Skip to main content
Glama

Server Details

Repository evidence for agents before they adopt dependencies, enter codebases, compare, or merge.

If you are the author of this connector, you can claim ownership by verifying the domain or GitHub account it belongs to. Claimed connector authors can inspect health checks, view analytics, and manage their listing.
Status
Healthy
Uptime
100.0% over 66 days
Last Tested
Transport
Streamable HTTP · MCP 2025-11-25
URL

TDQS

A4.3/5.0

Scored across 8 tools

Disambiguation4/5

Each tool has an explicit 'CALL when' trigger and most targets are distinct (code Q&A, artifact fetch, task planning, PR risk, dependency evaluation). However, the dependency cluster (check_dependency, evaluate_dependency_change, verify_dependency_change, compare_repos) shares heavily overlapping purpose and could still be misselected, especially check_dependency vs evaluate_dependency_change.

Naming Consistency5/5

All eight tools follow a consistent snake_case verb_noun pattern (analyze_repo, check_change_risk, get_artifact, plan_repo_task, verify_dependency_change). No camelCase or style mixing.

Tool Count5/5

Eight tools is well-scoped for a repo/dependency analysis assistant, and each tool maps to a distinct stage of the analyze-plan-change-verify workflow with little redundancy in count.

Completeness4/5

The surface covers code understanding, task planning, dependency evaluation, change risk, and post-change verification, giving broad lifecycle coverage. Minor gaps exist, such as no repository discovery/search or support for comparing more than two candidates, but core workflows are covered.

Available Tools

8 tools
analyze_repoUnderstand a repository or inspect source evidenceA
Read-onlyIdempotent
Inspect

CALL to investigate behavior in public source: supply question and relevant path_hints found from actual usages, for up to four files with commit-pinned line citations. checked_sha selects a commit; base_sha adds before/after excerpts; pr selects a public PR and observes its head's GitHub check runs. source_ranges retrieves missing context at pinned revisions, up to 40 lines per range. Selection is bounded, not exhaustive or proof of compatibility. Without question, returns repository_brief with saved purpose, main parts, starting files, setup, revisions and gaps. Pass exactly one of repo or package. Example: {repo:'expressjs/multer',question:'How are file size limits handled?',path_hints:['lib/make-middleware.js']}.

ParametersJSON Schema
NameRequiredDescriptionDefault
prNoPublic PR number in repo. Requires question. Omit base_sha.
repoNoPublic GitHub repository as owner/repo or a github.com URL.
ownerNoRepository owner, when repo carries only the bare name. Optional: prefer the single owner/repo form in repo.
packageNonpm package name, for example lodash or npm:@scope/pkg. To judge a specific VERSION rather than the package as a whole, use evaluate_dependency_change instead.
base_shaNoCompare source at this base commit; omit when using pr.
questionNo
path_hintsNoScope retrieval to these repository-relative files or directories. Requires question.
checked_shaNoImmutable head revision; required with source_ranges.
source_rangesNoRead only these exact ranges, at most two per file/side and 40 lines per range. Requires question and checked_sha; base side also requires base_sha. Paths must fall within path_hints when supplied. Omit pr for base ranges.

Output Schema

ParametersJSON Schema
NameRequiredDescription
toolYes
agentYes
statusYes
schema_versionYes
repository_briefNoConcise saved repository orientation shared with the website: purpose, main parts, starting files, setup, revisions and gaps. Null when unavailable; omitted in source-evidence mode.

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover safety (readOnlyHint, idempotentHint, destructiveHint=false), but the description adds substantive behavioral limits beyond them: selection is 'bounded, not exhaustive or proof of compatibility', four-file cap, 40-line-per-range cap, commit-pinned citations, and the PR check-run behavior. That is real added context, though it doesn't discuss rate limits or error behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with an imperative 'CALL to investigate behavior in public source', then proceeds through parameter behaviors in a logical order. It is dense and semicolon-heavy, packing multiple constraints per sentence, but nearly every clause carries a distinct, load-bearing fact rather than filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a nine-parameter tool with nested source_ranges and a declared output schema, the description covers the essential mode interactions (pr vs base_sha, question-required modes, one-of repo/package) and even summarizes repository_brief. Combined with the existing output schema, an agent has enough to invoke it correctly, with only minor gaps around failure modes.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 89%, so the baseline is 3 and the schema already documents most parameters. The description still adds cross-cutting semantics: how checked_sha/base_sha/pr/source_ranges combine, the before/after excerpt behavior, and the precise 'up to 40 lines per range' retrieval bound. This is meaningful beyond the schema's per-field text.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: investigate behavior in public source via question + path_hints, returning commit-pinned line citations. The scope (up to four files, bounded selection) is precise. It does not, however, name or distinguish itself from any sibling such as compare_repos or check_change_risk, so an agent still has to infer the boundary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear operational context for each mode: checked_sha selects a commit, base_sha adds before/after excerpts, pr selects a public PR and observes its check runs, source_ranges fills missing context, and omitting question yields repository_brief. It also states 'Pass exactly one of repo or package.' It stops short of explicit when-not guidance or naming an alternative tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

check_change_riskPrioritize review for a PR or diffA
Read-only
Inspect

CALL before merging a pull request or after producing a local diff. Returns a deterministic 0-10 change-shape score with receipts for size, spread, missing tests, sensitive paths, hotspots, and blast radius. Pass repo+pr OR diff; repo may accompany diff for cached hotspot context. This prioritizes review and never approves a merge.

ParametersJSON Schema
NameRequiredDescriptionDefault
prNoPositive pull request number, used with repo.
diffNoRaw unified git diff to score directly.
repoNoowner/repo or a github.com URL.
filesNoPrivacy-preserving changed-file facts; contains no source or diff hunks.
proofsNo
base_shaNo
head_shaNo
contract_idNoOptional short-lived contract_id returned by plan_repo_task.

Output Schema

ParametersJSON Schema
NameRequiredDescription
toolYes
agentYes
statusYes
schema_versionYes

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds valuable behavioral context: output is deterministic, it never approves a merge (limit on its authority), and it notes repo caching for hotspot context. It does not detail receipts format, but with readOnlyHint covering the safety dimension, 4 is generous but warranted.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, front-loaded with when to call, the core value (deterministic score with receipts), input modes, and a critical behavioral caveat. Every clause carries information; zero filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Output schema exists so return format needn't be detailed. The description covers invocation timing, input-mode disjunction, scoring dimensions, determinism, and non-approval semantics. It doesn't detail the receipt structure or caching behavior, but given the good annotations and output schema, this is adequately complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 63%, and the description fills key gaps: it explains the input-mode semantics (repo+PR OR diff), states repo may accompany diff for cached hotspot context, and notes files array is 'privacy-preserving... contains no source' — clarifying that line counts may be placeholders. This adds meaning beyond the oneOf constraints.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states it computes a 'deterministic 0-10 change-shape score' with receipts for specific factors (size, spread, missing tests, sensitive paths, hotspots, blast radius). The verb 'check' plus resources (PR/diff) and the distinct scoring behavior distinguish it from siblings like check_dependency or analyze_repo.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says 'CALL before merging a pull request or after producing a local diff', giving concrete timing. It lists valid input combinations ('repo+pr OR diff; repo may accompany diff') and clarifies it 'prioritizes review and never approves a merge', which sets expectations for when it's appropriate vs not.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

check_dependencyCheck a dependency before adoptionA
Read-onlyIdempotent
Inspect

CALL when the user or agent is about to add, upgrade, trust, fork, or deploy an npm package or public GitHub repository. Returns a lean repository-level recommendation, confidence, evidence gaps, CVEs, maintenance, ownership, license, CI/tests, Scorecard, freshness, and next actions. DO NOT use for code navigation. Pass exactly one of repo or package. A favourable result does not validate an exact package version or compatibility.

ParametersJSON Schema
NameRequiredDescriptionDefault
repoNoPublic GitHub repository as owner/repo or a github.com URL.
ownerNoRepository owner, when repo carries only the bare name. Optional: prefer the single owner/repo form in repo.
packageNonpm package name, for example lodash or npm:@scope/pkg. To judge a specific VERSION rather than the package as a whole, use evaluate_dependency_change instead.

Output Schema

ParametersJSON Schema
NameRequiredDescription
toolYes
agentYes
statusYes
schema_versionYes

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, and non-destructive behavior; the description adds the important caveat that a favourable result does not validate an exact package version or compatibility. It also describes what kind of report is returned (lean repository-level recommendation, CVEs, maintenance, etc.), which is useful beyond the structured fields.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: it starts with the trigger condition, then the return value, then exclusions and constraints. Each sentence carries distinct information, and the longer list of returned fields is informative rather than filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the open-world read-only annotations and presence of an output schema, the description adequately covers triggers, parameter constraints, and the key version/compatibility limitation. It does not explicitly differentiate from all siblings like verify_dependency_change, but the 'before adoption' framing and version-routing rule are sufficient for an agent to select it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, yet the description still adds meaning by enforcing 'exactly one of repo or package' and clarifying that repo can be owner/repo or a github.com URL. The package parameter description also points users to evaluate_dependency_change for version checks, making parameter choice unambiguous.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific action ('check') and resource ('dependency before adoption') and lists concrete triggers: add, upgrade, trust, fork, or deploy. It also distinguishes itself from code navigation and from evaluate_dependency_change for version-specific checks, so an agent can identify the tool without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It opens with an explicit 'CALL when...' list of adoption scenarios and includes a 'DO NOT use for code navigation' exclusion. It further routes version-specific judgments to evaluate_dependency_change, giving clear when-to-use and when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compare_reposCompare two repository choicesA
Read-onlyIdempotent
Inspect

CALL when the user is choosing between exactly two dependencies or repositories. Returns the preferred candidate for each use case, material trade-offs, confidence, and evidence gaps. Each target is owner/repo, a GitHub URL, an npm package name, or npm:@scope/pkg. Cached full analyses are preferred; a miss uses bounded live GitHub/OpenSSF evidence with limited confidence and explicit unknowns rather than guessing.

ParametersJSON Schema
NameRequiredDescriptionDefault
aYesFirst repo or npm package target.
bYesSecond repo or npm package target.

Output Schema

ParametersJSON Schema
NameRequiredDescription
toolYes
agentYes
statusYes
schema_versionYes

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, openWorld, idempotent, non-destructive. The description adds valuable behavioral detail beyond these: it discloses that on a cache miss it uses bounded live GitHub/OpenSSF evidence with limited confidence and explicit unknowns rather than fabricated certainty. This is honest about limitations and return variability based on cache state.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, tightly packed with useful information: when to call, what's returned, accepted formats, and behavioral caveats. No wasted words or repetition of annotation content. Front-loaded with the trigger condition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Tool has an output schema and rich annotations, so description needn't cover return value structure. It covers trigger condition, target format inputs, evidence sourcing behavior, and confidence caveats. For a comparison tool with simple two-string inputs and disclosed fallback strategy, this is complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so both parameters a and b are documented. The description also adds meaning by explaining accepted formats (owner/repo, GitHub URL, npm package name, npm:@scope/pkg) which extends beyond the schema's generic 'repo or npm package target'. However, it doesn't clarify dimensional/ordering semantics (e.g., whether a/b order matters) beyond what the schema provides, so a baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool compares two repository/dependency choices and lists what it returns (preferred candidate per use case, trade-offs, confidence, evidence gaps). It explicitly scopes to 'exactly two' choices, distinguishing it from single-repo analysis siblings. The accepted target formats are enumerated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to CALL ('when the user is choosing between exactly two dependencies or repositories') and implies when NOT to (single choice). It describes the fallback behavior: cached analyses preferred, bounded live evidence on miss with explicit unknowns rather than guessing. This provides strong guidance for selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

evaluate_dependency_changeEvaluate an exact dependency change in project contextA
Read-onlyIdempotent
Inspect

CALL immediately before adding or upgrading an npm dependency. Answers "is this exact version safe to take on" from registry metadata, advisory deltas (for the version itself and for every package in the dependency tree a fresh install resolves to), provenance, license, and repository evidence, and returns blockers, warnings, a recommendation, and a verification plan. Example: {"dependency":"lodash","to_version":"4.17.21"} — every field is top-level, never nested under a "change" key. Only dependency is required — omit to_version to evaluate the latest published version, exactly as npm install <pkg> would. to_version also accepts a dist-tag ("latest") or a SemVer range ("^4.17.0"); it resolves to one exact version, reported back in change.to_version. Everything RepoPilot can infer is inferred, and every default, repair, and resolution is listed in input_adjustments. Evaluates only; never installs or edits anything.

