Audit and repair any public GitHub repo. Free survey; paid source, unified diffs and a pull request.
Inferred from the transports this listing declares (streamable-http). A client not listed here hasn’t been ruled out — it just isn’t something Forge can confirm.
Verification confirms publisher identity (repo ownership), not code safety. The security scan covers known CVEs and suspicious install scripts.
Read from a real MCP initialize → tools/list handshake against the declared endpoint. No tool was ever invoked — tools/list is the read-only introspection call the protocol defines for this. It reflects what the server advertised at that moment; a hosted endpoint is not pinned to any version and can change without notice.
https://shpbl.com/mcpauth requiredhttps://shpbl.com/api/public/mcp17 tools · 1663mswelcomeCall this first, once, when a person connects. Returns the welcome, the full tool menu with one line per tool, the exact sentences a person can say to start a run, the support address, and the link to the user's manual. Free, unmetered, no key. Read it to the person in your own words — warmly and b…Call this first, once, when a person connects. Returns the welcome, the full tool menu with one line per tool, the exact sentences a person can say to start a run, the support address, and the link to the user's manual. Free, unmetered, no key. Read it to the person in your own words — warmly and b…
| Parameter | Type | Description |
|---|---|---|
| name | string | The person's first name, if you know it, so the greeting can use it. |
list_reposLists real repository names so a run never starts on a guessed one, and answers whether a repository can be written to. Pass `github_token` to see everything that token can see, or `owner` to list a public account's repositories; with neither, it lists the repositories the SHPBL GitHub App is insta…Lists real repository names so a run never starts on a guessed one, and answers whether a repository can be written to. Pass `github_token` to see everything that token can see, or `owner` to list a public account's repositories; with neither, it lists the repositories the SHPBL GitHub App is insta…
| Parameter | Type | Description |
|---|---|---|
| github_token | string | A GitHub token (PAT or fine-grained) to list with. Never stored, never logged — used for this call only. |
| owner | string | A GitHub user or organisation to list the public repositories of, when no token is available. |
| key | string | Your SHPBL key (shpbl_mcp_…), only needed to list App-connected repositories. Optional if sent as the Authorization header. |
| limit | integer | How many repositories to return (default 30, max 100). |
| page | integer | Which page of the connected-repository list to return, 1-based. Use this rather than a higher `limit` past 100; the response names the next page when there is… |
| repo | string | Ask about one target, `owner/repo`: whether this key may open a pull request on it. Call this before offering to write. |
method_protocolReturn the SHPBL disciplines verbatim — evaluation, remediation and harvest — plus the component classes' verification axes and the reporting style. Free and unmetered. Fetch it once, then call `fix_repo` or `harvest_repo` with `brief: true` so their payload is source rather than repeated instructi…Return the SHPBL disciplines verbatim — evaluation, remediation and harvest — plus the component classes' verification axes and the reporting style. Free and unmetered. Fetch it once, then call `fix_repo` or `harvest_repo` with `brief: true` so their payload is source rather than repeated instructi…
| Parameter | Type | Description |
|---|---|---|
| stage | string | One stage only: `evaluate`, `fix` or `harvest`. Omit for all three. |
run_contractRead the canonical twelve-step run contract, or check a run bundle against it. Call it with no `files` to get the contract itself: every step's id, the artifacts it must produce, the exact condition that closes it, the terminal word to report when it does not, the instruction-precedence order, the…Read the canonical twelve-step run contract, or check a run bundle against it. Call it with no `files` to get the contract itself: every step's id, the artifacts it must produce, the exact condition that closes it, the terminal word to report when it does not, the instruction-precedence order, the…
| Parameter | Type | Description |
|---|---|---|
| files | object | The run bundle as `path: text`, relative to the run folder (for example `STEP-LEDGER.json`). Send the canonical outputs you have; the gate says what is missing… |
| through_step | integer | Evaluate gates through this step only. Defaults to 12. |
