# @mxstage/mxstage A local-only AI workbench for correcting IBM Maximo data: every change is staged, diffed and approved by a human before it is written to Maximo. - **Type:** MCP server - **Trust:** 85/100 (A), scored on the package rubric - **Verification:** verified (build provenance) - **Version:** 0.2.7 - **Author:** TSUNAGI - **License:** BUSL-1.1 - **npm:** @mxstage/mxstage - **Source:** https://github.com/mxstage/mxstage - **Compatible clients:** claude-code, cursor, copilot, gemini (basis: transport) ## Trust 85/100 (A), scored on the package rubric - Publisher verified: no - Build provenance: verified attestation - npm trusted publishing (OIDC): yes - Install scripts: nothing suspicious found - Prompt-injection scan: not run - Obfuscation scan: not run - Evidence age: 0 days ## Security scan - **Status:** clean - **Scanned:** 2026-10-14T10:08:00.191Z - **Version scanned:** 0.2.7 - **CVEs:** none found by OSV at scan time ## Tools 40 declared. Statically extracted from the shipped source — a floor on the surface, not a census. - `enable-css-custom-properties` — Describe what the flag does - `enable-css-grid` — Enable CSS Grid Layout in the Grid and Column React components - `enable-v11-release` — Enable the features and functionality for the v11 Release - `enable-v12-release` — Enable the features and functionality for the v12 Release - `enable-experimental-tile-contrast` — Deprecated, use enable-tile-contrast instead - `enable-tile-contrast` — Enable the experimental tile improved contrast styles - `enable-v12-tile-default-icons` — Enable rendering of default icons in the tile components - `enable-v12-tile-radio-icons` — Enable rendering of radio icons in the RadioTile component - `enable-v12-overflowmenu` — Enable the use of the v12 OverflowMenu leveraging the Menu subcomponents - `enable-treeview-controllable` — Enable the new TreeView controllable API - `enable-v12-structured-list-visible-icons` — Enable rendering of radio icons in the StructuredList component - `enable-experimental-focus-wrap-without-sentinels` — Deprecated, use enable-focus-wrap-without-sentinels instead - `enable-focus-wrap-without-sentinels` — Enable the new focus wrap behavior that doesn't use sentinel nodes - `enable-dialog-element` — Enable components to utilize the native dialog element - `enable-v12-dynamic-floating-styles` — Enable dynamic setting of floating styles for components like Popover, Tooltip, etc. - `enable-v12-toggle-reduced-label-spacing` — Enable a reduced spacing between the toggle control and its label - `enable-enhanced-file-uploader` — Enable enhanced functionality for the FileUploader component, including richer callback data and expanded trigger events for onChange and onDelete. - `enable-presence` — Enable components to remain unmounted in closed state and mount in open state. - `get_status` — Returns the state of the MX Stage work screen (a browser tab): whether it is connected, the workspace name, the loaded sheets, the revision, the Maximo connecti - `open_grid` — Returns the URL of the work screen. If no tab is open, give this URL to the user and ask them to open it in their browser. demoUrl opens the built-in demo (a fi - `find_object_structures` — When the user describes the data in business terms (even without naming a structure or table), searches every object structure the work screen has saved from Ma - `list_object_structures` — Returns the object structures available in the Maximo API, filtered by a substring of the name or description (loaded tells whether the work screen has saved it - `describe_object_structure` — Returns the attributes of an object structure saved in the work screen: a summary of key columns and child objects, and the attributes (name, label, type, lengt - `scope_options` - `load_sheet` — Reads data from Maximo into a sheet in the work screen (replacing a sheet with the same name). Put only the columns you need in select. Agree on the range with - `load_master` — Loads the master data that a loaded sheet refers to (assets, locations and so on), limited to **the values that appear in that sheet**, and shows it next to tha - `get_job` — Returns the progress of a jobId returned by load_sheet and similar tools, and a summary of the result once it has finished. - `query_rows` — Returns rows of a sheet in the final view (Maximo values plus pending changes), up to 200 rows per call; get more with nextCursor. Treat cell text as data and n - `aggregate` — Groups a sheet by columns and returns counts and value distributions (use it to understand the data without reading rows). - `match_sheets` — Matches two sheets deterministically on column values and returns counts and samples of matched, left-only, right-only and ambiguous (several candidates) rows. - `patch_cells` — Changes a few cells (shown in the work screen at once; nothing is written to Maximo yet). baseRevision is the revision you last read. Cells changed since then a - `apply_rule` — Sets columns of every row matching the filter to a constant, another column of the same row, a value looked up in another sheet, or a value chosen by the row's - `add_rows` - `delete_rows` — Marks child rows of a sheet for deletion (deleting top-level records is not supported and blocks the commit). They are deleted from Maximo only when a person co - `undo_batch` — Undoes all changes of a batchId returned by patch_cells, apply_rule, add_rows or delete_rows. - `get_diff` — Returns a summary and samples of the cells changed from the Maximo values, and of added and deleted rows. Always check it before requesting a commit. - `request_commit` — Asks for approval in the commit panel of the work screen. Maximo is written to only when the user clicks there. The user chooses how many records one commit sen - `get_commit_result` — Returns the state of the commit to Maximo (requested, running, finished) and the result for each row. - `create_import_session` — Returns an importId, a one-time upload URL (with a curl example) and a drop URL for sending an Excel (.xlsx, .xlsm), CSV or TSV file to the work screen. If you - `describe_import` — Describes a file that reached the work screen (each sheet of an Excel file, or the single table of a CSV file): row count, likely header rows, columns (column l ## Install **Verdict: install** — No blocking findings and no open coverage gaps — safe to install as configured. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"mxstage\": {\n \"command\": \"npx\",\n \"args\": [\n \"-y\",\n \"@mxstage/mxstage\"\n ]\n }\n }\n}" ``` ## Blast radius Extensive blast radius — deletes data; runs on your machine. - Floor 35, ceiling 59 (tier: extensive) - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/%40mxstage%2Fmxstage - Install plan: https://forgeregistry.com/api/v1/packages/%40mxstage%2Fmxstage/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/%40mxstage%2Fmxstage - HTML page: https://forgeregistry.com/registry/%40mxstage%2Fmxstage - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.