io.github.tosin2013/mcp-adr-analysis-server
NPM · MCP-ADR-ANALYSIS-SERVER
ADR drift detection, content safety, and decision memory for architectural decisions
Available components
Last scanned (2 hours ago)
Scores higher than 99% of npm servers
Category Developer Tools
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security99
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 42 of 133 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to tosin2013/mcp-adr-analysis-server). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 7 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability81
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 9397 tokens (~105/item across 89 items; 63 tools + 26 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 99% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 63 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 64 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 31 Oct 26 0
- Stability: 0.97 → pass security
- 30 Oct 26 0
- Stability: pass → 0.97 functional
- 29 Oct 26 +57
- Injection markers: unverified → pass ▲ security
- Known CVEs: unverified → pass ▲ security
- Stability: unverified → pass ▲ security
- Tool coverage: unverified → 100 ▲ functional
- Schema quality: unverified → 100 ▲ functional
- Dependency health: unverified → 0.88 ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Package version: 2.14.13 → 2.14.19 functional
- 28 Oct 26 −57
- Known CVEs: pass → unverified ▼ security
- Stability: pass → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Dependency health: 0.88 → unverified ▼ functional
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: 100 → unverified ▼ functional
- Package version: 2.14.13 → 2.14.19 functional
- Package version: 2.14.13 → 2.14.16 functional
- 24 Oct 26 0
- CVE-2026-93687 no longer affects this package ▲ security
- Known CVEs: partial → pass ▲ security
- Stability: 0.97 → pass security
- 23 Oct 26 0
- Stability: pass → 0.97 functional
- 17 Oct 26 0
- Stability: 0.97 → pass security
- 16 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed npm/mcp-adr-analysis-server@2.14.19
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | tosin2013/mcp-adr-analysis-server |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/tosin2013/mcp-adr-analysis-server/.github/workflows/publish.yml@refs/tags/v2.14.19 |
| Rekor log index | 3546934480 |
| Predicate type | SLSA build provenance https://slsa.dev/provenance/v1 |
| Subject digest | sha512:1f22341ec5816c65d1c7c3d48b1ff23c12e4ed8d3de50debbec6fec3e47f472f1ca1ab5cad093f29141ec307215b1a6f947d25bf47398e9000d450330 |
Background: How many MCP packages publish verified provenance →
Dependencies 133 packages
| Packages resolved | 133 |
|---|---|
| Stale | 42 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
smart_git_push ~166
AI-driven security-focused git push with credential detection, file filtering, and deployment metrics tracking. Tests should be run by calling AI and results provided.
| Name | Type | Req | Description |
|---|---|---|---|
| branch | string | – | Target branch for push (optional, uses current branch if not specified) |
| dryRun | boolean | – | Show what would be pushed without actually pushing |
| forceUnsafe | boolean | – | Override security blocks and test failures (DANGEROUS) |
| message | string | – | Commit message (optional, commits staged files if provided) |
| projectPath | string | – | Path to project directory (defaults to current working directory) |
| skipSecurity | boolean | – | Skip security scanning (NOT RECOMMENDED) |
| testResults | object | – | Test results from AI-executed tests (required for proper deployment tracking) |
No output schema declared.
No examples provided.
smart_score ~343
Central coordination for project health scoring system - recalculate, sync, diagnose, optimize, and reset scores across all MCP tools
| Name | Type | Req | Description |
|---|---|---|---|
| analysisMode | string | – | Method for weight optimization (for optimize_weights operation) |
| checkDataFreshness | boolean | – | Validate data freshness across tools (for diagnose_scores operation) |
| component | string | – | Score component to reset (for reset_scores operation) |
| components | array | – | Score components to recalculate (for recalculate_scores operation) |
| customWeights | object | – | Custom weight overrides (for optimize_weights operation) |
| forceUpdate | boolean | – | Force update even if data is fresh |
| includeHistory | boolean | – | Include score history analysis (for diagnose_scores operation) |
| intentId | string | – | Intent ID to get score trends for (for get_intent_scores operation) |
| operation | string | yes | Smart scoring operation to perform |
| preserveHistory | boolean | – | Preserve score history in backup (for reset_scores operation) |
| previewOnly | boolean | – | Preview changes without applying (for optimize_weights operation) |
| projectPath | string | yes | Path to project directory |
| rebalanceWeights | boolean | – | Recalculate optimal scoring weights (for sync_scores operation) |
| recalculateAfterReset | boolean | – | Immediately recalculate after reset (for reset_scores operation) |
| suggestImprovements | boolean | – | Provide score improvement suggestions (for diagnose_scores operation) |
| todoPath | string | – | Path to TODO.md file (for sync_scores operation) |
| triggerTools | array | – | Tools to trigger for fresh data (for sync_scores operation) |
| updateSources | boolean | – | Trigger source tool updates before recalculating |
No output schema declared.
