repoctx
NPM · @NUGEHS/REPOCTX · SCANNED SEP 20
Local-first code context, impact analysis, and merge-readiness verdicts for AI agents.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security94
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs a script at install time (postinstall) that we could not recognise. It may be perfectly ordinary, but we do not read the published tarball, so we cannot say what it does. View diagnostics → Partial
- 0 of 1 dependencies flagged as unhealthy. View diagnostics → Pass
Provenance & Transparency74
- Repository check failed: the declared repository URL redirects; it must resolve directly. See how to fix → View diagnostics → Fail
- Cryptographically verified build provenance (signed, bound to nugehs/repoctx). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 54 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability69
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2380 tokens (~183/item across 13 items; 13 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management83
- Stability observed for 25 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 13 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 13 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
- Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
How do I install the repoctx MCP server?
repoctx runs locally as an npm package, launched with npx -y @nugehs/repoctx. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @nugehs/repoctx
claude mcp add nugehs-repoctx -- npx -y @nugehs/repoctx
{
"mcpServers": {
"nugehs-repoctx": {
"command": "npx",
"args": [
"-y",
"@nugehs/repoctx"
]
}
}
} {
"servers": {
"nugehs-repoctx": {
"command": "npx",
"args": [
"-y",
"@nugehs/repoctx"
]
}
}
} codex mcp add nugehs-repoctx -- npx -y @nugehs/repoctx
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"nugehs-repoctx": {
"type": "local",
"command": [
"npx",
"-y",
"@nugehs/repoctx"
],
"enabled": true
}
}
} openclaw mcp add nugehs-repoctx --command npx --arg -y --arg @nugehs/repoctx
mcp_servers:
nugehs-repoctx:
command: "npx"
args: ["-y", "@nugehs/repoctx"] {
"McpServers": {
"nugehs-repoctx": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@nugehs/repoctx"
]
}
}
} assistant mcp add nugehs-repoctx -t stdio -c npx -a -y @nugehs/repoctx
{
"mcpServers": {
"nugehs-repoctx": {
"command": "npx",
"args": [
"-y",
"@nugehs/repoctx"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 19 Sept 26 −3
- Stability: pass → 0.80 functional
- 18 Sept 26 +1
- Stability: 0.97 → pass security
- 16 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 14 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Sept 26 −3
- Stability: pass → 0.80 functional
- 11 Sept 26 +1
- Stability: 0.97 → pass security
- 9 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 7 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/@nugehs/repoctx@2.6.0
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | nugehs/repoctx |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/nugehs/repoctx/.github/workflows/release.yml@refs/tags/v2.6.0 |
| Rekor log index | 2262656646 |
| Predicate type | https://slsa.dev/provenance/v1 |
| Subject digest | sha512:8a18cef8bf15b14a72424c8eb2e39a3a9a91da52ce4f48f3fc07ae12cceafcafa7116a7c2ad59623bcc03f9effb055e6b3c34233c94bb13632d3e696f |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| postinstall | unreviewed | node scripts/postinstall.mjs |
Background: Why install scripts are a supply-chain risk →
Dependencies 1 package
| Packages resolved | 1 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
agent_experience Agent Experience (AX) ~223
Score Agent Experience (AX): a single 0–100 number answering "how cheap and safe is it for an agent to make this change here?", blending Changeability (token cost), Containment (blast radius), Guardrails (tests / validation / CODEOWNERS / CI), and Clarity (task groundedness). Deterministic and composed from the change_impact, token-estimate, and CODEOWNERS engines — no new analysis. Returns sub-scores, drivers, and concrete recommendations for raising AX. Writes a local .dev-context/index.json cache into the target repo; the call is idempotent and does not change source files.
| Name | Type | Req | Description |
|---|---|---|---|
| includeMarkdown | boolean | – | Return a compact human-readable markdown report instead of the full JSON. Defaults to false. |
| path | string | – | Repository path. Defaults to current working directory. |
| query | string | yes | Plain-English change request to score, e.g. "add a new MCP tool". |
| top | number | – | Number of impact files to consider when scoring blast radius. Defaults to 8. |
No output schema declared.
No examples provided.
change_impact Change Impact ~165
Given a plain-English change request, rank the files most likely to own the change, with risk flags, suggested tests, and an implementation plan. Optional diff base validates predictions against actual changed files. Writes a local .dev-context/index.json cache into the target repo; the call is idempotent and does not change source files.
| Name | Type | Req | Description |
|---|---|---|---|
| diffBase | string | – | Optional git ref to validate predictions against (e.g. origin/main, HEAD). |
| includeMarkdown | boolean | – | Return a compact human-readable markdown report instead of the full JSON. Defaults to false. |
| path | string | – | Repository path. Defaults to current working directory. |
| query | string | yes | Plain-English change request. |
| top | number | – | Number of files to return. Defaults to 10. |
No output schema declared.
