Atlas / MCP servers / mcp-tool-shop-org / repo-knowledge

repo-knowledgeSAFE

Name: repo-knowledge
Author: mcp-tool-shop-org

mcp/mcp-tool-shop-org/repo-knowledge

MCP server by mcp-tool-shop-org · audit · cli · fts5 · Audited 2026-10-12

⚑ Report / re-scan Source ↗

Repo knowledge system — relational catalog with full-text search, audit evidence, and MCP access

Verdict

SAFE

Grade

Trust score

88 /100

Exposed tools

46 38r · 6w · 2d

Transport

stdio

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Local-first repo knowledge system built on SQLite and FTS5. Catalogs repositories with structured metadata, thesis notes, architecture docs, audit evidence, and inter-repo relationships — then exposes everything through a CLI and MCP server for AI-integrated workflows.

Why

Package registries and GitHub APIs tell you what a repo is. They don't tell you what it's for, how it relates to your other repos, what its architectural thesis is, or whether it passed your last security audit. repo-knowledge fills that gap: a single local database that holds thesis, architecture, audit evidence, relationships, and full-text search across all of it.

Install

npm install -g @mcptoolshop/repo-knowledge

Requirements:

Node.js 20+ — this package's engines.node is >=20. The l

Read from source at commit 99452431d686OBSERVED · 2026-10-12

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add sample-test-repo --env GITHUB_TOKEN=${GITHUB_TOKEN} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "sample-test-repo": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "GITHUB_TOKEN": "${GITHUB_TOKEN}"
      }
    }
  }
}

Exposed tools (46)

38 read · 6 write · 2 destructive. Blast radius: 2 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`a`	read	an indexable description
`add_relationship`	write	Record a relationship between two repos.
`add_repo_note`	write	Add a knowledge note to a repo. Use for thesis, architecture, warnings, next steps, etc.
`alpha`	read	alpha service with quokka-token in the blurb
`archive_repo`	read	Mark a repo archived (lifecycle_status=archived, deprecated_at=now). Preserves all notes/findings — this is the reversible alternative to delete_repo. If reason is given it is recorded as a warning note. Re-archiving is idempotent (re-confirms deprecated_at).
`audit_controls_list`	read	List all canonical audit controls, optionally filtered by domain. Use this to know what control IDs to reference when submitting audit results.
`audit_detail`	read	Get the full latest audit for a repo: all control results, findings, metrics, and artifacts.
`audit_failing`	read	List repos whose LATEST audit has failing controls in a given domain. Returns each failing control id + title + notes per repo.
`audit_findings`	read	List open audit findings across the portfolio. Filter by severity or domain.
`audit_portfolio`	read	Portfolio-wide audit posture: all repos with their latest audit status, grouped by posture (critical/needs_attention/healthy/unaudited).
`audit_posture`	read	Get audit posture for a repo: last audit date, status, open findings by severity, failed domains, pass rate.
`audit_submit`	write	Submit audit results for a repo. This is the primary ingestion tool for Claude auditors. Accepts the full audit payload: run metadata, control results, findings, and metrics.
`audit_unaudited`	read	List repos that have no audit runs yet.
`b`	read	first
`beta`	read	beta library
`col-title`	read	documented title quux literal marker in the body
`colon-repo`	read	the slug hello literal marker phrase lives here
`db_fsck`	read
`delete_repo`	destructive	HARD-DELETE a repo and all related rows (notes, facts, docs, relationships, audit runs — FK cascade). IRREVERSIBLE. There is no interactive prompt over MCP, so
`find_repos`	read	Filter repos by owner, status, category, language, framework, or app shape.
`get_repo`	read	Get full knowledge dump for a repo. Includes tech, notes, facts, releases, relationships.
`health_doctor`	read	Single-repo build-health deep dive: CI, declared/observed toolchain + drift, dep-audit (with CVE IDs) and history, workflow actions + permissions. DB-only read (no network refresh).
`health_feed`	read	Build-health change feed across the whole portfolio: audit deltas, newly-unpinned actions, broken CI streaks, toolchain drift. DB-only read (no registry/network refresh) — reflects state as of the last
`health_portfolio`	read	Portfolio health rollup — one row per repo with CI / dep / action-pin health grades + toolchain-drift flag and inline detail. DB-only read (no network refresh).
`knowledge_stats`	read	Show database statistics: counts of repos, notes, docs, facts, releases, relationships.
`multi`	read	tagged content
`old`	read	desc
`ops_runs`	write	List recent operational run rows: db_health_runs (fsck) and/or sync_runs. Read-only audit trail. Use kind to scope to one table.
`r`	read	A test repo for FTS
`related_repos`	read	Show repos related to a given repo (dependencies, companions, successors, etc).
`repo`	destructive	DROP TABLE repos; -- malicious
`repo1`	read	something with ${marker} inside
`repo_diff`	read	Per-repo DB-entry change history within a time window: notes added, audit runs, dep-audit severity deltas, published versions. Default window is the last 7 days. DB-only read.
`repo_summary`	read	Compact one-paragraph summary of a repo: what it is, what stack, what state, what is next.
`repo_versions`	read	List published versions recorded for a repo, grouped per channel (npm / pypi / github-release). READ-ONLY — unlike
`repos_by_stack`	read	Find repos using a specific tech stack combination. Example:
`repos_needing_work`	read	Find repos that need attention: unaudited, stale, have warnings, or need next steps.
`search_repos`	read	Full-text search across all indexed content: docs, notes, repo descriptions. Use this when you remember a concept but not the repo name.
`suggest_dogfood`	read	Get dogfood intelligence suggestions (findings, patterns, recommendations, doctrine) for a repo OR a product surface. Specify EXACTLY ONE of repo / surface.
`sync_dogfood`	write	Sync dogfood evidence from dogfood-lab/testing-os into repo_facts. One-way read — testing-os remains write authority.
`sync_repos`	write	Trigger a full sync: GitHub metadata + local repo scan + FTS reindex.
`test-repo`	read	A test
`unicode-edge`	read	日本語 content here
`unicode-fr-acc`	read	café au lait french press
`unicode-jp`	read	日本語のテスト
`unicode-survive`	read	café tested edge case

Trust audit

SAFEgrade B · trust 88/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	PASS
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (2 observation(s))
Network: declared (5 observation(s))
Shell: declared (3 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (17)

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

delete_repo, repo

Why it matters. 2 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

src/audit/import.ts:570

checksum = createHash('md5').update(content).digest('hex');

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

src/sync/local.ts:53

return createHash('md5').update(content).digest('hex');

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

src/mcp/server.ts:90

const { version: pkgVersion } = require('../../package.json') as { version: string };

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357

package.json

@modelcontextprotocol/sdk, better-sqlite3, commander, @eslint/js, @types/better-sqlite3, @types/node, @vitest/coverage-v8, eslint

Why it matters. 12 dependency range(s) float

Fix. pin exact versions or ship a lockfile

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357

site/package.json

@astrojs/starlight, @mcptoolshop/site-theme, @tailwindcss/vite, astro, tailwindcss

Why it matters. 5 dependency range(s) float

Fix. pin exact versions or ship a lockfile

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357

test/fixtures/sample-repo/package.json

express, better-sqlite3, typescript

Why it matters. 3 dependency range(s) float

Fix. pin exact versions or ship a lockfile

LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427

research/STUDY-RK-003/pack-practitioner.md:26

8. SECURITY.md stdio MCP — mcp-tool-shop-org · dated 2026-06-22 on tip · `SECURITY.md` L26–30 — MCP server runs locally over stdio with no network endpoints; GitHub sync uses `gh` auth (no credentials