No examples provided.
suggest_adrs ~226
Suggest architectural decisions with advanced prompting techniques (Knowledge Generation + Reflexion). TIP: Read @.mcp-server-context.md first for project history, patterns, and previous ADRs to ensure consistency.
| Name | Type | Req | Description |
|---|---|---|---|
| afterCode | string | – | Code after changes (for code_changes analysis) |
| analysisType | string | – | Type of analysis to perform |
| beforeCode | string | – | Code before changes (for code_changes analysis) |
| changeDescription | string | – | Description of the changes (for code_changes analysis) |
| commitMessages | array | – | Related commit messages (for code_changes analysis) |
| conversationContext | object | – | Rich context from the calling LLM about user goals and discussion history |
| enhancedMode | boolean | – | Enable advanced prompting features (Knowledge Generation + Reflexion) |
| existingAdrs | array | – | List of existing ADR titles to avoid duplication |
| knowledgeEnhancement | boolean | – | Enable Knowledge Generation for domain-specific insights |
| learningEnabled | boolean | – | Enable Reflexion learning from past experiences |
| projectPath | string | – | Path to the project directory |
No output schema declared.
No examples provided.
sync_to_aggregator ~173
Sync ADRs to ADR Aggregator platform (https://adraggregator.com) for centralized tracking, visualization, and team collaboration. Supports incremental and full sync modes with optional metadata.
| Name | Type | Req | Description |
|---|---|---|---|
| adr_paths | array | – | Specific ADR paths to sync (syncs all if not provided) |
| full_sync | boolean | – | Replace all ADRs instead of incremental sync |
| include_code_links | boolean | – | Include AST-based code links (Pro+ tier) |
| include_diagrams | boolean | – | Include Mermaid diagrams (Pro+ tier) |
| include_metadata | boolean | – | Include analysis metadata in sync |
| include_security_scan | boolean | – | Include security scan results |
| include_timeline | boolean | – | Include timeline/staleness data |
| projectPath | string | – | Project path (defaults to PROJECT_PATH) |
No output schema declared.
No examples provided.
tool_chain_orchestrator ~119
AI-powered dynamic tool sequencing - intelligently analyze user requests and generate structured tool execution plans
| Name | Type | Req | Description |
|---|---|---|---|
| allowParallel | boolean | – | Allow parallel execution of independent steps |
| availableTools | array | – | List of available MCP tools to orchestrate |
| contextHints | array | – | Additional context hints for better plan generation |
| executionMode | string | – | Orchestration mode |
| maxSteps | number | – | Maximum number of steps in the execution plan |
| userRequest | string | yes | User request to analyze and create tool execution plan for |
No output schema declared.
No examples provided.
troubleshoot_guided_workflow ~181
Structured failure analysis and test plan generation with memory integration for troubleshooting session tracking and intelligent ADR/research suggestion capabilities - provide JSON failure info to get specific test commands
| Name | Type | Req | Description |
|---|---|---|---|
| adrDirectory | string | – | ADR directory path |
| enableAdrSuggestion | boolean | – | Enable automatic ADR suggestion based on recurring failures |
| enableMemoryIntegration | boolean | – | Enable memory entity storage for troubleshooting session tracking and pattern recognition |
| enablePatternRecognition | boolean | – | Enable automatic pattern recognition and failure classification |
| enableResearchGeneration | boolean | – | Enable automatic research question generation for persistent problems |
| failure | object | – | Structured failure information (required for analyze_failure and generate_test_plan) |
| operation | string | yes | Type of troubleshooting operation |
| projectPath | string | – | Path to project directory (optional) |
| todoPath | string | – | Path to TODO.md file |
No output schema declared.
No examples provided.
update_implementation_status ~72
Update the implementation status of synced ADRs directly from the IDE. Supports statuses: not_started, in_progress, implemented, deprecated, blocked. Requires Pro+ tier.
| Name | Type | Req | Description |
|---|---|---|---|
| projectPath | string | – | Project path (defaults to PROJECT_PATH) |
| updates | array | yes | Array of ADR status updates to apply |
No output schema declared.
