# ProjectPulse MCP (npm · projectpulse-mcp)

Monitor GitHub repo health, DORA metrics and CI signals from your AI assistant.

- Trust score: 74/100 (medium)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-20

## Components

- npm · `projectpulse-mcp`: 74/100 (this document), [markdown](https://verifymcp.io/servers/alexbypa-github-projectpulse-mcp/projectpulse-mcp.md), [page](https://verifymcp.io/servers/alexbypa-github-projectpulse-mcp/projectpulse-mcp)

## Channel facts

- Registry: `npm`
- Package: `projectpulse-mcp`
- Version: `1.7.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-20.

- **Supply Chain Security**: 98/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 31 of 114 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 48/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 11 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 63/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1854 tokens (~264/item across 7 items; 7 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 44/100
  - Stability check failed: the tool surface changed between 1.5.1 and 1.7.0: 1 tool removals, 0 breaking changes, 0 additions.
- **Tool Coverage**: 97/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 89% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 7 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 7 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the ProjectPulse MCP server?

ProjectPulse MCP runs locally as an npm package, launched with npx -y projectpulse-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add alexbypa-github-projectpulse-mcp -- npx -y projectpulse-mcp
```

### Cursor

```json
{
  "mcpServers": {
    "alexbypa-github-projectpulse-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "projectpulse-mcp"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "alexbypa-github-projectpulse-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "projectpulse-mcp"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add alexbypa-github-projectpulse-mcp -- npx -y projectpulse-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "alexbypa-github-projectpulse-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "projectpulse-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add alexbypa-github-projectpulse-mcp --command npx --arg -y --arg projectpulse-mcp
```

### Hermes

```yaml
mcp_servers:
  alexbypa-github-projectpulse-mcp:
    command: "npx"
    args: ["-y", "projectpulse-mcp"]
```

### Netclaw

```json
{
  "McpServers": {
    "alexbypa-github-projectpulse-mcp": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "projectpulse-mcp"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add alexbypa-github-projectpulse-mcp -t stdio -c npx -a -y projectpulse-mcp
```

### Other

```json
{
  "mcpServers": {
    "alexbypa-github-projectpulse-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "projectpulse-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-19 (score 74, +1)

No change was recorded against any check on this day. Stability & Change Management went from 38 to 41.

### 2026-09-17 (score 73, +1)

No change was recorded against any check on this day. Stability & Change Management went from 31 to 34.

### 2026-09-15 (score 72, +1)

No change was recorded against any check on this day. Stability & Change Management went from 24 to 28.

### 2026-09-12 (score 71, +1)

No change was recorded against any check on this day. Stability & Change Management went from 14 to 18.

### 2026-09-10 (score 70, +1)

No change was recorded against any check on this day. Stability & Change Management went from 8 to 11.

### 2026-09-09 (score 69, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-09-08 (score 54, −14)

- [security regression] Malware scan: pass → unverified
- [functional] Package version: 1.6.14 → 1.7.0

### 2026-09-07 (score 68, +25)

- [security regression] Stability: fail → unverified
- [security regression] Tool safety: pass → unverified
- [security improvement] Malware scan: unverified → pass
- [security improvement] Known CVEs: unverified → pass
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] Tool coverage: 71% → 100%
- [functional improvement] Dependency health: unverified → 0.87
- [functional] First check of Schema quality: unverified
- [functional] Package version: 1.6.12 → 1.6.14
- [functional] Package version: 1.6.12 → 1.6.13

## MCP tools (7)

### `check_ci_status` (~248 tokens)

Fetches recent CI/CD workflow runs (GitHub Actions) for a GitHub repository.
\- Side effects: None. This is a strictly read-only operation.
\- Data sources: GitHub REST API (actions/runs).
\- Auth requirements: No authentication required for public repositories. Uses configured token if available.
\- Rate limits: Subject to standard GitHub API limits.
\- Return shape: Returns a JSON array of workflow runs including name, status, conclusion, head_branch, created_at, updated_at, and html_url.
\- Usage guidelines: Use this tool ONLY to check raw GitHub Actions workflow history and CI build statuses. DO NOT use this tool for other analyses:
  \- For a computed A-F health score grading, use 'get_health_score' instead.
  \- For retrieving basic repository stats (stars, forks), use 'get_repo_health' instead.
  \- For calculated DORA metrics, use 'get_dora_metrics' instead.

