# Optibot (npm · @optimalai/optibot-mcp)

AI code review for your AI assistant — review local changes, branch diffs, and patch files.

- Trust score: 64/100 (medium)
- Change this week: +45
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `@optimalai/optibot-mcp`: 64/100 (this document), [markdown](https://verifymcp.io/servers/ai-getoptimal-optibot/optimalai-optibot-mcp.md), [page](https://verifymcp.io/servers/ai-getoptimal-optibot/optimalai-optibot-mcp)

## Channel facts

- Registry: `npm`
- Package: `@optimalai/optibot-mcp`
- Version: `1.4.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (113 of 117), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (113 of 117), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 19/100
  - Repository check failed: no source repository is declared.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 59 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 77/100
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 1317 tokens (~59/item across 22 items; 22 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add ai-getoptimal-optibot -- npx -y @optimalai/optibot-mcp
```

### Codex

```bash
codex mcp add ai-getoptimal-optibot -- npx -y @optimalai/optibot-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "ai-getoptimal-optibot": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@optimalai/optibot-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add ai-getoptimal-optibot --command npx --arg -y --arg @optimalai/optibot-mcp
```

### Hermes

```yaml
mcp_servers:
  ai-getoptimal-optibot:
    command: "npx"
    args: ["-y", "@optimalai/optibot-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "ai-getoptimal-optibot": {
      "command": "npx",
      "args": [
        "-y",
        "@optimalai/optibot-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 64, +19)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [functional regression] Security disclosure: unverified → fail
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Stability: unverified → 0.23
- [functional improvement] License: unverified → pass
- [functional] Licence: MIT

### 2026-08-01 (score 45, +45)

- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Tool coverage: unverified → 100

### 2026-07-31 (score 0, −34)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 34, −40)

- [security regression] Known CVEs: partial → unverified
- [security regression] Malware scan: pass → unverified
- [security regression] Provenance: fail → unverified
- [security regression] Install scripts: pass → unverified
- [functional regression] License: pass → unverified
- [functional regression] Security disclosure: fail → unverified
- [functional regression] Dependency health: partial → unverified
- [functional regression] Maintenance: pass → unverified
- [functional] Licence: MIT

### 2026-07-29 (score 74, +35)

- [functional improvement] Tool coverage: unverified → 100
- [functional] First check of Tool coverage: 100
- [functional] First check of Schema quality: pass
- [functional] First check of Schema quality: excellent
- [functional] First check of Schema quality: fail

### 2026-07-28 (score 39, +20)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [functional regression] Security disclosure: unverified → fail
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] License: unverified → pass
- [functional] Licence: MIT

### 2026-07-27 (score 19)

First indexed and scored.

## MCP tools (22)

### `review_local_changes` (~37 tokens)

Review uncommitted local changes (git diff HEAD). Runs an AI code review on all staged and unstaged changes in the current repository.

### `review_branch` (~75 tokens)

Review changes against a target branch. Compares the current branch against the specified branch (or auto-detects origin/main, origin/master, origin/develop). Includes merge conflict detection.

Input parameters:

- `branch` (string): Target branch to compare against. If omitted, auto-detects origin/main, origin/master, or origin/develop.

### `review_diff_file` (~46 tokens)

Review an arbitrary diff/patch file. Sends the contents of a diff file for AI code review.

Input parameters:

- `file_path` (string, required): Path to the diff or patch file to review

### `login` (~59 tokens)

Authenticate with Optibot via browser OAuth. Opens a browser window for login and saves credentials locally. Token expires after 90 days. If your account needs onboarding, returns a URL to complete setup before you can authenticate. Refuses to run inside CI environments.

### `logout` (~17 tokens)

Remove saved Optibot credentials from this machine.

### `check_auth` (~36 tokens)

Check current Optibot authentication status. Shows whether credentials are configured via environment variable or config file, and the active organization (if any).

### `create_api_key` (~61 tokens)

Create a new Optibot API key for CI/CD or automation. The key is only shown once — copy it immediately.

Input parameters:

- `name` (string, required): Name for the API key (e.g., "ci-github-actions", "jenkins-pipeline")

### `list_api_keys` (~21 tokens)

List all Optibot API keys associated with your account.

### `delete_api_key` (~42 tokens)

Delete an Optibot API key by ID. Use list_api_keys to find the ID.

Input parameters:

- `id` (string, required): ID of the API key to delete

### `list_organizations` (~36 tokens)

List all Optibot organizations you belong to. The currently active organization is marked with "*". Use switch_organization to change it.

