"Exploring a GitHub repository and creating a detailed flowchart of its functionality" matching MCP tools:

• works_verify_public_repositoryA

  WORKS Public VerifierA

  Use only after works_public_eligibility returns eligible. Download that immutable public GitHub snapshot, run the selected pinned static contract without executing repository commands, and return a signed receipt. Return the report field verbatim and stop.

  ConnectorNo auth

• delete_alertA

  tw-market-dataA

  Cancel one armed price trigger permanently, by its rule id. Disarms a single watch so it will not fire again — the opposite of `set_price_alert`, and unlike `list_alerts` it changes state rather than reporting it. Cancellation is irreversible: re-arming means creating a fresh trigger. Naming somebody else's rule id cancels nothing at all. Args: rule_id.

  Connector

  Destructive

  No auth

• estimate_auditA

  nittimA

  Price an audit before buying one: give a GitHub repository URL, or a manifest of paths and byte sizes — no file content, nothing uploaded — and get the tier (Audit or Full Audit), the pass count and the exact price. No account or key is needed: it never charges, runs no audit, calls no model and stores nothing. Signed in it also returns your credit balance and whether an unspent Audit covers the run; a guest quote omits both. `fullScan: true` prices Full Audit.

  ConnectorNo auth

• deploy-repository-toolA

  CoderbudsA

  Trigger a production deploy for one of your team's connected repositories. The repository must have a deploy trigger configured — either a deploy hook URL or a GitHub Actions workflow — in its Coderbuds settings. Identify the repository by name (e.g. "saas") or by full name (e.g. "patchstack/saas"). This ships whatever is currently merged; it is not a dry run. Use GetUndeployedPullRequestsTool first if you want to see what will go out.

  ConnectorOAuth

• import_repoA

  LayeroA

  Create a Layero project from a repository — path (a) without the dashboard. From then on a push to the branch is a preview, a push to the production branch is production. After the link the tool finishes the setup wizard itself and starts the first build; `setup` in the result says whether that happened. Detected values are NOT written into the project settings: the builder detects the framework, build command and output folder from the repository on every build, so a later change in the repository is picked up. Only a decision is pinned — the app folder of a monorepo and the package manager named in `layero.json`. Until 2.1.1 the project stayed in `pending_setup` while the answer promised a build that never started. Two shapes, same as the CLI: GitHub goes through the App installation (project and webhook in one call); other providers create the project first and then connect the source — that step reports whether the webhook could be registered. If the provider is not connected, the result says `needs_connection` with the dashboard address: the person connects the token there, never through the chat. Monorepo: one project builds one app folder — pass `root_directory`. Several apps in one repository are several projects, one call each, with different `root_directory` and `name`. If the repository is already linked and the call would duplicate an existing project (same folder, or no `root_directory` given), nothing is created: the result is `already_linked` with `linked_projects` — slug, url, root_directory and branch of every project built from this repository. On `created`, `linked_projects` lists the OTHER projects already built from the same repository; `linked_projects_checked: true` says the check was made, so an empty list means there are none (`my_projects(repo=…)` answers the same question later). When the root has no app and detection sees a frontend + backend pair, `app_dir_candidates` names the folders.

  ConnectorAPI key

• import_repoA

  LayeroA

  Create a Layero project from a repository — path (a) without the dashboard. From then on a push to the branch is a preview, a push to the production branch is production. After the link the tool finishes the setup wizard itself and starts the first build; `setup` in the result says whether that happened. Detected values are NOT written into the project settings: the builder detects the framework, build command and output folder from the repository on every build, so a later change in the repository is picked up. Only a decision is pinned — the app folder of a monorepo and the package manager named in `layero.json`. Until 2.1.1 the project stayed in `pending_setup` while the answer promised a build that never started. Two shapes, same as the CLI: GitHub goes through the App installation (project and webhook in one call); other providers create the project first and then connect the source — that step reports whether the webhook could be registered. If the provider is not connected, the result says `needs_connection` with the dashboard address: the person connects the token there, never through the chat. Monorepo: one project builds one app folder — pass `root_directory`. Several apps in one repository are several projects, one call each, with different `root_directory` and `name`. If the repository is already linked and the call would duplicate an existing project (same folder, or no `root_directory` given), nothing is created: the result is `already_linked` with `linked_projects` — slug, url, root_directory and branch of every project built from this repository. On `created`, `linked_projects` lists the OTHER projects already built from the same repository; `linked_projects_checked: true` says the check was made, so an empty list means there are none (`my_projects(repo=…)` answers the same question later). When the root has no app and detection sees a frontend + backend pair, `app_dir_candidates` names the folders.

