Repository evidence for agents before they adopt dependencies, enter codebases, compare, or merge.
Abgeleitet aus den Transporten, die dieser Eintrag deklariert (streamable-http). Ein Client, der hier nicht steht, ist damit nicht ausgeschlossen — Forge kann ihn nur nicht bestätigen.
Die Verifizierung bestätigt die Identität des Publishers (die Inhaberschaft am Repo), nicht die Sicherheit des Codes. Der Sicherheits-Scan deckt bekannte CVEs und verdächtige Installationsskripte ab.
Aus einem echten MCP-Handshake initialize → tools/list gegen den deklarierten Endpunkt gelesen. Es wurde nie ein Tool aufgerufen — tools/list ist der lesende Introspektionsaufruf, den das Protokoll dafür vorsieht. Es spiegelt wider, was der Server in diesem Moment angeboten hat; ein gehosteter Endpunkt ist an keine Version gebunden und kann sich ohne Ankündigung ändern.
https://repopilot.app/api/mcp8 Tools · 177 mscheck_dependencyCALL when the user or agent is about to add, upgrade, trust, fork, or deploy an npm package or public GitHub repository. Returns a lean repository-level recommendation, confidence, evidence gaps, CVEs, maintenance, ownership, license, CI/tests, Scorecard, freshness, and next actions. DO NOT use for…CALL when the user or agent is about to add, upgrade, trust, fork, or deploy an npm package or public GitHub repository. Returns a lean repository-level recommendation, confidence, evidence gaps, CVEs, maintenance, ownership, license, CI/tests, Scorecard, freshness, and next actions. DO NOT use for…
| Parameter | Typ | Beschreibung |
|---|---|---|
| repo | string | Public GitHub repository as owner/repo or a github.com URL. |
| package | string | npm package name, for example lodash or npm:@scope/pkg. To judge a specific VERSION rather than the package as a whole, use evaluate_dependency_change instead. |
| owner | string | Repository owner, when repo carries only the bare name. Optional: prefer the single owner/repo form in repo. |
evaluate_dependency_changeCALL immediately before adding or upgrading an npm dependency. Answers "is this exact version safe to take on" from registry metadata, advisory deltas, provenance, license, and repository evidence, and returns blockers, warnings, a recommendation, and a verification plan. Example: {"dependency":"lo…CALL immediately before adding or upgrading an npm dependency. Answers "is this exact version safe to take on" from registry metadata, advisory deltas, provenance, license, and repository evidence, and returns blockers, warnings, a recommendation, and a verification plan. Example: {"dependency":"lo…
| Parameter | Typ | Beschreibung |
|---|---|---|
| dependency* | string | A STRING: the npm package name on its own, with no version and no surrounding object — "lodash", "@types/node". Not {"name":...}, not {"lodash":"^4.17.0"}, not… |
| to_version | string | number | The version you intend to install — an exact version ("4.18.1"), a dist-tag ("latest"), or a SemVer range ("^4.17.0"). A quoted string is preferred; a bare JSO… |
| from_version | string | number | null | The version currently installed, or omitted when adding a new dependency. A bare JSON number is accepted the same way as to_version. Supplying it produces a be… |
| dependency_type | string | Where the dependency goes, in THESE words: "runtime" for a dependencies entry, "development" for devDependencies. The manifest and CLI spellings ("dev", "devDe… |
| package_manager | string | Optional. Only affects the commands and lockfile named in the verification plan. Inferred from project.lockfile_path when you send a project snapshot, and assu… |
| project | object | Optional, source-free facts about the project you are changing. Supplying it adds Node/peer/license compatibility and a command-level verification plan. Omit i… |
| policy_profile | string | Named team dependency policy. Strict requires provenance and denies package install hooks. Must be spelled exactly — a near-miss spelling is rejected rather th… |
| intent | string | Optional free text describing why you are making this change. Advisory only; it changes no verdict. |
verify_dependency_changeCALL after changing the manifest/lockfile and running local checks. Compares the exact evaluated target with the resolved result and caller-reported proof receipts, reports missing/failed evidence and residual risk, and labels receipts as caller asserted. It never runs commands or stores diff/check…CALL after changing the manifest/lockfile and running local checks. Compares the exact evaluated target with the resolved result and caller-reported proof receipts, reports missing/failed evidence and residual risk, and labels receipts as caller asserted. It never runs commands or stores diff/check…
| Parameter | Typ | Beschreibung |
|---|---|---|
| evaluation* | object | The verification_context object exactly as evaluate_dependency_change returned it, passed back unchanged. Its signature covers every field, so edit nothing ins… |
| after* | object | — |
| diff | string | — |
| checks* | array | — |
analyze_repoCALL when entering an unfamiliar repository or deciding whether to depend on, fork, learn from, or deploy it. Returns a concise four-use-case brief, watchouts, evidence confidence, architecture summary, freshness, and next actions without dumping the full generated artifact. Use get_artifact when f…CALL when entering an unfamiliar repository or deciding whether to depend on, fork, learn from, or deploy it. Returns a concise four-use-case brief, watchouts, evidence confidence, architecture summary, freshness, and next actions without dumping the full generated artifact. Use get_artifact when f…
