Skip to main content
Glama

SHPBL: Repository Audit & Repair

Pin a repository for step 1

pin_source
Read-onlyIdempotent

Build HOST-SOURCE-MANIFEST.json for canonical step 1 from a GitHub repository, online, with no clone and no download: every file's Git blob identity, the byte length, the head commit, and the SHPBL-SOURCE-DIGEST/1 digest over the pinned tree. Write the returned JSON to your run folder as HOST-SOURCE-MANIFEST.json and step 1 passes the gate. Free and unmetered. If the run is offline instead, do not call this — run node tools/source-manifest.mjs <repo-dir|repo.zip> from the edition, which produces the same manifest from a directory or straight out of the repository ZIP. Never invent the digest or the commit.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
keyNoYour SHPBL key, if you have one. Optional — this tool is free; a key only helps reach a private repository through a connected GitHub App install.
repoYesA GitHub repository: `owner/repo`, a github.com URL, or `owner/repo#branch`.
labelNoWhat to call the target in the manifest. Defaults to `owner/repo@branch`.
github_tokenNoOptional GitHub token (Contents: read) for a private repository.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Added

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnly/openWorld/idempotent annotations, the description adds key behavioral facts: no clone or download occurs, the returned JSON must be written to the run folder, the operation is free and unmetered, and the digest/commit must never be invented. These details meaningfully shape how an agent should use and trust the tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but purposeful: it front-loads the core action and output, then covers offline alternatives and a critical integrity warning. No sentence is wasted; each clause adds operational guidance the agent needs.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no output schema, the description compensates well by outlining the manifest's contents, the required agent action (write to run folder), the offline fallback, and the prohibition on inventing values. The annotations cover safety and idempotency, so nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already provides 100% coverage with clear descriptions for all four parameters, so the tool description does not need to re-explain them. The description adds contextual constraints like 'online' and 'no clone/no download', but no new parameter-specific semantics beyond what the schema already states.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a precise verb ('Build'), a concrete output artifact ('HOST-SOURCE-MANIFEST.json'), a specific source ('a GitHub repository'), and a clear workflow context ('canonical step 1'). It also lists exactly what the manifest contains, making the tool's purpose unmistakable and distinguishing it from sibling repo tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to call the tool ('online'), when not to call it ('If the run is offline instead, do not call this'), and provides the exact alternative command and inputs. It also warns against fabricating output values, giving an important boundary for correct use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources