Drupal core API changes, contrib usage, upgrade readiness, patch verdicts, code search, SQL.
Inferido de los transportes que declara este listado (streamable-http). Que un cliente no aparezca aquí no significa que se haya descartado: simplemente Forge no puede confirmarlo.
La verificación confirma la identidad del publicador (la propiedad del repo), no la seguridad del código. El análisis de seguridad cubre los CVE conocidos y los scripts de instalación sospechosos.
Leído de un handshake MCP real initialize → tools/list contra el endpoint declarado. No se invocó ninguna herramienta: tools/list es la llamada de introspección de solo lectura que el protocolo define para esto. Refleja lo que el servidor anunciaba en ese momento; un endpoint alojado no está fijado a ninguna versión y puede cambiar sin avisar.
https://mcp.tresbien.tech/mcp16 herramientas · 1043 mscheck_patchesDoes each composer patch still apply to the release the site installed, and is its fix already in that release?
- Send composer_json and composer_lock after composer update. Add patch_files for every patch, a local one read from disk and a URL one fetched by you. Every extra.patches entry is checke…Does each composer patch still apply to the release the site installed, and is its fix already in that release? - Send composer_json and composer_lock after composer update. Add patch_files for every patch, a local one read from disk and a URL one fetched by you. Every extra.patches entry is checke…
| Parámetro | Tipo | Descripción |
|---|---|---|
| items | null | array | Up to 50 patches to check. Each item has project, version, patch and title. project: webform or drupal/webform; drupal or core for Drupal core. version: the in… |
| composer_json | string | The contents of composer.json. Send the text; this server cannot read your filesystem. Its extra.patches becomes the item list, one item per patch. |
| composer_lock | string | The contents of composer.lock. It gives the installed version of each patched package. |
| patches_file | string | The text of the patches file, for a site on cweagans/composer-patches 2.x that keeps its patches out of composer.json. The path is in its own extra.composer-pa… |
| patches_lock | string | The text of patches.lock.json, which 2.x of the patch manager writes and applies from. Send it to judge what the site actually applies: it answers alone, over… |
| patch_files | object | The text of every patch the site declares, keyed by the source as written: a path (patches/x.patch) or its base name, or the URL. Fetch a URL patch yourself an… |
| target_core | string | Core the added code is checked against: a minor (11.4 or 11.4.x) or a release (11.4.5). A minor with no core release in the data is refused, and so is a major… |
describe_datasetLearn the dataset before writing SQL for query_dataset. Call it with no arguments first. Returns text. Prefer a typed tool when one answers the question.
- No arguments: one line per view, the join map, the four invariants, the causes of empty results, and the recipe index. The invariants: dev-bran…Learn the dataset before writing SQL for query_dataset. Call it with no arguments first. Returns text. Prefer a typed tool when one answers the question. - No arguments: one line per view, the join map, the four invariants, the causes of empty results, and the recipe index. The invariants: dev-bran…
| Parámetro | Tipo | Descripción |
|---|---|---|
| view | string | One view name. Returns its columns with types and descriptions, an example filter, and the joins into it. Leave empty for the overview. |
| views | null | array | Up to 8 views at once, documented one after the other in one call. |
| recipe | string | One recipe id from the overview's index. Returns a ready-to-run query_dataset statement with its placeholders explained. |
get_change_recordReturn one core change record in full: title, flavour, target version, machine-checkable tracks, linked issues, linked core symbols, and contrib adoption counts. To find records, use list_change_records or the change_record_nids from what_changed. For one symbol's detail, use lookup_core_symbol.
-…Return one core change record in full: title, flavour, target version, machine-checkable tracks, linked issues, linked core symbols, and contrib adoption counts. To find records, use list_change_records or the change_record_nids from what_changed. For one symbol's detail, use lookup_core_symbol. -…
| Parámetro | Tipo | Descripción |
|---|---|---|
| nid* | integer | The change record's drupal.org node id, for example 3581981. |
| top_projects | integer | How many impacted projects to return in the ranked head. Defaults to 10, capped at 40. |
list_change_recordsList the core change records (the human write-ups) that target a range of core versions, tagged by flavour and ranked, with counts. For the symbol-level diff, use what_changed. For one record in full, use get_change_record.
