# io.github.RCOLKITT/ccboot-mcp-server (npm · ccboot-mcp-server)

Generate and manage Claude Code configs: CLAUDE.md, skills, agents, hooks, and MCP settings.

- Trust score: 59/100 (low)
- Change this week: +23
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `ccboot-mcp-server`: 59/100 (this document), [markdown](https://verifymcp.io/servers/rcolkitt-ccboot-mcp-server/ccboot-mcp-server.md), [page](https://verifymcp.io/servers/rcolkitt-ccboot-mcp-server/ccboot-mcp-server)

## Channel facts

- Registry: `npm`
- Package: `ccboot-mcp-server`
- Version: `1.0.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 86/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 19/100
  - Repository check failed: the declared repository URL returned HTTP 404.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (ISC).
  - Actively maintained (last published 147 days ago).
  - Security-disclosure policy not yet verified: we couldn't inspect the source repository.
- **Schema Quality & AI Usability**: 53/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 4383 tokens (~292/item across 15 items; 15 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add rcolkitt-ccboot-mcp-server -- npx -y ccboot-mcp-server
```

### Codex

```bash
codex mcp add rcolkitt-ccboot-mcp-server -- npx -y ccboot-mcp-server
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "rcolkitt-ccboot-mcp-server": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "ccboot-mcp-server"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add rcolkitt-ccboot-mcp-server --command npx --arg -y --arg ccboot-mcp-server
```

### Hermes

```yaml
mcp_servers:
  rcolkitt-ccboot-mcp-server:
    command: "npx"
    args: ["-y", "ccboot-mcp-server"]
```

### Other

```json
{
  "mcpServers": {
    "rcolkitt-ccboot-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "ccboot-mcp-server"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 59, +15)

- [security regression] Known CVEs: partial → unverified
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [functional regression] Dependency health: partial → unverified
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] Stability: unverified → 0.23

### 2026-08-01 (score 44, +32)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Schema quality: unverified → good
- [functional] Licence: ISC

### 2026-07-31 (score 12, −6)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-28 (score 18, −18)

- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified

### 2026-07-27 (score 36)

First indexed and scored.

## MCP tools (15)

### `ccboot_init_project` (~313 tokens)

Initialize Project

Full project bootstrap with deep project analysis. Reads package.json, Cargo.toml, go.mod, pom.xml, and other project manifests to generate perfectly tailored CLAUDE.md, .claude/ directory, settings.json with smart permissions, agents, .mcp.json, and .claudeignore.

The generated CLAUDE.md includes real build commands, actual dependencies, framework-specific architecture rules, and detected patterns — not generic templates.

Examples:
  ccboot_init_project({ project_path: '.', tech_stack: ['nextjs'], team_size: 5 })
  ccboot_init_project({ project_path: './api', tech_stack: ['fastapi'], team_size: 12, compliance: ['hipaa'] })
  ccboot_init_project({ project_path: '.', tech_stack: ['springboot'], team_size: 50, compliance: ['sox', 'soc2'] })

Returns: List of all generated files with descriptions.
Error handling: Returns actionable suggestions if project_path doesn't exist or isn't writable.

Input parameters:

- `compliance` (array): Compliance standards to apply
- `dry_run` (boolean): If true, show what would be generated without writing files
- `output_format` (string): Output format: 'markdown' for human-readable, 'json' for programmatic consumption
- `project_path` (string, required): Absolute or relative path to the project root directory
- `team_size` (integer, required): Number of developers on the team
- `tech_stack` (array, required): Technology stacks used in the project

### `ccboot_generate_claudemd` (~291 tokens)

Generate CLAUDE.md

Creates a deeply customized CLAUDE.md by analyzing your actual project. Reads package.json, detects frameworks, finds real build/test/lint commands, identifies ORMs, CSS frameworks, state management, auth libraries, and generates architecture rules specific to your stack.

The output reflects what your project actually IS — not a generic template.

Examples:
  ccboot_generate_claudemd({ project_path: '.', scope: 'root' })
  ccboot_generate_claudemd({ project_path: './apps/web', scope: 'subdir', merge_existing: true })
  ccboot_generate_claudemd({ project_path: '.', tech_stack: ['nextjs', 'express'] })

Returns: Path to generated file, detected stack summary, line count.
Error: Returns if no tech stack detected (suggests providing tech_stack parameter).

