Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

io.github.ivanlai/primer-mcp

PYPI · PRIMER-MCP

A Jira-lite MCP server that guides planning-first workflows for AI-assisted development.

Available components

−2 this week 80 Trust /100

Last scanned (2 hours ago)

Scores higher than 80% of PyPI servers

Category Project Management

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security100
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • Runs hatchling.build at install time, a recognised build step with no custom scripting around it. View diagnostics → Pass
  • 1 of 31 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
Schema Quality & AI Usability82
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (good).Pass
  • Context-footprint check failed: tool/resource definitions use about 1839 tokens (~108/item across 17 items; 17 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management87
  • Stability observed for 26 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage71
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 0% of tool parameters carry a description.Fail
  • Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety75
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "delete_ticket" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
  • An AI judge read all 18 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a current MCP spec version (2026-07-28).Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 5 Nov 26 +15
    • Malware scan: unverified → pass ▲ security
  • 4 Nov 26 −2
    • Stability: pass → 0.83 functional
  • 30 Oct 26 −15
    • Malware scan: pass → unverified ▼ security
  • 22 Oct 26 0
    • Stability: 0.97 → pass security
  • 21 Oct 26 0
    • Stability: pass → 0.97 functional
  • 17 Oct 26 +3
    • Stability: 0.80 → pass security
  • 16 Oct 26 −3
    • Stability: pass → 0.80 functional
  • 15 Oct 26 0
    • Stability: 0.97 → pass security
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Analysed pypi/primer-mcp@0.1.8

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem pypi
Reason No attestation published

Background: How many MCP packages publish verified provenance →

Install scripts 1 script
Hook Tier Command
build_backend allowlisted hatchling.build

Background: Why install scripts are a supply-chain risk →

Dependencies 31 packages
Packages resolved 31
No linked repository 1
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 17 exposed · ~1,713 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
complete_spike ~52

Close a spike by recording its findings — the answer to the question it was investigating and any recommendations. Works from any status.

NameTypeReqDescription
findingsstringyes–
spike_idstringyes–
NameTypeReqDescription
resultstringyes–

No examples provided.

complete_task ~106

Mark a task as completed with notes on what was done. The notes parameter is a terse one-liner for the frontmatter field; write a fuller summary (approach, key changes, decisions) into the ## Completion Notes body section of the ticket separately. Ideally call start_task first, but this works from any status. After this, call verify_task with evidence to finalise.

NameTypeReqDescription
notesstringyes–
task_idstringyes–
NameTypeReqDescription
resultstringyes–

No examples provided.

create_spike ~84

Create a Spike under a story — a timeboxed investigation to answer a specific question before committing to an implementation approach. The parent story must already exist. When done, call complete_spike with your findings.

NameTypeReqDescription
questionstringyes–
story_idstringyes–
timeboxstringyes–
titlestringyes–
NameTypeReqDescription
resultstringyes–

No examples provided.

create_story ~182

Create a Story under an epic — a deliverable with acceptance criteria. The epic must exist — if one hasn't been created yet, call plan_epic first. The user will have described their goals; use that to create the epic, asking for clarification if needed. If no ADR has been recorded, the response will suggest capturing decisions first, but the story is still created. Pass adr_ids to link the story to the architectural decisions that govern it. Each ADR must exist and belong to the same epic. After creating stories, present the plan to the user and wait for their agreement before creating tasks or starting work.

NameTypeReqDescription
acceptance_criteria–––
adr_ids–––
definition_of_done–––
epic_idstringyes–
titlestringyes–
whatstringyes–
NameTypeReqDescription
resultstringyes–

No examples provided.

create_task ~142

Create a Task under a story — a concrete unit of implementation work with a testable outcome. The parent story must already exist. After breaking a story into tasks, present the task list to the user before starting work — don't create tasks and immediately begin implementing. For small bug fixes (1-2 tasks), prefer adding a task under the standing bug-fix story rather than creating a new story. Suggest a dedicated story only when the fix spans 3+ tasks.

NameTypeReqDescription
story_idstringyes–
testable_outcomestringyes–
titlestringyes–
what_to_dostringyes–
NameTypeReqDescription
resultstringyes–

No examples provided.

delete_ticket ~70

Delete a ticket. Non-todo tickets are deleted with a warning. Children are reported but not deleted — call delete_ticket on each to cascade. After all deletions, call sweep_blocked_by to clean up dangling references. Recoverable from git history.

NameTypeReqDescription
ticket_idstringyes–
NameTypeReqDescription
resultstringyes–

No examples provided.

export_graph ~85

Generate a self-contained HTML file visualising the project as an interactive graph. Opens in any browser with no external requests. Nodes are coloured by type and status; edges show both hierarchy (epic -> story -> task) and dependencies (blocked_by). Click a node to see its details. On-demand — call when you want a snapshot.

NameTypeReqDescription
output_path–––
NameTypeReqDescription
resultstringyes–

No examples provided.

get_ticket ~56

Read one ticket by ID, with its full body. Also reports which tickets it blocks — that direction is not stored on the ticket itself, so this is the only way to see it.

