RepoImmune convierte los errores resueltos de un repositorio en comprobaciones nativas del código y respaldadas por evidencia que pueden consultar tanto humanos como agentes de codificación.
Entrada | Procesamiento | Salida |
Un repositorio de GitHub o un diff de PR | Recuperar evidencia histórica de issue → fix → test → AST | Ubicación exacta de la regresión, enlaces a la fuente, tests protegidos y el fix histórico |
git clone https://github.com/Alex0AI/RepoImmune.git
cd RepoImmune
python -m venv .venv
# Windows: .venv\Scripts\activate
# macOS/Linux: source .venv/bin/activate
python -m pip install -e .
repoimmune init .
repoimmune check --diff examples/reintroduce-astropy-12907.diff --memory examples/memory
repoimmune replay astropy-12907 --memory examples/memory
repoimmune report --format htmlLa demo está fuera de línea, en sin claves y sin dependencias en tiempo de ejecución. La comprobación termina intencionadamente con el código 2 porque encuentra una regresión histórica real de Astropy PR #12907.
Related MCP server: mcp-software-engineering-challenge
Una Behavior Card no es un resumen de chat. Vincula un invariante con el código antes/después, la forma del AST, los elementos exactos, los tests de regresión, los commits, las URLs de la fuente, la licencia, la clase de evidencia y una cápsula opcional de reproducción. RepoImmune se niega a promover un candidato cuando la cadena de evidencia está incompleta.
flowchart LR
I[Issue / report] --> B[Buggy commit]
B --> F[Failing behavior]
F --> P[Fix PR / commit]
P --> T[Regression test]
T --> S[AST + symbol change]
S --> V[Repository invariant]
V --> C[Patch immunity check]El vertical slice incluido detecta esta reversión exacta:
- cright[-right.shape[0]:, -right.shape[1]:] = right
+ cright[-right.shape[0]:, -right.shape[1]:] = 1Informa de la línea exacta, explica por qué el bloque de todos unos fue históricamente incorrecto, enlaza el issue/PR/de merge y nombra los casos pytest añadidos con el fix.
repoimmune init .
repoimmune mine --repo owner/project
repoimmune check --diff HEAD~1
repoimmune recall "pagination returns duplicate rows"
repoimmune explain <behavior-card-id>
repoimmune replay <capsule-id>
repoimmune report --format html
repoimmune validate <card.json>check emite Markdown, JSON o SARIF. mine solo guarda las barreras candidatas; nunca llama a un LLM y no clasifica una Behavior Card únicamente a partir de un título.
La GitHub Action compuesta analiza los diffs de los pull request en modo solo lectura y sube la evidencia SARIF/Markdown.
El servidor MCP stdio expone seis herramientas estructuradas y de solo lectura: search_past_failures, explain_code_history, check_patch_against_memory, list_invariants_for_file, get_regression_test y replay_behavior_case.
La habilidad Agent Skill pide al agente que recuerde el historial antes de hacer cambios y de nuevo antes de dar la tarea por terminada. No concede autoridad para hacer commit, push, merge con varias.
La demo estática funciona sin iniciar sesión ni clave de API.
Cada resultado se clasifica explícitamente en uno de los siguientes:
verified: reproducido directamente y con corroboración mecánica mediante evidencia primaria de código/test.
extern: confiando en un registro upstream o de benchmark, no reproducido aquí.
heuristic: señal útil de candidato o de similitud, no una prueba.
inconclusive: evidencia contradictoria o incompleta.
Un valor de similitud nunca se presenta como prueba. Los hallazgos siempre muestran el código coincidente y la evidencia de la fuente.
La memoria del agente/chat: recuerda conversaciones o datos del repositorio; RepoImmune extrae el historial del código y crea comprobaciones mecánicas que perduran más allá de cualquier sesión de agente.
SWE-bench: evalúa si un agente puede reparar un issue; RepoImmune convierte issues resueltos en activos de prevención duraderos.
Análisis estático: parte de la regla general; RepoImmune aprende invariantes específicos del repositorio a partir de fallos reales de ese repositorio.
Generación de tests: puede permitir tests; RepoImmune conserva la cadena causal entre el reporte, el código erróneo/corregido, el test y la invariante.
git blame: el quién y cuándo; RepoImmune explica por qué el comportamiento debe conservarse y puede comprobarlo.
Consulta research-landscape.md para ver la comparación basada en evidencia.
El texto de un issue, los comentarios del PR, el código, los parches y los metadatos del repositorio son datos no confiables. RepoImmune nunca los evalúa como instrucciones. Minería usa respuestas HTTPS limitadas; se valida la identificación de los refs y los nombres de repositorios; las cápsulas se ejecutan con argv fijo, sin shell, rechazan rutas absolutos y enlaces simbólicos y tienen un límite de tiempo. Los comandos de instalación o los tests no se ejecutan por defecto. Consulta SECURITY.md y docs/threat-model.md.