ParametersJSON Schema
NameRequiredDescriptionDefault
intentNoOptional free text describing why you are making this change. Advisory only; it changes no verdict.
projectNoOptional, source-free facts about the project you are changing. Supplying it adds Node/peer/license compatibility and a command-level verification plan. Omit it entirely and compatibility comes back "unknown" - read that as not checked, never as no problem found. Every field is optional; anything missing is defaulted and reported in input_adjustments, never rejected. Never send source code.
dependencyYesA STRING: the npm package name on its own, with no version and no surrounding object — "lodash", "@types/node". Not {"name":...}, not {"lodash":"^4.17.0"}, not a list, and never wrapped in a top-level {"change":{...}} object — every field here is top-level. The version goes in to_version, the currently installed one in from_version.
to_versionNoThe version you intend to install — an exact version ("4.18.1"), a dist-tag ("latest"), or a SemVer range ("^4.17.0"). A quoted string is preferred; a bare JSON number ("to_version": 19) is also accepted and read as the string "19". Omit to evaluate the latest published version.
from_versionNoThe version currently installed, or omitted when adding a new dependency. A bare JSON number is accepted the same way as to_version. Supplying it produces a before/after advisory comparison.
policy_profileNoNamed team dependency policy. Strict requires provenance and denies package install hooks. Must be spelled exactly — a near-miss spelling is rejected rather than guessed, because reading it wrong would answer under a policy you did not ask for.balanced
dependency_typeNoWhere the dependency goes, in THESE words: "runtime" for a dependencies entry, "development" for devDependencies. The manifest and CLI spellings ("dev", "devDependencies", "--save-dev", "prod") are mapped onto these and reported in input_adjustments.runtime
package_managerNoOptional. Only affects the commands and lockfile named in the verification plan. Inferred from project.lockfile_path when you send a project snapshot, and assumed to be npm otherwise.

Output Schema

ParametersJSON Schema
NameRequiredDescription
toolYes
agentYes
statusYes
schema_versionYes

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, destructiveHint=false, openWorldHint=true, and idempotentHint=true, and the description aligns exactly by stating it evaluates only and never installs or edits anything. Beyond that, it discloses that every default, repair, and resolution is listed in input_adjustments, that missing project data yields compatibility "unknown" (not "no problem found"), and that to_version ranges resolve to one exact version reported in change.to_version.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but front-loads the action and purpose in the first sentence, then layer usage, inputs, and behavior. It is mostly dense and purposeful, though the repeated emphasis on top-level fields and the example JSON add some redundancy for an already 100%-covered schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex evaluation tool with 8 parameters, nested objects, and an output schema, the description covers the critical agent-facing behavior: when to call, what is inferred, how omitted project data is handled, that unsupported input shapes are rejected, and that the tool never mutates. With the output schema present, it does not need to enumerate return fields in detail, and its mention of blockers, warnings, recommendation, and verification plan is sufficient orientation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is already 100%, but the description adds substantial meaning beyond the schema: dependency must be a plain string (not an object or a {"change":{}} wrapper), to_version accepts exact versions, dist-tags, or SemVer ranges, from_version enables before/after advisory comparison, and policy_profile near-misses are rejected rather than guessed. It also explains dependency_type word mappings and that package_manager only affects verification commands and lockfile naming.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: evaluate a dependency change, answering "is this exact version safe to take on" from registry, advisory, provenance, license, and repository evidence. It clearly distinguishes evaluation from installation ("Evaluates only; never installs or edits anything"). However, it does not name or contrast with sibling tools such as verify_dependency_change or check_dependency, so sibling differentiation is left implicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives a clear trigger: "CALL immediately before adding or upgrading an npm dependency." It also clarifies the minimum input ("Only `dependency` is required — omit to_version to evaluate the latest published version"). But it provides no explicit when-not-to-use conditions or named alternatives, so the agent must infer the boundary with check_dependency and verify_dependency_change.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_artifactOrient an agent in an unfamiliar repositoryA
Read-onlyIdempotent
Inspect

CALL before substantial code work in an unfamiliar repository when the agent needs key files, entry points, architecture hypotheses, a reading order, and verify-before-trusting guidance. Returns the cached CLAUDE.md-style artifact or Cursor rules. Do not call again if the artifact is already in context. Takes NO artifact id: name the repository itself. Minimal call: {"repo":"vercel/next.js"}. Pass exactly one of repo or package, each a plain string.