  ConnectorOAuth

• well_create_company_candidateA

  WellA

  Mint a company candidate from a registry hit, the step between finding the company and creating its workspace. This is the deliberate pick the confirm-your-company card makes. REQUIRED: registry_ref — the `id` of a well_search_company_registry hit. This tool hydrates that hit and mints the company as a primary (own-company) candidate. Then call well_create_company_workspace with the returned `candidate_id` to make it the company workspace. Only a workspace owner or admin may mint a candidate. A caller without that role is refused, not silently ignored. When the picked company already has a confirmed company workspace, the result carries `linked_to_existing_child: true` and its `workspace_id` — switch into it with well_switch_workspace instead of creating another. Confirm the exact company with the user before calling; never pick one from a name alone.

  ConnectorNo auth

• get_cipA

  blobpediaA

  Read the full text of one Celestia Improvement Proposal (CIP) by its id. Celestia governance docs only — not GitHub issues or arbitrary proposals (use a GitHub tool for those). Get the id from search or list_cips first.

  ConnectorNo auth

• repo_statusA

  mcpA

  For a diagram that was created from a connected git repository: which repo and branch or tag it tracks, when it last synced, the commit it reflects, and whether daily sync is on. Use repo_refresh to sync it now. Only the owner of the repository connection can use this.

  ConnectorAPI key

• evaluate_repoA

  SHPBL: Repository Audit & RepairA

  Audit any GitHub repository and get back one complete result: a report (inventory, languages, spine files, risk signals), the capabilities found in it (name, signature, file and line, stated contract, dependencies), and how it stands against SHPBL's anonymous corpus of audited repositories. Works with no key: every caller gets the whole diagnosis of their own repository. A free run stops at the composition boundary — neither library is searched, so no library rows, candidates, parents or proposed architecture are returned — and nothing is retained (no pull request, no export, no recorded run). A Practitioner key (7-day free trial) continues past that boundary: both libraries searched, candidates identified and composed, and the result written back to your own repository. Whatever a run finds is yours. Follow with `fix_repo` for verbatim source and diffs, `harvest_repo` for the whole tree.

  ConnectorNo auth

• write_to_repoA

  SHPBL: Repository Audit & RepairA

  Land finished work in a repository as a pull request: pass the files you wrote (full new contents, not diffs) and this opens a branch and a PR for the human to review and merge. Nothing is ever pushed to the default branch. Requires a SHPBL Practitioner key and the SHPBL GitHub App installed on that repository (or a one-off `github_token`). The caller chooses the repository — ask which one, or call `list_repos` first; never assume. Where things go: Harvest output belongs under `.shpbl/` in **the caller's own repository** — the person who asked for the run — and never in the repository that was harvested. Those are frequently not the same repository: a run may read a public open-source project, or a repository the caller merely has access to, and writing a harvest back into a source repository would be putting our output into somebody else's software. Sources a run may read: public repositories that carry a proper open-source license, the caller's own repositories, or private repositories the caller has access to. The server never reads a repository the caller has no right to read, and it never absorbs customer harvests back into the public library. - `.shpbl/README.md` — the index of their capability library (this tool scaffolds it when it is absent). - `.shpbl/<run-seal>/LEDGER.md` — the folded ledger for one run. - `.shpbl/<run-seal>/REPORT.html` — the branded report, if one was produced. - `.shpbl/<capability-name>/` — a capability kept as source, one folder each. - `.shpbl/COMPOSITES.md` — your own composites: capabilities this run invented for your repository by fusing parts that did nothing alone. Record each as `- <name> — <what it fuses> — <why neither part sufficed>`. These are yours and stay private; SHPBL's global composites ledger is fed only by Governor-keyed published runs, so never send yours anywhere and never expect them to appear there. If the harvested repository is not the caller's own, the harvest still lands in the caller's `.shpbl/` and the source is named in provenance. Ask the person which of their repositories is the home for their library if it is not obvious, and stop for that answer rather than guessing. Give each kept capability a one-line contract in `.shpbl/README.md`, in the form `- <name> — <path> — <contract>`. That index is what makes the library reusable: on the next run, read it and pass those entries as `own_library` to `evaluate_repo`, `fix_repo` or `run_gauntlet`, and the run will tell you which concerns you already solved before citing anything new. Those entries stay yours — they are held for the call and never stored by SHPBL. Repairs are the exception: write the repaired file at its own path, never under `.shpbl/`.