No examples provided.
context_pack Context Pack ~179
Generate a task-aware local context packet with primary files, related files, tests, patterns, and validation commands. Writes a local .dev-context/index.json cache into the target repo; the call is idempotent and does not change source files.
| Name | Type | Req | Description |
|---|---|---|---|
| includeEvidence | boolean | – | Include per-file imports, exports, and symbol slices as source evidence. Defaults to false to keep the packet compact. |
| includeMarkdown | boolean | – | Return a compact human-readable markdown report instead of the full JSON packet. Defaults to false. |
| limit | number | – | Maximum primary, related, and test files per section. Defaults to 8. |
| path | string | – | Repository path. Defaults to current working directory. |
| paths | array | – | Repository paths for a multi-repo context packet. |
| query | string | yes | Task or question to gather context for. |
No output schema declared.
No examples provided.
convergence_score Convergence Score ~228
Score convergence: a deterministic 0–100 measure of the distance between a stated task (intent) and the actual git diff (execution), with sub-scores for Coverage (did the intent happen?), Scope (did only the intent happen?), and Risk alignment (did unrequested drift land on risk-sensitive paths?). Composed from the change_impact diff comparison and the shared risk vocabulary — no model, no new analysis. Emits a recomputable receipt (a timestamp-free hash anyone can regenerate and verify) as durable evidence. Requires a base git ref to diff against.
| Name | Type | Req | Description |
|---|---|---|---|
| base | string | yes | Git ref to diff against (e.g. origin/main, HEAD~1). Required. |
| includeMarkdown | boolean | – | Return a compact human-readable markdown report instead of the full JSON. Defaults to false. |
| path | string | – | Repository path. Defaults to current working directory. |
| query | string | yes | The stated task / intent to measure against the diff, e.g. "add Stripe refunds". |
| top | number | – | Number of predicted owner files to consider. Defaults to 10. |
No output schema declared.
No examples provided.
repo_harness Repository Harness ~65
Generate setup, validation, runtime, and context commands for an agent or CI harness.
| Name | Type | Req | Description |
|---|---|---|---|
| includeMarkdown | boolean | – | Return a compact human-readable markdown report instead of the full JSON. Defaults to false. |
| path | string | – | Repository path. Defaults to current working directory. |
No output schema declared.
No examples provided.
repo_index Index Repositories ~183
Index local repositories: generate .dev-context indexes and add them to the local catalog. Pass discover:true to find repository roots under the given paths first. Pass dryRun:true to discover and report without writing any indexes or catalog (read-only); this replaces the old repo_discover tool. Without dryRun this mutates the persistent local catalog, so it is not a pure read.
| Name | Type | Req | Description |
|---|---|---|---|
| catalog | string | – | Optional catalog JSON path. |
| depth | number | – | Maximum discovery depth. |
| discover | boolean | – | Discover repositories under the provided paths before indexing. |
| dryRun | boolean | – | Discover and report repositories without writing indexes or mutating the catalog. Read-only. Defaults to false. |
| limit | number | – | Maximum discovered repositories. |
| path | string | – | Single repository path. |
| paths | array | – | Repository paths, or roots when discover is true. |
No output schema declared.
No examples provided.
repo_inspect Inspect Repository ~91
Inspect repository shape, languages, package managers, script names, entrypoints, and git metadata. Returns up to 200 representative file paths; pass includeScripts:true to get full script command bodies instead of just names.
| Name | Type | Req | Description |
|---|---|---|---|
| includeScripts | boolean | – | Include full package.json script command bodies, not just their names. Defaults to false. |
| path | string | – | Repository path. Defaults to current working directory. |
No output schema declared.
No examples provided.
repo_map Map Repository ~249
Map a repository into a compact JSON code map, optionally narrowed by domain, file kind, or controller route. Pass domain to find files for a feature, kind to find files of a type (route, controller, service, apiClient, component, test), or route to match Nest controller routes by substring/regex. Replaces the old find_domain, find_file_kind, find_backend_route, and find_frontend_api_client tools. Writes a local .dev-context/index.json cache into the target repo; the call is idempotent and does not change source files.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | – | Optional domain filter such as booking, payment, email, events. |
| includeFiles | boolean | – | Include matching files in the response. Defaults to false. |
| kind | string | – | Optional file kind filter such as route, controller, service, apiClient, component, test. |
| limit | number | – | Maximum files to include. Defaults to 100. |
| path | string | – | Repository path. Defaults to current working directory. |
| route | string | – | Optional route filter. Substring or regex matched against each controller's combined route (controllerBasePath + httpMethods paths) and file path. |
No output schema declared.
No examples provided.
repo_search Search Repository Catalog ~138
Search indexed local repositories by path, domain, kind, route, imports, exports, and symbols. Omit query to list the local repository catalog instead (the catalog listing the old repo_catalog tool returned). Only searches repositories already in the local catalog — if the catalog is empty this returns no matches, so call repo_index on the target repositories first.
| Name | Type | Req | Description |
|---|---|---|---|
| catalog | string | – | Optional catalog JSON path. |
| limit | number | – | Maximum matches. Defaults to 25. |
| offline | boolean | – | Use stored index files without refreshing fingerprints. |
| query | string | – | Search query. Omit to return the catalog listing instead of search matches. |
No output schema declared.