ParametersJSON Schema
NameRequiredDescriptionDefault
repoNoPublic GitHub repository as owner/repo or a github.com URL.
ownerNoRepository owner, when repo carries only the bare name. Optional: prefer the single owner/repo form in repo.
formatNoOptional. markdown for CLAUDE.md-style guidance (the default); cursor for .mdc rules.markdown
packageNonpm package name, for example lodash or npm:@scope/pkg. To judge a specific VERSION rather than the package as a whole, use evaluate_dependency_change instead.

Output Schema

ParametersJSON Schema
NameRequiredDescription
toolYes
agentYes
statusYes
schema_versionYes

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already assert read-only, idempotent, open-world, and non-destructive behavior; the description adds cache semantics ('cached CLAUDE.md-style artifact'), verify-before-trusting guidance, and a caution about context reuse. No contradiction with annotations. It doesn't address staleness or auth, but the annotation profile lowers the burden.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description front-loads the when-to-call condition, then gives output, cancellation, and input-constraint guidance in compact sentences. Every sentence earns its place, and the minimal-call example is a high-value addition rather than filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a low-complexity, 4-parameter, read-only tool with a rich schema, an output schema, and safety annotations, the description covers when, why, how to call, and when not to call. Nothing essential is missing for an agent to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3; the description adds value beyond the schema by stating that there is no artifact id, that exactly one of repo or package must be supplied, and that each must be a plain string. The minimal-call example reinforces the required shape without repeating every schema property.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a concrete resource (repository/package), a precise action (return the cached CLAUDE.md-style artifact or Cursor rules), and a clear purpose (orient the agent before substantial code work). It also clarifies that there is no artifact id, avoiding confusion with the tool name. It does not explicitly differentiate from siblings like analyze_repo or compare_repos, so it stops short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives an explicit trigger condition ('CALL before substantial code work in an unfamiliar repository when...'), a clear do-not-call rule ('Do not call again if the artifact is already in context'), and an explicit alternative for version-specific judgment (evaluate_dependency_change in the package parameter). This fully routes the agent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

plan_repo_taskPlan a task against repository evidence and a checked SHAA
Read-only
Inspect

CALL before editing an unfamiliar public repository, or to find where a bug or feature lives. Pass the issue or task text (up to 4000 characters; include the error and expected behaviour) and checked_sha when you know it. Returns files ranked for the task at that commit (provenance task_localizer), the owning layer, a bounded reading order, dependency consumers, test/verification obligations, analyzed-vs-checked SHA relation, evidence provenance, and a short-lived verification contract. To rank files, task text is sent to RepoPilot's model provider; it is never persisted or echoed. Rankings are suggestions: read the files before acting.

ParametersJSON Schema
NameRequiredDescriptionDefault
repoNoPublic GitHub repository as owner/repo or a github.com URL.
taskYes
ownerNoRepository owner, when repo carries only the bare name. Optional: prefer the single owner/repo form in repo.
intentNo
packageNonpm package name, for example lodash or npm:@scope/pkg. To judge a specific VERSION rather than the package as a whole, use evaluate_dependency_change instead.
max_filesNo
path_hintsNoOptional repository-relative files or directories to prioritize.
checked_shaNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
toolYes
agentYes
statusYes
schema_versionYes

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already carry readOnlyHint, openWorldHint, and destructiveHint, so the bar is lower. The description still adds valuable non-obvious context: task text is sent to RepoPilot's model provider, is never persisted or echoed, and rankings are suggestions rather than authoritative actions. This goes beyond the annotations without contradicting them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but every sentence earns its place: call-to-action, input guidance, output summary, privacy disclosure, and a caveat. It is front-loaded with the most important usage signal and contains no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the main repo-based use case, output categories, and privacy behavior, and an output schema exists to carry return-value details. However, it ignores the package input branch of the oneOf schema, does not explain intent or max_files, and leaves the 'short-lived verification contract' vague. For a complex 8-parameter tool, this is a noticeable gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is about 50%, so the description must compensate. It adds useful meaning for task (max 4000 chars, include error and expected behaviour) and checked_sha (pass when known). But intent, max_files, path_hints, and the repo/package branch remain underdescribed, so compensation is only partial.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the tool's action and resource: planning a task against repository evidence, finding where a bug or feature lives, and returning ranked files. It is specific and useful, but it does not explicitly distinguish this tool from sibling tools such as analyze_repo or check_change_risk, so it misses the differentiator needed for a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives concrete when-to-use guidance: 'CALL before editing an unfamiliar public repository, or to find where a bug or feature lives.' It also tells the agent what to include in task text and when to pass checked_sha. However, it does not name alternatives or state when not to use this tool, so it falls short of fully explicit routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