- Bounds are inclusive. Forms: 11.2, 11.2.x, 11.2.0, 11, 11.x. A bare major…List the core change records (the human write-ups) that target a range of core versions, tagged by flavour and ranked, with counts. For the symbol-level diff, use what_changed. For one record in full, use get_change_record. - Bounds are inclusive. Forms: 11.2, 11.2.x, 11.2.0, 11, 11.x. A bare major…
| Parámetro | Tipo | Descripción |
|---|---|---|
| from* | string | Lower core version bound, inclusive: 11.2, 11.2.x, 11.2.0, 11, or 11.x. A bare major (11) covers every minor of it. |
| to* | string | Upper core version bound, inclusive. Same forms as from. |
| project | string | Optional contrib project machine name. Narrows the list to records a development branch of that project still matches. |
| limit | integer | Records in the head, 1 to 40 (default 15). Above the cap the call is refused. |
list_class_relationsList the contrib classes that extend, implement or use a core class, interface or trait, one row per edge with file and line, paged. Example: "who subclasses FormBase". Call-site counts: list_symbol_users. The symbol's status: lookup_core_symbol.
- target: with or without the leading backslash. An…List the contrib classes that extend, implement or use a core class, interface or trait, one row per edge with file and line, paged. Example: "who subclasses FormBase". Call-site counts: list_symbol_users. The symbol's status: lookup_core_symbol. - target: with or without the leading backslash. An…
| Parámetro | Tipo | Descripción |
|---|---|---|
| target* | string | The core class, interface or trait, with or without the leading backslash: DrupalCoreFormFormBase. |
| rel_kind | string | extends, implements, or uses_trait; any when absent. |
| project | string | Restrict to one project machine name. |
| per_project | integer | Edges shown per project on a page, 1 to 50 (default 3). Each row has project_edges, the project's full count. |
| limit | integer | Rows per page, 1 to 100 (default 50). |
| offset | integer | Skip this many rows in the same ranked order. Pass the previous page's next_offset. |
list_projectsList drupal.org projects after filters, largest install base first, paged. Examples: "top modules without an 11.4 branch", "themes over 10k installs without security coverage". One project: project_profile. Its pending records: project_upgrade_report.
- Filters combine: type, min_installs, security…List drupal.org projects after filters, largest install base first, paged. Examples: "top modules without an 11.4 branch", "themes over 10k installs without security coverage". One project: project_profile. Its pending records: project_upgrade_report. - Filters combine: type, min_installs, security…
| Parámetro | Tipo | Descripción |
|---|---|---|
| type | string | Filter: project_module, project_theme, project_distribution, project_general, project_theme_engine, project_translation. |
| min_installs | integer | Filter: reported install base at or above this. |
| security | string | Filter: security advisory coverage: covered, not-covered, revoked. |
| core_minor | string | Filter: a core minor in 11.4.x form. Keeps projects where the newest release on some development branch declares support for it. With missing=true, keeps proje… |
| missing | boolean | Invert core_minor: keep projects whose development branches do not declare it. |
| era | string | Filter: d8plus (Drupal 8+ code) or pre_d8, on any development branch. |
| member_of | string | Filter: keep only members of this root project's composer requires walk, for example cms. |
| max_depth | null | integer | With member_of: drop members further than this many requires away, 1 or more. |
| limit | integer | Projects per page, 1 to 100 (default 50). |
| offset | integer | Skip this many projects in the same ranked order. Pass the previous page's next_offset. |
list_symbol_usersList every contrib project using one core symbol, or any symbol in a class of symbols, one row per project, paged, with the matched symbols. lookup_core_symbol answers one symbol with a head of 30.
- Pass fqn, or filters: kind, status (deprecated, scheduled_removal, removed), subsystem, removal_in…List every contrib project using one core symbol, or any symbol in a class of symbols, one row per project, paged, with the matched symbols. lookup_core_symbol answers one symbol with a head of 30. - Pass fqn, or filters: kind, status (deprecated, scheduled_removal, removed), subsystem, removal_in…
| Parámetro | Tipo | Descripción |
|---|---|---|
| fqn | string | One core symbol, as lookup_core_symbol takes it. Pass this or a filter. |
| kind | string | Filter: one symbol kind (function, method, class, library, hook, service …). |
| status | string | Filter: deprecated | scheduled_removal (still present) | removed (gone). |
| subsystem | string | Filter: a core subsystem (Entity API, Views), case-insensitive. subsystem_coupling with no arguments lists them. |
| removal_in | string | Filter: removal stamp in this core minor (13.0). With status=scheduled_removal: still present, going away then. |
| deprecated_in | string | Filter: symbols deprecated in this core minor (11.4). |
| limit | integer | Projects per page, 1 to 100 (default 50). |
| offset | integer | Skip this many projects. Pass the previous next_offset. |
| symbols | integer | Symbols per project row, 1 to 30 (default 10), heaviest first. |
| matched | integer | Matched symbols listed on the envelope, 1 to 50 (default 20). |
lookup_core_symbolAnswer "is this core symbol safe to use, and who still uses it" for one symbol. A name that resolves to nothing returns the catalog entries containing it instead. Every user in pages: list_symbol_users. Changed between versions: what_changed. Code text: search_code.
