Remogram

NPM · @REMOGRAM/MCP · SCANNED AUG 3

SCM & forge boundary MCP: normalized, typed JSON from attributed Gitea, GitLab, and GitHub providers

Available components

+19 this week 63 63 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security88

No malware found by supply-chain analysis.Pass
Only part of the dependency tree could be resolved (102 of 106), so this covers what we could see, not the whole tree.Partial
No install/post-install scripts declared.Pass
Only part of the dependency tree could be resolved (102 of 106), so this covers what we could see, not the whole tree. View diagnostics → Partial

Provenance & Transparency45

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
Clear OSI-approved license (MIT).Pass
Actively maintained (last published 27 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability49

AI-judged instruction clarity (fair).Partial
Tool/resource definitions use about 2395 tokens (~59/item across 40 items; 40 tools + 0 resources), lean.Pass
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management27

Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial

Tool Coverage86

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
59% of tool parameters carry a description.Partial

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · @remogram/mcp

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add attebury-remogram -- npx -y @remogram/mcp

# add to Codex CLI

codex mcp add attebury-remogram -- npx -y @remogram/mcp

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "attebury-remogram": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@remogram/mcp"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add attebury-remogram --command npx --arg -y --arg @remogram/mcp

# ~/.hermes/config.yaml

mcp_servers:
  attebury-remogram:
    command: "npx"
    args: ["-y", "@remogram/mcp"]

// mcp.json

{
  "mcpServers": {
    "attebury-remogram": {
      "command": "npx",
      "args": [
        "-y",
        "@remogram/mcp"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

3 Aug 26 +1

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.
2 Aug 26 +42
- Provenance: unverified → fail ▼ security
- Install scripts: unverified → pass ▲ security
- Known CVEs: unverified → partial ▲ security
- Malware scan: unverified → pass ▲ security
- Security disclosure: fail → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- License: unverified → pass ▲ functional
- Schema quality: unverified → fair ▲ functional
- Maintenance: unverified → pass ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Stability: unverified → 0.23 ▲ functional
- Dependency health: unverified → partial ▲ functional
- First check of Schema quality: unverified functional
- Licence: MIT functional
31 Jul 26 −24
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
27 Jul 26 44

First indexed and scored.

Show 2 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/@remogram/[email protected]

Provenance none

Ecosystem: npm · Outcome: none

Dependencies 102 packages

102 packages in the resolved dependency tree · 95 deprecated · 29 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 40 exposed · ~2,395 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

attestation_read ~33

Read commit status attestation bindings for a SHA.

Input Output Examples

Name	Type	Req	Description
context	string	—	—
sha	string	yes	—

No output schema declared.

No examples provided.

branch_protection ~32

Branch protection policy facts: required status contexts, protected rules, approvals signal.

Input Output Examples

Name	Type	Req	Description
branch_ref	string	yes	—

No output schema declared.

No examples provided.

command_contract_export ~37

Read command contract metadata for all commands or one command key.

Input Output Examples

Name	Type	Req	Description
command	string	—	Optional command key, for example "issue inventory"

No output schema declared.

No examples provided.

cr_body ~24

Change request description body with close_keywords helper.

Input Output Examples

Name	Type	Req	Description
number	integer	yes	—

No output schema declared.

No examples provided.

cr_close ~76

Close an open change request on the configured forge without merging.

Input Output Examples

Name	Type	Req	Description
actor_id	string	—	Caller actor id; requires session_id when set
idempotency_key	string	—	—
number	integer	yes	—
session_id	string	—	Caller session id; requires actor_id when set (untrusted correlation only)

No output schema declared.

No examples provided.

cr_comments ~30

Review comments for a change request (sanitized bodies, truncation-aware).

Input Output Examples

Name	Type	Req	Description
number	integer	yes	—

No output schema declared.

No examples provided.

cr_edit ~98

Update change request title and/or body on the configured forge.

Input Output Examples

Name	Type	Req	Description
actor_id	string	—	Caller actor id; requires session_id when set
body	string	—	—
body_file	string	—	—
idempotency_key	string	—	—
number	integer	yes	—
session_id	string	—	Caller session id; requires actor_id when set (untrusted correlation only)
title	string	—	—

No output schema declared.

No examples provided.

cr_files ~29

Changed file paths for a change request (bounded, truncation-aware).

Input Output Examples

Name	Type	Req	Description
number	integer	yes	—

No output schema declared.

No examples provided.

cr_inventory ~87

Aggregate open change requests with checks and merge-plan facts into a semantic-diff slice.

Input Output Examples

Name	Type	Req	Description
cursor	string	—	Opaque cursor from prior cr_inventory next_cursor
limit	integer	—	Max open CR entries (default 3)
slice_ref	string	—	Optional slice ref label for consumers
sort	string	—	Open-list slice sort preset (default number_asc)

No output schema declared.