No examples provided.
update_knowledge ~170
ADR-018: Simple CRUD operations for project session state. Not a graph database — keyword retrieval over local JSON snapshots. Add/remove entities (intents, ADRs, tools, code) and relationships. Use knowledge://graph resource to read current state (zero token cost).
| Name | Type | Req | Description |
|---|---|---|---|
| entity | string | – | Entity ID (for add_entity/remove_entity operations) |
| entityType | string | – | Type of entity (required for add_entity operation) |
| metadata | object | – | Additional metadata for the entity or relationship |
| operation | string | yes | Type of operation to perform on project session state |
| relationship | string | – | Relationship type (for add_relationship/remove_relationship) |
| source | string | – | Source node ID (for relationship operations) |
| target | string | – | Target node ID (for relationship operations) |
No output schema declared.
No examples provided.
validate_adr ~115
Validate an existing ADR against actual infrastructure reality using research-driven analysis. TIP: Compare findings against patterns in @.mcp-server-context.md for consistency checks.
| Name | Type | Req | Description |
|---|---|---|---|
| adrDirectory | string | – | Directory containing ADR files |
| adrPath | string | yes | Path to the ADR file to validate (relative or absolute) |
| confidenceThreshold | number | – | Minimum research confidence threshold (0-1) |
| includeEnvironmentCheck | boolean | – | Include live environment verification in validation |
| projectPath | string | – | Path to the project directory |
No output schema declared.
No examples provided.
validate_adr_compliance ~75
Validate ADR compliance against implementation via ADR Aggregator. Checks that code actually implements documented decisions. Requires Pro+ tier.
| Name | Type | Req | Description |
|---|---|---|---|
| adr_paths | array | – | Specific ADR paths to validate |
| projectPath | string | – | Project path (defaults to PROJECT_PATH) |
| validation_type | string | – | Type of validation to perform |
No output schema declared.
No examples provided.
validate_all_adrs ~79
Validate all ADRs in a directory against actual infrastructure reality
| Name | Type | Req | Description |
|---|---|---|---|
| adrDirectory | string | – | Directory containing ADR files |
| includeEnvironmentCheck | boolean | – | Include live environment verification in validation |
| minConfidence | number | – | Minimum research confidence for validation (0-1) |
| projectPath | string | – | Path to the project directory |
No output schema declared.
No examples provided.
validate_content_masking ~41
Validate that content masking was applied correctly
| Name | Type | Req | Description |
|---|---|---|---|
| maskedContent | string | yes | Content after masking |
| originalContent | string | yes | Original content before masking |
No output schema declared.
No examples provided.
validate_rules ~97
Validate code against architectural rules
| Name | Type | Req | Description |
|---|---|---|---|
| fileContent | string | – | Content to validate (alternative to filePath) |
| fileName | string | – | Name of file being validated (when using fileContent) |
| filePath | string | – | Path to file to validate |
| reportFormat | string | – | Format for validation report |
| rules | array | yes | Rules to validate against |
| validationType | string | – | Type of validation to perform |
No output schema declared.
No examples provided.
How do I install the io.github.tosin2013/mcp-adr-analysis-server server?
io.github.tosin2013/mcp-adr-analysis-server runs locally as an npm package, launched with npx -y mcp-adr-analysis-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · mcp-adr-analysis-server
claude mcp add tosin2013-mcp-adr-analysis-server -- npx -y mcp-adr-analysis-server
What is the io.github.tosin2013/mcp-adr-analysis-server server?
io.github.tosin2013/mcp-adr-analysis-server is listed in the public MCP registry as io.github.tosin2013/mcp-adr-analysis-server. ADR drift detection, content safety, and decision memory for architectural decisions. This page covers its npm package (mcp-adr-analysis-server).
Is the io.github.tosin2013/mcp-adr-analysis-server server safe to use?
io.github.tosin2013/mcp-adr-analysis-server scores 96 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.tosin2013/mcp-adr-analysis-server server expose?
io.github.tosin2013/mcp-adr-analysis-server exposes 63 tools: analyze_project_ecosystem, get_architectural_context, generate_adrs_from_prd, compare_adr_progress, analyze_content_security, and 58 more. Their descriptions and schemas cost roughly 8,644 tokens of context every time the server is loaded.
Is the io.github.tosin2013/mcp-adr-analysis-server server still maintained?
io.github.tosin2013/mcp-adr-analysis-server is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.tosin2013/mcp-adr-analysis-server server under?
io.github.tosin2013/mcp-adr-analysis-server declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.