La versión alpha soporta en profundidad AST de Python y evidencia de pytest. TypeScript/TSX usa un adaptador opcional pinado de tree-sitter para la extracción de estructura y llamadas; JavaScript usa una estructura de tokens determin Mercy, y Jest/Vitest se pueden registrar como evidencia de test. La alcance interprocedural del programa completo, la reconstrucción automática del entorno upstream y un soporte amplio de lenguajes son parte de la hoja de ruta. Las tarjetas a escala de dataset son externally_report hasta que se reproducen; el vertical slice de Astropy incluido es la única cápsula de comportamiento verificada localmente en v0.1.0.
python scripts/build_research_snapshot.py --limit 500 --cards 120
python scripts/run_experiments.py
pytest
coverage run -m pytest && coverage report
ruff check . && mypy src/repoimmuneTodos los recuentos publicados se regeneran en research/results.json; las clasificaciones de clasificaciones y las limitaciones se conservan, incluidos casos no concluyentes. El origen de los datos se documenta en DATA_SOURCES.md, THIRD_PARTY.md y research/data-card.md.
La instantánea v0.1 incluida cuenta con 500 candidatos, 120 Behavior Cards, 12 repositorios y 30 cápsulas de comportamiento ligeras. En mutaciones deterministas detectó 120/120 exactas en reversiones históricas y 120/120 eliminaciones de sentencias protegidas; las refactorizaciones de la misma forma frazen con símbolos símbolos que produjeron 9/120 falsos positivos (7.5%). La búsqueda desde el título alcanzó un Recall@5/MRR 1.0/1.0, pero eso explícitamente es una prueba del sistema de misma fuente. La precisión de la minería independiente y el A/B de agentes controlado siguen sin ser concluyentes.
Lee CONTRIBUTING.md, la hoja de ruta y el esquema de Behavior Card antes de proponer una nueva fuente de extracción o evidencia. Licencia Apache-2.0.
中文说明：README.zh-CN.md
check patch against memory
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of disclosing behavioral traits. It only restates the tool name and gives no indication of side effects, return behavior, input expectations, or what 'memory' refers to.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is minimal but not meaningfully concise; it is under-specified. It provides no front-loaded useful content and reads as a placeholder rather than a structured tool definition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having no parameters and no output schema, the tool still needs context such as what 'patch' and 'memory' refer to and what the result indicates. The description is completely inadequate for an agent to select and invoke this tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the baseline is 4. There is no parameter information missing or requiring compensation from the description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'check patch against memory' is a verbatim restatement of the tool name, providing no additional information about what the tool actually does. It is a tautology that fails to distinguish itself from the sibling tools such as search_past_failures or explain_code_history.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance whatsoever about when to use this tool versus alternatives. The description offers no context, prerequisites, or exclusions, leaving an agent to guess when this tool is appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
explain code history
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description adds zero behavioral information. It does not disclose whether this is a read-only operation, how it retrieves history, what output format to expect, or any side effects. The description carries the full burden for behavioral disclosure and fails entirely.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is brief, but brevity here is under-specification rather than efficient conciseness. A single phrase that repeats the tool name without elaboration does not earn credit for structure; it fails to convey any substantive information while appearing to be a complete definition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has no output schema, no annotations, and a descriptor that is a tautology. Given its sibling tools perform distinct historical/diagnostic functions, an agent cannot determine what inputs are needed, what results to expect, or how this differs from related operations. The definition is completely inadequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool accepts 0 parameters, so there is nothing for the description to clarify about argument meanings. Per the baseline for 0-parameter tools, this dimension is not penalized for missing parameter documentation. The description's lack of context does not affect this score.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'explain code history' is essentially a restatement of the tool name with a verb and resource, but it provides no actual explanation of what 'explain' means in this context or what 'code history' refers to. It is a tautology, not a clear statement of function.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus its siblings like search_past_failures or replay_behavior_case. No context, prerequisites, or situational cues are provided. The agent is left to guess which scenario would call for explaining code history.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get regression test
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the full burden, but it reveals nothing about behavior, side effects, return values, or error cases. It is purely a label, not a behavioral disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The text is extremely short, but this is under-specification rather than useful conciseness. It says nothing beyond the tool name and provides no structured or front-loaded information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no annotations and no output schema, the description is entirely inadequate. It does not explain what a regression test is, what the tool returns, or how it relates to the listed sibling tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool declares zero parameters, so the baseline is 4; the description adds no parameter meaning, but there are no parameters for it to explain. The permissive additionalProperties: true schema is not clarified, but that is a minor gap with no required inputs.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'get regression test' merely restates the tool name and adds no verb-resource detail beyond it. It does not distinguish this tool from siblings like search_past_failures or replay_behavior_case.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance about when to use this tool or when to prefer a sibling. No context, conditions, or alternatives are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list invariants for file