No examples provided.

cr_open ~204

Open a change request (pull request) on the configured forge.

Input Output Examples

Name	Type	Req	Description
actor_id	string	—	Caller actor id; requires session_id when set
base	string	yes	Base branch ref
body	string	—	Optional change request body
body_file	string	—	Path to body file (mutually exclusive with body); use - for stdin
dedupe_key	string	—	Durable cross-process dedupe key (24h XDG store)
head	string	yes	Head branch ref
idempotency	string	—	Idempotency scan mode when forge open-pull scan is incomplete
idempotency_key	string	—	Optional agent idempotency key for retry-safe writes
repo	string	—	Override forge repo as owner/name on the same host
session_id	string	—	Caller session id; requires actor_id when set (untrusted correlation only)
title	string	yes	Change request title

No output schema declared.

No examples provided.

doctor ~44

Read-only provider readiness diagnostics for config, remote trust, auth, capabilities, and checks.

Input Output Examples

Name	Type	Req	Description
live	boolean	—	When true, perform a bounded live forge API reachability probe

No output schema declared.

No examples provided.

forge_changes ~115

Forge activity events since an observed_at boundary (PR lifecycle, head SHA moves, check conclusions).

Input Output Examples

Name	Type	Req	Description
cursor	string	—	Opaque cursor from prior forge_changes next_cursor
include_issues	boolean	—	Include issue open/close lifecycle events
limit	integer	—	Events per page (default 64)
log_path	string	—	Override forge event log path
since	string	—	ISO-8601 observed_at boundary (required on first page)
source	string	—	Event source preference

No output schema declared.

No examples provided.

forge_log_ingest ~48

Ingest a Gitea webhook JSON payload into the local forge event log.

Input Output Examples

Name	Type	Req	Description
file	string	—	—
log_path	string	—	—
stdin	boolean	—	—

No output schema declared.

No examples provided.

forge_log_read ~41

Read normalized events from the local forge event log.

Input Output Examples

Name	Type	Req	Description
limit	integer	—	—
log_path	string	—	—
since	string	yes	—

No output schema declared.

No examples provided.

forge_queue_snapshot ~65

Composed forge queue snapshot (repo status, CR slice, merge summaries).

Input Output Examples

Name	Type	Req	Description
base_ref	string	—	—
cr_limit	integer	—	—
include_issues	boolean	—	—
include_refs	boolean	—	—
integration_ref	string	—	—

No output schema declared.

No examples provided.

issue_bundle ~58

Create an issue_bundle packet for issue lifecycle and linked review context.

Input Output Examples

Name	Type	Req	Description
issue_number	integer	yes	—
linked_pr	integer	—	—
state	string	—	—
title	string	—	—
url	string	—	—

No output schema declared.

No examples provided.

issue_close ~74

Close an open forge issue on the configured repository.

Input Output Examples

Name	Type	Req	Description
actor_id	string	—	Caller actor id; requires session_id when set
idempotency_key	string	—	—
number	integer	yes	—
session_id	string	—	Caller session id; requires actor_id when set (untrusted correlation only)

No output schema declared.

No examples provided.

issue_comment ~87

Post a comment on a forge issue.

Input Output Examples

Name	Type	Req	Description
actor_id	string	—	Caller actor id; requires session_id when set
body	string	—	—
body_file	string	—	—
idempotency_key	string	—	—
number	integer	yes	—
session_id	string	—	Caller session id; requires actor_id when set (untrusted correlation only)

No output schema declared.

No examples provided.

issue_comments ~26

Issue comments (sanitized bodies, truncation-aware).

Input Output Examples

Name	Type	Req	Description
number	integer	yes	—

No output schema declared.

No examples provided.

issue_inventory ~85

Aggregate open issues into a semantic-diff inventory slice with pagination cursors.

Input Output Examples

Name	Type	Req	Description
cursor	string	—	Opaque cursor from prior issue_inventory next_cursor
limit	integer	—	Max open issue entries (default 3)
slice_ref	string	—	Optional slice ref label for consumers
sort	string	—	Open-list slice sort preset (default number_asc)

No output schema declared.

No examples provided.

issue_open ~139

Open a forge issue on the configured repository (Gitea v1).

Input Output Examples

Name	Type	Req	Description
actor_id	string	—	Caller actor id; requires session_id when set
body	string	—	Optional issue body (inline cap; use body_file for larger bodies)
body_file	string	—	Path to body file for bodies above inline cap (mutually exclusive with body); use - for stdin
idempotency_key	string	—	Optional agent idempotency key for retry-safe writes
session_id	string	—	Caller session id; requires actor_id when set (untrusted correlation only)
title	string	yes	Issue title

No output schema declared.

No examples provided.

issue_view ~25

Issue metadata facts with optional linked change request snapshot.

Input Output Examples

Name	Type	Req	Description
number	integer	yes	—

No output schema declared.

