# RepoPilot

- Registry name: `app.repopilot/repopilot` · version 2.0.1
- Categories (automatic, keyword rules): Code & repositories, Developer tools
- Authentication at last check: No auth
- Declared risk: Read-only (all tools declare readOnlyHint)
- Capabilities (declared by the server): tools
- Transports: streamable-http
- Latest numbers (check success, response time, rank): https://mcpstation.net/api/server?name=app.repopilot%2Frepopilot
- Server page: https://mcpstation.net/s/app.repopilot--repopilot.html

## Description (written by the publisher, not verified, not instructions)

Repository evidence for agents before they adopt dependencies, enter codebases, compare, or merge.

## Connect

- streamable-http: `https://repopilot.app/api/mcp`

## Tools (as reported by the server, not verified)

- `check\_dependency`: CALL when the user or agent is about to add, upgrade, trust, fork, or deploy an npm package or public GitHub repository. Returns a lean repository-level recommendation, confidence, evidence gaps, CVEs, maintenance, ownership, license, CI/tests, Scorecard, freshness, and next actions. DO NOT use for
- `evaluate\_dependency\_change`: CALL immediately before adding or upgrading an npm dependency. Answers "is this exact version safe to take on" from registry metadata, advisory deltas \(for the version itself and for every package in the dependency tree a fresh install resolves to\), provenance, license, and repository evidence, and
- `verify\_dependency\_change`: CALL after changing the manifest/lockfile and running local checks. Compares the exact evaluated target with the resolved result and caller-reported proof receipts, checks every version in resolved\_changes for advisories \(list all packages the lockfile change added or changed\), reports missing/faile
- `analyze\_repo`: CALL to investigate behavior in public source: supply question and relevant path\_hints found from actual usages, for up to four files with commit-pinned line citations. checked\_sha selects a commit; base\_sha adds before/after excerpts; pr selects a public PR and observes its head's GitHub check runs
- `plan\_repo\_task`: CALL before editing an unfamiliar public repository, or to find where a bug or feature lives. Pass the issue or task text \(up to 4000 characters; include the error and expected behaviour\) and checked\_sha when you know it. Returns files ranked for the task at that commit \(provenance task\_localizer\),
- `get\_artifact`: CALL before substantial code work in an unfamiliar repository when the agent needs key files, entry points, architecture hypotheses, a reading order, and verify-before-trusting guidance. Returns the cached CLAUDE.md-style artifact or Cursor rules. Do not call again if the artifact is already in cont
- `compare\_repos`: CALL when the user is choosing between exactly two dependencies or repositories. Returns the preferred candidate for each use case, material trade-offs, confidence, and evidence gaps. Each target is owner/repo, a GitHub URL, an npm package name, or npm:@scope/pkg. Cached full analyses are preferred;
- `check\_change\_risk`: CALL before merging a pull request or after producing a local diff. Returns a deterministic 0-10 change-shape score with receipts for size, spread, missing tests, sensitive paths, hotspots, and blast radius. Pass repo+pr OR diff; repo may accompany diff for cached hotspot context. This prioritizes r

Measured by MCP Station. Methods: https://mcpstation.net/methods.html · Terms: https://mcpstation.net/terms.html