No examples provided.
review_context Review Context ~197
Produce PR review context from local git diff metadata, optionally enriched with GitHub PR comments. Use review_context when you want the raw diff/comment context for a change, not a verdict. Use review_verdict instead for the full impact + review + gate composite, or review_gate for the gate verdict alone.
| Name | Type | Req | Description |
|---|---|---|---|
| base | string | – | Base ref. Defaults to PR base, upstream, origin/main, or main. |
| comment | boolean | – | Create or update a sticky GitHub PR comment using gh. This writes to GitHub. |
| github | boolean | – | Ask gh to infer the current branch PR. |
| head | string | – | Head ref. Defaults to HEAD. |
| includeMarkdown | boolean | – | Return a compact human-readable markdown report instead of the full JSON. Defaults to false. |
| number | number | – | Optional GitHub PR number for gh enrichment. |
| path | string | – | Repository path. Defaults to current working directory. |
No output schema declared.
No examples provided.
review_gate Review Gate ~360
Gate a change for merge and return a PASS / WARN / FAIL verdict. Omit pr to run the local, no-GitHub gate against a base ref (changed files, secret safety, risk-sensitive paths, release discipline, validation commands, dependency audit, policy profile). Set pr to gate an open GitHub PR via `gh` (PR state, review decision, CODEOWNERS approvals, unresolved conversations, branch protection, status checks). Merges the old merge_readiness and pr_merge_readiness tools. Use review_verdict instead when you want the full impact + review + gate composite, or review_context when you want diff/comment context with no verdict.
| Name | Type | Req | Description |
|---|---|---|---|
| base | string | – | Base ref for the local gate. Defaults to origin/main, then HEAD. Ignored in PR mode. |
| governance | string | – | Governance: team (default) or solo. |
| minConvergence | number | – | Optional minimum convergence score (0–100). Enables a failing gate when the task/diff score is below this floor. |
| path | string | – | Repository path. Defaults to current working directory. |
| policy | string | – | Policy profile: standard (default), company, or high-risk. |
| pr | string | – | Optional PR selector (number, URL, or branch). When set, runs the GitHub gate; when absent, runs the local gate. |
| receipt | string | – | Optional convergence receipt id, hash, JSON object, or path to a JSON receipt artifact. Must match the current task, base, and commit. |
| request | string | – | Optional change request for context evidence output. |
| staged | boolean | – | Inspect only the Git index. Use this for automatic pre-commit readiness; ignored in GitHub PR mode. |
No output schema declared.
No examples provided.
review_verdict Review Verdict ~248
Run the full review pipeline in one shot: change_impact plus review_context plus review_gate, returning a unified verdict with a derived confidence score. Use review_verdict when you want the complete picture of a change in a single call. Use review_context instead for diff metadata only (no verdict), or review_gate for the gate verdict alone.
| Name | Type | Req | Description |
|---|---|---|---|
| base | string | – | Base ref for local diff. Defaults to origin/main, then HEAD. |
| governance | string | – | Governance: team (default) or solo. |
| impactTop | number | – | Number of impact files. Defaults to 8. |
| minConvergence | number | – | Optional minimum convergence score (0–100) enforced by the merge gate. |
| path | string | – | Repository path. Defaults to current working directory. |
| policy | string | – | Policy profile: standard (default), company, or high-risk. |
| pr | string | – | Optional PR selector. When set, pass-pr runs against GitHub instead of local mode. |
| receipt | string | – | Optional convergence receipt id, hash, JSON object, or path to a JSON receipt artifact. |
| request | string | – | Plain-English change request for impact scoring. |
No output schema declared.
No examples provided.
workspace_report Workspace Report ~54
Generate a product-level report across multiple related repositories.
| Name | Type | Req | Description |
|---|---|---|---|
| includeMarkdown | boolean | – | Return a compact human-readable markdown report instead of the full JSON. Defaults to false. |
| paths | array | yes | Repository paths to inspect together. |
No output schema declared.
No examples provided.
What is the repoctx MCP server?
repoctx is an MCP server listed in the public MCP registry as io.github.nugehs/repoctx. Local-first code context, impact analysis, and merge-readiness verdicts for AI agents. This page covers its npm package (@nugehs/repoctx).
Is the repoctx MCP server safe to use?
repoctx scores 83 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the repoctx MCP server expose?
repoctx exposes 13 tools: repo_inspect, repo_map, repo_index, repo_search, context_pack, and 8 more. Their descriptions and schemas cost roughly 2,380 tokens of context every time the server is loaded.
Is the repoctx MCP server still maintained?
repoctx is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the repoctx MCP server under?
repoctx declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.