The mcp-ashigaru server lets you orchestrate automated GitHub issue fixes using Claude AI, with three core tools:
work_ticket: Start an automated dev run by providing a repo and issue number. The server clones the repo, uses a Claude Code agent (starting with Sonnet, escalating if needed) to fix the issue, runs quality gates, and opens a PR — returning a run_id immediately while work continues in the background.
status: Poll an active or completed run by run_id to get an on-demand digest: current phase, recent agent actions, model tier reached, CI/build check results, and the PR URL.
promote: Squash-merge a reviewed PR to production. This is human-gated — it requires an approval_token matching a human-approval marker, ensuring no changes ship without explicit human authorization.
Allows creating pull requests from GitHub issues, running repository gates, and promoting to production on approval.
Reports live CI/build check status for pull requests.
Handles human approval prompts for promoting changes to production.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@mcp-ashigaru work crunchtools/ashigaru #12"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Kagetora's dispatchable dev-runner corps. An MCP server that lets Kagetora drive
Claude Code as a headless dev sub-agent across the crunchtools fleet: pull a GitHub
issue, fix it in an unprivileged sandbox, run the repo's gates, open a PR — and, on
explicit human approval, promote to production. The goal is light development from a
phone: text Kagetora "work <repo> #N," review what comes back, approve, ship.
Named for the ashigaru (足軽) — the foot-soldiers a daimyo dispatched into the field. Kagetora is the commander; these are the units it sends.
Status: alpha / under active construction. See Roadmap for what's live vs. pending.
Three roles, deliberately kept apart so the component that can be talked into something bad has the least authority, and the component with authority can't be talked into anything:
you (phone) ──Signal──▶ Kagetora ──▶ airlock gateway ──▶ mcp-ashigaru ──▶ wrapper scripts ──▶ agent container
(the boss) (foreman, LLM) (single secured (this repo — (deterministic; (Claude Code,
endpoint) thin tool surface) hold the creds) sealed sandbox)Role | What it is | Authority |
Kagetora | The foreman (Hermes agent, Signal interface). Decides what work happens, holds the approval gates. | An LLM → persuadable → holds no dangerous powers directly. |
mcp-ashigaru | This server. A thin MCP surface ( | Translates intent → wrapper invocations. No arbitrary command surface. |
Wrapper scripts | Deterministic bash ( | Hold the GitHub token, run podman gates, do git/gh. Not an LLM → can't be prompt-injected. |
Agent container | Claude Code ( | Edits code only. Only a Claude token — no GH token, no podman socket, no prod secrets. |
Reached by Kagetora through the airlock gateway (added as a backend in the
kagetora profile), so the same single-endpoint + defense pipeline that fronts the
rest of the fleet also fronts this. Part of the Ashigaru dev-runner platform —
see the fleet spec for the full design (pool of ashigaru-1..5, code/webapp
profiles, the merge-train, web previews).
Related MCP server: devflow-mcp
Tool | Purpose |
| Start a run: clone |
| On-demand digest: phase, recent agent actions, which model tier the run reached, live CI/build checks for the PR, and the PR URL. This is what Kagetora answers from when you ask "what's the status of the builds?" |
| Squash-merge a reviewed PR to ship via the repo's pipeline. Trust-based — no approval token; authorized by your Signal instruction to Kagetora, acting on airlock-filtered content. |
Every run starts cheap and escalates only when the work proves hard. The gate is the arbiter — never the agent's self-assessment.
Tier 1 Sonnet ──▶ gate ─pass─▶ PR
└─fail─▶
Tier 2 Opus (failure fed back) ──▶ gate ─pass─▶ PR
└─fail─▶
Tier 3 Opus, high/xhigh effort ──▶ gate ─pass─▶ PR
└─fail─▶ escalate to human (Kagetora pings you)Most routine fixes land at Sonnet prices; only sticky bugs spend Opus tokens.
The diff + gate failure from each tier is fed to the next so it iterates rather than
starting cold. status reports which tier a run reached.
