# Remogram (npm · @remogram/mcp)

SCM & forge boundary MCP: normalized, typed JSON from attributed Gitea, GitLab, and GitHub providers

- Trust score: 63/100 (medium)
- Change this week: +19
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `@remogram/mcp`: 63/100 (this document), [markdown](https://verifymcp.io/servers/attebury-remogram/remogram-mcp.md), [page](https://verifymcp.io/servers/attebury-remogram/remogram-mcp)

## Channel facts

- Registry: `npm`
- Package: `@remogram/mcp`
- Version: `0.2.0-beta.4`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 88/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (102 of 106), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (102 of 106), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 27 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 49/100
  - AI-judged instruction clarity (fair).
  - Tool/resource definitions use about 2395 tokens (~59/item across 40 items; 40 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 86/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 59% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add attebury-remogram -- npx -y @remogram/mcp
```

### Codex

```bash
codex mcp add attebury-remogram -- npx -y @remogram/mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "attebury-remogram": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@remogram/mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add attebury-remogram --command npx --arg -y --arg @remogram/mcp
```

### Hermes

```yaml
mcp_servers:
  attebury-remogram:
    command: "npx"
    args: ["-y", "@remogram/mcp"]
```

### Other

```json
{
  "mcpServers": {
    "attebury-remogram": {
      "command": "npx",
      "args": [
        "-y",
        "@remogram/mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 63, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-02 (score 62, +42)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [functional regression] Security disclosure: fail → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] License: unverified → pass
- [functional improvement] Schema quality: unverified → fair
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Stability: unverified → 0.23
- [functional improvement] Dependency health: unverified → partial
- [functional] First check of Schema quality: unverified
- [functional] Licence: MIT

### 2026-07-31 (score 20, −24)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-27 (score 44)

First indexed and scored.

## MCP tools (40)

### `doctor` (~44 tokens)

Read-only provider readiness diagnostics for config, remote trust, auth, capabilities, and checks.

Input parameters:

- `live` (boolean): When true, perform a bounded live forge API reachability probe

### `provider_capabilities` (~46 tokens)

Structured provider capability facts for commands, auth, checks, host binding, pagination, and write support.

Input parameters:

- `repo` (string): Override forge repo as owner/name on the same host

### `repo_status` (~37 tokens)

Forge repo status facts (auth, capabilities, default branch).

Input parameters:

- `repo` (string): Override forge repo as owner/name on the same host

### `ref_compare` (~56 tokens)

Compare two refs with exact SHAs and ahead/behind counts.

Input parameters:

- `base` (string, required): Base ref
- `head` (string, required): Head ref
- `repo` (string): Override forge repo as owner/name on the same host

### `ref_inventory` (~41 tokens)

List repository refs with SHAs, default branch hint, and optional ancestry hints.

Input parameters:

- `repo` (string): Override forge repo as owner/name on the same host

### `cr_inventory` (~87 tokens)

Aggregate open change requests with checks and merge-plan facts into a semantic-diff slice.

Input parameters:

- `cursor` (string): Opaque cursor from prior cr_inventory next_cursor
- `limit` (integer): Max open CR entries (default 3)
- `slice_ref` (string): Optional slice ref label for consumers
- `sort` (string): Open-list slice sort preset (default number_asc)

### `issue_inventory` (~85 tokens)

Aggregate open issues into a semantic-diff inventory slice with pagination cursors.

Input parameters:

- `cursor` (string): Opaque cursor from prior issue_inventory next_cursor
- `limit` (integer): Max open issue entries (default 3)
- `slice_ref` (string): Optional slice ref label for consumers
- `sort` (string): Open-list slice sort preset (default number_asc)

### `cr_open` (~204 tokens)

Open a change request (pull request) on the configured forge.

Input parameters:

- `actor_id` (string): Caller actor id; requires session_id when set
- `base` (string, required): Base branch ref
- `body` (string): Optional change request body
- `body_file` (string): Path to body file (mutually exclusive with body); use - for stdin
- `dedupe_key` (string): Durable cross-process dedupe key (24h XDG store)
- `head` (string, required): Head branch ref
- `idempotency` (string): Idempotency scan mode when forge open-pull scan is incomplete
- `idempotency_key` (string): Optional agent idempotency key for retry-safe writes
- `repo` (string): Override forge repo as owner/name on the same host
- `session_id` (string): Caller session id; requires actor_id when set (untrusted correlation only)
- `title` (string, required): Change request title

### `status_set` (~185 tokens)

Set a commit status (check context) on the configured forge.

