← MCP Security Catalog

logicstamp-mcp 0.2.4

npm · logicstamp-mcp · latest release

Confirmed vulnerable
Security result
7
Observed tools
43
Version rating
—
Change risk

Independent inventory

Observed 2026-08-22T08:04:30.497Z using mcpSecurity-inventory. Protocol 2025-06-18.

ToolCategoryRisk
logicstamp_compare_modesGenerates token cost comparison across all modes (none/header/header+style/full) to help choose optimal mode. Executes `stamp context --compare-modes --stats` and returns token counts (GPT-4o-mini/Claude), savings vs raw source (~70% for header) and vs full context, file stats. Modes: none (~79% savings), header (~65%, recommended), header+style (~52%), full (no savings). Use before generating context, when user asks about token budgets, or to evaluate style metadata impact. Performance: Takes 2-3x longer (regenerates with/without style for accuracy).
Input schema
{
  "type": "object",
  "properties": {
    "projectPath": {
      "type": "string",
      "description": "Absolute path to project root (default: current working directory)"
    },
    "cleanCache": {
      "type": "boolean",
      "description": "Manually force cleanup of .logicstamp cache folder. Default: false (auto-detects corruption/mismatch). Set to true to force cache reset. Use only when experiencing cache-related issues.",
      "default": false
    }
  }
}
——
logicstamp_compare_snapshotCompares current snapshot with baseline to detect changes. Reads context_main.json and folder context.json files. Detects: ADDED/REMOVED/CHANGED/UNCHANGED folders/components (props, hooks, imports, semantic hash changes). Returns structured diff with token deltas. Use after editing files to verify changes (like Jest snapshots - detects contract drift, not just file changes). Default (forceRegenerate=false): Reads from disk (fast, assumes fresh). Set forceRegenerate=true to regenerate before comparing. Style: Set includeStyle=true (with forceRegenerate=true) to include style metadata. Depth: Set depth when forceRegenerate=true (default=2 nested, 1=direct only). Baseline: "disk" (current snapshot, default), "snapshot" (stored), or "git:<ref>" (future). Error: If context_main.json missing and forceRegenerate=false, fails - run refresh_snapshot first or use forceRegenerate=true.
Input schema
{
  "type": "object",
  "properties": {
    "profile": {
      "type": "string",
      "enum": [
        "llm-chat",
        "llm-safe",
        "ci-strict"
      ],
      "description": "Analysis profile (only used if forceRegenerate: true). llm-chat=balanced (default), llm-safe=conservative, ci-strict=contracts only",
      "default": "llm-chat"
    },
    "mode": {
      "type": "string",
      "enum": [
        "header",
        "full",
        "none"
      ],
      "description": "Code inclusion mode (only used if forceRegenerate: true). none=contracts only, header=contracts+JSDoc (default), full=complete source",
      "default": "header"
    },
    "includeStyle": {
      "type": "boolean",
      "description": "Include style metadata in comparison (only takes effect when forceRegenerate: true). Extracts Tailwind classes, SCSS, layout patterns, colors, spacing, animations. If forceRegenerate is false, compares whatever is on disk (may not have style metadata).",
      "default": false
    },
    "depth": {
      "type": "number",
      "description": "Dependency traversal depth. Default: 2 (includes nested components, e.g., App → Hero → Button). Set to 1 for direct dependencies only (e.g., App → Hero). Only used when forceRegenerate: true.",
      "default": 2
    },
    "forceRegenerate": {
      "type": "boolean",
      "description": "Force regeneration before comparing. When true, runs `stamp context` (with --include-style if includeStyle is true) to generate fresh context files. When false, reads existing context_main.json from disk (fast, assumes context is fresh).",
      "default": false
    },
    "projectPath": {
      "type": "string",
      "description": "Absolute path to project root (default: current working directory)"
    },
    "baseline": {
      "type": "string",
      "description": "Comparison baseline: \"disk\" (current snapshot, default), \"snapshot\" (stored snapshot), or \"git:<ref>\" (future: git baseline)",
      "default": "disk"
    },
    "cleanCache": {
      "type": "boolean",
      "description": "Manually force cleanup of .logicstamp cache folder. Default: false (auto-detects corruption/mismatch). Set to true to force cache reset. Use only when experiencing cache-related issues.",
      "default": false
    }
  }
}
——
logicstamp_list_bundles⚠️ CRITICAL: Do NOT use sleep() delays before calling this tool. When watch mode is active, bundles are already fresh - call this tool directly without any waiting. Lists all ROOT bundles from context_main.json. Returns bundle catalog (component names, file paths, bundle paths, token estimates). IMPORTANT: LogicStamp organizes components into ROOT components (have their own bundles, listed here) and DEPENDENCIES (included in importing root's bundle.graph.nodes[], not listed here). If a component isn't in this list, it's a dependency - find which root imports it, then read that root's bundle to see the dependency contract in bundle.graph.nodes[]. Use bundle paths in read_bundle to get component contracts. Watch mode: Use projectPath directly (no snapshotId needed). Filter: folderPrefix="src/components" to filter by directory. Next: read_bundle(snapshotId|projectPath, bundlePath). The tool handles race conditions internally - no external sleep() delays needed.
