# Context Engine (npm · @sham-sundar-senthil-kumar/mcp-server)

Local-first persistent context memory MCP server for AI coding agents.

- Trust score: 56/100 (low)
- Change this week: +56
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

> **Recent critical change**: CVE-2026-41242 affects this package (2026-10-22). See the changelog below before you install this server.

## Components

- npm · `@sham-sundar-senthil-kumar/mcp-server`: 56/100 (this document), [markdown](https://verifymcp.io/servers/shamsundarsk-mcp-server/sham-sundar-senthil-kumar-mcp-server.md), [page](https://verifymcp.io/servers/shamsundarsk-mcp-server/sham-sundar-senthil-kumar-mcp-server)

## Channel facts

- Registry: `npm`
- Package: `@sham-sundar-senthil-kumar/mcp-server`
- Version: `0.1.4`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Supply Chain Security**: 80/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known high-severity CVE affects @modelcontextprotocol/sdk 0.6.1, a direct dependency. A fixed version is available.
  - No install/post-install scripts declared.
  - 53 of 137 dependencies flagged as unhealthy (2 deprecated).
- **Provenance & Transparency**: 32/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - License check failed: no license is declared.
  - Actively maintained (last published 15 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 70/100
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 659 tokens (~73/item across 9 items; 9 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 75/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "merge" implies "merge" and declares no destructiveHint at all, which the MCP spec reads as destructive by default.
  - An AI judge read all 9 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 20/100
  - Spec-recency check failed: implements MCP spec 2024-11-05; the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### How do I install the Context Engine MCP server?

Context Engine runs locally as an npm package, launched with npx -y @sham-sundar-senthil-kumar/mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add shamsundarsk-mcp-server -- npx -y @sham-sundar-senthil-kumar/mcp-server
```

### Cursor

```json
{
  "mcpServers": {
    "shamsundarsk-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@sham-sundar-senthil-kumar/mcp-server"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "shamsundarsk-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@sham-sundar-senthil-kumar/mcp-server"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add shamsundarsk-mcp-server -- npx -y @sham-sundar-senthil-kumar/mcp-server
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "shamsundarsk-mcp-server": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@sham-sundar-senthil-kumar/mcp-server"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add shamsundarsk-mcp-server --command npx --arg -y --arg @sham-sundar-senthil-kumar/mcp-server
```

### Hermes

```yaml
mcp_servers:
  shamsundarsk-mcp-server:
    command: "npx"
    args: ["-y", "@sham-sundar-senthil-kumar/mcp-server"]
```

### Netclaw

```json
{
  "McpServers": {
    "shamsundarsk-mcp-server": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "@sham-sundar-senthil-kumar/mcp-server"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add shamsundarsk-mcp-server -t stdio -c npx -a -y @sham-sundar-senthil-kumar/mcp-server
```

### Other

```json
{
  "mcpServers": {
    "shamsundarsk-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@sham-sundar-senthil-kumar/mcp-server"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-05 (score 56, +56)

- [security regression] CVE-2026-114113 affects this package: high
- [security regression] CVE-2026-44294 affects this package: high
- [security regression] CVE-2026-44289 affects this package: high
- [security regression] CVE-2026-44292 affects this package: high
- [security regression] CVE-2026-44288 affects this package: high
- [security regression] CVE-2026-114111 affects this package: high
- [security regression] CVE-2026-45740 affects this package: high
- [security regression] CVE-2025-66414 affects this package: high
- [security regression] CVE-2026-44291 affects this package: high
- [security regression] CVE-2026-54269 affects this package: high
- [security regression] CVE-2026-44293 affects this package: high
- [security regression] CVE-2026-111769 affects this package: high
- [security regression] CVE-2023-54404 affects this package: high
- [security regression] CVE-2026-48712 affects this package: high
- [security regression] CVE-2026-44290 affects this package: high
- [security regression] CVE-2026-114112 affects this package: high
- [security improvement] CVE-2026-41242 no longer affects this package
- [security] Known CVEs: CVE check failed: a known high-severity CVE affects @modelcontextprotocol/sdk 0.6.1, a direct dependency. A fixed version is available.
- [functional improvement] Score status: failed → scored

### 2026-10-22 (score 0, −36)

- [critical regression] CVE-2026-41242 affects this package: high
- [critical regression] Known CVEs: unverified → fail
- [critical regression] Score status: scored → failed
- [security improvement] CVE-2026-111769 no longer affects this package
- [security improvement] CVE-2025-66414 no longer affects this package
- [security improvement] Malware scan: unverified → pass
- [functional improvement] Dependency health: unverified → 0.81

### 2026-10-21 (score 36, +20)

- [security regression] Known CVEs: fail → unverified
- [security improvement] Injection markers: unverified → pass
- [security] First check of Judged manipulation: pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional regression] MCP protocol: unverified → fail
- [functional regression] Dependency health: partial → unverified
- [functional improvement] Tool coverage: unverified → 100
- [functional] First check of Schema quality: fail
- [functional] First check of Destructive annotations: 0
- [functional] First check of Schema quality: pass
- [functional] First check of Schema quality: good
- [functional] First check of Tool coverage: 100
- [functional] Package version: 0.1.2 → 0.1.4

### 2026-10-20 (score 16)

First indexed and scored.

