md-feedback
NPM · MD-FEEDBACK · SCANNED SEP 20
Review markdown plans before AI agents build. Annotate, gate-check, apply fixes, session handoffs.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 96 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency35
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- License check failed: the license (SUL-1.0) isn't a recognized OSI-approved license. See how to fix → Fail
- Actively maintained (last published 181 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability75
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 2116 tokens (~78/item across 27 items; 27 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management90
- Stability observed for 27 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 27 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 27 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the md-feedback MCP server?
md-feedback runs locally as an npm package, launched with npx -y md-feedback. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · md-feedback
claude mcp add yeominux-md-feedback -- npx -y md-feedback
{
"mcpServers": {
"yeominux-md-feedback": {
"command": "npx",
"args": [
"-y",
"md-feedback"
]
}
}
} {
"servers": {
"yeominux-md-feedback": {
"command": "npx",
"args": [
"-y",
"md-feedback"
]
}
}
} codex mcp add yeominux-md-feedback -- npx -y md-feedback
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"yeominux-md-feedback": {
"type": "local",
"command": [
"npx",
"-y",
"md-feedback"
],
"enabled": true
}
}
} openclaw mcp add yeominux-md-feedback --command npx --arg -y --arg md-feedback
mcp_servers:
yeominux-md-feedback:
command: "npx"
args: ["-y", "md-feedback"] {
"McpServers": {
"yeominux-md-feedback": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"md-feedback"
]
}
}
} assistant mcp add yeominux-md-feedback -t stdio -c npx -a -y md-feedback
{
"mcpServers": {
"yeominux-md-feedback": {
"command": "npx",
"args": [
"-y",
"md-feedback"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
- 18 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 17 Sept 26 −3
- Stability: pass → 0.80 functional
- 16 Sept 26 +1
- Stability: 0.97 → pass security
- 13 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
- 11 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 10 Sept 26 −3
- Stability: pass → 0.80 functional
- 9 Sept 26 +1
- Stability: 0.97 → pass security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/md-feedback@1.5.6
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 96 packages
| Packages resolved | 96 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
advance_workflow_phase ~63
Advance workflow phase in strict sequence: scope -> root_cause -> implementation -> verification.
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | yes | Path to the annotated markdown file |
| note | string | – | Optional transition note |
| toPhase | string | yes | Next phase to move to |
No output schema declared.
No examples provided.
apply_memo ~290
Apply an implementation action to a memo. Supports text_replace (requires occurrence or replaceAll when oldText has multiple matches; optional section-scoped propagation), file_patch (applies unified diff patch — snapshot saved first), and file_create (create a new file). Creates a snapshot before modification, records the implementation, and updates memo status to needs_review.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Type of implementation action |
| content | string | – | For file_create: the file content to write |
| dryRun | boolean | – | If true, return preview without writing |
| file | string | yes | Path to the annotated markdown file |
| memoId | string | yes | The memo ID to apply implementation to |
| newText | string | – | For text_replace: the replacement text |
| occurrence | integer | – | For text_replace: which occurrence to replace (1-indexed). Required when oldText appears multiple times unless replaceAll=true |
| oldText | string | – | For text_replace: the text to find and replace |
| patch | string | – | For file_patch: unified diff patch content |
| replaceAll | boolean | – | For text_replace: replace all occurrences instead of one |
| scope | string | – | For text_replace: replacement scope (body = whole document body, section = heading section around memo anchor) |
| targetFile | string | – | For file_patch/file_create: target file path |
No output schema declared.
No examples provided.
approve_checkpoint ~68
Approve a pending high-risk checkpoint. Grants one execution for the approved tool.
| Name | Type | Req | Description |
|---|---|---|---|
| approvedBy | string | yes | Approver identity |
| file | string | yes | Path to the annotated markdown file |
| reason | string | yes | Approval rationale |
| tool | string | yes | Tool name being approved |
No output schema declared.
No examples provided.
batch_apply ~68
Apply multiple implementation operations in a single transaction. Parses the document once, applies all operations sequentially, then writes once. Each operation follows the same format as apply_memo.
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | yes | Path to the annotated markdown file |
| operations | array | yes | Array of operations to apply |
No output schema declared.
No examples provided.
create_annotation ~143
Create a new review annotation on a markdown file. Finds the anchor text in the document and attaches a review memo. Auto-creates a quality gate and updates cursor.
| Name | Type | Req | Description |
|---|---|---|---|
| anchorText | string | yes | The exact text in the document to annotate (must exist in the file) |
| file | string | yes | Path to the annotated markdown file |
| occurrence | integer | – | Which occurrence of anchorText to annotate (1-indexed, default 1). Use when the same text appears multiple times. |
| text | string | yes | The review feedback or note to attach |
| type | string | yes | fix = needs change, question = needs clarification, highlight = mark for reference |
No output schema declared.
No examples provided.
create_checkpoint ~59
Create a review checkpoint in an annotated markdown file. Records current annotation counts and reviewed sections.
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | yes | Path to the annotated markdown file |
| note | string | yes | Checkpoint note (e.g., "Phase 1 review done") |
No output schema declared.
No examples provided.
evaluate_gates ~43
Evaluate all gates in a markdown file against current memo statuses. Returns updated gate statuses without modifying the file.
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | yes | Path to the annotated markdown file |
No output schema declared.
No examples provided.
export_review ~92
Export review feedback in a format optimized for a specific AI coding tool. Targets: claude-code, cursor, codex, copilot, cline, windsurf, roo-code, gemini, antigravity, generic, handoff. Returns formatted markdown ready to save to the appropriate file.
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | yes | Path to the annotated markdown file |
| target | string | yes | Target AI tool format |
No output schema declared.
No examples provided.
generate_handoff ~61
Generate a structured handoff document from an annotated markdown file. Anti-compression format: explicit fields, numbers, lists only.
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | yes | Path to the annotated markdown file |
| target | string | – | Output format target (default: standalone) |
No output schema declared.
No examples provided.
get_checkpoints ~31
List all checkpoints in an annotated markdown file.
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | yes | Path to the annotated markdown file |
No output schema declared.
No examples provided.
get_document_structure ~78
Parse an annotated markdown file and return v0.4.0 ReviewDocument metadata. By default bodyMd is omitted to reduce context size; set includeBody=true only when full body is required.
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | yes | Path to the annotated markdown file |
| includeBody | boolean | – | Include full bodyMd content (larger payload) |
No output schema declared.
No examples provided.
get_memo_changes ~80
Get the implementation history and progress for a memo. Returns all MemoImpl records and progress entries from .md-feedback/progress.json. If memoId is omitted, returns all changes.
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | yes | Path to the annotated markdown file |
| memoId | string | – | Optional memo ID to filter by — if omitted, returns all changes |
No output schema declared.
No examples provided.
get_policy_status ~20
Return current runtime policy profile and memo-action routing rules.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_review_status ~65
Get current review session status: annotation counts, checkpoints, and reviewed sections. Summary-only — returns counts and metadata, not individual memos. Use list_annotations for memo details or get_document_structure for the full parse.
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | yes | Path to the annotated markdown file |
No output schema declared.
No examples provided.
get_severity_status ~36
Return memo severity overrides and unresolved blocking memo IDs for the document.
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | yes | Path to the annotated markdown file |
No output schema declared.
No examples provided.
get_workflow_status ~34
Return current workflow phase and transition history for a document.
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | yes | Path to the annotated markdown file |
No output schema declared.
No examples provided.
link_artifacts ~75
Link file artifacts (source files, configs, etc.) to a memo. Creates a MemoArtifact record in the document.
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | yes | Path to the annotated markdown file |
| files | array | yes | Array of relative file paths to link |
| memoId | string | yes | The memo ID to link artifacts to |
No output schema declared.
No examples provided.
list_annotations ~74
List all annotations (USER_MEMO comments) in a markdown file. Returns structured array with id, type, status, owner, text, and color. Lightweight — returns only memo data, no document body or sections. Use get_document_structure for the full parse.
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | yes | Path to the annotated markdown file |
No output schema declared.