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure, but it only repeats the action 'list' and the resource 'file'. It does not mention side effects (likely read-only), error conditions, ordering, filtering, or what data is actually returned.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One short sentence is concise, but this is under-specification rather than efficient brevity. The description omits essential details that an agent needs, so it does not earn credit for structure.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has no output schema and no annotations, so the description must provide nearly all context. It fails to state how the file is selected, what invariants look like, or what a successful call returns, leaving the agent with only the tool name as guidance.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero declared parameters, so the description cannot add parameter-level detail beyond the schema. The 100% schema coverage and empty parameter list make the missing specification less harmful, though the description does not explain how 'file' is supplied.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'list invariants for file' is a near-verbatim restatement of the tool name. It identifies the action and resource but does not clarify what 'invariants' means in this context or how it differs from the sibling tools, making it tautological rather than informative.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance about when to use this tool instead of alternatives such as search_past_failures or check_patch_against_memory. There is no context, prerequisite, or exclusion information, leaving the agent to guess.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
replay behavior case
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It fails to state side effects, permissions, return values, or any observable behavior beyond the vague verb 'replay'. There is nothing here to inform an agent about what will happen when the tool is invoked.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three words is technically concise, but this is under-specification rather than effective structure. The description has no front-loaded action statement, no scoping, and no differentiation—it reads as a placeholder, not a deliberate, minimal definition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no annotations, no output schema, no parameter details, and only sibling tool names for context, the description is the sole source of guidance and it provides none. An agent cannot understand what a 'behavior case' is, what replaying entails, or what result to expect.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters, so the description has no parameter details to explain, and the baseline is 4. However, the schema allows additionalProperties: true, meaning arbitrary input could be passed, and the description offers no hint about what properties might be relevant. This is a minor gap given no defined parameters exist.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description is literally the tool name: 'replay behavior case'. It restates the name without defining the action, the resource, or the domain meaning of 'behavior case'. An agent cannot distinguish it from siblings like search_past_failures or get_regression_test.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance about when to use this tool versus alternatives, no context, and no examples. The description contains only a phrase with no actionable direction, so an agent receives zero assistance in selecting it correctly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search past failures
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the full burden of behavioral disclosure. It does not state whether this is a read-only query, what data it covers, what it returns, or any side effects or limitations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely short but not appropriately concise; it is under-specified. It consists only of a tautological phrase that adds no actionable information for an agent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no annotations, no output schema, and no usage guidance, the description is completely inadequate for an agent to decide when to invoke this tool or what behavior to expect. The tool cannot be used correctly based on the provided definition alone.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters for the agent to interprethysics, which matches the baseline of 4. No parameter documentation is necessary since the input schema is effectively unrestricted and empty.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'search past failures' merely restates the tool name, providing no meaningful elaboration on what constitutes a 'past failure' or what the search returns. It also offers no differentiation from sibling tools like get_regression_test or replay_behavior_case.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance on when to use this tool versus the sibling alternatives. There is no mention of intended scenarios, prerequisites, or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v0.1.0check_patch_against_memoryexplain_code_historyget_regression_testlist_invariants_for_filereplay_behavior_casesearch_past_failuresScored across 6 tools
Each tool targets a distinct action and resource, but some functional overlap exists: 'search_past_failures' and 'get_regression_test' both relate to historical failures, and 'explain_code_history' and 'check_patch_against_memory' both deal with stored repository memory. The descriptions are terse but generally enough to guide selection.
All tool names follow a consistent lowercase snake_case verb-first pattern: search_, explain_, check_, list_, get_, replay_. The naming style is uniform and predictable across the entire set.
Six tools is well-scoped for a specialized repository memory/invariant server. Each tool has a clear purpose, and the count feels neither thin nor bloated for the apparent domain.
The surface covers the main read/replay workflow: searching failures, explaining history, checking patches, listing invariants, and replaying test cases. The only notable gap is the lack of any tool to record or update memory/invariants, but this may be intentional if ingestion happens outside the server.
A read-only verified record of agent-operable GTM tools: search, fetch, compare, track changes.
Persistent memory and knowledge management for AI agents with semantic search and 50+ tools.
Read-only AI coding tools for change verification, release readiness, capacity, and guidance.
Never let your agent repeat a bug or linger on a known issue. Search 385+ failure lessons to skip known errors instantly.