Input parameters:

- `dry_run` (boolean): If true, show what would be generated without writing files
- `merge_existing` (boolean): Whether to merge with an existing CLAUDE.md
- `output_format` (string): Output format: 'markdown' for human-readable, 'json' for programmatic consumption
- `project_path` (string, required): Absolute or relative path to the project root directory
- `scope` (string): Whether this is the root or subdirectory CLAUDE.md
- `tech_stack` (array): Tech stack override; auto-detected if omitted

### `ccboot_create_skill` (~375 tokens)

Create Skill

Scaffolds a production-ready skill in .claude/skills/<name>/ with SKILL.md containing valid YAML frontmatter. Skills are reusable AI capabilities — code review, test generation, documentation, security scanning, etc.

The YAML frontmatter controls behavior:
• invocation: 'user' (slash command), 'auto' (triggered by context), 'both'
• context: 'inline' (runs in main session), 'fork' (runs in subagent)
• allowed_tools: restricts which tools the skill can use

Examples:
  ccboot_create_skill({ name: 'code-review', description: 'Reviews code changes for quality and security', invocation: 'auto', context: 'fork', allowed_tools: ['Read', 'Grep', 'Glob'] })
  ccboot_create_skill({ name: 'db-migrate', description: 'Generates and applies database migrations', invocation: 'user', context: 'inline', allowed_tools: ['Read', 'Write', 'Bash'] })

Returns: Skill location, frontmatter summary, next steps.
Error: If skill name already exists (suggests different name).

Input parameters:

- `agent_type` (string): Agent type hint for forked skills
- `allowed_tools` (array): List of tools the skill can use
- `context` (string): Whether skill runs inline or in forked context
- `description` (string, required): Skill description (max 200 chars)
- `dry_run` (boolean): If true, show what would be generated without writing files
- `invocation` (string): How the skill is triggered
- `name` (string, required): Skill name (max 64 chars, lowercase with hyphens)
- `output_format` (string): Output format: 'markdown' for human-readable, 'json' for programmatic consumption

### `ccboot_create_agent` (~292 tokens)

Create Agent

Scaffolds a subagent definition in .claude/agents/. Subagents are specialized AI workers with restricted tool access and focused system prompts.

Built-in roles with smart defaults:
• explore: Read-only codebase investigation (Read, Grep, Glob)
• plan: Architecture planning without code changes (Read, Grep, Glob)
• general: Full-capability agent
• custom: Blank template for custom behavior

Examples:
  ccboot_create_agent({ name: 'security-auditor', description: 'Scans for OWASP vulnerabilities', role: 'explore' })
  ccboot_create_agent({ name: 'db-migrator', description: 'Plans and executes database migrations', role: 'general', allowed_tools: ['Read', 'Write', 'Bash'] })

Returns: Agent file path, role, next steps.
Error: If agent name already exists.

Input parameters:

- `allowed_tools` (array): Tools the agent can access
- `description` (string, required): Agent description
- `dry_run` (boolean): If true, show what would be generated without writing files
- `model_hint` (string): Preferred model hint
- `name` (string, required): Agent name (lowercase with hyphens)
- `output_format` (string): Output format: 'markdown' for human-readable, 'json' for programmatic consumption
- `role` (string): Agent role type

### `ccboot_create_hook` (~392 tokens)

Create Hook

Adds a lifecycle hook to .claude/settings.json. Hooks run shell commands in response to Claude Code events — format code after writes, lint changes, block dangerous commands, etc.

Supported events:
• PreToolCall: Before a tool executes (use to block or validate)
• PostToolCall: After a tool executes (use to format, lint, test)
• Notification: On status notifications
• Stop: When Claude stops generating
• SubagentStop: When a subagent stops
• PreCompact: Before context compaction
• PostCompact: After context compaction
• SessionStart: When a new session begins

Environment variables available: $TOOL_INPUT_COMMAND, $TOOL_INPUT_FILE_PATH, etc.

Examples:
  ccboot_create_hook({ event: "PostToolCall", matcher: "Write|Edit", command: 'npx prettier --write "$TOOL_INPUT_FILE_PATH"', exit_behavior: "notify", description: "Format on write" })
  ccboot_create_hook({ event: "PreToolCall", matcher: "Bash", command: 'echo "$TOOL_INPUT_COMMAND" | grep -qE "rm -rf|DROP TABLE" && exit 1', exit_behavior: "block", description: "Block dangerous commands" })

Returns: Hook details, updated settings path.
Idempotent: Re-running with same command+matcher updates the existing hook.