### `get_current_organization` (~36 tokens)

Show the currently active Optibot organization and your role in it. Read from the JWT organizationId claim (the authoritative source).

### `switch_organization` (~114 tokens)

Switch the active Optibot organization. Rescopes your token so subsequent tool calls act as that organization. Accept either organizationId or name — if multiple orgs share a name, provide organizationId instead. Token is replaced in ~/.optibot/config.json.

Input parameters:

- `name` (string): Organization name (or displayName) to switch to. Used only when organizationId is not provided. Must match exactly one organization.
- `organizationId` (integer): Organization id to switch to. Provide either organizationId or name.

### `get_status` (~36 tokens)

Show full Optibot status: authentication method, active organization, and review quota. Mirrors `optibot status` from the CLI.

### `trigger_security_scan` (~201 tokens)

Trigger an AI security scan on a repository in the active organization. Blocks until the scan completes (or the timeout is reached, in which case it returns a "still_running" handoff). Streams live progress events. Accepts either repositoryId or name.

Input parameters:

- `maxBudgetUSD` (number): Max budget per scan in USD (0.50–500).
- `modelTier` (string): Model tier: low (cheapest), medium, high (most thorough). Server default if omitted.
- `name` (string): Repository name or fullName to scan. Used only when repositoryId is not provided.
- `postAsIssue` (boolean): If true, open the scan report as a GitHub/GitLab issue on completion.
- `repositoryId` (integer): Repository id to scan. Provide either repositoryId or name.
- `timeoutSeconds` (integer): How long to wait for completion before returning a still_running handoff. Default 300.

### `list_security_scans` (~86 tokens)

List recent security scans for the active organization. Optionally filter by repository. Paginated.

Input parameters:

- `name` (string): Filter by repository name or fullName.
- `page` (integer): Page number (default 1).
- `pageSize` (integer): Results per page (default 5, max 50).
- `repositoryId` (integer): Filter by repository id.

### `get_security_scan` (~60 tokens)

Fetch the full markdown report and metadata for a specific security scan by id. The backend has no by-id endpoint, so this pages through recent scans up to a reasonable cap.

Input parameters:

- `scanId` (integer, required): Scan id (from list_security_scans).

### `get_security_usage` (~24 tokens)

Show current-month token usage and cost for security scans on the active organization.

### `get_security_pricing` (~21 tokens)

Show per-tier pricing and markup multiplier for security scans.

### `list_scannable_repos` (~33 tokens)

List repositories available to scan in the active organization. Use these ids/names when calling trigger_security_scan.

### `get_security_config` (~30 tokens)

Show the scheduled-scan configuration (schedule, enabled repos, budget, tier) for the active organization.

### `update_security_config` (~156 tokens)

Update the scheduled-scan configuration for the active organization. Only specified fields are changed; unspecified fields keep their current value. When schedule is "custom", customCron is required.

Input parameters:

- `customCron` (string): Cron expression (required when schedule=custom).
- `enabled` (boolean): Enable or disable scheduled scans.
- `maxBudgetUSD` (number): Max budget per scheduled scan.
- `modelTier` (string): Model tier for scheduled scans.
- `postAsIssue` (boolean): Whether to open scan reports as repository issues.
- `repositoryIds` (array): List of repository ids to include in scheduled scans. Replaces the existing list.
- `schedule` (string): Scan frequency. If "custom", provide customCron.

### `setup_ci` (~90 tokens)

Set up Optibot for CI/CD: mints a long-lived API key bound to the currently active organization and returns the export line ready to paste into the user's CI secret store. Use this for any "set up Optibot in CI" / GitHub Actions / GitLab CI / agentic-coder question.

Input parameters:

- `name` (string): Name for the API key. Default: "ci".

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/ai-getoptimal-optibot/optimalai-optibot-mcp#diagnostics

## Score history

- 2026-08-03: 64
- 2026-08-02: 64
- 2026-08-01: 45
- 2026-07-31: 0
- 2026-07-30: 34
- 2026-07-29: 74
- 2026-07-28: 39
- 2026-07-27: 19

## Links

- npm package: https://www.npmjs.com/package/@optimalai/optibot-mcp
- Socket report: https://socket.dev/npm/package/@optimalai/optibot-mcp
- Website: https://getoptimal.ai/
- Changelog RSS feed: https://verifymcp.io/servers/ai-getoptimal-optibot/optimalai-optibot-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/ai-getoptimal-optibot/optimalai-optibot-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/ai-getoptimal-optibot/optimalai-optibot-mcp