# io.github.MAIAS-project/maias (npm · @maias/mcp)

Validate, query, safely edit, and wireframe MAIAS app-IA documents: cascading renames, atomic edits.

- Trust score: 66/100 (medium)
- Change this week: +40
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `@maias/mcp`: 66/100 (this document), [markdown](https://verifymcp.io/servers/maias-project-maias/maias-mcp.md), [page](https://verifymcp.io/servers/maias-project-maias/maias-mcp)

## Channel facts

- Registry: `npm`
- Package: `@maias/mcp`
- Version: `0.5.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (98 of 102), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (98 of 102), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (Apache-2.0).
  - Actively maintained (last published 8 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 63/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 866 tokens (~173/item across 5 items; 5 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 97/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 92% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add maias-project-maias -- npx -y @maias/mcp
```

### Codex

```bash
codex mcp add maias-project-maias -- npx -y @maias/mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "maias-project-maias": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@maias/mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add maias-project-maias --command npx --arg -y --arg @maias/mcp
```

### Hermes

```yaml
mcp_servers:
  maias-project-maias:
    command: "npx"
    args: ["-y", "@maias/mcp"]
```

### Other

```json
{
  "mcpServers": {
    "maias-project-maias": {
      "command": "npx",
      "args": [
        "-y",
        "@maias/mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 66, +4)

- [functional improvement] Stability: unverified → 0.27

### 2026-08-02 (score 62, +43)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Security disclosure: fail → unverified
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Schema quality: unverified → good
- [functional] First check of Schema quality: unverified
- [functional] Licence: Apache-2.0

### 2026-07-31 (score 19, −7)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-27 (score 26)

First indexed and scored.

## MCP tools (5)

### `validate` (~63 tokens)

Validate a MAIAS document

JSON Schema validation plus semantic lint (dangling targets, orphans, registry membership, …) for a MAIAS file. Returns { valid, diagnostics[] } with line/col positions.

Input parameters:

- `file` (string, required): Path to a .yaml or .json MAIAS document

### `query` (~178 tokens)

Query a MAIAS document graph

Graph utilities over a MAIAS file: get one screen, list screens/flows, reachability analysis, orphan detection, "what links here" for a screen id, a text outline of the structure (tree — show this to the user after creating or restructuring a document), and a Mermaid flowchart (mermaid — renders in GitHub/Claude/Obsidian). tree and mermaid return plain text, not JSON; mermaid accepts an optional flow to scope the diagram.

Input parameters:

- `file` (string, required): Path to the MAIAS document
- `flow` (string): mermaid: scope the diagram to one flow
- `operation` (string, required)
- `refs` (boolean): tree: append each screen's outbound targets and states
- `screen_id` (string): Screen id — required for 'screen' and 'what_links_here'

### `edit` (~186 tokens)

Safely edit a MAIAS document

Reference-safe edits: rename_screen cascades to flows, the navigation registry, and every target; add_screen registers the screen; remove_screen refuses to leave dangling references unless cascade is set. Writes the result back to the file (canonically formatted when format_output is true).

Input parameters:

- `cascade` (boolean): remove_screen: also remove inbound references
- `file` (string, required): Path to the MAIAS document
- `flow` (string): Flow to append the new screen to (add_screen)
- `format_output` (boolean): Write canonical form (default true)
- `new_id` (string): New id (rename_screen)
- `operation` (string, required)
- `registry` (string): Registry list for add_screen (default secondary)
- `screen` (object): Screen object per the spec (add_screen)
- `screen_id` (string): Target screen id (rename_screen / remove_screen)

### `edit_elements` (~233 tokens)

Safely edit a screen's elements

Batch edit of a screen's `elements` list (or a declared state's list): insert, update, remove, move. The batch is atomic — a failing op refuses the whole batch and the file is untouched. Ops apply sequentially, so each op's index addresses the list as left by the previous ops (0-based; insert at list length appends; move's `to` is the final index). `update.set` patches only the given keys — an explicit null deletes a key, `x_` fields not named survive. An op introducing a `target` that matches no screen is refused, as is editing a state the screen does not declare. Pass `expect` so a stale index fails loudly instead of editing the wrong element. Writes the result back to the file (canonically formatted when format_output is true).

Input parameters:

- `file` (string, required): Path to the MAIAS document
- `format_output` (boolean): Write canonical form (default true)
- `ops` (array, required): Operations, applied in order, all-or-nothing
- `screen_id` (string, required): Screen whose elements are edited

### `wireframe` (~206 tokens)

Render an HTML wireframe board

Deterministic mobile wireframes from a MAIAS file: one self-contained HTML file (inline CSS, no JS, no external URLs) with one phone frame per screen, flows as rows, and click-through anchors between frames. Pass out to write the file (recommended — returns a summary); without out the raw HTML is returned as text (large). Refuses documents with validation errors (dangling targets become dead links) unless force is set.

Input parameters:

- `accent` (string): Hex accent colour (e.g. #0A84FF) replacing the default wireframe grey
- `file` (string, required): Path to the MAIAS document
- `flow` (string): Render only this flow
- `force` (boolean): Render despite validation errors
- `out` (string): Write the HTML here (e.g. <app>-wireframes.html); when absent the HTML is returned as text
- `states` (boolean): Also emit declared empty/loading/error variants as extra frames

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/maias-project-maias/maias-mcp#diagnostics

## Score history

- 2026-08-03: 66
- 2026-08-02: 62
- 2026-08-01: 19
- 2026-07-31: 19
- 2026-07-30: 26
- 2026-07-28: 26
- 2026-07-27: 26

## Links

- npm package: https://www.npmjs.com/package/@maias/mcp
- Socket report: https://socket.dev/npm/package/@maias/mcp
- Repository: https://github.com/MAIAS-project/maias
- Changelog RSS feed: https://verifymcp.io/servers/maias-project-maias/maias-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/maias-project-maias/maias-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/maias-project-maias/maias-mcp