  ConnectorNo auth

• pin_sourceA

  SHPBL: Repository Audit & RepairA

  Build `HOST-SOURCE-MANIFEST.json` for canonical step 1 from a GitHub repository, online, with no clone and no download: every file's Git blob identity, the byte length, the head commit, and the `SHPBL-SOURCE-DIGEST/1` digest over the pinned tree. Write the returned JSON to your run folder as `HOST-SOURCE-MANIFEST.json` and step 1 passes the gate. Free and unmetered. If the run is offline instead, do not call this — run `node tools/source-manifest.mjs <repo-dir|repo.zip>` from the edition, which produces the same manifest from a directory or straight out of the repository ZIP. Never invent the digest or the commit.

  ConnectorNo auth

• get_github_discussionA

  canton-ccpediaA

  Get the full body and comments of a single GitHub Discussion from a Canton Network or Digital Asset repo, by its GitHub GraphQL node id (from list_github_discussions). CANTON-ONLY, read from CCPEDIA's cache. Not the live GitHub API. This is GitHub Discussions, distinct from the Canton web forum (get_discussion) and mailing lists (get_mailing_thread).

  ConnectorNo auth

• check_dependencyA

  RepoPilotA

  CALL when the user or agent is about to add, upgrade, trust, fork, or deploy an npm package or public GitHub repository. Returns a lean repository-level recommendation, confidence, evidence gaps, CVEs, maintenance, ownership, license, CI/tests, Scorecard, freshness, and next actions. DO NOT use for code navigation. Pass exactly one of repo or package. A favourable result does not validate an exact package version or compatibility.

  ConnectorNo auth

• get_developer_profileA

  DevGlobeA

  Use when the user names a GitHub login or selects one DevGlobe search result and needs its public profile and contribution evidence. No authentication is required. Example: {"login":"sajeetharan"}.

  ConnectorNo auth

• github-repo-preflightA

  SALT19 Agent Utility GridB

  GitHub repository due diligence for coding agents: evaluate whether a public or open-source repository is safe and maintained enough to adopt using license, maintenance, release freshness, activity, project health, and risk signals. Price: $0.10 via x402. Generate one _salt19_operation_id per intended purchase, preserve it across retries, and add _x402_payment_signature after satisfying the challenge. A stable _salt19_operation_id is required and makes semantic retries at-most-once. _salt19_operation_id is recommended but optional for standard x402 compatibility.

  ConnectorNo auth

• check_package_provenanceA

  NPMScanA

  Checks whether a package version was published with npm's own Sigstore-backed publish provenance (`npm publish --provenance`), and cross-checks that provenance against reality rather than just reporting its presence. Three checks: (1) parses the SLSA build attestation (declared source repo, commit, builder identity, GitHub Actions run URL) and flags a builder that isn't GitHub-hosted, or an attested source repo that doesn't match package.json's own `repository` field; (2) when this version LACKS provenance, checks whether most peer packages (same npm scope, or same maintainer for an unscoped name) DO have it — a package that's the odd one out in an org that otherwise always publishes from CI is a real anomaly, not proof of malice; (3) fetches package.json from the source repository at the exact attested commit (or a best-effort matching git tag when no provenance/commit is available) and diffs its install-lifecycle scripts (preinstall/install/postinstall/prepare) and dependency names against what's actually in the published tarball — this is the single highest-signal check here, since a script or dependency that exists on npm but was never committed is exactly the pattern of a stolen-npm-token publish that bypasses CI (the event-stream/ua-parser-js incident shape). This is a heuristic, structural check: it does NOT cryptographically re-verify the Sigstore bundle (Fulcio cert chain, Rekor inclusion proof) — it trusts that npm's registry already refused to accept a publish that failed that verification, and checks the CONTENT of what the registry reports instead. Most packages don't use --provenance yet, so its bare absence is never scored on its own — only an org-norm anomaly or an actual source mismatch is. Use get_package/get_package_version first for basic package info; use this specifically to assess publish-integrity risk.

