# RepoPilot MCP server

Repository evidence for agents before they adopt dependencies, enter codebases, compare, or merge.

## Links
- Registry page: https://www.getdrio.com/mcp/app-repopilot-repopilot
- Repository: https://github.com/sjmoran/repo-pilot
- Website: https://repopilot.app

## Install
- Endpoint: https://repopilot.app/api/mcp
- Auth: Not captured

## Setup notes
- Remote endpoint: https://repopilot.app/api/mcp

## Tools
- check_dependency (Check a dependency before adoption) - CALL when the user or agent is about to add, upgrade, trust, fork, or deploy an npm package or public GitHub repository. Returns a lean repository-level recommendation, confidence, evidence gaps, CVEs, maintenance, ownership, license, CI/tests, Scorecard, freshness, and next actions. DO NOT use for code navigation. Pass exactly one of repo or package. A favourable result does not validate an exact package version or compatibility. Endpoint: https://repopilot.app/api/mcp
- evaluate_dependency_change (Evaluate an exact dependency change in project context) - CALL immediately before adding or upgrading an npm dependency. Requires an exact published target version plus a bounded, source-free project snapshot. Applies the named permissive, balanced (default), or strict team policy to advisories, provenance attestations, and npm install-hook names. Checks exact metadata, Node/peer/license compatibility, repository evidence, and returns blockers plus a verification plan. This tool evaluates; it never installs or edits anything. Endpoint: https://repopilot.app/api/mcp
- verify_dependency_change (Verify a dependency change after local work) - CALL after changing the manifest/lockfile and running local checks. Compares the exact evaluated target with the resolved result and caller-reported proof receipts, reports missing/failed evidence and residual risk, and labels receipts as caller asserted. It never runs commands or stores diff/check output. Endpoint: https://repopilot.app/api/mcp
- analyze_repo (Get a repository decision brief) - CALL when entering an unfamiliar repository or deciding whether to depend on, fork, learn from, or deploy it. Returns a concise four-use-case brief, watchouts, evidence confidence, architecture summary, freshness, and next actions without dumping the full generated artifact. Use get_artifact when file-level orientation is needed. Pass exactly one of repo or package. Endpoint: https://repopilot.app/api/mcp
- plan_repo_task (Plan a task against repository evidence and a checked SHA) - CALL before editing an unfamiliar public repository. Returns a bounded reading order, relevant files, dependency consumers, test/verification obligations, analyzed-vs-checked SHA relation, evidence provenance, and a short-lived verification contract. Task text is used only for bounded local matching and is never persisted raw. Endpoint: https://repopilot.app/api/mcp
- get_artifact (Orient an agent in an unfamiliar repository) - CALL before substantial code work in an unfamiliar repository when the agent needs key files, entry points, architecture hypotheses, a reading order, and verify-before-trusting guidance. Returns the cached CLAUDE.md-style artifact or Cursor rules. Do not call again if the artifact is already in context. Pass exactly one of repo or package. Endpoint: https://repopilot.app/api/mcp
- compare_repos (Compare two repository choices) - CALL when the user is choosing between exactly two dependencies or repositories. Returns the preferred candidate for each use case, material trade-offs, confidence, and evidence gaps. Each target is owner/repo, a GitHub URL, an npm package name, or npm:@scope/pkg. Cached full analyses are preferred; a miss uses bounded live GitHub/OpenSSF evidence with limited confidence and explicit unknowns rather than guessing. Endpoint: https://repopilot.app/api/mcp
- check_change_risk (Prioritize review for a PR or diff) - CALL before merging a pull request or after producing a local diff. Returns a deterministic 0-10 change-shape score with receipts for size, spread, missing tests, sensitive paths, hotspots, and blast radius. Pass repo+pr OR diff; repo may accompany diff for cached hotspot context. This prioritizes review and never approves a merge. Endpoint: https://repopilot.app/api/mcp

## Resources
Not captured

## Prompts
Not captured

## Metadata
- Owner: app.repopilot
- Version: 2.0.1
- Runtime: Streamable Http
- Transports: HTTP
- License: Not captured
- Language: Not captured
- Stars: Not captured
- Updated: Aug 2, 2026
- Source: https://registry.modelcontextprotocol.io