Input parameters:

- `actor_id` (string): Caller actor id; requires session_id when set
- `context` (string, required): Status context name
- `description` (string): Optional status description
- `idempotency_key` (string): Optional agent idempotency key for retry-safe writes
- `note` (string): Additional attestation note
- `proof_hash` (string): Attestation proof hash (sha256:...)
- `proof_url` (string): Attestation proof URL
- `session_id` (string): Caller session id; requires actor_id when set (untrusted correlation only)
- `sha` (string, required): 40-character commit SHA
- `state` (string, required): Status state
- `target_url` (string): Optional target URL for the status
- `verifier` (string): Verifier identity label

### `issue_open` (~139 tokens)

Open a forge issue on the configured repository (Gitea v1).

Input parameters:

- `actor_id` (string): Caller actor id; requires session_id when set
- `body` (string): Optional issue body (inline cap; use body_file for larger bodies)
- `body_file` (string): Path to body file for bodies above inline cap (mutually exclusive with body); use - for stdin
- `idempotency_key` (string): Optional agent idempotency key for retry-safe writes
- `session_id` (string): Caller session id; requires actor_id when set (untrusted correlation only)
- `title` (string, required): Issue title

### `issue_close` (~74 tokens)

Close an open forge issue on the configured repository.

Input parameters:

- `actor_id` (string): Caller actor id; requires session_id when set
- `idempotency_key` (string)
- `number` (integer, required)
- `session_id` (string): Caller session id; requires actor_id when set (untrusted correlation only)

### `issue_comment` (~87 tokens)

Post a comment on a forge issue.

Input parameters:

- `actor_id` (string): Caller actor id; requires session_id when set
- `body` (string)
- `body_file` (string)
- `idempotency_key` (string)
- `number` (integer, required)
- `session_id` (string): Caller session id; requires actor_id when set (untrusted correlation only)

### `issue_view` (~25 tokens)

Issue metadata facts with optional linked change request snapshot.

Input parameters:

- `number` (integer, required)

### `issue_comments` (~26 tokens)

Issue comments (sanitized bodies, truncation-aware).

Input parameters:

- `number` (integer, required)

### `pr_status` (~22 tokens)

PR metadata and mergeability facts.

Input parameters:

- `number` (integer, required)

### `pr_checks` (~19 tokens)

CI/check conclusions for a PR number or git ref.

### `merge_plan` (~34 tokens)

Merge readiness facts: mergeability, checks, blockers.

Input parameters:

- `allowed_paths` (array)
- `number` (integer, required)

### `whoami` (~25 tokens)

Authenticated forge identity facts (login, can_write, token scope/expiry signals).

### `branch_protection` (~32 tokens)

Branch protection policy facts: required status contexts, protected rules, approvals signal.

Input parameters:

- `branch_ref` (string, required)

### `cr_files` (~29 tokens)

Changed file paths for a change request (bounded, truncation-aware).

Input parameters:

- `number` (integer, required)

### `cr_comments` (~30 tokens)

Review comments for a change request (sanitized bodies, truncation-aware).

Input parameters:

- `number` (integer, required)

### `cr_body` (~24 tokens)

Change request description body with close_keywords helper.

Input parameters:

- `number` (integer, required)

### `cr_edit` (~98 tokens)

Update change request title and/or body on the configured forge.

Input parameters:

- `actor_id` (string): Caller actor id; requires session_id when set
- `body` (string)
- `body_file` (string)
- `idempotency_key` (string)
- `number` (integer, required)
- `session_id` (string): Caller session id; requires actor_id when set (untrusted correlation only)
- `title` (string)

### `cr_close` (~76 tokens)

Close an open change request on the configured forge without merging.

Input parameters:

- `actor_id` (string): Caller actor id; requires session_id when set
- `idempotency_key` (string)
- `number` (integer, required)
- `session_id` (string): Caller session id; requires actor_id when set (untrusted correlation only)

### `forge_changes` (~115 tokens)

Forge activity events since an observed_at boundary (PR lifecycle, head SHA moves, check conclusions).