- fqn forms: a namespaced name w…Answer "is this core symbol safe to use, and who still uses it" for one symbol. A name that resolves to nothing returns the catalog entries containing it instead. Every user in pages: list_symbol_users. Changed between versions: what_changed. Code text: search_code. - fqn forms: a namespaced name w…
| Parámetro | Tipo | Descripción |
|---|---|---|
| fqn* | string | Core symbol name, or part of one. A namespaced name with or without the leading backslash (DrupalCoreEntityEntityInterface, DrupalCoreRecipeRecipeRunner::insta… |
| top_projects | integer | How many using projects to return in the ranked head. Defaults to 10, capped at 30. |
| candidates | integer | When the name resolves to no symbol: how many catalog entries containing it to return, 1 to 50 (default 10). |
| kind | string | Restrict candidates to one symbol kind (class, method, function, hook, library, service …). |
project_profileAnswer "what is this contrib project, how big is it, which core versions does it support, what moves with it" for one drupal.org project. Pending change records: project_upgrade_report. Core symbols it calls: list_symbol_users.
- project: title, type, status, security, installs. installs_by_version…Answer "what is this contrib project, how big is it, which core versions does it support, what moves with it" for one drupal.org project. Pending change records: project_upgrade_report. Core symbols it calls: list_symbol_users. - project: title, type, status, security, installs. installs_by_version…
| Parámetro | Tipo | Descripción |
|---|---|---|
| project* | string | drupal.org project machine name, e.g. webform. The composer name drupal/webform is accepted. |
| releases | integer | Releases to list, newest first, 1 to 30 (default 10). release_count says how many exist. |
| include | null | array | Optional sections: trend (monthly install series per release line) and related (full requires / required_by / co_installed lists, replacing the related summary… |
| months | integer | With include trend: months of history, 1 to 120 (default 36), ending at the latest month in the data. |
| dependents | integer | With include related: dependents per page in required_by, 1 to 100 (default 20). |
| dependents_offset | integer | With include related: dependents to skip. Pass required_by.next_offset from the previous call. |
project_upgrade_reportAnswer "is this contrib project ready for a target core version, and what work is left". For one record's detail, use get_change_record. For a symbol's users, use list_symbol_users.
- A record applies when it targets the target version or earlier, and a development branch of the project matched one…Answer "is this contrib project ready for a target core version, and what work is left". For one record's detail, use get_change_record. For a symbol's users, use list_symbol_users. - A record applies when it targets the target version or earlier, and a development branch of the project matched one…
| Parámetro | Tipo | Descripción |
|---|---|---|
| project* | string | Contrib project machine name as it appears on drupal.org, for example webform. The composer name drupal/webform is accepted. Packages from other vendors are no… |
| target_version* | string | Target core version: 11.2, 11.2.x, 11.2.0, 11, or 11.x. A bare major (11) covers every minor of it. |
| limit | integer | Outstanding records to return with evidence, 1 to 15 (default 8). Above the cap the call is refused. |
query_datasetRun read-only DuckDB SELECTs over the dataset behind the other tools, for a question none of them asks. Call describe_dataset first; it lists the 31 views, their columns, joins and recipes. Prefer a typed tool when one fits.
- statements=[…]: up to 5 statements in one call, one result or error each…Run read-only DuckDB SELECTs over the dataset behind the other tools, for a question none of them asks. Call describe_dataset first; it lists the 31 views, their columns, joins and recipes. Prefer a typed tool when one fits. - statements=[…]: up to 5 statements in one call, one result or error each…
| Parámetro | Tipo | Descripción |
|---|---|---|
| sql | string | One DuckDB SELECT over the views describe_dataset lists. SHOW TABLES, DESCRIBE <view> and FROM-first syntax also work. No semicolon, one statement. Use stateme… |
| statements | null | array | Up to 5 statements in one call. Results come back in order under results, each with its own rows or error. The byte budget is shared. Use this instead of sql f… |
| max_rows | integer | Rows to return per statement, 1 to 500 (default 100). The result byte budget may cut a wide result sooner. truncated says so either way. |
reroll_patchprivilegiadaRe-roll one composer patch that check_patches reported conflicts or fuzzy: a new diff that applies to the installed release. Call check_patches first for the whole list. Call this once per patch that came back conflicts or fuzzy.
- Input: project, version, patch, title, base. patch is the diff text…Re-roll one composer patch that check_patches reported conflicts or fuzzy: a new diff that applies to the installed release. Call check_patches first for the whole list. Call this once per patch that came back conflicts or fuzzy. - Input: project, version, patch, title, base. patch is the diff text…
| Parámetro | Tipo | Descripción |
|---|---|---|
| project* | string | drupal.org machine name (webform) or composer name (drupal/webform); drupal or core for Drupal core. |
| version* | string | The composer version installed, e.g. 1.13.0 or 11.4.5. |
| patch* | string | Unified diff text. This service downloads nothing, so fetch a URL patch yourself and send what came back. With the index lines git diff writes, it is merged on… |
| title | string | Optional, echoed back. |
| base | string | Optional. The release the site had before the upgrade. Its commit sha from composer.lock (source.reference), or its composer version: 6.1.0 when version is 6.2… |
| target_core | string | Core the added code is checked against: a minor (11.4 or 11.4.x) or a release (11.4.5). A minor with no core release in the data is refused, and so is a major… |
| drop_tests | null | boolean | Optional. Leave it out and the re-roll drops every file the release package omits, read from the release's own archive. false keeps every hunk, for a site inst… |
| resolutions | null | array | Decisions for the conflicted regions of a previous call on the same project, version and patch, one entry per region. region: the index in that file's conflict… |
scan_composerWhich of a site's drupal/* packages need a new release for a target core, and which have none? Send composer.lock and composer.json once; do not query one package at a time. The answer is the release scan for every package, plus extra.patches as check_patches items. Constraints are read by composer…Which of a site's drupal/* packages need a new release for a target core, and which have none? Send composer.lock and composer.json once; do not query one package at a time. The answer is the release scan for every package, plus extra.patches as check_patches items. Constraints are read by composer…
| Parámetro | Tipo | Descripción |
|---|---|---|
| composer_json | string | The contents of composer.json (require, require-dev, extra.patches). Send the text; this server cannot read your filesystem. Optional; without it there are no… |
| composer_lock* | string | The text of composer.lock. A real lock is too big to paste: send its path (composer.lock) instead. The answer is then the curl command that uploads the files f… |
| patches_file | string | The text of the patches file, for a site on cweagans/composer-patches 2.x that keeps its patches out of composer.json. The path is in its own extra.composer-pa… |
| patches_lock | string | The text of patches.lock.json, which 2.x of the patch manager writes and applies from. Send it to judge what the site actually applies: it answers alone, over… |
| target_core | string | Core to move to: a minor (11.4), a release (11.4.5), or latest for the newest core the site's own constraint allows. Leave empty to scan against the core the s… |
| patches | boolean | Judge the site's patches in the same call: each one against the release its package would install for target_core. Returns a verdict per patch instead of items… |
| patch_files | object | The text of every patch the site declares, keyed by the source as written: a path (patches/x.patch) or its base name, or the URL. Only needed with patches:true… |
| installed_core | object | What each installed release requires of core, keyed by composer name. Read it from the site's own vendor directory: composer show -f json <pkg>, or the drupal/… |
search_codeSearch the source of every indexed contrib project, plus core, for a code pattern: which files, or with by_repo which projects. Who-uses-a-core-symbol counts: list_symbol_users or lookup_core_symbol.
- query is a regex. Set literal for exact text with ( [ ] . $ : or a space, and put r: f: lang: cas…Search the source of every indexed contrib project, plus core, for a code pattern: which files, or with by_repo which projects. Who-uses-a-core-symbol counts: list_symbol_users or lookup_core_symbol. - query is a regex. Set literal for exact text with ( [ ] . $ : or a space, and put r: f: lang: cas…
| Parámetro | Tipo | Descripción |
|---|---|---|
| query* | string | Code to find, a regex unless literal is true. Filters may be inline when literal is false, else in filters. Example: hook_form_alter f:.module$ |
| literal | boolean | true: query is matched as exact text. Use it for text with ( [ ] $ . such as #[Hook(. With literal, filters go in filters. |
| filters | string | Zoekt filters appended as written: r:<repo regex> f:<path regex> lang:<language> b:<branch> sym:<symbol> case:yes. |
| repos | null | array | Restrict to these projects, by machine name, in one query. |
| limit | integer | Files to return, default 20, cap 50. Ignored with by_repo. |
| by_repo | boolean | Return repos as (repo, file_count) instead of files. Pulls up to 1000 files; total_files is the ceiling. |
subsystem_couplingAnswer "what else tends to fail when a merge request touches this core subsystem" from CI history over about 9,000 core merge requests. With issue_nid: "which subsystems does this issue touch, and what co-fails with them". No arguments: the list of subsystems, the same one core_symbol.subsystem and…Answer "what else tends to fail when a merge request touches this core subsystem" from CI history over about 9,000 core merge requests. With issue_nid: "which subsystems does this issue touch, and what co-fails with them". No arguments: the list of subsystems, the same one core_symbol.subsystem and…
| Parámetro | Tipo | Descripción |
|---|---|---|
| subsystem | string | A core subsystem (Views, Entity API) or a path bucket (module:views, core_lib:Entity). Leave both subsystem and issue_nid empty to get the list of subsystems. |
| issue_nid | integer | A drupal.org core issue nid: reports the subsystems its merge request touches, then the coupling edges from each. |
| min_lift | number | Keep edges with lift at or above this (default 0.05). |
| min_co_fail | integer | Keep edges seen in at least this many merge requests (default 3). |
| limit | integer | Edges to return, 1 to 50 (default 20). count says how many pass the floors. |
what_changedAnswer "what changed in the core API between two core versions": symbols added, deprecated and removed, as ranked groups with counts. One symbol: lookup_core_symbol. Human write-ups: list_change_records. Every row of one bucket: flat=true with bucket, paged. Every row of the whole diff: the result'…Answer "what changed in the core API between two core versions": symbols added, deprecated and removed, as ranked groups with counts. One symbol: lookup_core_symbol. Human write-ups: list_change_records. Every row of one bucket: flat=true with bucket, paged. Every row of the whole diff: the result'…
| Parámetro | Tipo | Descripción |
|---|---|---|
| from* | string | Lower core version bound, inclusive: 11.2, 11.2.x, 11.2.0, 11, 11.x. Upgrading from 11.2 means from=11.3. |
| to* | string | Upper bound, inclusive, same forms. |
| head | integer | Groups per bucket, 1 to 5 (default 5). Ignored when flat is true. |
| kind | string | Restrict to one symbol kind (method, class, function, hook, service, library …). Applies to counts too. |
| min_projects_using | integer | Drop symbols fewer than this many contrib projects call on a development branch. Applies to counts too. |
| offset | integer | Skip this many groups per bucket (grouped) or rows (flat), in ranked order. Flat: pass the previous page's next_offset. |
| flat | boolean | true: one bucket as flat symbol rows, paged, instead of three buckets of ranked groups. Needs bucket. |
| bucket | string | With flat: which side of the diff to list, added, deprecated, or removed. One bucket per call. |
| limit | integer | With flat: rows per page, 1 to 100 (default 50). A page of very long fqns may come back shorter. next_offset always says where the next page starts. |
16 de 16 herramientas publicaron una descripción.
Los nombres y descripciones de las herramientas los escribe el publicador y se muestran literalmente como texto inerte. Son las cadenas que un cliente MCP pasa al modelo, así que Forge las analiza en busca de patrones de inyección de prompts — cualquier hallazgo aparece junto al análisis de seguridad de arriba. «Privilegiada» es una coincidencia de palabra clave en el nombre de la herramienta, no una auditoría de lo que hace: un nombre inofensivo puede hacer cualquier cosa.
Drupal core API changes, contrib usage, upgrade readiness, patch verdicts, code search, SQL.
Los nombres enlazados abren el índice de Forge con todas las entradas que se observó que exponen esa herramienta. Ver todas las herramientas indexadas.
Esta entrada no publica ningún paquete de npm, así que Forge no tiene un árbol de dependencias para ella. Es una carencia de cobertura, no una afirmación de que no tenga dependencias.