Public MCP · read-only · no API key

Give your coding agent evidence before it acts—and proofs after.

RepoPilot evaluates exact npm changes in project context, orients work against a stated Git revision, and verifies the resulting local receipts. Every result separates observed evidence, caller-asserted claims, and what remains unknown.

Codex: connect in one command

Runs the local companion, which adds workspace-aware proof tools and closes the verification loop without you assembling the snapshot by hand. Then start a new Codex session so the tools appear.

Recommended

bash

terminal

codex mcp add repopilot -- npx -y @repopilotapp/cli mcp

Here without an agent?Inspect a repository in the visual analyzer →

Other clients

Claude Code

bash

terminal

claude mcp add repopilot -- npx -y @repopilotapp/cli mcp

Cursor, Cline, and other config-based MCP clients

json

MCP configuration

{
  "mcpServers": {
    "repopilot": {
      "command": "npx",
      "args": ["-y", "@repopilotapp/cli", "mcp"]
    }
  }
}

VS Code configuration

json

.vscode/mcp.json

{
  "servers": {
    "repopilot": {
      "command": "npx",
      "args": ["-y", "@repopilotapp/cli", "mcp"]
    }
  }
}

Advanced: hosted endpoint directly

No local process, but also no workspace_preflight/workspace_postflight — you assemble the verification snapshot yourself when calling verify_dependency_change.

Codex

bash

terminal

codex mcp add repopilot --url https://repopilot.app/api/mcp

Claude Code

bash

terminal

claude mcp add --transport http repopilot https://repopilot.app/api/mcp

Claude Desktop / Claude.ai

Open Settings → Connectors, choose Add custom connector, name it RepoPilot, and paste this remote MCP URL. (The CLI’s stdio mode is not available here — Claude Desktop connectors are HTTP-only.)

text

RepoPilot connector URL

https://repopilot.app/api/mcp

Cursor, Cline, and other config-based MCP clients

json

MCP configuration

{
  "mcpServers": {
    "repopilot": {
      "type": "http",
      "url": "https://repopilot.app/api/mcp"
    }
  }
}

Make sure it works

Restart the client after connecting, then ask this. A working setup will visibly call evaluate_dependency_change and report both a recommendation and its required proofs.

text

test prompt

Before adding express@5.1.0, evaluate the exact version against this project with RepoPilot. Tell me the recommendation, confidence, strongest evidence, required proofs, and anything not verified. Do not install it.

Close the proof loop

1 · Before

Evaluate the exact target version against bounded project facts. Preserve the returned verification context unchanged.

2 · Local work

Make the approved change and run the required commands yourself. RepoPilot never installs packages or executes checks.

3 · After

Verify resolved versions, lockfile/advisory changes, and exact command receipts. Local receipts remain caller asserted.

Eight tools, chosen by intent

check_dependency

When you need a lean repository-level check without project context.

Repository recommendation, receipts, confidence, and evidence gaps.

evaluate_dependency_change

Before adding or upgrading an exact npm version in this workspace.

Named policy decision, exact advisories, install-hook/provenance evidence, required proofs, and rollback plan.

verify_dependency_change

After the manifest, lockfile, and local checks have changed.

Resolved-version, lockfile, advisory, and caller-asserted proof verification.

analyze_repo

When entering an unfamiliar public GitHub repository.

A concise decision brief without flooding the agent context.

plan_repo_task

Before editing an unfamiliar repository at a known checkout SHA.

Ranked files, dependency consumers, proof obligations, SHA relation, and a short-lived contract.

get_artifact

Before substantial code work, after the short brief.

Key files, entry points, reading order, and a cached agent artifact.

compare_repos

When choosing between two repositories or npm packages.

Per-use-case preference, trade-offs, confidence, and unknowns.

check_change_risk

Before merging a pull request or after producing a local diff.

A deterministic change-shape score and review priorities.

Compact by default

Briefs preserve context. The full repository artifact is opt-in.

Unknown means unknown

A cache miss or missing evidence is never presented as approval.

Explicit retry semantics

Tools are read-only. Task planning creates a proof contract, and a contract-backed risk check records an attempt, so neither is safe to retry automatically.

What the result means

agent.summary is the action-oriented answer; confidence describes the available repository evidence; and evidence_gaps states what the agent must not assume.

A dependency result with evidence_source: live_fallback uses bounded GitHub/OpenSSF evidence because no full analysis is cached. It has limited confidence, keeps tests, CI, published dependency advisories, and code structure unknown. It does not start a full repository analysis or consume the uncached-analysis budget. Cold live-evidence fetches have a shared 500/day ceiling; five-minute fallback cache hits and full cached analyses do not consume it.

Exact dependency evaluation combines immutable npm metadata, deps.dev advisories, project runtime/peer/license constraints, and repository evidence. It still does not certify safety or production fit. Local receipts are labelled caller asserted.

Task text is used only for bounded local rule matching and is never persisted raw. Project snapshots, manifest/lock contents, diffs, command strings, and proof output are not retained.

Keep source and diff hunks local

check_change_risk accepts bounded source-free file facts: relative paths, status, additions, deletions, and optional previous paths. Filenames are still metadata. Omit the repository slug when identity is sensitive and inspect payloads before sending. The @repopilotapp/cli local stdio companion pins one workspace root, collects these facts, and shows the exact outbound payload in --dry-run mode.

REST API reference Agent rules without MCPEndpoint: https://repopilot.app/api/mcp