Repository evidence for agents before they adopt dependencies, enter codebases, compare, or merge.
Dedotto dai trasporti dichiarati da questo annuncio (streamable-http). Un client che non compare qui non è escluso — semplicemente Forge non è in grado di confermarlo.
La verifica conferma l’identità del publisher (la proprietà del repo), non la sicurezza del codice. L’analisi di sicurezza copre i CVE noti e gli script di installazione sospetti.
Letto da un vero handshake MCP initialize → tools/list verso l’endpoint dichiarato. Nessuno strumento è stato invocato — tools/list è la chiamata di introspezione in sola lettura che il protocollo prevede a questo scopo. Riflette ciò che il server annunciava in quel momento; un endpoint ospitato non è vincolato ad alcuna versione e può cambiare senza preavviso.
https://repopilot.app/api/mcp8 strumenti · 177 mscheck_dependencyCALL when the user or agent is about to add, upgrade, trust, fork, or deploy an npm package or public GitHub repository. Returns a lean repository-level recommendation, confidence, evidence gaps, CVEs, maintenance, ownership, license, CI/tests, Scorecard, freshness, and next actions. DO NOT use for…CALL when the user or agent is about to add, upgrade, trust, fork, or deploy an npm package or public GitHub repository. Returns a lean repository-level recommendation, confidence, evidence gaps, CVEs, maintenance, ownership, license, CI/tests, Scorecard, freshness, and next actions. DO NOT use for…
| Parametro | Tipo | Descrizione |
|---|---|---|
| repo | string | Public GitHub repository as owner/repo or a github.com URL. |
| package | string | npm package name, for example lodash or npm:@scope/pkg. To judge a specific VERSION rather than the package as a whole, use evaluate_dependency_change instead. |
| owner | string | Repository owner, when repo carries only the bare name. Optional: prefer the single owner/repo form in repo. |
evaluate_dependency_changeCALL immediately before adding or upgrading an npm dependency. Answers "is this exact version safe to take on" from registry metadata, advisory deltas, provenance, license, and repository evidence, and returns blockers, warnings, a recommendation, and a verification plan. Example: {"dependency":"lo…CALL immediately before adding or upgrading an npm dependency. Answers "is this exact version safe to take on" from registry metadata, advisory deltas, provenance, license, and repository evidence, and returns blockers, warnings, a recommendation, and a verification plan. Example: {"dependency":"lo…
| Parametro | Tipo | Descrizione |
|---|---|---|
| dependency* | string | A STRING: the npm package name on its own, with no version and no surrounding object — "lodash", "@types/node". Not {"name":...}, not {"lodash":"^4.17.0"}, not… |
| to_version | string | number | The version you intend to install — an exact version ("4.18.1"), a dist-tag ("latest"), or a SemVer range ("^4.17.0"). A quoted string is preferred; a bare JSO… |
| from_version | string | number | null | The version currently installed, or omitted when adding a new dependency. A bare JSON number is accepted the same way as to_version. Supplying it produces a be… |
| dependency_type | string | Where the dependency goes, in THESE words: "runtime" for a dependencies entry, "development" for devDependencies. The manifest and CLI spellings ("dev", "devDe… |
| package_manager | string | Optional. Only affects the commands and lockfile named in the verification plan. Inferred from project.lockfile_path when you send a project snapshot, and assu… |
| project | object | Optional, source-free facts about the project you are changing. Supplying it adds Node/peer/license compatibility and a command-level verification plan. Omit i… |
| policy_profile | string | Named team dependency policy. Strict requires provenance and denies package install hooks. Must be spelled exactly — a near-miss spelling is rejected rather th… |
| intent | string | Optional free text describing why you are making this change. Advisory only; it changes no verdict. |
verify_dependency_changeCALL after changing the manifest/lockfile and running local checks. Compares the exact evaluated target with the resolved result and caller-reported proof receipts, reports missing/failed evidence and residual risk, and labels receipts as caller asserted. It never runs commands or stores diff/check…CALL after changing the manifest/lockfile and running local checks. Compares the exact evaluated target with the resolved result and caller-reported proof receipts, reports missing/failed evidence and residual risk, and labels receipts as caller asserted. It never runs commands or stores diff/check…
| Parametro | Tipo | Descrizione |
|---|---|---|
| evaluation* | object | The verification_context object exactly as evaluate_dependency_change returned it, passed back unchanged. Its signature covers every field, so edit nothing ins… |
| after* | object | — |
| diff | string | — |
| checks* | array | — |
analyze_repoCALL when entering an unfamiliar repository or deciding whether to depend on, fork, learn from, or deploy it. Returns a concise four-use-case brief, watchouts, evidence confidence, architecture summary, freshness, and next actions without dumping the full generated artifact. Use get_artifact when f…CALL when entering an unfamiliar repository or deciding whether to depend on, fork, learn from, or deploy it. Returns a concise four-use-case brief, watchouts, evidence confidence, architecture summary, freshness, and next actions without dumping the full generated artifact. Use get_artifact when f…