No examples provided.

merge_execute ~116

Execute a forge merge for an open change request after SHA-bound preflight.

Input Output Examples

Name	Type	Req	Description
actor_id	string	—	Caller actor id; requires session_id when set
expected_base_sha	string	yes	Expected base SHA (40 hex chars)
expected_head_sha	string	yes	Expected head SHA (40 hex chars)
method	string	—	Merge method (v1: merge only)
number	integer	yes	—
session_id	string	—	Caller session id; requires actor_id when set (untrusted correlation only)

No output schema declared.

No examples provided.

merge_plan ~34

Merge readiness facts: mergeability, checks, blockers.

Input Output Examples

Name	Type	Req	Description
allowed_paths	array	—	—
number	integer	yes	—

No output schema declared.

No examples provided.

observer_snapshot ~53

Deprecated alias for forge_queue_snapshot — prefer forge_queue_snapshot.

Input Output Examples

Name	Type	Req	Description
cr_limit	integer	—	—
include_issues	boolean	—	—
include_refs	boolean	—	—
integration_ref	string	—	—

No output schema declared.

No examples provided.

plugin_boundary ~24

Read forge plugin boundary metadata (emit surfaces, denied claims, contract export linkage).

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

pr_checks ~19

CI/check conclusions for a PR number or git ref.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

pr_status ~22

PR metadata and mergeability facts.

Input Output Examples

Name	Type	Req	Description
number	integer	yes	—

No output schema declared.

No examples provided.

provider_capabilities ~46

Structured provider capability facts for commands, auth, checks, host binding, pagination, and write support.

Input Output Examples

Name	Type	Req	Description
repo	string	—	Override forge repo as owner/name on the same host

No output schema declared.

No examples provided.

publish_execute ~51

Push a local branch to the configured git remote (requires publish_branch write_commands).

Input Output Examples

Name	Type	Req	Description
head	string	yes	Local branch name to publish
remote	string	—	Git remote (must match configured config.remote)

No output schema declared.

No examples provided.

publish_plan ~49

Plan branch publication to the configured git remote before opening a change request.

Input Output Examples

Name	Type	Req	Description
head	string	yes	Local branch name to publish
remote	string	—	Git remote (must match configured config.remote)

No output schema declared.

No examples provided.

ref_compare ~56

Compare two refs with exact SHAs and ahead/behind counts.

Input Output Examples

Name	Type	Req	Description
base	string	yes	Base ref
head	string	yes	Head ref
repo	string	—	Override forge repo as owner/name on the same host

No output schema declared.

No examples provided.

ref_inventory ~41

List repository refs with SHAs, default branch hint, and optional ancestry hints.

Input Output Examples

Name	Type	Req	Description
repo	string	—	Override forge repo as owner/name on the same host

No output schema declared.

No examples provided.

repo_status ~37

Forge repo status facts (auth, capabilities, default branch).

Input Output Examples

Name	Type	Req	Description
repo	string	—	Override forge repo as owner/name on the same host

No output schema declared.

No examples provided.

review_bundle ~63

Create a review_bundle packet for reviewed head/base, decision, and summary facts.

Input Output Examples

Name	Type	Req	Description
decision	string	—	—
number	integer	yes	—
reviewed_base_sha	string	—	—
reviewed_head_sha	string	—	—
summary	string	—	—

No output schema declared.

No examples provided.

semantic_diff ~20

Composed semantic diff since a time or git ref boundary.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

status_set ~185

Set a commit status (check context) on the configured forge.

Input Output Examples

Name	Type	Req	Description
actor_id	string	—	Caller actor id; requires session_id when set
context	string	yes	Status context name
description	string	—	Optional status description
idempotency_key	string	—	Optional agent idempotency key for retry-safe writes
note	string	—	Additional attestation note
proof_hash	string	—	Attestation proof hash (sha256:...)
proof_url	string	—	Attestation proof URL
session_id	string	—	Caller session id; requires actor_id when set (untrusted correlation only)
sha	string	yes	40-character commit SHA
state	string	yes	Status state
target_url	string	—	Optional target URL for the status
verifier	string	—	Verifier identity label

No output schema declared.

No examples provided.

sync_plan ~26

Local vs remote sync facts and divergent-remote blockers.

Input Output Examples

Name	Type	Req	Description
remote	string	—	—

No output schema declared.

No examples provided.

verify_bind ~71

Create a verify_bind packet bound to a target SHA and optional proof metadata.

Input Output Examples

Name	Type	Req	Description
note	string	—	Optional verification notes
proof_url	string	—	Verification proof URL
target_sha	string	yes	40-character verified target SHA
verifier	string	—	Verifier identity or lane label

No output schema declared.

No examples provided.

whoami ~25

Authenticated forge identity facts (login, can_write, token scope/expiry signals).

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

27 Jul 3 Aug