## MCP tools (9)

### `gather_context` (~61 tokens)

MANDATORY ON NEW CHAT OR CONTEXT RESET: Reconstructs and retrieves bounded context memory (rolling summary and all preserved architectural facts) from previous sessions.

Input parameters:

- `session_id` (string): Optional session ID to gather context from. Defaults to active project session.

### `get_context_tree` (~52 tokens)

Outputs a highly structured, clean markdown visual text graph tree of all active branches, commits, and memory states straight to the chat view.

Input parameters:

- `session_id` (string): Optional session ID to inspect memory tree for.

### `override_memory_node` (~138 tokens)

Power user tool to target an exact node in the SQLite history graph and forcibly overwrite its text content, completely pruning out incorrect details or debug junk.

Input parameters:

- `commit_id` (string, required): The exact commit ID in the memory graph to overwrite
- `kept_chunks` (array): Optional list of verified permanent facts to retain
- `new_summary` (string, required): New summary text replacing the original reason log
- `new_topic` (string): Optional new topic title
- `prune_transient` (boolean): If true, automatically deletes all transient logs and discarded chunks for this node (default: true)
- `session_id` (string): Optional session ID

### `observe_turn` (~94 tokens)

Autonomous background observer: Records conversation turn history, runs dual-tier triage, and auto-commits compressed state every 5-10 turns.

Input parameters:

- `content` (string, required): Turn message text to observe and buffer
- `role` (string): Role of the message sender
- `session_id` (string): Optional session ID
- `workspace_path` (string): Optional workspace path to trigger auto-branching on directory shifts

### `recall` (~57 tokens)

Recall previous commits and context facts for a given query

Input parameters:

- `query` (string, required): Keyword or topic query to search context history
- `scope` (string): Search active branch or all branches
- `session_id` (string): Optional session ID

### `commit` (~74 tokens)

Record key architectural decision, bug fix, or findings into context graph

Input parameters:

- `kept_refs` (array, required): Critical code snippets or facts to keep verbatim
- `session_id` (string): Optional session ID
- `summary` (string, required): Plain language explanation of the decision or finding
- `topic` (string, required): Brief topic label

### `branch` (~79 tokens)

Create a new branch or switch to an existing branch by name. If the branch already exists, it switches to it cleanly without modifying history.

Input parameters:

- `from_commit` (string): Optional starting commit ID for new branches only
- `name` (string, required): Name of the branch to create or switch to
- `session_id` (string): Optional session ID

### `merge` (~63 tokens)

Merge a feature context branch into target branch (defaults to main)

Input parameters:

- `session_id` (string): Optional session ID
- `source_branch` (string, required): Source branch name to merge from
- `target_branch` (string): Target branch name to merge into (defaults to main)

### `checkout` (~41 tokens)

Roll back context memory to a previous commit ID

Input parameters:

- `commit_id` (string, required): Target commit ID to checkout
- `session_id` (string): Optional session ID

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/shamsundarsk-mcp-server/sham-sundar-senthil-kumar-mcp-server#diagnostics

## Score history

- 2026-11-05: 56
- 2026-11-04: 0
- 2026-11-03: 0
- 2026-11-02: 0
- 2026-11-01: 0
- 2026-10-31: 0
- 2026-10-30: 0
- 2026-10-29: 0
- 2026-10-28: 0
- 2026-10-27: 0
- 2026-10-26: 0
- 2026-10-25: 0
- 2026-10-24: 0
- 2026-10-23: 0
- 2026-10-22: 0
- 2026-10-21: 36
- 2026-10-20: 16

## Common questions

### What is the Context Engine MCP server?

Context Engine is an MCP server listed in the public MCP registry as io.github.shamsundarsk/mcp-server. Local-first persistent context memory MCP server for AI coding agents. This page covers its npm package (@sham-sundar-senthil-kumar/mcp-server).

### Is the Context Engine MCP server safe to use?

Context Engine scores 56 out of 100 on VerifyMCP. We recorded 16 known advisories against it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Context Engine MCP server expose?

Context Engine exposes 9 tools: gather_context, get_context_tree, override_memory_node, observe_turn, recall, and 4 more. Their descriptions and schemas cost roughly 659 tokens of context every time the server is loaded.

### Is the Context Engine MCP server still maintained?

Context Engine is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- npm package: https://www.npmjs.com/package/@sham-sundar-senthil-kumar/mcp-server
- Socket report: https://socket.dev/npm/package/@sham-sundar-senthil-kumar/mcp-server
- Repository: https://github.com/shamsundarsk/contextengine-
- Changelog RSS feed: https://verifymcp.io/servers/shamsundarsk-mcp-server/sham-sundar-senthil-kumar-mcp-server.xml
- Changelog JSON feed: https://verifymcp.io/servers/shamsundarsk-mcp-server/sham-sundar-senthil-kumar-mcp-server.json
- HTML version of this page: https://verifymcp.io/servers/shamsundarsk-mcp-server/sham-sundar-senthil-kumar-mcp-server