  ConnectorNo auth

• check_package_provenanceA

  NPMScanA

  Checks whether a package version was published with npm's own Sigstore-backed publish provenance (`npm publish --provenance`), and cross-checks that provenance against reality rather than just reporting its presence. Three checks: (1) parses the SLSA build attestation (declared source repo, commit, builder identity, GitHub Actions run URL) and flags a builder that isn't GitHub-hosted, or an attested source repo that doesn't match package.json's own `repository` field; (2) when this version LACKS provenance, checks whether most peer packages (same npm scope, or same maintainer for an unscoped name) DO have it — a package that's the odd one out in an org that otherwise always publishes from CI is a real anomaly, not proof of malice; (3) fetches package.json from the source repository at the exact attested commit (or a best-effort matching git tag when no provenance/commit is available) and diffs its install-lifecycle scripts (preinstall/install/postinstall/prepare) and dependency names against what's actually in the published tarball — this is the single highest-signal check here, since a script or dependency that exists on npm but was never committed is exactly the pattern of a stolen-npm-token publish that bypasses CI (the event-stream/ua-parser-js incident shape). This is a heuristic, structural check: it does NOT cryptographically re-verify the Sigstore bundle (Fulcio cert chain, Rekor inclusion proof) — it trusts that npm's registry already refused to accept a publish that failed that verification, and checks the CONTENT of what the registry reports instead. Most packages don't use --provenance yet, so its bare absence is never scored on its own — only an org-norm anomaly or an actual source mismatch is. Use get_package/get_package_version first for basic package info; use this specifically to assess publish-integrity risk.

  ConnectorNo auth

• initA

  SymvantaA

  Call first, with repository:"owner/name" (your checkout's GitHub remote). Binds the session to the project holding that repository and returns it as the active project with its repositories, index health, and a `usage` field (decision matrix + routing). workspace.attached=false means the checkout is NOT indexed: nothing in the answer describes it; attach it (add_repository, create_project) or work without the graph, do not route through the projects listed. Without repository: the pinned project (ref op:"use_project") or the workspace default.

  ConnectorNo auth

• add_repositoryA

  SymvantaA

  Attach a GitHub repository to a project (owner + repo_name; clone URL derived; projectId defaults to the bound / default project). Public repos need nothing else. Private repos need installation_id from list_installations (a GitHub App installation that covers the repo) or a workspace PAT saved on the dashboard; without either the attach is refused (private_repository_needs_credential) instead of failing on the queued clone. Idempotent. First attach dispatches an indexing job; response carries visibility, credential ("installation" | "pat" | null), indexing_status ("queued" | "already_indexed") and indexing_job_id to poll. Needs mcp:admin.

  ConnectorNo auth

• set_github_repoA

  Inclusify AccessibilityA

  Names the GitHub repository where this site's problems become work somebody can pick up. Reach for it when a developer or a coding agent should be getting issues instead of reading a dashboard. WRITES to this website's Inclusify configuration, never to the site itself and never to GitHub: it records the repository and opens no issues by itself, which file_github_issues does. It CANNOT install the GitHub App: that is an approval screen on the customer's GitHub account reached from the Integrations page of the Inclusify panel, and no assistant can do it, so this refuses until the workspace has an installation. Before saving it checks the App can actually write issues in that repository and saves nothing if it cannot, so a stored binding always works. REQUIRES CONFIRMATION, because the wrong repository puts accessibility work in front of a team that did not ask for it, somewhere a coding agent may act on it unattended. The account owner is emailed a record, including the previous repository. Needs the PRO plan, matching the panel.

  Connector

  Destructive

  API key