NameTypeReqDescription
ticket_idstringyes–
NameTypeReqDescription
resultstringyes–

No examples provided.

init_project ~95

Initialise this project for primer-mcp: creates the primer/ ticket store and adds the workflow section to CLAUDE.md and AGENTS.md, creating them if needed. Non-destructive and idempotent. Call this once per project, before any other tool. Optionally pass jira_project_key if tickets may later be exported to Jira.

NameTypeReqDescription
jira_project_key–––
project_namestringyes–
NameTypeReqDescription
resultstringyes–

No examples provided.

list_actionable ~204

List what can be acted on right now, with epic context. Returns the epic's goals, story coverage, and a table of actionable items. Always show the full table to the user first, then add your recommendation below it. The table is the primary output — the user needs to see all options to make their own call. After showing the table, recommend what to do next: 1. Check whether the stories cover the epic's goals. If goals are uncovered, recommend more planning (create_story) before execution. 2. Urgent items (unverified or in-progress tasks) should usually be finished before starting new work. 3. For the remaining items, read the tickets that look relevant (get_ticket) and recommend based on impact — what unblocks the most work, what aligns with current momentum, why now. 4. If several items are genuinely equal, say so and explain why.

Input schema present but exposes no named parameters.

NameTypeReqDescription
resultstringyes–

No examples provided.

list_tickets ~77

List tickets one per line, newest work last. Filter by type (epic, adr, story, task, spike), status, or parent_id (show only children of that ticket). Use this to find an ID before calling another tool.

NameTypeReqDescription
parent_id–––
status–––
ticket_type–––
NameTypeReqDescription
resultstringyes–

No examples provided.

plan_epic ~109

Create an Epic — the top-level container for a body of work. Start here: state why the work matters, its goals, and how you'll know it's done. Consider recording decisions (record_adr) before creating stories — it captures reasoning that gets lost once implementation starts.

NameTypeReqDescription
constraints–––
goalsarrayyes–
non_goals–––
success_criteria–––
titlestringyes–
whystringyes–
NameTypeReqDescription
resultstringyes–

No examples provided.

record_adr ~102

Record an Architecture Decision Record under an epic: the context forcing a choice, the decision, alternatives rejected (with reasons), and consequences accepted. Recording decisions before creating stories is recommended — it captures reasoning that gets lost once implementation starts.

NameTypeReqDescription
alternativesarrayyes–
consequencesstringyes–
contextstringyes–
decisionstringyes–
epic_idstringyes–
titlestringyes–
NameTypeReqDescription
resultstringyes–

No examples provided.

start_task ~58

Transition a task to in-progress — call this when you begin working on a task. Works from any status; you'll get a note if the transition is unusual. After finishing, call complete_task.

NameTypeReqDescription
task_idstringyes–
NameTypeReqDescription
resultstringyes–

No examples provided.

sweep_blocked_by ~38

Remove blocked_by references that point to tickets that no longer exist. Call once after finishing a batch of delete_ticket calls.

Input schema present but exposes no named parameters.

NameTypeReqDescription
resultstringyes–

No examples provided.

update_ticket ~161

Amend a ticket after creation; anything left out is left alone. status — which values each type accepts: - Epic, story, spike: todo, in-progress, blocked, done. - Task: todo, in-progress, blocked. Finish with complete_task then verify_task. - ADR: none — it records a decision and has no lifecycle. blocked_by replaces the dependency list. It is refused if a referenced ticket does not exist or the edge would create a cycle. To say "A blocks B", set blocked_by on B. body_sections replaces whole markdown sections by heading.

NameTypeReqDescription
blocked_by–––
body_sections–––
external_ref–––
status–––
ticket_idstringyes–
NameTypeReqDescription
resultstringyes–

No examples provided.

verify_task ~92

Verify a task with evidence that the work holds (e.g. "218 passed, mypy clean"). Pass the short commit hash in the commit parameter so it is labelled consistently. Ideally call complete_task first to capture notes, but this works from any status. Sets the task to verified.

NameTypeReqDescription
commitstring––
evidencestringyes–
task_idstringyes–
NameTypeReqDescription
resultstringyes–

No examples provided.

Install

How do I install the io.github.ivanlai/primer-mcp server?

io.github.ivanlai/primer-mcp runs locally as a PyPI package, launched with uvx primer-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

pypi · primer-mcp

# add to Claude Code
claude mcp add ivanlai-primer-mcp -- uvx primer-mcp
Common questions

What is the io.github.ivanlai/primer-mcp server?

io.github.ivanlai/primer-mcp is listed in the public MCP registry as io.github.ivanlai/primer-mcp. A Jira-lite MCP server that guides planning-first workflows for AI-assisted development. This page covers its PyPI package (primer-mcp).

Is the io.github.ivanlai/primer-mcp server safe to use?

io.github.ivanlai/primer-mcp scores 80 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the io.github.ivanlai/primer-mcp server expose?

io.github.ivanlai/primer-mcp exposes 17 tools: init_project, plan_epic, record_adr, create_story, create_task, and 12 more. Their descriptions and schemas cost roughly 1,713 tokens of context every time the server is loaded.

Is the io.github.ivanlai/primer-mcp server still maintained?

io.github.ivanlai/primer-mcp is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the io.github.ivanlai/primer-mcp server under?

io.github.ivanlai/primer-mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.