verify_dependency_changeVerify a dependency change after local workA
Read-onlyIdempotent
Inspect

CALL after changing the manifest/lockfile and running local checks. Compares the exact evaluated target with the resolved result and caller-reported proof receipts, checks every version in resolved_changes for advisories (list all packages the lockfile change added or changed), reports missing/failed evidence and residual risk, and labels receipts as caller asserted. It never runs commands or stores diff/check output.

ParametersJSON Schema
NameRequiredDescriptionDefault
diffNo
afterYes
checksYes
evaluationYesThe verification_context object exactly as evaluate_dependency_change returned it, passed back unchanged. Its signature covers every field, so edit nothing inside it. Sending the whole evaluate result instead is accepted; the receipt is read out of its verification_context.

Output Schema

ParametersJSON Schema
NameRequiredDescription
toolYes
agentYes
statusYes
schema_versionYes

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, non-destructive, open-world. The description adds genuinely new behavioral facts: it never executes commands, never stores diff/check output, and it labels receipts as caller-asserted rather than verified — important trust semantics not captured by annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two dense sentences, front-loaded with the imperative CALL trigger, and every clause adds information about behavior or inputs. It is long but not padded, though it could be broken into shorter sentences for scanability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex verification tool with an output schema present (so return format need not be explained), the description covers sequencing, comparison behavior, advisory scanning, evidence-gap reporting, and non-execution. It is nearly complete, with only parameter-level detail for the nested inputs left thin.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 25%, so the description must compensate, and it does explain a few fields (resolved_changes as packages added/changed, receipts as caller-reported). However most of the large nested schema (after, checks, evaluation) gets no semantic elaboration in the description, leaving real gaps.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states concrete verbs and resources: it compares the evaluated target against the resolved result and caller receipts, checks advisories across resolved_changes, and reports missing/failed evidence and residual risk. An agent can distinguish this from evaluate_dependency_change, which produces the evaluation this tool consumes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives an explicit trigger ('CALL after changing the manifest/lockfile and running local checks'), which is exactly the when-to-use guidance an agent needs. It does not name when-not-to-call or point at a sibling alternative, so it falls short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 1 tool update
    • Changedanalyze_repo1 field changed
      • addedOutput schema / properties / repository_brief
        Added value: +{
        +  "description": "Concise saved repository orientation shared with the website: purpose, main parts, starting files, setup, revisions and gaps. Null when unavailable; omitted in source-evidence mode.",
        +  "type": [
        +    "string",
        +    "null"
        +  ]
        +}
  2. 1 tool update
    • Changedverify_dependency_change1 field changed
      • changedInput schema / properties / after / properties / resolved_changes / maxItems
        Previous value: -100New value: +1000
  3. 2 tool updates
    • Changedevaluate_dependency_change2 fields changed
      • changedInput schema / properties / project / properties / dependency_usage / description
        Previous value: -"Optional local call shapes for this dependency under native Node with default conditions. No source, paths, local names or call arguments. Coverage is always partial; transpiled/bundled code is unsupported."New value: +"Optional local call shapes for this dependency under native Node with default conditions. No source, paths, local names or call arguments. Coverage is always partial; transpiled CommonJS output is read, bundles are unsupported. instance_member names a method called on an instance of the export."
      • addedInput schema / properties / project / properties / dependency_usage / properties / uses / items / properties / instance_member
        Added value: +{
        +  "maxLength": 100,
        +  "pattern": "^[A-Za-z_$][A-Za-z0-9_$]*$",
        +  "type": "string"
        +}
    • Changedverify_dependency_change2 fields changed
      • changedInput schema / properties / after / properties / dependency_usage / description