Input parameters:

- `command` (string, required): Shell command to execute
- `description` (string, required): Human-readable description of the hook
- `event` (string, required): Claude Code lifecycle event to hook into
- `exit_behavior` (string): What to do on non-zero exit
- `matcher` (string): Regex pattern to match (e.g., tool name for PreToolCall)
- `output_format` (string): Output format: 'markdown' for human-readable, 'json' for programmatic consumption

### `ccboot_create_command` (~307 tokens)

Create Command

Creates a slash command (e.g., /review, /deploy, /docs) as a skill with user invocation. Slash commands are the primary way teams standardize Claude Code workflows.

When a user types /command-name, Claude receives the prompt_body as instructions.

Examples:
  ccboot_create_command({ name: "review", description: "Review current changes", prompt_body: "Review the current git diff. Check for security issues, performance problems, and code quality. Output findings as Critical/Warning/Suggestion." })
  ccboot_create_command({ name: "deploy-check", description: "Pre-deploy checklist", prompt_body: "Run through the deployment checklist: 1. All tests pass 2. No TODO/FIXME in changed files 3. No console.log statements 4. Database migrations are reversible", arguments: [{ name: "env", description: "Target environment", required: true }] })

Returns: Slash command usage, file location.
Error: If command name already exists.

Input parameters:

- `arguments` (array): Arguments the command accepts
- `description` (string, required): Command description
- `dry_run` (boolean): If true, show what would be generated without writing files
- `name` (string, required): Command name (used as /command-name)
- `output_format` (string): Output format: 'markdown' for human-readable, 'json' for programmatic consumption
- `prompt_body` (string, required): The prompt template body for the command

### `ccboot_create_knowledge` (~299 tokens)

Create Knowledge Document

Adds a reference document to .claude/docs/ that Claude Code can use as context. Use this for ADRs, runbooks, API specs, data schemas, and style guides.

Knowledge documents give Claude deep domain context — the kind of information that turns generic AI suggestions into expert-level guidance specific to your system.

Categories:
• adr: Architecture Decision Records
• runbook: Operational procedures
• api: API documentation and contracts
• schema: Data model definitions
• style: Code style guides and conventions

Examples:
  ccboot_create_knowledge({ title: 'Payment Processing Flow', category: 'api', content: '## Overview\nPayments go through 3 stages...', tags: ['payments', 'stripe'] })
  ccboot_create_knowledge({ title: 'Incident Response', category: 'runbook', content: '## When PagerDuty fires...', tags: ['ops', 'oncall'] })

Returns: Document location, category, and tags.
Error: If document with same title already exists.

Input parameters:

- `category` (string, required): Document category
- `content` (string, required): Document content in markdown
- `dry_run` (boolean): If true, show what would be generated without writing files
- `output_format` (string): Output format: 'markdown' for human-readable, 'json' for programmatic consumption
- `tags` (array): Tags for categorization
- `title` (string, required): Document title

### `ccboot_create_adr` (~299 tokens)

Create ADR

Generates an Architecture Decision Record following the standard ADR template. ADRs are the most valuable knowledge documents for AI — they explain WHY architectural decisions were made, which prevents Claude from suggesting approaches that were already considered and rejected.

Auto-numbers ADRs sequentially (0001, 0002, etc.).

Examples:
  ccboot_create_adr({ title: 'Use PostgreSQL over MongoDB', status: 'accepted', context: 'We need ACID transactions for payment processing...', decision: 'Use PostgreSQL with Prisma ORM...', consequences: 'Must manage migrations, but get strong consistency...' })
  ccboot_create_adr({ title: 'Adopt tRPC for API layer', status: 'proposed', context: 'REST endpoints lack type safety across client/server boundary...', decision: 'Replace REST with tRPC...', consequences: 'Tight coupling to TypeScript, but eliminates entire class of bugs...' })

Returns: ADR number, file path, status.

Input parameters:

- `consequences` (string, required): Consequences of the decision
- `context` (string, required): Context and problem statement
- `decision` (string, required): The decision made
- `dry_run` (boolean): If true, show what would be generated without writing files
- `output_format` (string): Output format: 'markdown' for human-readable, 'json' for programmatic consumption
- `status` (string): Decision status
- `title` (string, required): ADR title

### `ccboot_list_artifacts` (~245 tokens)

List Artifacts

Lists all Claude Code configuration artifacts in the project with type, location, validation status, and issue details. Supports filtering by artifact type.

