results` — use `clientRef` to correlate. Max 100 items; chunk beyond that. Guardrails match submit_activity at batch level: actor='human' rejects the whole batch; actor='hybrid', activity='changeStatus', or any state override (top-level or per-item) requires `confirmed: true`.
| Name | Type | Req | Description |
|---|---|---|---|
| activity | string | — | — |
| ai | object | yes | Default AI traceability applied to every item that does not specify its own. Same field semantics as submit_activity.ai. |
| confirmed | boolean | — | REQUIRED when the activity is 'changeStatus', any per-item or top-level `state` override is supplied, or the activity's actor is 'hybrid'. Set true ONLY after surfacing the planned bulk action to the… |
| items | array | yes | 1-100 items. Each item carries only what differs from the top-level activity. |
| module | string | yes | — |
| workspaceId | string|number | — | Workspace ID. Omit if set via env or set_workspace; required in stateless/remote mode. |
No output schema declared.
No examples provided.
submit_activity Submit Activity ~415
Perform an activity on a module entry: standard (create [no entryId], edit, delete, changeStatus, comment, duplicate, manage) or any custom activity from get_module_schema. Call get_form before the first submission per (module, activity); reuse its schema for further entries. The `ai` object is REQUIRED (reasoning + model + confidence). If confidence < the activity's threshold, the transition is suppressed and the entry is flagged. Server-side guard rules (human/hybrid actor, state-change confirm, confidence-inflation) may block — see inistate://guardrails. Input shapes: ActivitySubmission in inistate://schema/runtime.
| Name | Type | Req | Description |
|---|---|---|---|
| activity | string | — | — |
| ai | object | yes | REQUIRED — AI agent traceability |
| assignees | array | — | Usernames |
| comment | string | — | Optional. Add only when it carries information not already in the field values or reasoning. Keep short and precise. |
| confirmed | boolean | — | Set true only after explicit user authorization. Required for: changeStatus, state override, hybrid actor, retry after flag. Does not unlock human-actor activities. See inistate://guardrails. |
| due | string | — | ISO 8601 |
| entryId | string|number | — | Omit for create |
| entryIds | array | — | For bulk ops |
| input | object | — | Field values keyed by display name. File/Image: {name,path}. Module: {id,value} (both required). User: {id,value,username} (all three required). Plural variants (Users/Modules/Files/Images): arrays o… |
| module | string | yes | — |
| state | string | — | Target state name |
| workspaceId | string|number | — | Workspace ID. Omit if set via env or set_workspace; required in stateless/remote mode. |
No output schema declared.
No examples provided.
switch_mode ~111
Switch tool surface. 'configure' (default) = entry CRUD + module design tools and design resources. 'runtime' = entry CRUD plus get_module_schema (available in every mode). 'frontend' = configure + the inistate://frontend-guide resource (REST reference for building Vue/React UIs that call the Inistate API directly) — use it when the user wants a custom UI. The tool/resource list refreshes via list_changed after this call.
| Name | Type | Req | Description |
|---|---|---|---|
| mode | string | yes | Target mode |
No output schema declared.
No examples provided.
update_module Update Module ~232
Update an existing module. Merges changes into the existing canvas; items matched by id enable renaming. Omitted sections are left unchanged. Always call get_module_canvas first to obtain the stable module id and item ids. Full-canvas payloads (information included) are validated internally like create_module; for partial payloads, validate the merged canvas with validate_design first.
| Name | Type | Req | Description |
|---|---|---|---|
| activities | array | — | Custom activities. Omit for record list modules. |
| description | string | — | — |
| flows | array | — | State transition rules. Omit for record list modules. |
| icon | string | — | Emoji identifier |
| id | string|number | yes | Module id from get_module_canvas. Identifies which module to update. |
| information | array | — | Field definitions. Items matched by id on update enable renaming. |
| name | string | — | New module name (for renaming) |
| states | array | — | Workflow states. Omit for record list modules. |
| workspaceId | string|number | — | Workspace ID. Omit if set via env or set_workspace; required in stateless/remote mode. |
No output schema declared.
No examples provided.
upload_file Upload File (Fallback) ~180
FALLBACK ONLY — use request_upload_url + confirm_upload first; call this only after that presigned flow has actually failed. Uploads via base64. Returns { path, filename, mimeType, size } — use path as the File/Image field value in submit_activity. Max 50MB. Blocked: .exe, .bat, .cmd, .dll, .msi.
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | yes | Base64-encoded file content |
| mimeType | string | — | MIME type of the file |
| module | string | yes | Module name. Required — scopes the file to the module's storage folder. |
| name | string | yes | Original filename (e.g. 'report.pdf') |
| workspaceId | string|number | — | Workspace ID. Omit if set via env or set_workspace; required in stateless/remote mode. |
No output schema declared.
No examples provided.
validate_design Validate Design ~103
Validate a module schema without submitting anything. create_module (and update_module on full-canvas payloads) runs these same checks internally, so this tool is optional there — use it to iterate on a draft, or before a partial update_module where the merged canvas cannot be checked client-side.
| Name | Type | Req | Description |
|---|---|---|---|
| mode | string | — | create = new module (all rules). update = merge (omitted sections acceptable). |
| schema | object | yes | A complete or partial ModuleSchema object |
No output schema declared.
No examples provided.