Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, email [email protected] and we’ll put it right.

Inistate MCP

NPM · INISTATE-MCP · 2 COMPONENTS · SCANNED AUG 3

MCP server for the Inistate platform: module discovery, entry management, and activity submission.

+19 this week 69 Trust /100
Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security87
  • No malware found by supply-chain analysis.Pass
  • Only part of the dependency tree could be resolved (97 of 98), so this covers what we could see, not the whole tree.Partial
  • No install/post-install scripts declared.Pass
  • Only part of the dependency tree could be resolved (97 of 98), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency45
Schema Quality & AI Usability79
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 4060 tokens (~156/item across 26 items; 21 tools + 5 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
  • Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage94
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 83% of tool parameters carry a description.Partial
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · inistate-mcp

# add to Claude Code
claude mcp add inistate-inistate-mcp -- npx -y inistate-mcp
# add to Codex CLI
codex mcp add inistate-inistate-mcp -- npx -y inistate-mcp
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "inistate-inistate-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "inistate-mcp"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add inistate-inistate-mcp --command npx --arg -y --arg inistate-mcp
# ~/.hermes/config.yaml
mcp_servers:
  inistate-inistate-mcp:
    command: "npx"
    args: ["-y", "inistate-mcp"]
// mcp.json
{
  "mcpServers": {
    "inistate-inistate-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "inistate-mcp"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 2 Aug 26 +26
    • Provenance: fail → unverified security
    • Install scripts: pass → unverified security
    • Known CVEs: unverified → partial security
    • Malware scan: unverified → pass security
    • Maintenance: pass → unverified functional
    • License: pass → unverified functional
    • Dependency health: unverified → partial functional
    • Stability: unverified → 0.23 functional
    • Licence: Apache-2.0 functional
  • 1 Aug 26 −11
    • Known CVEs: partial → unverified security
    • Dependency health: partial → unverified functional
  • 31 Jul 26 +5
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 30 Jul 26 −31
    • Known CVEs: partial → unverified security
    • Malware scan: pass → unverified security
    • Dependency health: partial → unverified functional
  • 29 Jul 26 +30
    • Provenance: unverified → fail security
    • Install scripts: unverified → pass security
    • Known CVEs: unverified → partial security
    • Maintenance: unverified → pass functional
    • Dependency health: unverified → partial functional
    • License: unverified → pass functional
    • Schema quality: unverified → excellent functional
    • Licence: Apache-2.0 functional
  • 27 Jul 26 50

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/[email protected]

Provenance none

Ecosystem: npm · Outcome: none

Dependencies 97 packages

97 packages in the resolved dependency tree · 97 deprecated · 30 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 21 exposed · ~3,522 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens
confirm_upload ~123

Confirm a presigned upload after the PUT to uploadUrl succeeded. The server verifies the object in S3 and returns { url, filename, mimeType, size } — url is the /s/ path usable as a File/Image field value. Returns 400 if the file is not in S3 (ensure the PUT completed first).

NameTypeReqDescription
s3KeystringyesThe s3Key returned from request_upload_url.
workspaceIdstring|numberWorkspace ID. Omit if set via env or set_workspace; required in stateless/remote mode.

No output schema declared.

No examples provided.

create_module ~210

Create a new module. Supports workflow modules (states, activities, flows) and record list modules (fields only). Requires Administrator, Consultant, or Workspace Admin role. Validates internally with the same rules as validate_design and returns structured errors without creating anything — a separate validate_design call beforehand is optional. See inistate://schema/configure for field types, color palette, and design rules.

NameTypeReqDescription
activitiesarrayCustom activities. Omit for record list modules.
descriptionstring
flowsarrayState transition rules. Omit for record list modules.
iconstringEmoji identifier
informationarrayField definitions. Items matched by id on update enable renaming.
namestringyesModule name
statesarrayWorkflow states. Omit for record list modules.
workspaceIdstring|numberWorkspace ID. Omit if set via env or set_workspace; required in stateless/remote mode.

No output schema declared.