Artifact types discovered:
• claudemd: CLAUDE.md files (root and subdirectory)
• skill: Skills in .claude/skills/
• agent: Subagents in .claude/agents/
• hook: Hooks in .claude/settings.json
• knowledge: Docs in .claude/docs/
• mcp-config: .mcp.json configuration
• settings: .claude/settings.json

Examples:
  ccboot_list_artifacts({ project_path: '.' })
  ccboot_list_artifacts({ project_path: '.', type_filter: 'skill' })
  ccboot_list_artifacts({ project_path: '.', type_filter: 'hook' })

Returns: Formatted list with validation status per artifact.
Error: If project_path doesn't exist.

Input parameters:

- `output_format` (string): Output format: 'markdown' for human-readable, 'json' for programmatic consumption
- `project_path` (string, required): Absolute or relative path to the project root directory
- `type_filter` (string): Filter by artifact type

### `ccboot_validate_config` (~329 tokens)

Validate Configuration

Deep validation of all Claude Code configuration files. Catches real problems before they cause confusing behavior in Claude Code sessions.

Checks performed:
• CLAUDE.md: Exists, not empty, starts with heading, under 500 lines
• Skills: Valid YAML frontmatter, required 'name' and 'description' fields, name under 64 chars, description under 200 chars
• Settings: Valid JSON, proper hook structure
• .mcp.json: Valid JSON structure
• Agents: Files exist and are readable

auto_fix mode can repair:
• Trailing commas in JSON
• Missing frontmatter fields (adds placeholders)

CI mode (ci_mode: true):
• Forces JSON output format for machine readability
• Returns isError: true when validation fails (exit code 1 in CLI)
• Ideal for CI/CD pipelines and pre-commit hooks

Examples:
  ccboot_validate_config({ project_path: '.', fix_mode: 'report' })
  ccboot_validate_config({ project_path: '.', fix_mode: 'auto_fix' })
  ccboot_validate_config({ project_path: '.', ci_mode: true })

Returns: Validation report with errors, warnings, and applied fixes.

Input parameters:

- `ci_mode` (boolean): CI mode: returns isError=true on validation failures for CI/CD pipelines
- `fix_mode` (string): Whether to report issues or auto-fix them
- `output_format` (string): Output format: 'markdown' for human-readable, 'json' for programmatic consumption
- `project_path` (string, required): Absolute or relative path to the project root directory

### `ccboot_audit_context` (~178 tokens)

Audit Context Budget

Analyzes how much of Claude's context window your configuration artifacts consume. Every token spent on CLAUDE.md, skills, agents, and knowledge docs is a token NOT available for your actual code and conversation.

Budget guidelines:
• Skills should use < 2% of context window (~4,000 tokens)
• Total config should use < 5% (~10,000 tokens)
• Individual skills over 500 tokens should be trimmed

Examples:
  ccboot_audit_context({ project_path: '.' })

Returns: Token breakdown by category, budget percentage, specific warnings.
Read-only: Does not modify any files.

Input parameters:

- `output_format` (string): Output format: 'markdown' for human-readable, 'json' for programmatic consumption
- `project_path` (string, required): Absolute or relative path to the project root directory

### `ccboot_apply_compliance` (~291 tokens)

Apply Compliance Pack

Applies a compliance template pack to the project — generates hooks for audit logging, skills for compliance-aware code review, and CLAUDE.md sections with regulatory requirements.

Supported standards:
• hipaa: PHI handling, audit logging, encryption requirements, data classification
• soc2: Access controls, audit trails, change management, encryption
• pci-dss: Card number blocking, tokenization requirements, OWASP checks
• sox: Financial calculation review, audit trails, separation of duties

Scope options:
• full: Hooks + skills + CLAUDE.md section
• hooks_only: Just audit/blocking hooks
• skills_only: Just compliance review skills

Examples:
  ccboot_apply_compliance({ project_path: '.', standard: 'hipaa', scope: 'full' })
  ccboot_apply_compliance({ project_path: '.', standard: 'soc2', scope: 'hooks_only' })

Idempotent: Safe to run multiple times — won't duplicate hooks.