pin_sourceBuild `HOST-SOURCE-MANIFEST.json` for canonical step 1 from a GitHub repository, online, with no clone and no download: every file's Git blob identity, the byte length, the head commit, and the `SHPBL-SOURCE-DIGEST/1` digest over the pinned tree. Write the returned JSON to your run folder as `HOST-…Build `HOST-SOURCE-MANIFEST.json` for canonical step 1 from a GitHub repository, online, with no clone and no download: every file's Git blob identity, the byte length, the head commit, and the `SHPBL-SOURCE-DIGEST/1` digest over the pinned tree. Write the returned JSON to your run folder as `HOST-…
| Parameter | Type | Description |
|---|---|---|
| repo* | string | A GitHub repository: `owner/repo`, a github.com URL, or `owner/repo#branch`. |
| key | string | Your SHPBL key, if you have one. Optional — this tool is free; a key only helps reach a private repository through a connected GitHub App install. |
| github_token | string | Optional GitHub token (Contents: read) for a private repository. |
| label | string | What to call the target in the manifest. Defaults to `owner/repo@branch`. |
evaluate_repoAudit any GitHub repository and get back one complete result: a report (inventory, languages, spine files, risk signals), the capabilities found in it (name, signature, file and line, stated contract, dependencies), and how it stands against SHPBL's anonymous corpus of audited repositories. Works w…Audit any GitHub repository and get back one complete result: a report (inventory, languages, spine files, risk signals), the capabilities found in it (name, signature, file and line, stated contract, dependencies), and how it stands against SHPBL's anonymous corpus of audited repositories. Works w…
| Parameter | Type | Description |
|---|---|---|
| repo* | string | A GitHub repository: `owner/repo`, a github.com URL, or `owner/repo#branch`. |
| key | string | Your SHPBL key (shpbl_mcp_…), if you have one. Optional — without it the audit runs at the free depth. Also read from the `Authorization: Bearer …` header. |
| github_token | string | Optional GitHub token (Contents: read) for a private repository. Not needed if the owner connected the SHPBL GitHub App to this key at https://shpbl.com/mcp-ac… |
| brief | boolean | Default true: keep the audit compact and do not include the full method protocol. Set false to include the protocol block. |
| protocol_ack | boolean | Set true to say you already hold the SHPBL protocol. The discipline, the ten meta capabilities, the hands-off list and the return shape are then not reprinted… |
| as_free | boolean | Run at the free depth even when the key carries a paid tier, so you can see exactly what a caller without a subscription is handed. Costs no allowance and chan… |
| own_library | array | Your own previously harvested capabilities, read out of your repository's `.shpbl/` library and passed back in. Optional. When present, this run checks your co… |
| sections | array | Which sections to print, when you only need some of them. Omit it and the whole audit comes back, which is the right default on a first call. On a follow-up —… |
fix_repoThe repair: verbatim source of the files you name — or the repository's spine when you name none — paginated for your context window, with the remediation protocol your model writes the diffs against. Free to run with no key: every file you name, paginated, plus the ordered remediation protocol — r…The repair: verbatim source of the files you name — or the repository's spine when you name none — paginated for your context window, with the remediation protocol your model writes the diffs against. Free to run with no key: every file you name, paginated, plus the ordered remediation protocol — r…
| Parameter | Type | Description |
|---|---|---|
| key | string | Your SHPBL key (shpbl_mcp_…), if you have one. Optional — without it the repair returns one file at the free depth. Also read from the `Authorization: Bearer …… |
| github_token | string | Optional GitHub token (Contents: read) for a private repository. Not needed if the SHPBL GitHub App is connected to this key. |
| repo* | string | A GitHub repository: `owner/repo` or a URL. |
| paths | array | Paths to read, from the evaluation. Omit to read the repository's spine. |
| part | integer | Which page of source to return. Page 1 reports the total and carries the protocol. |
| brief | boolean | Skip the remediation protocol preamble and return source with a one-line reminder instead. Use it once you already hold the method — `method_protocol` (free) r… |
| protocol_ack | boolean | Set true to say you already hold the SHPBL protocol — the discipline, the ten meta capabilities, the hands-off list and the return shape are then not reprinted… |
| own_library | array | Your own previously harvested capabilities, read out of your repository's `.shpbl/` library and passed back in. Optional. When present, this run checks your co… |