No examples provided.

design_workflow ~165

Generate a scaffolded ModuleSchema template from a natural language description. Use when the user wants to create a new module or workflow. Design workflow: design_workflow → (complete template) → validate_design → create_module → get_module_schema(tier=extended). Load resources inistate://schema and inistate://design-guide before designing for valid field types, colors, and design rules.

NameTypeReqDescription
descriptionstringyesNatural language description of the desired workflow. Include: entity type, lifecycle states, activities, who performs each, what data is collected.
industrystringIndustry context, free text — mapped to financial_services, healthcare, legal, hr, procurement, it_service, or general (default). Affects audit fields, confidence thresholds, actor suggestions.

No output schema declared.

No examples provided.

download_file ~118

Download a file by module name. Construct the URL from a File/Image field value: field.path = '/s/{guid}/{fileName}'. Returns a pre-signed S3 URL (1hr TTL).

NameTypeReqDescription
fileNamestringyesOriginal filename
guidstringyesShort ID from the file URL
moduleNamestringyesModule name (resolved to vectorId internally)
workspaceIdstring|numberWorkspace ID. Omit if set via env or set_workspace; required in stateless/remote mode.

No output schema declared.

No examples provided.

get_entry ~84

Read a single entry by its ID. Returns current field values, state, audit metadata, and available activities.

NameTypeReqDescription
entryIdstring|numberyesEntry ID
modulestringyesModule name from list_modules
workspaceIdstring|numberWorkspace ID. Omit if set via env or set_workspace; required in stateless/remote mode.

No output schema declared.

No examples provided.

get_entry_history ~121

Get the audit trail and comments for an entry. Returns chronological list of actions (create, edit, state changes, comments) with field-level change details and AI traceability context.

NameTypeReqDescription
entryIdstring|numberyesEntry ID to get history for
modulestringyesModule name from list_modules
pageintegerPage number (0-based, 50 items per page)
workspaceIdstring|numberWorkspace ID. Omit if set via env or set_workspace; required in stateless/remote mode.

No output schema declared.

No examples provided.

get_form ~173

Get the form fields, current values, and options for a module activity. Call this before the FIRST submit_activity on each (module, activity) pair — the form schema is stable within a session, so reuse it for subsequent entries (per-entry current values come from get_entry/list_entries). Never fabricate form data — if required fields cannot be confidently populated, ask the user.

NameTypeReqDescription
activitystringActivity name: create, edit, view, or any custom activity name from get_module_schema
entryIdstring|number|nullEntry ID for edit/view/custom activities. Omit for create.
modulestringyesModule name from list_modules
workspaceIdstring|numberWorkspace ID. Omit if set via env or set_workspace; required in stateless/remote mode.

No output schema declared.

No examples provided.

get_module_canvas ~130

Get the full module definition with stable IDs. The output is round-trippable — modify and send back via update_module. Use this when modifying a module to preserve IDs for renaming. Modify workflow: list_modules → get_module_canvas → (apply changes) → validate_design → update_module. Load resource inistate://schema before modifying to know valid field types, colors, and actors.

NameTypeReqDescription
modulestringyesModule name or numeric ID
workspaceIdstring|numberWorkspace ID. Omit if set via env or set_workspace; required in stateless/remote mode.

No output schema declared.

No examples provided.

get_module_schema ~121

Get the canvas schema for a module. Use tier=basic (default) for fields and states only. Use tier=extended to also include activities and flows. Use basic for query operations. Use extended when you need to understand available activities and state transitions.

NameTypeReqDescription
modulestringyesModule name from list_modules
tierstringbasic = fields + states. extended = + activities and flows.
workspaceIdstring|numberWorkspace ID. Omit if set via env or set_workspace; required in stateless/remote mode.

No output schema declared.

No examples provided.

list_entries ~336

Query entries with filters, sorting, pagination. Filter keys are field display names; values are equality (simple) or operator objects (contains/startsWith/endsWith/min/max/above/below/between/after/before/empty/exists/yes/no/is/not/excludes). Use {or:[…]} for OR; multiple keys are AND-ed. Use 'me' for User-field self-match. See FilterOperators in inistate://schema/runtime for the full set. Token control: use `fields` to restrict the returned `data` to just the columns you need. For modules with many fields this can shrink the response by an order of magnitude. System fields (id, state, audit metadata, etc.) are always returned regardless.