Input parameters:

- `limit` (number): Number of runs to return
- `owner` (string, required): GitHub repository owner (e.g., 'modelcontextprotocol')
- `repo` (string, required): GitHub repository name (e.g., 'sdk')

Output parameters:

- `runs` (array)

### `get_repo_health` (~315 tokens)

Fetches basic repository metadata and statistics from the public GitHub API.
\- Side effects: None. This is a strictly read-only operation.
\- Data sources: Public GitHub REST API (GET /repos/{owner}/{repo}).
\- Auth requirements: No authentication required for public repositories. Uses configured GitHub token if available.
\- Rate limits: Subject to standard GitHub API limits (60 requests/hour unauthenticated, 5000 requests/hour authenticated).
\- Return shape: Returns a JSON object containing specific metadata: full_name (string), description (string), stargazers_count (number), open_issues_count (number), language (string), license (string, SPDX ID), pushed_at (ISO 8601 string), default_branch (string), archived (boolean), and forks_count (number).
\- Usage guidelines: Use this tool ONLY to retrieve basic raw metadata (like stars, forks, language, and issue counts). DO NOT use this tool for other specific analyses:
  \- For a computed A-F health score grading, use 'get_health_score' instead.
  \- For checking CI/CD workflow run statuses, use 'check_ci_status' instead.
  \- For package vulnerabilities and dependency graph, use 'analyze_dependencies' instead.
  \- For code security and static analysis, use 'analyze_code_scanning' instead.

Input parameters:

- `owner` (string, required): GitHub repository owner (e.g., 'modelcontextprotocol')
- `repo` (string, required): GitHub repository name (e.g., 'sdk')

Output parameters:

- `archived` (boolean)
- `default_branch` (string)
- `description` (string|null)
- `forks_count` (number)
- `full_name` (string)
- `language` (string|null)
- `license` (string|null)
- `open_issues_count` (number)
- `pushed_at` (string)
- `stargazers_count` (number)

### `analyze_dependencies` (~221 tokens)

Fetches Dependabot alerts for a GitHub repository to analyze vulnerable package dependencies.
\- Side effects: None. This is a strictly read-only operation.
\- Data sources: GitHub REST API (dependabot/alerts).
\- Auth requirements: Requires GITHUB_TOKEN with appropriate permissions (dependabot alerts are often restricted).
\- Rate limits: Subject to standard GitHub API limits.
\- Return shape: Returns a JSON array of vulnerable package dependencies including summary, severity, package_name, state, and html_url.
\- Usage guidelines: Use this tool ONLY to find vulnerable package dependencies (npm, pip, etc.). DO NOT use this tool for other checks:
  \- For static code security vulnerabilities (CodeQL), use 'analyze_code_scanning' instead.
  \- For a computed A-F health score grading, use 'get_health_score' instead.

Input parameters:

- `owner` (string, required): GitHub repository owner (e.g., 'modelcontextprotocol')
- `repo` (string, required): GitHub repository name (e.g., 'sdk')
- `severity` (string)

Output parameters:

- `alerts` (array)

### `analyze_code_scanning` (~305 tokens)

Fetches or triggers open Code Scanning (CodeQL) alerts for a GitHub repository.
\- Side effects: Read-only by default. If trigger_scan=true, writes to GitHub Actions by creating a workflow_dispatch event.
\- Data sources: GitHub REST API (code-scanning/alerts and actions).
\- Auth requirements: Requires GITHUB_TOKEN with appropriate permissions (security-events).
\- Rate limits: Subject to standard GitHub API limits.
\- Return shape: Returns a JSON array of alert objects including rule_id, severity, rule_description, state, location paths, and html_url.
\- Usage guidelines: Use this tool ONLY for deep static code vulnerability scanning (CodeQL). DO NOT use this tool for other checks:
  \- For package/dependency vulnerabilities, use 'analyze_dependencies' instead.
  \- For a computed A-F health score grading, use 'get_health_score' instead.
  \- For checking standard CI/CD workflow statuses, use 'check_ci_status' instead.

Input parameters:

- `owner` (string, required): GitHub repository owner (e.g., 'modelcontextprotocol')
- `poll_interval_seconds` (number): Seconds between poll attempts (default 15)
- `poll_timeout_seconds` (number): Max seconds to wait for CodeQL scan completion (default 300)
- `repo` (string, required): GitHub repository name (e.g., 'sdk')
- `trigger_scan` (boolean): If true, triggers CodeQL workflow then polls for results before returning alerts

Output parameters:

- `alerts` (array)
- `warning` (string)

### `get_health_score` (~282 tokens)

Calculates a 0-100 health score and A-F grade for a GitHub repository.
\- Side effects: Writes a trend snapshot to local disk for history tracking. Read-only against GitHub API.
\- Data sources: GitHub REST API (repos, actions, dependabot) and OpenSSF Scorecard API.
\- Auth requirements: No authentication required for public repositories. Uses configured token if available.
\- Rate limits: Subject to standard GitHub API limits (heavy usage across multiple endpoints).
\- Return shape: Returns a JSON object with a grade (A-F), total score, detailed category breakdown (CI, freshness, security, community, maintenance), improvement suggestions, and historical trend data.
\- Usage guidelines: Use this tool ONLY for deep analytical grading and overall repository health assessment. DO NOT use this tool for quick metadata checks:
  \- For basic raw metadata (stars, language, etc.), use 'get_repo_health' instead.
  \- For raw CI workflow statuses, use 'check_ci_status' instead.
  \- For deep code vulnerability scanning, use 'analyze_code_scanning' instead.
  \- For DORA metrics, use 'get_dora_metrics' instead.