harvest_repoThe harvest shortcut: point it at a repository you hold a licence to reuse — one you do not own and will never open a pull request against — and it goes straight to the capabilities. It reads what that repository can already do, fuses those affordances with the owned SHPBL capability library, ranks…The harvest shortcut: point it at a repository you hold a licence to reuse — one you do not own and will never open a pull request against — and it goes straight to the capabilities. It reads what that repository can already do, fuses those affordances with the owned SHPBL capability library, ranks…
| Parameter | Type | Description |
|---|---|---|
| key | string | Your SHPBL Practitioner subscription key (shpbl_mcp_…). Optional if your client sends it as the `Authorization: Bearer …` request header. |
| github_token | string | Optional GitHub token (Contents: read) for a private repository. Not needed if the SHPBL GitHub App is connected to this key. |
| cml_license | string | Your perpetual copy's licence key, if you hold one. It changes retention, never depth. |
| governor_key | string | Operator passphrase for SHPBL's own copy. Resolved by the server; it changes only where the harvest is staged, never what is proposed. |
| repo* | string | A GitHub repository: `owner/repo` or a URL. |
| part | number | Walk mode only: which batch to return, 1 to 2000. Batch 1 carries the protocol and the manifest; walk them all in order. |
| include | string | Optional path filter — only paths containing this text are harvested. |
| estimate | boolean | Return the size of the walk only — batch count, total characters, largest batch, split files — with no source. |
| ledger_digest | string | The ledger folded so far, handed back by a previous session so this batch continues the same run instead of starting over. |
| budget | number | Characters per batch — a whole number from 10,000 to 120,000. Defaults to 90000; lower it for a smaller context window, raise it only if the client can carry i… |
| brief | boolean | Walk mode only: skip the harvest protocol preamble on batch 1 and spend the payload on source. Use it once you already hold the method — `method_protocol` (fre… |
| mode | string | `harvest` (the default when nothing else in the call implies a walk) is the shortcut: proposals, your decision, then the seed modules for what you approved. `w… |
| grants | number | Harvest mode: how many capability proposals to rank, 1 to 200. There is no fixed shallow ceiling any more — a sophisticated repository can support far more tha… |
| quality_floor | number | Harvest mode: drop proposals scoring below this, 0 to 1. The score is a discovery aid for ordering what to read first — it is never evidence that a capability… |
| novelty_threshold | number | Harvest mode: how different a proposal must be from the higher-ranked ones already chosen, 0 to 1, measured on bound capabilities and title vocabulary. 0 suppr… |
| suppress_duplicates | boolean | Harvest mode: drop proposals whose proposed composition is identical to a higher-ranked one. Default true. |
| per_affordance | number | Harvest mode: how many proposals one host affordance may produce, 1 to 200. |
| pages | number | Harvest mode: how many source pages to read for evidence, 1 to 12 (about 90,000 characters each). Proposals are cut only from what was actually read. |
| approve | array | Harvest mode: the grant ids the person approved. Only these are emitted. Omit it on the first call — the proposals have to be put to them first. An id nobody p… |
| decline | array | Harvest mode: the grant ids the person explicitly said no to. Only these are recorded as declined; anything they were not asked about stays open and is re-offe… |
| approved_by | string | The name of the person who approved them. Required with `approve`. An agent, a model, a vendor, a policy or a default is refused, not recorded. |
| host_license | string | What the target repository's licence permits for this reuse, and any obligation it attaches — for example `MIT, attribution required`. Required with `approve`;… |
| reuse_permitted | boolean | Required with `approve`: the person's explicit statement that reuse of this upstream project is permitted for this composition. Absence is never a yes, and SHP… |
| upstream_project | string | The upstream project the reuse is declared against. Defaults to the repository being harvested. |
compose_capabilityThe harvest lane: read what a repository can already do, then offer codeless capability nominations that fuse those affordances with owned SHPBL primitive capabilities — DREAM, EVOLUTION, MEMORY, DEFENSE, BRAIN and the rest of the canonical forty, plus the S-Tier artifacts. Each nomination names ho…The harvest lane: read what a repository can already do, then offer codeless capability nominations that fuse those affordances with owned SHPBL primitive capabilities — DREAM, EVOLUTION, MEMORY, DEFENSE, BRAIN and the rest of the canonical forty, plus the S-Tier artifacts. Each nomination names ho…
