# progressor-mcp An MCP server that keeps an AI Agent and the Developer focused on their Goals across context compression and distractions. - **Type:** MCP server - **Trust:** 85/100 (A), scored on the package rubric - **Verification:** verified (build provenance) - **Version:** 0.6.2 - **Author:** Rachit Asthana - **License:** GPL-3.0-or-later - **npm:** progressor-mcp - **Source:** https://github.com/racstan/progressor-mcp - **Compatible clients:** claude-code, cursor, copilot, gemini (basis: transport) ## Trust 85/100 (A), scored on the package rubric - Publisher verified: no - Build provenance: verified attestation - npm trusted publishing (OIDC): yes - Install scripts: nothing suspicious found - Prompt-injection scan: not run - Obfuscation scan: not run - Evidence age: 0 days ## Security scan - **Status:** clean - **Scanned:** 2026-10-25T09:25:01.435Z - **Version scanned:** 0.6.2 - **CVEs:** none found by OSV at scan time ## Tools 18 declared. Statically extracted from the shipped source — a floor on the surface, not a census. - `get_status` — Compact summary of this Session's Goal, current Task, open Detour, next Task and the Developer's Standing Instructions. Call it at the start of every conversati - `get_item` — Look up one Goal, Task, Detour or Standing Instruction by its ref (progressor:///, or progressor://roadmap/), with its file and line. U - `add_goal` — Add a Goal to the end of the Roadmap, with an optional Task list and Outcome; with claim: true, also claim it to start work. A title another Goal already has is - `update_goal` — Rename a Goal or set its Outcome. Its ID, refs and Plan File stay the same, and it needs no Claim. To change a Goal's Tasks, claim it and use add_tasks, update_ - `move_goal` — Move a Goal right before or after another Goal, so the Roadmap lists the work in the order it should happen. Give exactly one of before and after. - `drop_goal` — Drop a Goal that will not be done, with the reason; its Plan File stays as a record. Releases this Session's Claim on it. A Goal another running Session holds, - `claim_goal` — Claim a Goal for this Session, so only this Session works on it. Releases (pauses) any Goal this Session held before. Fails if another running Session holds it. - `release_goal` — Release this Session's Claim, leaving the Goal paused for a later Session. - `complete_goal` — Mark the claimed Goal done and release it, once its Outcome is true and its Tasks are done or dropped. If more work turns up later, claim_goal reopens it. - `add_tasks` — Append Tasks to the claimed Goal's plan. For work that is not part of the plan, declare a Detour instead. Set done on a Task that is already finished. - `start_task` — Mark a Task in progress. Only one Task can be in progress at a time. - `complete_task` — Mark a Task of the claimed Goal done, recording the files it touched and, if it changed, the final summary of what it did. Works whether or not the Task was sta - `update_task` — Change a Task's title, summary or files, for instance when the fix turns out different from the plan. Leaves its status alone. - `drop_task` — Drop one Task of the claimed Goal that is no longer needed, with the reason; it stays in the Plan File, struck through. To replace the whole remaining plan, end - `start_detour` — Declare that the work is splitting off from the planned Tasks, before doing it. Branches from the current Task. Only one Detour can be open. - `end_detour` — End the open Detour. 'merge back': it was small and is done; the plan is unchanged. 'return': go back to the plan, appending `tasks` for the Detour's intended w - `add_standing_instruction` — Save a lasting rule from the Developer about how you should work in this project, such as 'ask me before changing the plan'. get_status lists it from then on. U - `update_standing_instruction` — Reword a Standing Instruction when the Developer changes a rule, or remove it with an empty text when they drop it. The IDs (s1, s2...) are in get_status. ## Install **Verdict: install** — No blocking findings and no open coverage gaps — safe to install as configured. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"progressor\": {\n \"command\": \"npx\",\n \"args\": [\n \"-y\",\n \"progressor-mcp\"\n ]\n }\n }\n}" ``` ## Blast radius Extensive to critical — no credential declaration found, from the publisher, the upstream registry, or the README. Known so far: deletes data; runs on your machine. - Floor 38, ceiling 62 (tier: unknown) - `unknown` means the floor and ceiling land in different bands — not measured enough to name one. It does not mean low. - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/progressor-mcp - Install plan: https://forgeregistry.com/api/v1/packages/progressor-mcp/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/progressor-mcp - HTML page: https://forgeregistry.com/registry/progressor-mcp - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.