        Previous value: -"Optional local call shapes for this dependency under native Node with default conditions. No source, paths, local names or call arguments. Coverage is always partial; transpiled/bundled code is unsupported."New value: +"Optional local call shapes for this dependency under native Node with default conditions. No source, paths, local names or call arguments. Coverage is always partial; transpiled CommonJS output is read, bundles are unsupported. instance_member names a method called on an instance of the export."
      • addedInput schema / properties / after / properties / dependency_usage / properties / uses / items / properties / instance_member
        Added value: +{
        +  "maxLength": 100,
        +  "pattern": "^[A-Za-z_$][A-Za-z0-9_$]*$",
        +  "type": "string"
        +}
  4. 1 tool update
    • Changedplan_repo_task1 field changed
      • changedInput schema / properties / task / maxLength
        Previous value: -500New value: +4000
  5. 2 tool updates
    • Changedevaluate_dependency_change1 field changed
      • addedInput schema / properties / project / properties / dependency_usage
        Added value: +{
        +  "additionalProperties": false,
        +  "description": "Optional local call shapes for this dependency under native Node with default conditions. No source, paths, local names or call arguments. Coverage is always partial; transpiled/bundled code is unsupported.",
        +  "properties": {
        +    "coverage": {
        +      "const": "partial",
        +      "type": "string"
        +    },
        +    "runtime": {
        +      "additionalProperties": false,
        +      "properties": {
        +        "arch": {
        +          "maxLength": 32,
        +          "pattern": "^[a-z0-9_]+$",
        +          "type": "string"
        +        },
        +        "node": {
        +          "maxLength": 32,
        +          "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$",
        +          "type": "string"
        +        },
        +        "platform": {
        +          "maxLength": 32,
        +          "pattern": "^[a-z0-9_]+$",
        +          "type": "string"
        +        }
        +      },
        +      "required": [
        +        "node",
        +        "platform",
        +        "arch"
        +      ],
        +      "type": "object"
        +    },
        +    "schema_version": {
        +      "const": 1,
        +      "type": "integer"
        +    },
        +    "uses": {
        +      "items": {
        +        "additionalProperties": false,
        +        "properties": {
        +          "export_path": {
        +            "items": {
        +              "maxLength": 100,
        +              "pattern": "^[A-Za-z_$][A-Za-z0-9_$]*$",
        +              "type": "string"
        +            },
        +            "maxItems": 2,
        +            "type": "array"
        +          },
        +          "loader": {
        +            "enum": [
        +              "require",
        +              "import"
        +            ],
        +            "type": "string"
        +          }
        +        },
        +        "required": [
        +          "loader",
        +          "export_path"
        +        ],
        +        "type": "object"
        +      },
        +      "maxItems": 50,
        +      "type": "array"
        +    }
        +  },
        +  "required": [
        +    "schema_version",
        +    "runtime",
        +    "coverage",
        +    "uses"
        +  ],
        +  "type": "object"
        +}
    • Changedverify_dependency_change1 field changed
      • addedInput schema / properties / after / properties / dependency_usage
        Added value: +{
        +  "additionalProperties": false,
        +  "description": "Optional local call shapes for this dependency under native Node with default conditions. No source, paths, local names or call arguments. Coverage is always partial; transpiled/bundled code is unsupported.",
        +  "properties": {
        +    "coverage": {
        +      "const": "partial",
        +      "type": "string"
        +    },
        +    "runtime": {
        +      "additionalProperties": false,
        +      "properties": {
        +        "arch": {
        +          "maxLength": 32,
        +          "pattern": "^[a-z0-9_]+$",
        +          "type": "string"
        +        },
        +        "node": {
        +          "maxLength": 32,
        +          "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$",
        +          "type": "string"
        +        },
        +        "platform": {
        +          "maxLength": 32,
        +          "pattern": "^[a-z0-9_]+$",
        +          "type": "string"
        +        }
        +      },
        +      "required": [
        +        "node",
        +        "platform",
        +        "arch"
        +      ],
        +      "type": "object"
        +    },
        +    "schema_version": {
        +      "const": 1,
        +      "type": "integer"
        +    },
        +    "uses": {
        +      "items": {
        +        "additionalProperties": false,
        +        "properties": {
        +          "export_path": {
