repo-aeoBLOCK
Make any repository, npm package and docs site findable and recommendable to humans, AI agents and search engines.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
English | Русский
[](./LICENSE) [](https://nodejs.org)
Make any repository, npm package and docs site findable and recommendable for humans, AI agents and search engines.
RDK scores how discoverable your repository is, fixes the parts that can be fixed automatically, and keeps it from regressing in CI. It is the tool you point at a repo that is good but invisible.
The audit runs 44 checks in under 300 ms offline on this repository (measured with rdk audit --format json, duration_ms field) and carries 0 runtime dependencies, so npx stays fast and the supply chain stays small.
Quickstart
Prerequisites: Node.js >= 18
# 1. add RDK to your repository npm install --save-dev repo-aeo # 2. scaffold the config and the missing files npx repo-aeo init --apply # 3. see the score and the prioritised fix list npx repo-aeo audit # 4. run the test suite npm test
Two-minute setup for a repository you do not own yet: clone it, run npx repo-aeo init --apply, then npx repo-aeo audit. Everything the CLI writes is a reviewable diff — it never publishes, tags or force-pushes. The one exception lives in CI: the opt-in autofix job force-pushes its own dated rdk/autofix- bot branch and opens a reviewable PR.
Ways to use it
You fork nothing and install nothing permanently. Pick the surface that matches how you work — each pulls the engine on demand:
5b31fb27499dOBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add repo-aeo-mcp --env MCP_REGISTRY_TOKEN=${MCP_REGISTRY_TOKEN} --env RDK_EVAL_API_KEY=${RDK_EVAL_API_KEY} -- npx -y [email protected]{
"mcpServers": {
"repo-aeo-mcp": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"MCP_REGISTRY_TOKEN": "${MCP_REGISTRY_TOKEN}",
"RDK_EVAL_API_KEY": "${RDK_EVAL_API_KEY}"
}
}
}
}Exposed tools (37)
32 read · 5 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
cite-me | read | A citable project |
cli-demo | read | CLI demo project |
competitor_scan_list_articles | read | Scan a configured search endpoint for |
d-lib | read | Does things |
dry | write | Dry run |
fmt-demo | read | Format demo |
fresh | read | A fresh project |
from-pkg | read | From package.json |
fwd | read | forwarding demo |
github_audit_visibility_signals | read | Audit the live GitHub visibility signals of a repository: stars, forks, topics, open issues, release freshness, wiki and discussions, with the same thresholds the CLI audit uses. |
heal-me | read | Heal me |
idem | read | Idempotent |
initdry | write | init dry run demo |
keep | read | Existing description |
keep-mine | read | Keep mine |
llms_txt_check_freshness | read | Check whether llms.txt still matches its sources: marker-managed files are compared against the rendered output, hand-written files against source modification times; drift is reported because a stale llms.txt actively misleads agents. |
locations | read | Community profile locations |
managed-drift | read | Managed drift |
mark-channel | read | mark channel disambiguation demo |
mark-flags | read | mark flag validation demo |
minscore | read | min score gate demo |
no-readme | read | No readme repo |
no-scripts | read | No scripts here |
nogithub | read | no github demo |
npm_get_search_score | read | Get the current npms.io search score for an npm package (final, quality, popularity, maintenance) plus the concrete gaps that block the completeness bonus. Omit package_name to score the package in the current repository. |
readme-sync | write | Readme sync check |
repo_get_discoverability_score | write | Run the same discoverability audit engine as the CLI against a repository and return the full 0-100 score, per-axis breakdown and every finding. |
repo_list_findings | read | List the audit findings for a repository, filtered by severity, effort or autofixability, so an agent can work through them one at a time. |
seed-holder | read | Seeded holder |
seeded | read | Seeded project |
site_check_llms_txt | read | Check that a project website serves /llms.txt at its domain root and report status, size and the first heading so an agent can decide whether to fetch it. |
stray | read | stray argument demo |
stray-skill | read | stray skill demo |
sync | write | Sync demo |
track-demo | read | track registration demo |
trust-files | read | Trust files |
valid-calls | read | valid invocation demo |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (7 observation(s))
- Network
- declared (3 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (10)
const suspicious = files.filter((entry) => /(^|\/)(\.env|\.git|secrets?|id_rsa|\.npmrc)/i.test(String(entry)));
const suspicious = pack.files.filter((file) => /(^|\/)(\.env|\.npmrc|secrets?|id_rsa)(\.|$)/i.test(file) || /(^|\/)\.git(\/|$)/i.test(file));
assert.ok(!source.includes('exec('));import { exists, readTextIfExists } from '../../util/fs.js';import { exists, readTextIfExists } from '../../util/fs.js';import { generatedDrift, jsonldVersionDrift, GENERATED_START } from '../../generate/index.js';import { exists, readTextIfExists } from '../../util/fs.js';import { citationVersionDrift, citationRepositoryDrift, dependabotEcosystems } from '../../generate/index.js';return await run(`http://127.0.0.1:${server.address().port}/`);repo-aeo
Gates applied: no_behavioural_pass.
5b31fb27499dfull audit observations/trust-audit/mcp-server/whitebite__repo-aeo.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 5b31fb27499d | BLOCK | D | 69 | first audit |
Questions
What is the repo-aeo MCP server?
Make any repository, npm package and docs site findable and recommendable to humans, AI agents and search engines.
What tools does repo-aeo expose?
37 in total: 32 read-only, 5 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is repo-aeo safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does repo-aeo need?
It reads MCP_REGISTRY_TOKEN and RDK_EVAL_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How current is this page?
The grade is for one exact copy of the source (5b31fb27499d), read on 2026-10-11. The repository is watched and re-audited when it changes.