| Parameter | Type | Description |
|---|---|---|
| key | string | Your SHPBL Practitioner subscription key (shpbl_mcp_…). Optional if your client sends it as the `Authorization: Bearer …` request header. |
| github_token | string | Optional GitHub token (Contents: read) for a private repository. |
| repo* | string | A GitHub repository: `owner/repo` or a URL. |
| include | string | Optional path filter — only paths containing this text are read for affordances. |
| grants | number | How many codeless capability nominations to return, 1 to 200. Ranked by measured fit and capability standing. |
| per_affordance | number | How many nominations one affordance may produce, 1 to 200. Raise it to see alternative leads for the same host capability. |
| pages | number | How many source pages to read for affordance evidence, 1 to 12 (about 90,000 characters each). More pages means more of the tree is read; the grants are cut fr… |
build_intentThe gate between discovery and creation, and the human checkpoint in front of it. Register one Build Intent — what you found in the host, what SHPBL already possesses, what new software becomes possible, why neither parent does it alone, and the tests that would prove it — and this returns the mech…The gate between discovery and creation, and the human checkpoint in front of it. Register one Build Intent — what you found in the host, what SHPBL already possesses, what new software becomes possible, why neither parent does it alone, and the tests that would prove it — and this returns the mech…
| Parameter | Type | Description |
|---|---|---|
| key | string | Your SHPBL Practitioner key (shpbl_mcp_…). Optional if your client sends it as the `Authorization: Bearer …` header. |
| cml_license | string | The licence key from a purchased Complete Master Library. Perpetual rights to that release count as execution authority on their own — no subscription needed. |
| governor_key | string | Governor authority. Only a Governor-resolved call may stage an artifact for SHPBL's global corpus. |
| github_token | string | Optional GitHub token (Contents: read) so the gate can read the host tree and prove the cited paths exist. Not needed if you pass `host_source_manifest`. |
| host_source_manifest | — | The `HOST-SOURCE-MANIFEST.json` from `pin_source` or `tools/source-manifest.mjs`, as JSON text or an object. Offline runs must send this: the gate recomputes i… |
| intent* | object | The Build Intent record; every field it asks for is part of the evidence, and each field carries its own description in this schema. Required: `build_intent_id… |
| human_decision | object | The person's decision on this proposal. Step 9 is a blocking checkpoint: without an attributed human decision this tool returns the words to say and nothing el… |
run_gauntletOne runner for an entire SHPBL repository audit and repair: survey, opening library comparison, evaluation, repair, the batched harvest, closing library comparison, the branded HTML report, and the write-back path. STRICT SEQUENCE: call it once with no `step` for the run card, then `step: 1`, `step…One runner for an entire SHPBL repository audit and repair: survey, opening library comparison, evaluation, repair, the batched harvest, closing library comparison, the branded HTML report, and the write-back path. STRICT SEQUENCE: call it once with no `step` for the run card, then `step: 1`, `step…
| Parameter | Type | Description |
|---|---|---|
| key | string | Your SHPBL Practitioner subscription key (shpbl_mcp_…). Optional if your client sends it as the `Authorization: Bearer …` request header. |
| repo* | string | A GitHub repository: `owner/repo`, a URL, or `owner/repo#branch`. |
| github_token | string | Optional GitHub token (Contents: read) for a private repository. Not needed if the SHPBL GitHub App is connected to this key. |
| step | number | 0 to 2000. 0 (default) returns the run card and the plan with no source. 1…N walk the harvest batches, one per turn and in order. N+1 closes the run with the r… |
| include | string | Optional path filter — only paths containing this text are in scope for the whole run. |
| ledger_digest | string | The ledger folded so far, one line per capability, **each line carrying the file path it came from** (for example `src/lib/queue.ts — retry with backoff`). Req… |
| fold_token | string | The `fold_token` returned by the previous step, passed back verbatim. Required from `step: 2` onward: it is signed by this server and carries the previous step… |
| continue_ack | string | The person's approval to continue past a checkpoint. Every 3 harvest steps this run pauses: report to the person, ask whether to continue, and only when they s… |
| checkpoint_interval | number | How many harvest steps between check-ins with the person. Defaults to 3; raise it (up to 10) only when the person has asked for fewer pauses. Never set it sile… |
| protocol_ack | boolean | Set true to say this session already holds the SHPBL protocol. The discipline, the ten meta capabilities, the hands-off list and the return shapes are then not… |
| own_library | array | Your own previously harvested capabilities, read out of your repository's `.shpbl/` library and passed back in. Optional. When present, this run checks your co… |
| personality | string | How the person wants to be spoken to for this run: technical, professional, friendly, light, coach, deadpan. Ask them once before step 0 and pass what they cho… |
| budget | number | Characters per harvest step — a whole number from 10,000 to 120,000. Defaults to a moderate 45,000 so each step stays readable and cheap; raise it toward 90,00… |
library_indexEverything published on shpbl.com in one read: the editions and their prices and licences, the seven volumes of The Strategic Master Library with their seals and read links, the public downloads with byte sizes, and the case studies of real audit runs with each verdict, and `pools` — the canonical…Everything published on shpbl.com in one read: the editions and their prices and licences, the seven volumes of The Strategic Master Library with their seals and read links, the public downloads with byte sizes, and the case studies of real audit runs with each verdict, and `pools` — the canonical…
| Parameter | Type | Description |
|---|---|---|
| sections | array | Which sections to return. Omit for all of them: facts, volumes, editions, downloads, case_studies, pools. `pools` is the canonical reconciliation of every coun… |
| volume | string | One volume in full, by slug or by number 1-7. Its complete text is a `library_document` call. |
| case_study | string | One case study in full, by slug — what the run got right and what it learned. |
library_documentRead one long SHPBL document, paged for a context window: `volume` (the complete text of a volume of The Strategic Master Library), `catalog_outline` (the Collective catalog's parts, component classes, agent-kit steps and verification axes), `report_template` (the branded audit report HTML to fill…Read one long SHPBL document, paged for a context window: `volume` (the complete text of a volume of The Strategic Master Library), `catalog_outline` (the Collective catalog's parts, component classes, agent-kit steps and verification axes), `report_template` (the branded audit report HTML to fill…
| Parameter | Type | Description |
|---|---|---|
| key | string | Your SHPBL subscription key (shpbl_mcp_…). Optional if your client sends it as the `Authorization: Bearer …` request header. |
| document* | string | Which document to read. |
| volume | string | Required for `document: volume` — the volume slug or its number, 1 through 7. |
| section | string | For `document: catalog_outline` — only parts or sections whose name contains this text. |
| part | number | 1-based page of the document, up to 60. |
library_searchSearch the Collective Master Library for a capability in plain words, before writing new code. `scope: "catalog"` (Practitioner) searches the engineered components — class, what each does, API surface, line counts, verification marks. `scope: "composites"` searches capabilities earlier runs invente…Search the Collective Master Library for a capability in plain words, before writing new code. `scope: "catalog"` (Practitioner) searches the engineered components — class, what each does, API surface, line counts, verification marks. `scope: "composites"` searches capabilities earlier runs invente…
| Parameter | Type | Description |
|---|---|---|
| key | string | Your SHPBL subscription key (shpbl_mcp_…). Optional if your client sends it as the `Authorization: Bearer …` request header. |
| scope | string | `catalog` — engineered components (Practitioner). `crown-jewels` — the S-Tier Vault of standalone lab-curated artifacts. `composites` — capabilities past runs… |
| query | string | Plain-words capability, name, ID or API symbol. Omit to page the whole pool. |
| ids | array | Up to 20 component IDs (e.g. `STIER-S-84`, `BLD-ENG-303`) returned in full instead of a search. |
| component_class | string | Catalog only: restrict to one component class, e.g. `CrownJewel/S-Tier`, `Block/Engine`. Substring match. |
| pack | string | Vault only: restrict to one vertical pack, e.g. `fintech-v1`. Substring match. |
| certified_only | boolean | Crown jewels only: return only rows whose body the certification harness executed and read clean (CERTIFIED or PROVISIONAL). This withholds the INCONCLUSIVE ro… |
| include_siblings | boolean | With `ids`: also list up to 12 other component IDs in the same class, for comparison. |
| page | number | 1-based page of results. A page past the end is refused, never returned empty. |
| page_size | number | Rows per page, 1 to 50. Defaults to 20. |
| limit | number | Alias for `page_size`, 1 to 50. Given both, `page_size` wins. |
selfcheck_mcpRuns SHPBL's own audit against the running server and returns one pass/fail/unavailable line per verification axis: the registered tool surface against the priced tier table, version agreement across the published files, subscription-register reachability, catalog reachability, repository-write aut…Runs SHPBL's own audit against the running server and returns one pass/fail/unavailable line per verification axis: the registered tool surface against the priced tier table, version agreement across the published files, subscription-register reachability, catalog reachability, repository-write aut…
| Parameter | Type | Description |
|---|---|---|
| verbose | boolean | Include the full tool-to-tier table and the axis definitions in the answer. |
subscription_statusReport the tiers of this MCP server and — from the `key` argument or the same `Authorization` header the gated tools read — that key's tier, status and month-to-date usage. This is the authoritative answer to "am I connected, and what do I have".Report the tiers of this MCP server and — from the `key` argument or the same `Authorization` header the gated tools read — that key's tier, status and month-to-date usage. This is the authoritative answer to "am I connected, and what do I have".
| Parameter | Type | Description |
|---|---|---|
| key | string | Optional SHPBL subscription key. Omit it if your client sends the key as a request header. |
write_to_repoprivilegedLand finished work in a repository as a pull request: pass the files you wrote (full new contents, not diffs) and this opens a branch and a PR for the human to review and merge. Nothing is ever pushed to the default branch. Requires a SHPBL Practitioner key and the SHPBL GitHub App installed on tha…Land finished work in a repository as a pull request: pass the files you wrote (full new contents, not diffs) and this opens a branch and a PR for the human to review and merge. Nothing is ever pushed to the default branch. Requires a SHPBL Practitioner key and the SHPBL GitHub App installed on tha…
| Parameter | Type | Description |
|---|---|---|
| key | string | Your SHPBL subscription key (shpbl_mcp_…). Optional if your client sends it as the `Authorization: Bearer …` request header. |
| repo* | string | The GitHub repository to write to: `owner/repo` or a URL. |
| title* | string | Pull request title — say what the change does. |
| summary* | string | Pull request body: the repair order, or the run seal and coverage of a harvest. Markdown. |
| files* | array | Complete file contents to commit. For a repair, the whole fixed file — not a diff. |
| run_id | string | A stable id for this piece of work (a harvest run seal, a repair order id). Retrying with the same run_id lands on the same branch and updates the same pull re… |
| branch | string | Branch to write on. Defaults to one derived from `run_id`, or `shpbl/<date>-<n>`; reusing a name appends to that PR. |
| base_ref | string | Branch to open against. Defaults to the repository's default branch. |
| kind | string | What this pull request lands. `harvest` means kept capabilities and a ledger: write them under `.shpbl/` and this scaffolds `.shpbl/README.md` as the index of… |
| build_authorization | array | The signed build authorizations `build_intent` returned, one per artifact this pull request lands. Required when `kind` is `foundry`: the server verifies each… |
| github_token | string | One-off GitHub token with Contents and Pull requests write. Used for this call only and never stored. Omit it if the SHPBL GitHub App is installed. |
17 of 17 tools published a description.
Tool names and descriptions are written by the publisher and shown verbatim as inert text. They are the strings an MCP client passes to a model, so Forge scans them for prompt-injection patterns — any finding appears with the security scan above. “Privileged” is a keyword match on the tool name, not an audit of what the tool does: a benign-sounding name can still do anything.
Audit and repair any public GitHub repo. Free survey; paid source, unified diffs and a pull request.
Linked names open Forge’s index of every entry observed exposing that tool. Browse all indexed tools.
This entry publishes no npm package, so Forge has no dependency tree for it. That is a gap in coverage — not a statement that it has no dependencies.