ProjectPulse MCP

Fetches or triggers open Code Scanning (CodeQL) alerts for a GitHub repository. - Side effects: Read-only by default. If trigger_scan=true, writes to GitHub Actions by creating a workflow_dispatch event. - Data sources: GitHub REST API (code-scanning/alerts and actions). - Auth requirements: Requires GITHUB_TOKEN with appropriate permissions (security-events). - Rate limits: Subject to standard GitHub API limits. - Return shape: Returns a JSON array of alert objects including rule_id, severity, rule_description, state, location paths, and html_url. - Usage guidelines: Use this tool ONLY for deep static code vulnerability scanning (CodeQL). DO NOT use this tool for other checks: - For package/dependency vulnerabilities, use 'analyze_dependencies' instead. - For a computed A-F health score grading, use 'get_health_score' instead. - For checking standard CI/CD workflow statuses, use 'check_ci_status' instead.

Fetches Dependabot alerts for a GitHub repository to analyze vulnerable package dependencies. - Side effects: None. This is a strictly read-only operation. - Data sources: GitHub REST API (dependabot/alerts). - Auth requirements: Requires GITHUB_TOKEN with appropriate permissions (dependabot alerts are often restricted). - Rate limits: Subject to standard GitHub API limits. - Return shape: Returns a JSON array of vulnerable package dependencies including summary, severity, package_name, state, and html_url. - Usage guidelines: Use this tool ONLY to find vulnerable package dependencies (npm, pip, etc.). DO NOT use this tool for other checks: - For static code security vulnerabilities (CodeQL), use 'analyze_code_scanning' instead. - For a computed A-F health score grading, use 'get_health_score' instead.

Fetches recent CI/CD workflow runs (GitHub Actions) for a GitHub repository. - Side effects: None. This is a strictly read-only operation. - Data sources: GitHub REST API (actions/runs). - Auth requirements: No authentication required for public repositories. Uses configured token if available. - Rate limits: Subject to standard GitHub API limits. - Return shape: Returns a JSON array of workflow runs including name, status, conclusion, head_branch, created_at, updated_at, and html_url. - Usage guidelines: Use this tool ONLY to check raw GitHub Actions workflow history and CI build statuses. DO NOT use this tool for other analyses: - For a computed A-F health score grading, use 'get_health_score' instead. - For retrieving basic repository stats (stars, forks), use 'get_repo_health' instead. - For calculated DORA metrics, use 'get_dora_metrics' instead.

Compares health scores of multiple GitHub repositories (2-5 repos) and ranks them. - Side effects: None. This is a strictly read-only operation. - Data sources: GitHub REST API and OpenSSF Scorecard API (via get_health_score logic). - Auth requirements: No authentication required for public repositories. Uses configured token if available. - Rate limits: Subject to standard GitHub API limits. Multiplies API calls by the number of repositories compared. - Return shape: Returns a JSON object containing a ranked list of repositories (owner, repo, rank) with their detailed health breakdown (score, CI, freshness, security, community, maintenance). - Usage guidelines: Use this tool ONLY when you need to compare or rank multiple repositories against each other based on their health scores. DO NOT use this tool for analyzing a single repository: - For getting the health score of a single repository, use 'get_health_score' instead. - For comparing raw metadata instead of health scores, query 'get_repo_health' individually.

Calculates DORA proxy metrics (deployment frequency, lead time, change failure rate, MTTR) for a GitHub repository. - Side effects: None. This is a strictly read-only operation. - Data sources: GitHub REST API (releases, actions/runs, pulls). - Auth requirements: No special authentication required for public repositories. Private repositories require GITHUB_TOKEN. - Rate limits: Subject to standard GitHub API limits. Heavy API usage due to multiple list endpoints being queried. - Return shape: Returns a JSON object with calculated DORA metrics over the specified period. - Usage guidelines: Use this tool ONLY to evaluate DORA metrics and team delivery performance. DO NOT use this tool for other checks: - For raw workflow statuses, use 'check_ci_status' instead. - For a computed A-F health score grading, use 'get_health_score' instead. - For general repository metadata, use 'get_repo_health' instead.

Calculates a 0-100 health score and A-F grade for a GitHub repository. - Side effects: Writes a trend snapshot to local disk for history tracking. Read-only against GitHub API. - Data sources: GitHub REST API (repos, actions, dependabot) and OpenSSF Scorecard API. - Auth requirements: No authentication required for public repositories. Uses configured token if available. - Rate limits: Subject to standard GitHub API limits (heavy usage across multiple endpoints). - Return shape: Returns a JSON object with a grade (A-F), total score, detailed category breakdown (CI, freshness, security, community, maintenance), improvement suggestions, and historical trend data. - Usage guidelines: Use this tool ONLY for deep analytical grading and overall repository health assessment. DO NOT use this tool for quick metadata checks: - For basic raw metadata (stars, language, etc.), use 'get_repo_health' instead. - For raw CI workflow statuses, use 'check_ci_status' instead. - For deep code vulnerability scanning, use 'analyze_code_scanning' instead. - For DORA metrics, use 'get_dora_metrics' instead.

Fetches basic repository metadata and statistics from the public GitHub API. - Side effects: None. This is a strictly read-only operation. - Data sources: Public GitHub REST API (GET /repos/{owner}/{repo}). - Auth requirements: No authentication required for public repositories. Uses configured GitHub token if available. - Rate limits: Subject to standard GitHub API limits (60 requests/hour unauthenticated, 5000 requests/hour authenticated). - Return shape: Returns a JSON object containing specific metadata: full_name (string), description (string), stargazers_count (number), open_issues_count (number), language (string), license (string, SPDX ID), pushed_at (ISO 8601 string), default_branch (string), archived (boolean), and forks_count (number). - Usage guidelines: Use this tool ONLY to retrieve basic raw metadata (like stars, forks, language, and issue counts). DO NOT use this tool for other specific analyses: - For a computed A-F health score grading, use 'get_health_score' instead. - For checking CI/CD workflow run statuses, use 'check_ci_status' instead. - For package vulnerabilities and dependency graph, use 'analyze_dependencies' instead. - For code security and static analysis, use 'analyze_code_scanning' instead.