No examples provided.
list_documents ~63
List markdown files in the workspace. Optionally filter to only files that already contain annotations.
| Name | Type | Req | Description |
|---|---|---|---|
| annotatedOnly | boolean | – | If true, return only files containing USER_MEMO/HIGHLIGHT_MARK annotations |
| maxFiles | integer | – | Maximum number of files to return |
No output schema declared.
No examples provided.
pickup_handoff ~42
Parse an existing handoff document to resume a review session. Returns structured data for session continuity.
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | yes | Path to the handoff markdown file |
No output schema declared.
No examples provided.
request_approval_checkpoint ~67
Create an approval checkpoint for a high-risk action before execution.
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | yes | Path to the annotated markdown file |
| reason | string | yes | Reason for approval request |
| tool | string | yes | High-risk tool name (e.g., batch_apply, rollback_memo) |
No output schema declared.
No examples provided.
respond_to_memo ~90
Add an AI response to a memo annotation. Inserts a REVIEW_RESPONSE block into the markdown file directly below the memo's anchor text. Automatically sets the memo status to "needs_review" for human approval.
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | yes | Path to the annotated markdown file |
| memoId | string | yes | The memo ID to respond to |
| response | string | yes | The response text (markdown supported) |
No output schema declared.
No examples provided.
rollback_memo ~72
Rollback the latest implementation for a memo. Reverses text_replace operations (swaps before/after), marks the impl as reverted, and sets the memo status back to open.
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | yes | Path to the annotated markdown file |
| memoId | string | yes | The memo ID to rollback |
No output schema declared.
No examples provided.
set_memo_severity ~67
Set severity override for a memo. Defaults remain: fix=blocking, question/highlight=non_blocking.
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | yes | Path to the annotated markdown file |
| memoId | string | yes | Memo ID to classify |
| severity | string | yes | Severity override |
No output schema declared.
No examples provided.
update_cursor ~98
Update the plan cursor position in a markdown file. The cursor tracks "where we are" in a plan. Only one cursor per document.
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | yes | Path to the annotated markdown file |
| nextAction | string | yes | Description of the next action to take |
| step | string | yes | Current step (e.g., "3/7" or "Phase 2") |
| taskId | string | yes | Current task ID |
No output schema declared.
No examples provided.
update_memo_progress ~120
Update the progress of a memo with a status change and message. Writes progress to .md-feedback/progress.json and updates the memo status. Terminal statuses (done, failed) require human approval via VS Code.
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | yes | Path to the annotated markdown file |
| memoId | string | yes | The memo ID to update progress for |
| message | string | yes | Progress message describing what was done or what failed |
| status | string | yes | New progress status. Terminal statuses (done, failed) require human approval via VS Code. |
No output schema declared.
No examples provided.
update_memo_status ~117
Update the status of a memo annotation. Writes the change back to the markdown file. Returns the updated memo. Terminal statuses (answered, done, failed, wontfix) require human approval via VS Code.
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | yes | Path to the annotated markdown file |
| memoId | string | yes | The memo ID to update |
| owner | string | – | Optionally change the owner |
| status | string | yes | New status. Terminal statuses (answered, done, failed, wontfix) require human approval via VS Code. |
No output schema declared.
No examples provided.
What is the md-feedback MCP server?
md-feedback is an MCP server listed in the public MCP registry as io.github.yeominux/md-feedback. Review markdown plans before AI agents build. Annotate, gate-check, apply fixes, session handoffs. This page covers its npm package (md-feedback).
Is the md-feedback MCP server safe to use?
md-feedback scores 81 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the md-feedback MCP server expose?
md-feedback exposes 27 tools: list_documents, get_policy_status, get_workflow_status, get_severity_status, get_checkpoints, and 22 more. Their descriptions and schemas cost roughly 2,116 tokens of context every time the server is loaded.
Is the md-feedback MCP server still maintained?
md-feedback is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the md-feedback MCP server under?
md-feedback declares the SUL-1.0 licence, which is not on the OSI-approved list. Read the terms before using it at work, and note this covers the source only, not the cost of any service it calls.