Unprivileged sandbox. Everything runs as the devrunner user on lotor with rootless podman — no root, no sudo, no path to production, prod secrets, or other services. Blast radius = devrunner's sandbox.
Capability starvation for the agent. The coding agent's container holds only a Claude token. No GitHub token (can't push or touch other repos), no podman socket, no prod creds. Its entire reach is "edit files in this one checkout."
Deterministic wrappers hold the keys. git/gh, podman gates, and deploy live in fixed bash scripts that can't be prompt-injected — not in the LLM surface and not in the agent.
Production promotion is trust-based, not token-gated. It is authorized by the maintainer's Signal instruction to Kagetora — designed for phone-driven ops — acting on airlock-filtered content. Defense in depth comes from that filtered content lane plus the fact that a squash-merge is revertable and host rollout is a separate step, not from an out-of-band token the agent would have to hold.
mcp-ashigaru-crunchtools --transport streamable-http --host 0.0.0.0 --port 8020
# or: python -m mcp_ashigaru --transport streamable-http --port 8020Deployed on lotor as a systemd unit run under the devrunner user, on the
crunchtools network, so it inherits the unprivileged sandbox and can reach
devrunner's rootless podman socket to launch agent containers and run gates.
Image is built and pushed by GHA only — never hand-pushed. quay.io/crunchtools/mcp-ashigaru (+ ghcr) via .github/workflows/container.yml, dual-push per the crunchtools constitution. A local podman push to the registry is not part of the flow.
The repo is public. Required because crunchtools is a GitHub Free org, and Free orgs cannot expose org-level Actions secrets (QUAY_USERNAME/QUAY_PASSWORD) to private repos — the secrets list as "available" via the API but arrive empty at runtime. Public repos get them. (No secrets live in this repo; tokens are runtime env on lotor.)
Deploy pulls the GHA-built image on lotor and runs it as the devrunner systemd unit; adding dev-runner/ashigaru as a backend in the kagetora gateway profile makes it reachable from your phone.
Gate is the arbiter, not the agent. Maiden run (ROTV #475): the agent produced a confident, plausible fix that failed CI — caught before prod. That's the system working: an agent whose mistakes are reliably gated, with a human holding the prod key.
Tool scoping is a reliability lever, not just a security one. Giving the agent Bash in a no-podman container let it launch a build command that hung until timeout (and --output-format json buffers, so a kill left zero output). Scope tools to exactly what the task needs (Read,Edit,Write,Glob,Grep for a code fix); denials are instant.
Observability via --output-format stream-json --verbose. Streams one event per action (file reads, edits, reasoning), so progress is visible live and a timeout still leaves partial output. The status tool summarizes this on demand — pull, not push; Kagetora pings only on milestone transitions.
./run.sh test is NOT safe on the prod host. ROTV's gate uses --network=host --privileged -p 8080 and needs prod seed data — it's for an isolated dev box. The PR's GitHub Actions CI is the prod-safe gate.
Unprivileged devrunner sandbox + rootless podman on lotor
Headless Claude Code on subscription token, in a container, validated
This server scaffolded (work_ticket/status/promote), GHA → quay (public)
Model-escalation model specced
work-ticket.sh wrapper implementing the Sonnet→Opus ladder + event persistence
status wired to live CI/build checks; promote.sh gated deploy
Deploy on lotor (devrunner systemd unit) + add to the kagetora gateway profile
Dogfood: iterate on mcp-ashigaru with mcp-ashigaru
The pool (ashigaru-1..5), webapp previews, merge-train (see fleet spec)
GATED. Promote a reviewed PR to production via the repo's deploy path.