Input schema
{
  "type": "object",
  "properties": {
    "snapshotId": {
      "type": "string",
      "description": "Snapshot ID from logicstamp_refresh_snapshot. Optional if watch mode is active - use projectPath instead for direct access."
    },
    "projectPath": {
      "type": "string",
      "description": "Absolute path to project root. Use this instead of snapshotId when watch mode is active for instant access to fresh context."
    },
    "folderPrefix": {
      "type": "string",
      "description": "Filter bundles by folder path prefix (optional, e.g., \"src/components\" to see only that folder)"
    }
  }
}
——
logicstamp_read_bundle⚠️ CRITICAL: Do NOT use sleep() delays before calling this tool. When watch mode is active, bundles are already fresh - call this tool directly without any waiting. Reads bundle/index file to get component contracts and dependency graphs. Reads context_main.json (project overview) or folder context.json (component contracts). These are pre-parsed summaries optimized for AI - PREFER over raw .ts/.tsx files. ROOT vs DEPENDENCY: Root components have their own bundles (use rootComponent param). Dependencies appear in bundle.graph.nodes[] of the root that imports them. If a component isn't found as root, it's a dependency - read bundles that might import it and check bundle.graph.nodes[] for the dependency contract. Bundle contains: entryId, graph.nodes[] (UIFContract for root + dependencies), graph.edges[] (dependencies), meta.missing[] (unresolved). UIFContract: kind, description, props, emits, state, exports, semanticHash, optional style metadata. Watch mode: Use projectPath directly (no snapshotId needed). Use bundlePath="context_main.json" for overview, or folder paths from list_bundles for details. The tool handles race conditions internally with retry logic (200-500ms delays + exponential backoff built-in). No external sleep() delays needed.
Input schema
{
  "type": "object",
  "properties": {
    "snapshotId": {
      "type": "string",
      "description": "Snapshot ID from logicstamp_refresh_snapshot. Optional if watch mode is active - use projectPath instead for direct access."
    },
    "projectPath": {
      "type": "string",
      "description": "Absolute path to project root. Use this instead of snapshotId when watch mode is active for instant access to fresh context."
    },
    "bundlePath": {
      "type": "string",
      "description": "Relative path to context.json file or context_main.json from project root. Use \"context_main.json\" for project overview, or folder paths like \"src/components/context.json\" for component bundles."
    },
    "rootComponent": {
      "type": "string",
      "description": "Specific ROOT component name to filter within the bundle file (optional). Only works for root components (listed in list_bundles). If omitted, returns the first bundle. Note: Dependencies appear in bundle.graph.nodes[] of the root that imports them, not as separate root bundles."
    }
  },
  "required": [
    "bundlePath"
  ]
}
——
logicstamp_read_logicstamp_docsReturns comprehensive LogicStamp documentation (logicstamp-for-llms.md guide, usage, UIF contracts, schema, CLI commands, limitations). Returns complete doc bundle with key concepts, workflow instructions, and best practices. Use when: unsure how LogicStamp works, starting new project, need bundle structure/contract format, or want recommended workflow. Escape hatch: if confused about LogicStamp, call this first. Explains: what LogicStamp is, why bundles over raw code, workflow (refresh → list → read), bundle structure, best practices.
Input schema
{
  "type": "object",
  "properties": {}
}
——
logicstamp_refresh_snapshot⚠️ CRITICAL: Do NOT use sleep() delays. After calling this tool, bundles are immediately available. When watch mode is active, skip this tool entirely and read bundles directly - they're already fresh. ⚠️ FIRST: Call logicstamp_watch_status! If watch mode is ACTIVE → SKIP this tool, go to list_bundles → read_bundle (context is fresh). Use when: watch mode INACTIVE, first-time analysis, or after large changes. Default skipIfWatchActive=true (auto-skips regeneration if watch mode active). WHAT IT DOES: Runs `stamp context` to analyze React/TypeScript/Node.js codebases (Next.js, Express.js, NestJS) and generate structured context files (context_main.json + per-folder context.json bundles). These are STRUCTURED DATA, not raw source. SLOW compared to reading existing context. WHAT YOU GET: Summary statistics (component counts, token estimates, folder structure) and a snapshotId. If watch mode is active, also includes watchMode status. IMPORTANT: This summary does NOT include component details, props, dependencies, or style metadata. WHAT TO DO NEXT: list_bundles(snapshotId|projectPath) → read_bundle(snapshotId|projectPath, bundlePath). Use projectPath when watch mode is active (no snapshotId needed). STYLE METADATA: Set includeStyle=true to extract visual/design info (Tailwind/SCSS/animations/colors/spacing). Appears in bundle "style" field, NOT in summary. Use for design system analysis or when user asks about styling/colors/animations. DEPTH PARAMETER: Default depth=2 includes nested components (App → Hero → Button) with contracts and styles. Set depth=1 for direct dependencies only (App → Hero). PREFER BUNDLES OVER RAW CODE: These bundles are pre-parsed summaries optimized for AI - use them instead of reading raw .ts/.tsx files when possible. If you're unsure how LogicStamp works, call logicstamp_read_logicstamp_docs first.