NameTypeReqDescription
currentPageinteger
fieldsarrayField display names (or raw field names) to include in each entry's `data`. Strongly preferred over returning everything when the module has many or large fields — prunes both DB I/O and response tok…
filtersobject
modulestringyesModule name from list_modules
pageSizeintegerDefault 50, max 500
searchstringFree-text against document ID and indexed text fields
sortBystring
sortDirectionstring
statestring
workspaceIdstring|numberWorkspace ID. Omit if set via env or set_workspace; required in stateless/remote mode.

No output schema declared.

No examples provided.

list_modules ~70

List all discoverable modules in the current workspace. set_workspace already returns this list — call this only to refresh it or when operating stateless without set_workspace.

NameTypeReqDescription
workspaceIdstring|numberWorkspace ID. Omit if set via env or set_workspace; required in stateless/remote mode.

No output schema declared.

No examples provided.

list_workspaces ~72

List workspaces the current user has access to. Typically the first call of a session. If exactly one workspace matches, it is selected automatically and its module list is returned — no set_workspace or list_modules needed; otherwise call set_workspace next.

NameTypeReqDescription
searchstringOptional name filter (case-insensitive)

No output schema declared.

No examples provided.

request_upload_url ~226

DEFAULT upload path for every file (up to 500MB); upload_file is only the fallback if this flow fails. Flow: 1) call this tool, 2) PUT the raw bytes to uploadUrl with Content-Type exactly matching contentType (S3 rejects mismatches with 403), 3) call confirm_upload({ s3Key }) — its returned path is the File/Image field value for submit_activity. uploadUrl expires in ~1 hour; call again on expiry.

NameTypeReqDescription
contentTypestringMIME type. Must match the Content-Type header used in the PUT request.
fileNamestringyesOriginal filename including extension (e.g. 'report.pdf')
fileSizeintegeryesFile size in bytes. Must be > 0 and ≤ 500MB (524288000).
modulestringyesModule name. Required — scopes the file to the module's storage folder.
workspaceIdstring|numberWorkspace ID. Omit if set via env or set_workspace; required in stateless/remote mode.

No output schema declared.

No examples provided.

scaffold_module ~65

Not available on this backend — calls return a structured capability_unavailable message. Local-runtime only; use design_workflow to draft a module here.

NameTypeReqDescription
namestring
sourcestringyes
statestring
tablestring

No output schema declared.

No examples provided.

set_workspace ~147

Set the active workspace for the current session. The response includes the workspace's module list — go straight to list_entries / get_form / get_module_schema with those names; list_modules is only needed to refresh. In stateless/remote mode, prefer passing workspaceId directly to each tool instead. Workflow sequences after workspace is set: - Design: design_workflow → create_module (validates internally) - Execute: list_entries → get_form → submit_activity - Modify: get_module_canvas → validate_design → update_module - Query: list_entries → get_entry / get_entry_history

NameTypeReqDescription
workspaceIdstring|numberyesWorkspace ID (or exact name) from list_workspaces

No output schema declared.

No examples provided.

submit_activities ~320

Bulk variant of submit_activity: one module + one activity applied to many entries, each item with its own input. Use instead of N sequential submit_activity calls when creating/editing many rows — one tool turn instead of N. A per-item `ai` wholly replaces the top-level default (no partial merge). Items run sequentially fail-soft on the server: one failure does not abort the rest; per-item outcomes (success, entryId, flagged, validation details) return in `results` — use `clientRef` to correlate. Max 100 items; chunk beyond that. Guardrails match submit_activity at batch level: actor='human' rejects the whole batch; actor='hybrid', activity='changeStatus', or any state override (top-level or per-item) requires `confirmed: true`.

NameTypeReqDescription
activitystring
aiobjectyesDefault AI traceability applied to every item that does not specify its own. Same field semantics as submit_activity.ai.
confirmedbooleanREQUIRED when the activity is 'changeStatus', any per-item or top-level `state` override is supplied, or the activity's actor is 'hybrid'. Set true ONLY after surfacing the planned bulk action to the…
itemsarrayyes1-100 items. Each item carries only what differs from the top-level activity.
modulestringyes
workspaceIdstring|numberWorkspace ID. Omit if set via env or set_workspace; required in stateless/remote mode.

No output schema declared.

No examples provided.

submit_activity ~415

Perform an activity on a module entry: standard (create [no entryId], edit, delete, changeStatus, comment, duplicate, manage) or any custom activity from get_module_schema. Call get_form before the first submission per (module, activity); reuse its schema for further entries. The `ai` object is REQUIRED (reasoning + model + confidence). If confidence < the activity's threshold, the transition is suppressed and the entry is flagged. Server-side guard rules (human/hybrid actor, state-change confirm, confidence-inflation) may block — see inistate://guardrails. Input shapes: ActivitySubmission in inistate://schema/runtime.

NameTypeReqDescription
activitystring
aiobjectyesREQUIRED — AI agent traceability
assigneesarrayUsernames
commentstringOptional. Add only when it carries information not already in the field values or reasoning. Keep short and precise.
confirmedbooleanSet true only after explicit user authorization. Required for: changeStatus, state override, hybrid actor, retry after flag. Does not unlock human-actor activities. See inistate://guardrails.
duestringISO 8601
entryIdstring|numberOmit for create
entryIdsarrayFor bulk ops
inputobjectField values keyed by display name. File/Image: {name,path}. Module: {id,value} (both required). User: {id,value,username} (all three required). Plural variants (Users/Modules/Files/Images): arrays o…
modulestringyes
statestringTarget state name
workspaceIdstring|numberWorkspace ID. Omit if set via env or set_workspace; required in stateless/remote mode.

No output schema declared.

No examples provided.

switch_mode ~111

Switch tool surface. 'configure' (default) = entry CRUD + module design tools and design resources. 'runtime' = entry CRUD plus get_module_schema (available in every mode). 'frontend' = configure + the inistate://frontend-guide resource (REST reference for building Vue/React UIs that call the Inistate API directly) — use it when the user wants a custom UI. The tool/resource list refreshes via list_changed after this call.

NameTypeReqDescription
modestringyesTarget mode

No output schema declared.

No examples provided.

update_module ~232

Update an existing module. Merges changes into the existing canvas; items matched by id enable renaming. Omitted sections are left unchanged. Always call get_module_canvas first to obtain the stable module id and item ids. Full-canvas payloads (information included) are validated internally like create_module; for partial payloads, validate the merged canvas with validate_design first.

NameTypeReqDescription
activitiesarrayCustom activities. Omit for record list modules.
descriptionstring
flowsarrayState transition rules. Omit for record list modules.
iconstringEmoji identifier
idstring|numberyesModule id from get_module_canvas. Identifies which module to update.
informationarrayField definitions. Items matched by id on update enable renaming.
namestringNew module name (for renaming)
statesarrayWorkflow states. Omit for record list modules.
workspaceIdstring|numberWorkspace ID. Omit if set via env or set_workspace; required in stateless/remote mode.

No output schema declared.

No examples provided.

upload_file ~180

FALLBACK ONLY — use request_upload_url + confirm_upload first; call this only after that presigned flow has actually failed. Uploads via base64. Returns { path, filename, mimeType, size } — use path as the File/Image field value in submit_activity. Max 50MB. Blocked: .exe, .bat, .cmd, .dll, .msi.

NameTypeReqDescription
filestringyesBase64-encoded file content
mimeTypestringMIME type of the file
modulestringyesModule name. Required — scopes the file to the module's storage folder.
namestringyesOriginal filename (e.g. 'report.pdf')
workspaceIdstring|numberWorkspace ID. Omit if set via env or set_workspace; required in stateless/remote mode.

No output schema declared.

No examples provided.

validate_design ~103

Validate a module schema without submitting anything. create_module (and update_module on full-canvas payloads) runs these same checks internally, so this tool is optional there — use it to iterate on a draft, or before a partial update_module where the merged canvas cannot be checked client-side.

NameTypeReqDescription
modestringcreate = new module (all rules). update = merge (omitted sections acceptable).
schemaobjectyesA complete or partial ModuleSchema object

No output schema declared.

No examples provided.