Input parameters:

- `dry_run` (boolean): If true, show what would be generated without writing files
- `output_format` (string): Output format: 'markdown' for human-readable, 'json' for programmatic consumption
- `project_path` (string, required): Absolute or relative path to the project root directory
- `scope` (string): Scope of compliance artifacts
- `standard` (string, required): Compliance standard to apply

### `ccboot_create_ci_workflow` (~256 tokens)

Create CI Workflow

Generates a GitHub Actions workflow that enables Claude Code to review pull requests. Creates a .github/workflows/claude-review.yml file that triggers on PRs and @claude mentions.

Review focus options:
• security: OWASP vulnerabilities, auth issues, data exposure
• performance: N+1 queries, memory leaks, bundle size
• style: Code conventions, naming, organization
• all: Comprehensive review covering all areas

Examples:
  ccboot_create_ci_workflow({ repo_path: '.', review_focus: 'all', branch_pattern: 'main' })
  ccboot_create_ci_workflow({ repo_path: '.', review_focus: 'security', branch_pattern: 'develop' })

Requires: ANTHROPIC_API_KEY in repository secrets.
Idempotent: Updates existing workflow if present.

Input parameters:

- `branch_pattern` (string): Branch pattern to trigger on
- `dry_run` (boolean): If true, show what would be generated without writing files
- `output_format` (string): Output format: 'markdown' for human-readable, 'json' for programmatic consumption
- `repo_path` (string, required): Path to the git repository
- `review_focus` (string): Focus area for reviews

### `ccboot_create_security_hook` (~256 tokens)

Create Security Hooks

Generates a comprehensive security hook system that blocks dangerous commands and detects secret leaks before they happen. Creates a blocker script and hooks it into Claude Code's PreToolCall lifecycle.

Strictness levels:
• standard: Blocks rm -rf, force push, DROP TABLE, TRUNCATE (8 patterns)
• strict: + git reset --hard, chmod 777, curl|sh, wget|sh (13 patterns)
• paranoid: + eval(), exec(), sudo, su, pkill, killall (19 patterns)

Also detects secret patterns: AWS keys, API keys, GitHub tokens, private keys.

Examples:
  ccboot_create_security_hook({ project_path: '.', strictness: 'standard' })
  ccboot_create_security_hook({ project_path: '.', strictness: 'paranoid' })

Idempotent: Updates existing security hook if present.

Input parameters:

- `dry_run` (boolean): If true, show what would be generated without writing files
- `output_format` (string): Output format: 'markdown' for human-readable, 'json' for programmatic consumption
- `project_path` (string, required): Absolute or relative path to the project root directory
- `strictness` (string): Security strictness level

### `ccboot_generate_mcp_config` (~260 tokens)

Generate MCP Config

Creates a .mcp.json file with pre-configured MCP server entries for your services. Each entry includes the correct npx command and environment variable placeholders.

Supported services: github, sentry, postgres, slack, linear, jira, datadog, pagerduty, vercel, supabase

Scope:
• project: Creates .mcp.json in project root (team-shared)
• user: Creates in ~/.claude/.mcp.json (personal)

Examples:
  ccboot_generate_mcp_config({ project_path: '.', services: ['github', 'slack'], scope: 'project' })
  ccboot_generate_mcp_config({ project_path: '.', services: ['github', 'sentry', 'postgres'], scope: 'project' })

Returns: Config file location, list of configured services, next steps.

Input parameters:

- `dry_run` (boolean): If true, show what would be generated without writing files
- `output_format` (string): Output format: 'markdown' for human-readable, 'json' for programmatic consumption
- `project_path` (string, required): Absolute or relative path to the project root directory
- `scope` (string): Configuration scope
- `services` (array, required): MCP services to configure

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/rcolkitt-ccboot-mcp-server/ccboot-mcp-server#diagnostics

## Score history

- 2026-08-03: 59
- 2026-08-02: 59
- 2026-08-01: 44
- 2026-07-31: 12
- 2026-07-30: 18
- 2026-07-28: 18
- 2026-07-27: 36

## Links

- npm package: https://www.npmjs.com/package/ccboot-mcp-server
- Socket report: https://socket.dev/npm/package/ccboot-mcp-server
- Changelog RSS feed: https://verifymcp.io/servers/rcolkitt-ccboot-mcp-server/ccboot-mcp-server/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/rcolkitt-ccboot-mcp-server/ccboot-mcp-server/changelog.json
- HTML version of this page: https://verifymcp.io/servers/rcolkitt-ccboot-mcp-server/ccboot-mcp-server