| Parameter | Typ | Beschreibung |
|---|---|---|
| repo | string | Public GitHub repository as owner/repo or a github.com URL. |
| package | string | npm package name, for example lodash or npm:@scope/pkg. To judge a specific VERSION rather than the package as a whole, use evaluate_dependency_change instead. |
| owner | string | Repository owner, when repo carries only the bare name. Optional: prefer the single owner/repo form in repo. |
plan_repo_taskCALL before editing an unfamiliar public repository. Returns a bounded reading order, relevant files, dependency consumers, test/verification obligations, analyzed-vs-checked SHA relation, evidence provenance, and a short-lived verification contract. Task text is used only for bounded local matchin…CALL before editing an unfamiliar public repository. Returns a bounded reading order, relevant files, dependency consumers, test/verification obligations, analyzed-vs-checked SHA relation, evidence provenance, and a short-lived verification contract. Task text is used only for bounded local matchin…
| Parameter | Typ | Beschreibung |
|---|---|---|
| repo | string | Public GitHub repository as owner/repo or a github.com URL. |
| package | string | npm package name, for example lodash or npm:@scope/pkg. To judge a specific VERSION rather than the package as a whole, use evaluate_dependency_change instead. |
| owner | string | Repository owner, when repo carries only the bare name. Optional: prefer the single owner/repo form in repo. |
| task* | string | — |
| checked_sha | string | — |
| intent | object | — |
| max_files | integer | — |
| path_hints | array | Optional repository-relative files or directories to prioritize. |
get_artifactCALL before substantial code work in an unfamiliar repository when the agent needs key files, entry points, architecture hypotheses, a reading order, and verify-before-trusting guidance. Returns the cached CLAUDE.md-style artifact or Cursor rules. Do not call again if the artifact is already in con…CALL before substantial code work in an unfamiliar repository when the agent needs key files, entry points, architecture hypotheses, a reading order, and verify-before-trusting guidance. Returns the cached CLAUDE.md-style artifact or Cursor rules. Do not call again if the artifact is already in con…
| Parameter | Typ | Beschreibung |
|---|---|---|
| repo | string | Public GitHub repository as owner/repo or a github.com URL. |
| package | string | npm package name, for example lodash or npm:@scope/pkg. To judge a specific VERSION rather than the package as a whole, use evaluate_dependency_change instead. |
| owner | string | Repository owner, when repo carries only the bare name. Optional: prefer the single owner/repo form in repo. |
| format | string | Optional. markdown for CLAUDE.md-style guidance (the default); cursor for .mdc rules. |
compare_reposCALL when the user is choosing between exactly two dependencies or repositories. Returns the preferred candidate for each use case, material trade-offs, confidence, and evidence gaps. Each target is owner/repo, a GitHub URL, an npm package name, or npm:@scope/pkg. Cached full analyses are preferred…CALL when the user is choosing between exactly two dependencies or repositories. Returns the preferred candidate for each use case, material trade-offs, confidence, and evidence gaps. Each target is owner/repo, a GitHub URL, an npm package name, or npm:@scope/pkg. Cached full analyses are preferred…
| Parameter | Typ | Beschreibung |
|---|---|---|
| a* | string | First repo or npm package target. |
| b* | string | Second repo or npm package target. |
check_change_riskCALL before merging a pull request or after producing a local diff. Returns a deterministic 0-10 change-shape score with receipts for size, spread, missing tests, sensitive paths, hotspots, and blast radius. Pass repo+pr OR diff; repo may accompany diff for cached hotspot context. This prioritizes…CALL before merging a pull request or after producing a local diff. Returns a deterministic 0-10 change-shape score with receipts for size, spread, missing tests, sensitive paths, hotspots, and blast radius. Pass repo+pr OR diff; repo may accompany diff for cached hotspot context. This prioritizes…
| Parameter | Typ | Beschreibung |
|---|---|---|
| repo | string | owner/repo or a github.com URL. |
| pr | number | string | Positive pull request number, used with repo. |
| diff | string | Raw unified git diff to score directly. |
| files | array | Privacy-preserving changed-file facts; contains no source or diff hunks. |
| contract_id | string | Optional short-lived contract_id returned by plan_repo_task. |
| base_sha | string | — |
| head_sha | string | — |
| proofs | array | — |
8 von 8 Tools haben eine Beschreibung veröffentlicht.
Tool-Namen und -Beschreibungen stammen vom Publisher und werden wortgetreu als inerter Text angezeigt. Es sind die Zeichenketten, die ein MCP-Client an ein Modell übergibt, deshalb prüft Forge sie auf Prompt-Injection-Muster — jeder Befund erscheint oben beim Sicherheits-Scan. „Privilegiert“ ist ein Schlagwort-Treffer im Tool-Namen, keine Prüfung dessen, was das Tool tut: ein harmlos klingender Name kann trotzdem alles tun.
Repository evidence for agents before they adopt dependencies, enter codebases, compare, or merge.
Verlinkte Namen öffnen den Forge-Index aller Einträge, bei denen dieses Tool beobachtet wurde. Alle indexierten Tools durchsuchen.
Dieser Eintrag veröffentlicht kein npm-Paket, daher hat Forge keinen Abhängigkeitsbaum dafür. Das ist eine Lücke in der Abdeckung — keine Aussage, dass er keine Abhängigkeiten hat.