# @collhub/mcp

MCP server for CollHub: documents, projects, comments, workflows and data sources as tools for Claude Code, Claude Desktop, Cursor, VS Code and Codex

- **Type:** MCP server
- **Trust:** 60/100 (B), scored on the package rubric
- **Verification:** community-indexed — nobody has claimed this listing
- **Version:** 1.0.1
- **Author:** Unknown
- **License:** MIT
- **npm:** @collhub/mcp
- **Source:** https://collhub.com
- **Compatible clients:** claude-code, cursor, copilot, gemini (basis: transport)

## Trust

60/100 (B), scored on the package rubric
- Publisher verified: no
- Install scripts: nothing suspicious found
- Prompt-injection scan: not run
- Obfuscation scan: not run
- Evidence age: 0 days

## Security scan

- **Status:** clean
- **Scanned:** 2026-09-23T11:29:22.327Z
- **Version scanned:** 1.0.1
- **CVEs:** none found by OSV at scan time

## Tools

40 declared. Statically extracted from the shipped source — a floor on the surface, not a census.
- `whoami` — Who the server is logged in as on the instance: `user` (email, name) first, then the session (the host profile it belongs to) and the account (id, privileges, m
- `login` — Log in to the instance in the browser — only when the user asks. Plain: resumes the stored session, opens a browser only when there is none. `switch_user`: open
- `logout` — Sign out of the instance — only when the user asks. Ends this host's session on the backend and forgets it here; the user's other sessions and the app stay sign
- `list_principals` — Users and groups — the directory behind principal-typed fields such as a Task's `assignee`, which accept a name on write but store a numeric id. `query` (case-i
- `search_documents` — Hybrid semantic + full-text search in one collection; collection_id=0 lists/filters across ALL collections (system fields only, no query). Structured filters ne
- `find` — BM25 keyword search in one collection — exact terms, ranked by lexical relevance (search_documents for semantic queries). The top results carry their best passa
- `find_similar`
- `get_document_info`
- `read_document`
- `read_documents`
- `get_document_passages`
- `get_document_history` — Get the version history of a document.
- `diff_versions` — Compare two versions of a document and return a unified diff. Use get_document_history to discover available version numbers. Omit from_version to diff against 
- `list_document_types` — List available document types that can be created — the complete list, never a page. Call this before create_document to discover valid types. A type's `instruc
- `create_document`
- `write_document`
- `edit_document`
- `replace_in_document`
- `renumber_document`
- `mark_headings`
- `unlock_document` — Unlock a document after editing. Call this when done writing to release the lock. Unlocking PUBLISHES: it mints the new version and re-extracts the section tree
- `read_stream` — Read a named stream from a document as text. System streams are "draft" (Markdown), "data" (JSON), "style" (CSS: the theme binding and the document's own rules)
- `write_stream`
- `update_metadata` — Set metadata field values on a document — collection fields plus the document type's own (a Task's assignee, due_date, priority; list_metadata_fields with the t
- `rename_document` — Rename a document by changing its `name` field. File-named documents keep their extension ("Report Q3.pdf"); typed documents keep plain titles (see the guide's 
- `move_document`
- `list_labels` — List labels — the complete list, never a page — to find ids for update_labels or check existence before create_label. Empty fields are left out; the document_de
- `update_labels` — Add or remove labels on a document. Use list_labels to discover available label IDs. Use get_document_info with include=["labels"] to see current labels.
- `locate_regex`
- `get_document_toc`
- `upload_document` — Upload a local file as a new document. Reads the file as binary, auto-detects the document type from the file extension (include it in the name), creates the do
- `list_collections` — List available collections. Use this first to discover collection IDs before searching or browsing documents.
- `get_collection` — Get full details of a collection including permissions and configuration. Its `instructions`, when set, say how documents there are written and handled: follow 
- `create_collection` — Create a new collection. Collections group related documents with custom metadata schemas. Set is_hierarchical=true when the user asks for a "hierarchical colle
- `create_folder` — Create a folder inside a hierarchical collection. The collection must have is_hierarchical=true. Use parent_id to nest folders within other folders, or omit to 
- `list_folder` — List the contents of a folder or project, folders and projects first (an is_folder item can be listed further by its id). For navigating INSIDE a hierarchical c
- `list_metadata_fields` — Metadata fields and their types. Without type_id: the collection-level fields (the filter fields for search_documents). With type_id: the EFFECTIVE schema of th
- `list_projects` — List projects across all collections (most recently modified first). A project is a special folder that anchors AI project workflows. Take one in with get_proje
- `create_project`
- `get_project_brief`

## Install

**Verdict: review** — Installable, but 1 thing to check first: No publisher has proved control of this listing; it is indexed, not vouched for.
**Cautions** (coverage gaps and advisories — never blocking)
- No publisher has proved control of this listing; it is indexed, not vouched for.
**Config** (claude-code):
```json
"{\n  \"mcpServers\": {\n    \"mcp\": {\n      \"command\": \"npx\",\n      \"args\": [\n        \"-y\",\n        \"@collhub/mcp\"\n      ]\n    }\n  }\n}"
```

## Blast radius

Extensive blast radius — mutates data; runs on your machine.
- Floor 35, ceiling 59 (tier: extensive)
- This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score.

## Machine-readable views of this entry

- Signed JSON: https://forgeregistry.com/api/v1/packages/%40collhub%2Fmcp
- Install plan: https://forgeregistry.com/api/v1/packages/%40collhub%2Fmcp/install-plan
- Alternatives: https://forgeregistry.com/api/v1/alternatives/%40collhub%2Fmcp
- HTML page: https://forgeregistry.com/registry/%40collhub%2Fmcp
- MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan`

## About this document

Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.