        +            "items": {
        +              "maxLength": 100,
        +              "pattern": "^[A-Za-z_$][A-Za-z0-9_$]*$",
        +              "type": "string"
        +            },
        +            "maxItems": 2,
        +            "type": "array"
        +          },
        +          "loader": {
        +            "enum": [
        +              "require",
        +              "import"
        +            ],
        +            "type": "string"
        +          }
        +        },
        +        "required": [
        +          "loader",
        +          "export_path"
        +        ],
        +        "type": "object"
        +      },
        +      "maxItems": 50,
        +      "type": "array"
        +    }
        +  },
        +  "required": [
        +    "schema_version",
        +    "runtime",
        +    "coverage",
        +    "uses"
        +  ],
        +  "type": "object"
        +}
  6. 1 tool update
    • Changedanalyze_repo2 fields changed
      • addedInput schema / properties / checked_sha / description
        Added value: +"Immutable head revision; required with source_ranges."
      • addedInput schema / properties / source_ranges
        Added value: +{
        +  "description": "Read only these exact ranges, at most two per file/side and 40 lines per range. Requires question and checked_sha; base side also requires base_sha. Paths must fall within path_hints when supplied. Omit pr for base ranges.",
        +  "items": {
        +    "additionalProperties": false,
        +    "properties": {
        +      "end_line": {
        +        "description": "Last line, inclusive; from start_line through start_line + 39.",
        +        "minimum": 1,
        +        "type": "integer"
        +      },
        +      "path": {
        +        "maxLength": 4096,
        +        "minLength": 1,
        +        "type": "string"
        +      },
        +      "side": {
        +        "default": "head",
        +        "enum": [
        +          "head",
        +          "base"
        +        ],
        +        "type": "string"
        +      },
        +      "start_line": {
        +        "description": "First line, inclusive, 1-based.",
        +        "minimum": 1,
        +        "type": "integer"
        +      }
        +    },
        +    "required": [
        +      "path",
        +      "start_line",
        +      "end_line"
        +    ],
        +    "type": "object"
        +  },
        +  "maxItems": 4,
        +  "type": "array"
        +}
  7. 1 tool update
    • Changedanalyze_repo5 fields changed
      • addedInput schema / properties / base_sha
        Added value: +{
        +  "description": "Compare source at this base commit; omit when using pr.",
        +  "pattern": "^[a-fA-F0-9]{40}$",
        +  "type": "string"
        +}
      • addedInput schema / properties / checked_sha
        Added value: +{
        +  "pattern": "^[a-fA-F0-9]{40}$",
        +  "type": "string"
        +}
      • addedInput schema / properties / path_hints
        Added value: +{
        +  "description": "Scope retrieval to these repository-relative files or directories. Requires question.",
        +  "items": {
        +    "maxLength": 4096,
        +    "minLength": 1,
        +    "type": "string"
        +  },
        +  "maxItems": 4,
        +  "type": "array"
        +}
      • addedInput schema / properties / pr
        Added value: +{
        +  "description": "Public PR number in repo. Requires question. Omit base_sha.",
        +  "minimum": 1,
        +  "type": "integer"
        +}
      • addedInput schema / properties / question
        Added value: +{
        +  "maxLength": 600,
        +  "minLength": 1,
        +  "type": "string"
        +}

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    B
    maintenance
    Enables coding agents to analyze a repository evidence-first, answering questions as verifiable claims with source evidence, targeted test observations, and reference resolution.
    5
    3
    Apache 2.0
  • A
    license
    Not graded
    quality
    A
    maintenance
    Local-first evidence-backed repository memory for coding agents, providing read-only tools to list concepts, explain them, get governed context packs, and verify claims against the codebase.
    58 PyPI
    11
    Apache 2.0
  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables AI coding agents and hosts to enforce deterministic repository boundaries via MCP, providing structured reads, supervised edits, snapshots, audits, and recovery with machine-readable evidence.
    MIT
  • A
    license
    Not graded
    quality
    A
    maintenance
    Provides local-first repository architecture analysis with file-level proof, enabling agents to map codebases, locate implementations, trace call paths, and assess change impact with deterministic evidence.
    4 npm
    7
    MIT
Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources