# letmediff

MCP server of letmediff.it...allows the agent to show the diff url and receive the diff comments from the server

- **Type:** MCP server
- **Trust:** 85/100 (A), scored on the package rubric
- **Verification:** verified (build provenance)
- **Version:** 0.0.11
- **License:** ISC
- **npm:** letmediff
- **Source:** https://github.com/paoloricciuti/letmediff
- **Compatible clients:** claude-code, cursor, copilot, gemini (basis: transport)

## Trust

85/100 (A), scored on the package rubric
- Publisher verified: no
- Build provenance: verified attestation
- npm trusted publishing (OIDC): yes
- Install scripts: nothing suspicious found
- Prompt-injection scan: not run
- Obfuscation scan: not run
- Evidence age: 0 days

## Security scan

- **Status:** clean
- **Scanned:** 2026-09-08T01:10:17.887Z
- **Version scanned:** 0.0.11
- **CVEs:** none found by OSV at scan time

## Tools

2 declared. Statically extracted from the shipped source — a floor on the surface, not a census.
- `get_url` — Invoke this when the users ask you to review the code to get the review URL. You can include multiple steps each should be used to guide the user through the be
- `wait_for_feedback` — Wait for the user to provide feedback on the diff. The tool will return the feedback provided by the user so after it returns assume that's the user telling you

## Install

**Verdict: install** — No blocking findings and no open coverage gaps — safe to install as configured.
**Config** (claude-code):
```json
"{\n  \"mcpServers\": {\n    \"letmediff\": {\n      \"command\": \"npx\",\n      \"args\": [\n        \"-y\",\n        \"letmediff\"\n      ]\n    }\n  }\n}"
```

## Blast radius

Contained to moderate — no credential declaration found, from the publisher, the upstream registry, or the README. Known so far: runs on your machine; read-only tool surface.
- Floor 13, ceiling 31 (tier: unknown)
- `unknown` means the floor and ceiling land in different bands — not measured enough to name one. It does not mean low.
- This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score.

## Machine-readable views of this entry

- Signed JSON: https://forgeregistry.com/api/v1/packages/letmediff
- Install plan: https://forgeregistry.com/api/v1/packages/letmediff/install-plan
- Alternatives: https://forgeregistry.com/api/v1/alternatives/letmediff
- HTML page: https://forgeregistry.com/registry/letmediff
- MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan`

## About this document

Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.