get_audit_report

Instructions

Implementation Reference

• src/tools/get-report.ts:6-53 (handler)

  The handler function that executes the 'get_audit_report' tool logic. It calls registerTool with the tool name, inputSchema, and an async callback that fetches the report from /api/skill/{slug}/latest, returning the SkillReport JSON or an error message.

  export function registerGetReport(server: McpServer): void {
    server.registerTool(
      'get_audit_report',
      {
        description:
          'Get the full behavioral security audit report for a GitHub repository. ' +
          'Use this to review all findings before installing a third-party MCP server, plugin, or tool. ' +
          'Returns the latest completed audit with trust score, verdict, findings, ' +
          'category scores, and recommendation. ' +
          'Use get_skill_summary for a quick safety check instead.',
        inputSchema: {
          owner: z.string().describe('GitHub repository owner (e.g. "anthropics")'),
          repo: z.string().describe('GitHub repository name (e.g. "claude-code")'),
        },
      },
      async ({ owner, repo }) => {
        const slug = `${owner}/${repo}`;
        try {
          const res = await apiFetch(`/api/skill/${slug}/latest`);
          const data = (await res.json()) as { report: SkillReport };
          return {
            content: [
              { type: 'text' as const, text: JSON.stringify(data.report, null, 2) },
            ],
          };
        } catch (err) {
          if (err instanceof ApiError) {
            if (err.status === 404) {
              return {
                content: [
                  {
                    type: 'text' as const,
                    text: `No completed audit found for ${owner}/${repo}.`,
                  },
                ],
                isError: true,
              };
            }
            return {
              content: [{ type: 'text' as const, text: err.message }],
              isError: true,
            };
          }
          throw err;
        }
      },
    );
  }

• src/tools/get-report.ts:16-19 (schema)

  Input schema for the 'get_audit_report' tool, defining two required parameters: owner (GitHub repo owner) and repo (GitHub repo name), both validated as Zod strings.

  inputSchema: {
    owner: z.string().describe('GitHub repository owner (e.g. "anthropics")'),
    repo: z.string().describe('GitHub repository name (e.g. "claude-code")'),
  },

• src/index.ts:21-23 (registration)

  Registration of the 'get_audit_report' tool by calling registerGetReport(server) in the main entry point.

  registerGetReport(server);
  registerGetSummary(server);
  registerSearchAudits(server);

• src/index.ts:6-7 (registration)

  Import of the registerGetReport function from the get-report tool module into the main entry point.

  import { registerGetReport } from './tools/get-report.js';
  import { registerGetSummary } from './tools/get-summary.js';

• src/lib/client.ts:31-70 (helper)

  The apiFetch helper used by the handler to make HTTP requests to the Oathe API. Handles timeouts, network errors, and non-OK responses.

  export async function apiFetch(
    path: string,
    init?: RequestInit,
  ): Promise<Response> {
    const url = `${BASE_URL}${path}`;
  
    let res: Response;
    try {
      res = await fetch(url, {
        ...init,
        signal: init?.signal ?? AbortSignal.timeout(30_000),
        headers: {
          'Content-Type': 'application/json',
          ...init?.headers,
        },
      });
    } catch (err: unknown) {
      if (err instanceof DOMException && err.name === 'TimeoutError') {
        throw new ApiError(
          'Request timed out after 30 seconds. The API may be temporarily unavailable.',
          0,
        );
      }
      if (err instanceof TypeError) {
        throw new ApiError(
          `Network error: unable to reach API at ${BASE_URL}. Check your connection or OATHE_API_BASE setting.`,
          0,
        );
      }
      throw err;
    }
  
    if (!res.ok) {
      const body = await res.json().catch(() => ({}));
      const message = body.message ?? body.error ?? 'Unknown error';
      throw new ApiError(message, res.status);
    }
  
    return res;
  }