Input schema
{
  "type": "object",
  "properties": {
    "profile": {
      "type": "string",
      "enum": [
        "llm-chat",
        "llm-safe",
        "ci-strict"
      ],
      "description": "Analysis profile: llm-chat=balanced (default), llm-safe=conservative (max 30 nodes), ci-strict=contracts only, strict deps",
      "default": "llm-chat"
    },
    "mode": {
      "type": "string",
      "enum": [
        "header",
        "full",
        "none"
      ],
      "description": "Code inclusion mode: none=contracts only (~79% token savings), header=contracts+JSDoc headers (~65% savings, recommended), full=complete source code (no savings)",
      "default": "header"
    },
    "includeStyle": {
      "type": "boolean",
      "description": "Extract style metadata (Tailwind, SCSS, Material UI, animations, layout patterns). Equivalent to `stamp context style` or `stamp context --include-style`. Style data appears in component contracts when reading bundles, NOT in the summary.",
      "default": false
    },
    "depth": {
      "type": "number",
      "description": "Dependency traversal depth. Default: 2 (includes nested components, e.g., App → Hero → Button). Set to 1 for direct dependencies only (e.g., App → Hero). Depth=2 is recommended for React projects with component hierarchies.",
      "default": 2
    },
    "projectPath": {
      "type": "string",
      "description": "CRITICAL: Absolute path to project root. REQUIRED - must always be provided. When stamp init has been run, MCP clients may omit this, causing hangs. This parameter is REQUIRED for the tool to work correctly."
    },
    "cleanCache": {
      "type": "boolean",
      "description": "Manually force cleanup of .logicstamp cache folder. Default: false (auto-detects corruption/mismatch). Set to true to force cache reset. Use only when experiencing cache-related issues.",
      "default": false
    },
    "skipIfWatchActive": {
      "type": "boolean",
      "description": "Skip regeneration if watch mode is active (default: true). When true and watch mode is running, skips expensive regeneration and reads existing context files instantly. Set to false only if you need to force regeneration even when watch mode is active.",
      "default": true
    }
  },
  "required": [
    "projectPath"
  ]
}
——
logicstamp_watch_status⚠️ CRITICAL: Do NOT use sleep() delays before calling LogicStamp tools when watch mode is active. Watch mode keeps bundles fresh automatically - just read them directly. ⚠️ CALL THIS FIRST before any other LogicStamp tool! Checks if watch mode (`stamp context --watch`) is active. If ACTIVE: SKIP refresh_snapshot, go to list_bundles → read_bundle (context fresh via incremental rebuilds). If INACTIVE: Call refresh_snapshot first. Enables zero-cost instant context access when watch mode running. Reads .logicstamp/context_watch-status.json and verifies process is running. Watch features: Incremental rebuilds (affected bundles only), change detection (props/hooks/state/components), debouncing (500ms), optional log file. Strict watch mode (`stamp context --watch --strict-watch`): Also detects breaking changes. Returns strictWatch=true when enabled. Detection: Reads strictWatch field from .logicstamp/context_watch-status.json file (when LogicStamp CLI includes it). Set includeRecentLogs=true to see recent regeneration events. When watch mode is active, bundles are already fresh - read them directly without any sleep() delays. The tools handle race conditions internally.
Input schema
{
  "type": "object",
  "properties": {
    "projectPath": {
      "type": "string",
      "description": "CRITICAL: Absolute path to project root. REQUIRED - must always be provided."
    },
    "includeRecentLogs": {
      "type": "boolean",
      "description": "Include recent watch log entries showing what changed (default: false). Only available if watch mode was started with --log-file flag.",
      "default": false
    },
    "logLimit": {
      "type": "number",
      "description": "Maximum number of recent log entries to return (default: 5)",
      "default": 5
    }
  },
  "required": [
    "projectPath"
  ]
}
——

Resources 0

Resource templates 0

Prompts 0

Changes from previous version

No completed comparison is available.

RiskChangeSubject
No material changes recorded.

Confirmed vulnerabilities

SeverityFindingAdvisory
No confirmed vulnerability is published for this version.

Provenance

Artifact SHA-256: b6b864a1a9f44770894871d7eeacf6f5d7837c3b91af23e99d42ee3e7018e8d6

Scanner: mcp-proof-engine 0.1.0.

Let’s talk about MCP security.

Share your details and our security team will contact you.