io.github.MAIAS-project/maias
NPM · @MAIAS/MCP · SCANNED AUG 3
Validate, query, safely edit, and wireframe MAIAS app-IA documents: cascading renames, atomic edits.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security87
- No malware found by supply-chain analysis.Pass
- Only part of the dependency tree could be resolved (98 of 102), so this covers what we could see, not the whole tree.Partial
- No install/post-install scripts declared.Pass
- Only part of the dependency tree could be resolved (98 of 102), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (Apache-2.0).Pass
- Actively maintained (last published 8 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability63
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 866 tokens (~173/item across 5 items; 5 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
- Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage97
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 92% of tool parameters carry a description.Partial
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
npm · @maias/mcp
claude mcp add maias-project-maias -- npx -y @maias/mcp
codex mcp add maias-project-maias -- npx -y @maias/mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"maias-project-maias": {
"type": "local",
"command": [
"npx",
"-y",
"@maias/mcp"
],
"enabled": true
}
}
} openclaw mcp add maias-project-maias --command npx --arg -y --arg @maias/mcp
mcp_servers:
maias-project-maias:
command: "npx"
args: ["-y", "@maias/mcp"] {
"mcpServers": {
"maias-project-maias": {
"command": "npx",
"args": [
"-y",
"@maias/mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 3 Aug 26 +4
- Stability: unverified → 0.27 ▲ functional
- 2 Aug 26 +43
- Provenance: unverified → fail ▼ security
- Install scripts: unverified → pass ▲ security
- Known CVEs: unverified → partial ▲ security
- Malware scan: unverified → pass ▲ security
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- Tool coverage: 100 → unverified ▼ functional
- Security disclosure: fail → unverified ▼ functional
- License: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- Maintenance: unverified → pass ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Schema quality: unverified → good ▲ functional
- First check of Schema quality: unverified functional
- Licence: Apache-2.0 functional
- 31 Jul 26 −7
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 27 Jul 26 26
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 3 Aug 2026 · Analysed npm/@maias/[email protected]
Provenance none
Ecosystem: npm · Outcome: none
Dependencies 98 packages
98 packages in the resolved dependency tree · 97 deprecated · 29 stale.
The dependency tree was only partially resolved, so these counts may be incomplete.
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
edit Safely edit a MAIAS document ~186
Reference-safe edits: rename_screen cascades to flows, the navigation registry, and every target; add_screen registers the screen; remove_screen refuses to leave dangling references unless cascade is set. Writes the result back to the file (canonically formatted when format_output is true).
| Name | Type | Req | Description |
|---|---|---|---|
| cascade | boolean | — | remove_screen: also remove inbound references |
| file | string | yes | Path to the MAIAS document |
| flow | string | — | Flow to append the new screen to (add_screen) |
| format_output | boolean | — | Write canonical form (default true) |
| new_id | string | — | New id (rename_screen) |
| operation | string | yes | — |
| registry | string | — | Registry list for add_screen (default secondary) |
| screen | object | — | Screen object per the spec (add_screen) |
| screen_id | string | — | Target screen id (rename_screen / remove_screen) |
No output schema declared.
No examples provided.
edit_elements Safely edit a screen's elements ~233
Batch edit of a screen's `elements` list (or a declared state's list): insert, update, remove, move. The batch is atomic — a failing op refuses the whole batch and the file is untouched. Ops apply sequentially, so each op's index addresses the list as left by the previous ops (0-based; insert at list length appends; move's `to` is the final index). `update.set` patches only the given keys — an explicit null deletes a key, `x_` fields not named survive. An op introducing a `target` that matches no screen is refused, as is editing a state the screen does not declare. Pass `expect` so a stale index fails loudly instead of editing the wrong element. Writes the result back to the file (canonically formatted when format_output is true).
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | yes | Path to the MAIAS document |
| format_output | boolean | — | Write canonical form (default true) |
| ops | array | yes | Operations, applied in order, all-or-nothing |
| screen_id | string | yes | Screen whose elements are edited |
No output schema declared.
No examples provided.
query Query a MAIAS document graph ~178
Graph utilities over a MAIAS file: get one screen, list screens/flows, reachability analysis, orphan detection, "what links here" for a screen id, a text outline of the structure (tree — show this to the user after creating or restructuring a document), and a Mermaid flowchart (mermaid — renders in GitHub/Claude/Obsidian). tree and mermaid return plain text, not JSON; mermaid accepts an optional flow to scope the diagram.
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | yes | Path to the MAIAS document |
| flow | string | — | mermaid: scope the diagram to one flow |
| operation | string | yes | — |
| refs | boolean | — | tree: append each screen's outbound targets and states |
| screen_id | string | — | Screen id — required for 'screen' and 'what_links_here' |
No output schema declared.
No examples provided.
validate Validate a MAIAS document ~63
JSON Schema validation plus semantic lint (dangling targets, orphans, registry membership, …) for a MAIAS file. Returns { valid, diagnostics[] } with line/col positions.
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | yes | Path to a .yaml or .json MAIAS document |
No output schema declared.
No examples provided.
wireframe Render an HTML wireframe board ~206
Deterministic mobile wireframes from a MAIAS file: one self-contained HTML file (inline CSS, no JS, no external URLs) with one phone frame per screen, flows as rows, and click-through anchors between frames. Pass out to write the file (recommended — returns a summary); without out the raw HTML is returned as text (large). Refuses documents with validation errors (dangling targets become dead links) unless force is set.
| Name | Type | Req | Description |
|---|---|---|---|
| accent | string | — | Hex accent colour (e.g. #0A84FF) replacing the default wireframe grey |
| file | string | yes | Path to the MAIAS document |
| flow | string | — | Render only this flow |
| force | boolean | — | Render despite validation errors |
| out | string | — | Write the HTML here (e.g. <app>-wireframes.html); when absent the HTML is returned as text |
| states | boolean | — | Also emit declared empty/loading/error variants as extra frames |
No output schema declared.
No examples provided.