Input parameters:

- `owner` (string, required): GitHub repository owner (e.g., 'modelcontextprotocol')
- `repo` (string, required): GitHub repository name (e.g., 'sdk')

Output parameters:

- `badgeSnippet` (string)
- `recommendations` (array)
- `report` (object)
- `trend`

### `get_dora_metrics` (~257 tokens)

Calculates DORA proxy metrics (deployment frequency, lead time, change failure rate, MTTR) for a GitHub repository.
\- Side effects: None. This is a strictly read-only operation.
\- Data sources: GitHub REST API (releases, actions/runs, pulls).
\- Auth requirements: No special authentication required for public repositories. Private repositories require GITHUB_TOKEN.
\- Rate limits: Subject to standard GitHub API limits. Heavy API usage due to multiple list endpoints being queried.
\- Return shape: Returns a JSON object with calculated DORA metrics over the specified period.
\- Usage guidelines: Use this tool ONLY to evaluate DORA metrics and team delivery performance. DO NOT use this tool for other checks:
  \- For raw workflow statuses, use 'check_ci_status' instead.
  \- For a computed A-F health score grading, use 'get_health_score' instead.
  \- For general repository metadata, use 'get_repo_health' instead.

Input parameters:

- `days` (number): Number of past days to analyze (default: 30)
- `owner` (string, required): GitHub repository owner (e.g., 'modelcontextprotocol')
- `repo` (string, required): GitHub repository name (e.g., 'sdk')

Output parameters:

- `change_failure_rate` (object)
- `deployment_frequency` (object)
- `lead_time` (object)
- `measured_from` (string)
- `measured_to` (string)
- `mttr` (object)
- `owner` (string)
- `period_days` (number)
- `repo` (string)

### `compare_repos` (~226 tokens)

Compares health scores of multiple GitHub repositories (2-5 repos) and ranks them.
\- Side effects: None. This is a strictly read-only operation.
\- Data sources: GitHub REST API and OpenSSF Scorecard API (via get_health_score logic).
\- Auth requirements: No authentication required for public repositories. Uses configured token if available.
\- Rate limits: Subject to standard GitHub API limits. Multiplies API calls by the number of repositories compared.
\- Return shape: Returns a JSON object containing a ranked list of repositories (owner, repo, rank) with their detailed health breakdown (score, CI, freshness, security, community, maintenance).
\- Usage guidelines: Use this tool ONLY when you need to compare or rank multiple repositories against each other based on their health scores. DO NOT use this tool for analyzing a single repository:
  \- For getting the health score of a single repository, use 'get_health_score' instead.
  \- For comparing raw metadata instead of health scores, query 'get_repo_health' individually.

Input parameters:

- `repos` (array, required)

Output parameters:

- `compared_at` (string)
- `repos` (array)

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/alexbypa-github-projectpulse-mcp/projectpulse-mcp#diagnostics

## Score history

- 2026-09-20: 74
- 2026-09-19: 74
- 2026-09-18: 73
- 2026-09-17: 73
- 2026-09-16: 72
- 2026-09-15: 72
- 2026-09-14: 71
- 2026-09-13: 71
- 2026-09-12: 71
- 2026-09-11: 70
- 2026-09-10: 70
- 2026-09-09: 69
- 2026-09-08: 54
- 2026-09-07: 68
- 2026-09-06: 43
- 2026-09-05: 70
- 2026-09-04: 69
- 2026-09-03: 69

## Common questions

### What is the ProjectPulse MCP server?

ProjectPulse MCP is listed in the public MCP registry as io.github.alexbypa/github-projectpulse-mcp. Monitor GitHub repo health, DORA metrics and CI signals from your AI assistant. This page covers its npm package (projectpulse-mcp).

### Is the ProjectPulse MCP server safe to use?

ProjectPulse MCP scores 74 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the ProjectPulse MCP server expose?

ProjectPulse MCP exposes 7 tools: check_ci_status, get_repo_health, analyze_dependencies, analyze_code_scanning, get_health_score, and 2 more. Their descriptions and schemas cost roughly 1,854 tokens of context every time the server is loaded.

### Is the ProjectPulse MCP server still maintained?

ProjectPulse MCP is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the ProjectPulse MCP server under?

ProjectPulse MCP declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/projectpulse-mcp
- Socket report: https://socket.dev/npm/package/projectpulse-mcp
- Repository: https://github.com/alexbypa/github-projectpulse-mcp
- Website: https://www.npmjs.com/package/projectpulse-mcp
- Changelog RSS feed: https://verifymcp.io/servers/alexbypa-github-projectpulse-mcp/projectpulse-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/alexbypa-github-projectpulse-mcp/projectpulse-mcp.json
- HTML version of this page: https://verifymcp.io/servers/alexbypa-github-projectpulse-mcp/projectpulse-mcp