Refuses unless approval_token matches the human-approval marker recorded
for this PR (set only through a confirmed Signal approval). This is the hard
gate on the one irreversible action — the coding agent never reaches it.
| Name | Required | Description | Default |
|---|---|---|---|
| pr | Yes | PR number to promote. | |
| approval_token | Yes | the approval marker from the confirmed human gate. |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, but description fully discloses gating, token requirement (set only via Signal), and irreversible nature. Adds critical behavioral context beyond schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four efficient sentences, front-loaded purpose, no filler. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Simple tool (2 required params, output schema exists). Description explains purpose, gating, and token source comprehensively, leaving no ambiguity for use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema covers 100% of parameters with clear descriptions. Description does not add new info about each parameter beyond what schema already provides, so baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states verb 'promote' and resource 'PR to production'. Distinguishes from siblings 'status' and 'work_ticket' which are non-promotion tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly notes gating (requires approval_token) and refusal condition. Implies when to use: after review and human approval. Does not mention alternatives but siblings are unrelated, so no confusion.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Return an on-demand digest of a run: current phase, recent agent actions, gate result, and PR URL. This is what Kagetora answers from when you ask "what's the runner doing?".
| Name | Required | Description | Default |
|---|---|---|---|
| run_id | Yes |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided. Description implies a read operation and lists output contents, but does not disclose behavioral traits like side effects, auth requirements, or performance impact.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with purpose and contents, followed by a helpful analogy. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given a single simple parameter and an output schema, the description adequately explains the return value contents. Could mention constraints (e.g., run must exist) but not necessary for this simple tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has one required string parameter 'run_id' with 0% schema description coverage. The description does not describe the parameter, leaving the agent to infer from context. While obvious, it does not compensate for the low coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states it returns a digest of a run with specific components (phase, actions, gate result, PR URL). Differentiates from siblings 'promote' and 'work_ticket' by focusing on status retrieval.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says 'on-demand digest' and gives a user-friendly context ('what's the runner doing?'). No explicit when-not or alternatives, but sibling tools are clearly different.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Start a dev run: clone , fix GitHub issue # with Claude (Sonnet), run the repo's quality gates, and open a PR. Returns a run_id immediately; the run continues in the background. Poll status(run_id) for progress.
| Name | Required | Description | Default |
|---|---|---|---|
| repo | Yes | crunchtools repo name (e.g. "rotv"). | |
| issue | Yes | GitHub issue number to work. |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description fully carries the burden. It details the workflow (clone, fix, quality gates, PR), immediate return of run_id, background execution, and how to poll for progress. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences, each carrying essential information: first sentence explains the action, second describes return behavior, third instructs on monitoring. No unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has an output schema (implied by context signals) and the description mentions the return value (run_id). It covers the complete workflow and expected behavior for a background dev run tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% with both parameters described. The description adds minimal extra meaning beyond the schema, restating that repo is a 'crunchtools repo name' and issue is a 'GitHub issue number'. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description specifies the action (start a dev run), the resources (repo and issue), and the steps (clone, fix, quality gates, PR). It clearly distinguishes from sibling tools 'promote' and 'status' by mentioning polling status separately.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use: to start a new dev run for a given repo and issue. It also suggests using status(run_id) to monitor progress, but does not explicitly state when not to use this tool or mention alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Each tool serves a unique purpose: starting a run, monitoring status, and promoting to production. There is no overlap in functionality.
All names are simple and readable, but there is a slight inconsistency: 'promote' and 'status' are single words while 'work_ticket' is a compound. However, the style is uniform overall.
With only 3 tools, the server feels minimal for a deployment pipeline. While it covers the essential steps, additional tools like cancellation or listing runs would be expected for broader utility.
The tool set covers the core workflow (start, check, promote), but lacks common operations such as canceling a run, retrying, or viewing history. The surface is functional but not comprehensive.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
An MCP server that gives your AI access to the source code and docs of all public github repos
A MCP server built for developers enabling Git based project management with project and personal…
Create, deploy, and operate MCP servers directly from your GitHub repositories.
Devopness MCP server for DevOps happiness! Empower AI Agents to deploy apps and infra, to any cloud.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/crunchtools/mcp-ashigaru'
If you have feedback or need assistance with the MCP directory API, please join our Discord server