| Parametro | Tipo | Descrizione |
|---|---|---|
| repo | string | Public GitHub repository as owner/repo or a github.com URL. |
| package | string | npm package name, for example lodash or npm:@scope/pkg. To judge a specific VERSION rather than the package as a whole, use evaluate_dependency_change instead. |
| owner | string | Repository owner, when repo carries only the bare name. Optional: prefer the single owner/repo form in repo. |
plan_repo_taskCALL before editing an unfamiliar public repository. Returns a bounded reading order, relevant files, dependency consumers, test/verification obligations, analyzed-vs-checked SHA relation, evidence provenance, and a short-lived verification contract. Task text is used only for bounded local matchin…CALL before editing an unfamiliar public repository. Returns a bounded reading order, relevant files, dependency consumers, test/verification obligations, analyzed-vs-checked SHA relation, evidence provenance, and a short-lived verification contract. Task text is used only for bounded local matchin…
| Parametro | Tipo | Descrizione |
|---|---|---|
| repo | string | Public GitHub repository as owner/repo or a github.com URL. |
| package | string | npm package name, for example lodash or npm:@scope/pkg. To judge a specific VERSION rather than the package as a whole, use evaluate_dependency_change instead. |
| owner | string | Repository owner, when repo carries only the bare name. Optional: prefer the single owner/repo form in repo. |
| task* | string | — |
| checked_sha | string | — |
| intent | object | — |
| max_files | integer | — |
| path_hints | array | Optional repository-relative files or directories to prioritize. |
get_artifactCALL before substantial code work in an unfamiliar repository when the agent needs key files, entry points, architecture hypotheses, a reading order, and verify-before-trusting guidance. Returns the cached CLAUDE.md-style artifact or Cursor rules. Do not call again if the artifact is already in con…CALL before substantial code work in an unfamiliar repository when the agent needs key files, entry points, architecture hypotheses, a reading order, and verify-before-trusting guidance. Returns the cached CLAUDE.md-style artifact or Cursor rules. Do not call again if the artifact is already in con…
| Parametro | Tipo | Descrizione |
|---|---|---|
| repo | string | Public GitHub repository as owner/repo or a github.com URL. |
| package | string | npm package name, for example lodash or npm:@scope/pkg. To judge a specific VERSION rather than the package as a whole, use evaluate_dependency_change instead. |
| owner | string | Repository owner, when repo carries only the bare name. Optional: prefer the single owner/repo form in repo. |
| format | string | Optional. markdown for CLAUDE.md-style guidance (the default); cursor for .mdc rules. |
compare_reposCALL when the user is choosing between exactly two dependencies or repositories. Returns the preferred candidate for each use case, material trade-offs, confidence, and evidence gaps. Each target is owner/repo, a GitHub URL, an npm package name, or npm:@scope/pkg. Cached full analyses are preferred…CALL when the user is choosing between exactly two dependencies or repositories. Returns the preferred candidate for each use case, material trade-offs, confidence, and evidence gaps. Each target is owner/repo, a GitHub URL, an npm package name, or npm:@scope/pkg. Cached full analyses are preferred…
| Parametro | Tipo | Descrizione |
|---|---|---|
| a* | string | First repo or npm package target. |
| b* | string | Second repo or npm package target. |
check_change_riskCALL before merging a pull request or after producing a local diff. Returns a deterministic 0-10 change-shape score with receipts for size, spread, missing tests, sensitive paths, hotspots, and blast radius. Pass repo+pr OR diff; repo may accompany diff for cached hotspot context. This prioritizes…CALL before merging a pull request or after producing a local diff. Returns a deterministic 0-10 change-shape score with receipts for size, spread, missing tests, sensitive paths, hotspots, and blast radius. Pass repo+pr OR diff; repo may accompany diff for cached hotspot context. This prioritizes…
| Parametro | Tipo | Descrizione |
|---|---|---|
| repo | string | owner/repo or a github.com URL. |
| pr | number | string | Positive pull request number, used with repo. |
| diff | string | Raw unified git diff to score directly. |
| files | array | Privacy-preserving changed-file facts; contains no source or diff hunks. |
| contract_id | string | Optional short-lived contract_id returned by plan_repo_task. |
| base_sha | string | — |
| head_sha | string | — |
| proofs | array | — |
8 strumenti su 8 hanno pubblicato una descrizione.
I nomi e le descrizioni degli strumenti sono scritti dal publisher e mostrati alla lettera come testo inerte. Sono le stringhe che un client MCP passa a un modello, quindi Forge vi cerca schemi di prompt injection — ogni rilievo compare insieme all’analisi di sicurezza qui sopra. «Privilegiato» è una corrispondenza di parola chiave sul nome dello strumento, non una verifica di ciò che fa: un nome innocuo può comunque fare qualsiasi cosa.
Repository evidence for agents before they adopt dependencies, enter codebases, compare, or merge.
I nomi collegati aprono l’indice Forge di tutte le voci osservate esporre quello strumento. Sfoglia tutti gli strumenti indicizzati.
Questa voce non pubblica alcun pacchetto npm, quindi Forge non ha un albero delle dipendenze per essa. È una lacuna di copertura, non l'affermazione che non abbia dipendenze.