Input parameters:

- `cursor` (string): Opaque cursor from prior forge_changes next_cursor
- `include_issues` (boolean): Include issue open/close lifecycle events
- `limit` (integer): Events per page (default 64)
- `log_path` (string): Override forge event log path
- `since` (string): ISO-8601 observed_at boundary (required on first page)
- `source` (string): Event source preference

### `forge_queue_snapshot` (~65 tokens)

Composed forge queue snapshot (repo status, CR slice, merge summaries).

Input parameters:

- `base_ref` (string)
- `cr_limit` (integer)
- `include_issues` (boolean)
- `include_refs` (boolean)
- `integration_ref` (string)

### `observer_snapshot` (~53 tokens)

Deprecated alias for forge_queue_snapshot — prefer forge_queue_snapshot.

Input parameters:

- `cr_limit` (integer)
- `include_issues` (boolean)
- `include_refs` (boolean)
- `integration_ref` (string)

### `semantic_diff` (~20 tokens)

Composed semantic diff since a time or git ref boundary.

### `forge_log_ingest` (~48 tokens)

Ingest a Gitea webhook JSON payload into the local forge event log.

Input parameters:

- `file` (string)
- `log_path` (string)
- `stdin` (boolean)

### `forge_log_read` (~41 tokens)

Read normalized events from the local forge event log.

Input parameters:

- `limit` (integer)
- `log_path` (string)
- `since` (string, required)

### `attestation_read` (~33 tokens)

Read commit status attestation bindings for a SHA.

Input parameters:

- `context` (string)
- `sha` (string, required)

### `verify_bind` (~71 tokens)

Create a verify_bind packet bound to a target SHA and optional proof metadata.

Input parameters:

- `note` (string): Optional verification notes
- `proof_url` (string): Verification proof URL
- `target_sha` (string, required): 40-character verified target SHA
- `verifier` (string): Verifier identity or lane label

### `review_bundle` (~63 tokens)

Create a review_bundle packet for reviewed head/base, decision, and summary facts.

Input parameters:

- `decision` (string)
- `number` (integer, required)
- `reviewed_base_sha` (string)
- `reviewed_head_sha` (string)
- `summary` (string)

### `issue_bundle` (~58 tokens)

Create an issue_bundle packet for issue lifecycle and linked review context.

Input parameters:

- `issue_number` (integer, required)
- `linked_pr` (integer)
- `state` (string)
- `title` (string)
- `url` (string)

### `merge_execute` (~116 tokens)

Execute a forge merge for an open change request after SHA-bound preflight.

Input parameters:

- `actor_id` (string): Caller actor id; requires session_id when set
- `expected_base_sha` (string, required): Expected base SHA (40 hex chars)
- `expected_head_sha` (string, required): Expected head SHA (40 hex chars)
- `method` (string): Merge method (v1: merge only)
- `number` (integer, required)
- `session_id` (string): Caller session id; requires actor_id when set (untrusted correlation only)

### `sync_plan` (~26 tokens)

Local vs remote sync facts and divergent-remote blockers.

Input parameters:

- `remote` (string)

### `publish_plan` (~49 tokens)

Plan branch publication to the configured git remote before opening a change request.

Input parameters:

- `head` (string, required): Local branch name to publish
- `remote` (string): Git remote (must match configured config.remote)

### `publish_execute` (~51 tokens)

Push a local branch to the configured git remote (requires publish_branch write_commands).

Input parameters:

- `head` (string, required): Local branch name to publish
- `remote` (string): Git remote (must match configured config.remote)

### `command_contract_export` (~37 tokens)

Read command contract metadata for all commands or one command key.

Input parameters:

- `command` (string): Optional command key, for example "issue inventory"

### `plugin_boundary` (~24 tokens)

Read forge plugin boundary metadata (emit surfaces, denied claims, contract export linkage).

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/attebury-remogram/remogram-mcp#diagnostics

## Score history

- 2026-08-03: 63
- 2026-08-02: 62
- 2026-08-01: 20
- 2026-07-31: 20
- 2026-07-29: 44
- 2026-07-28: 44
- 2026-07-27: 44

## Links

- npm package: https://www.npmjs.com/package/@remogram/mcp
- Socket report: https://socket.dev/npm/package/@remogram/mcp
- Repository: https://github.com/attebury/remogram
- Changelog RSS feed: https://verifymcp.io/servers/attebury-remogram/remogram-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/attebury-remogram/remogram-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/attebury-remogram/remogram-mcp