Loading ToolBench
MCP Server for GitHub repository health monitoring
ProjectPulse demonstrates strong naming conventions (verb_noun pattern), explicit input schemas with type definitions, and detailed descriptions that guide LLM selection. However, output schemas are documented only in narrative form within descriptions rather than as formal JSON Schema. Tool descriptions exceed the recommended 200-character threshold in several cases, introducing token waste. Error handling narratives are present but lack structured recovery guidance. Composition is sound, tools are single-responsibility and chain naturally via IDs. Most tools lack explicit pagination despite returning arrays, and per-request logLevel annotations are not present. Overall, this server shows good engineering discipline but falls short of A-grade production polish in schema formality and API response optimization.
Fetches or triggers open Code Scanning (CodeQL) alerts for a GitHub repository. - Side effects: Read-only by default. If trigger_scan=true, writes to GitHub Actions by creating a workflow_dispatch event. - Data sources: GitHub REST API (code-scanning/alerts and actions). - Auth requirements: Requires GITHUB_TOKEN with appropriate permissions (security-events). - Rate limits: Subject to standard GitHub API limits. - Return shape: Returns a JSON array of alert objects including rule_id, severity, rule_description, state, location paths, and html_url. - Usage guidelines: Use this tool ONLY for deep static code vulnerability scanning (CodeQL). DO NOT use this tool for other checks: - For package/dependency vulnerabilities, use 'analyze_dependencies' instead. - For a computed A-F health score grading, use 'get_health_score' instead. - For checking standard CI/CD workflow statuses, use 'check_ci_status' instead.
Fetches Dependabot alerts for a GitHub repository to analyze vulnerable package dependencies. - Side effects: None. This is a strictly read-only operation. - Data sources: GitHub REST API (dependabot/alerts). - Auth requirements: Requires GITHUB_TOKEN with appropriate permissions (dependabot alerts are often restricted). - Rate limits: Subject to standard GitHub API limits. - Return shape: Returns a JSON array of vulnerable package dependencies including summary, severity, package_name, state, and html_url. - Usage guidelines: Use this tool ONLY to find vulnerable package dependencies (npm, pip, etc.). DO NOT use this tool for other checks: - For static code security vulnerabilities (CodeQL), use 'analyze_code_scanning' instead. - For a computed A-F health score grading, use 'get_health_score' instead.
Fetches recent CI/CD workflow runs (GitHub Actions) for a GitHub repository. - Side effects: None. This is a strictly read-only operation. - Data sources: GitHub REST API (actions/runs). - Auth requirements: No authentication required for public repositories. Uses configured token if available. - Rate limits: Subject to standard GitHub API limits. - Return shape: Returns a JSON array of workflow runs including name, status, conclusion, head_branch, created_at, updated_at, and html_url. - Usage guidelines: Use this tool ONLY to check raw GitHub Actions workflow history and CI build statuses. DO NOT use this tool for other analyses: - For a computed A-F health score grading, use 'get_health_score' instead. - For retrieving basic repository stats (stars, forks), use 'get_repo_health' instead. - For calculated DORA metrics, use 'get_dora_metrics' instead.
Output schemas documented narratively in descriptions rather than as formal JSON Schema. Consumers must parse description text to understand response structure instead of validating against a schema.
Tool descriptions exceed 200-character optimal length (most 300-400+ chars), wasting LLM tokens and burying key details. Example: get_health_score description is 400+ chars with a matrix of anti-use-cases.
Tools returning arrays (check_ci_status, analyze_dependencies, analyze_code_scanning, compare_repos) lack pagination support (limit, offset, cursor, next_cursor, total_count). Large result sets risk context window exhaustion.
Inferred effective spec: 2025-06-18+.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | B | 71 | 2025-06-18+ | v2 |
Compares health scores of multiple GitHub repositories (2-5 repos) and ranks them. - Side effects: None. This is a strictly read-only operation. - Data sources: GitHub REST API and OpenSSF Scorecard API (via get_health_score logic). - Auth requirements: No authentication required for public repositories. Uses configured token if available. - Rate limits: Subject to standard GitHub API limits. Multiplies API calls by the number of repositories compared. - Return shape: Returns a JSON object containing a ranked list of repositories (owner, repo, rank) with their detailed health breakdown (score, CI, freshness, security, community, maintenance). - Usage guidelines: Use this tool ONLY when you need to compare or rank multiple repositories against each other based on their health scores. DO NOT use this tool for analyzing a single repository: - For getting the health score of a single repository, use 'get_health_score' instead. - For comparing raw metadata instead of health scores, query 'get_repo_health' individually.
Calculates DORA proxy metrics (deployment frequency, lead time, change failure rate, MTTR) for a GitHub repository. - Side effects: None. This is a strictly read-only operation. - Data sources: GitHub REST API (releases, actions/runs, pulls). - Auth requirements: No special authentication required for public repositories. Private repositories require GITHUB_TOKEN. - Rate limits: Subject to standard GitHub API limits. Heavy API usage due to multiple list endpoints being queried. - Return shape: Returns a JSON object with calculated DORA metrics over the specified period. - Usage guidelines: Use this tool ONLY to evaluate DORA metrics and team delivery performance. DO NOT use this tool for other checks: - For raw workflow statuses, use 'check_ci_status' instead. - For a computed A-F health score grading, use 'get_health_score' instead. - For general repository metadata, use 'get_repo_health' instead.
Calculates a 0-100 health score and A-F grade for a GitHub repository. - Side effects: Writes a trend snapshot to local disk for history tracking. Read-only against GitHub API. - Data sources: GitHub REST API (repos, actions, dependabot) and OpenSSF Scorecard API. - Auth requirements: No authentication required for public repositories. Uses configured token if available. - Rate limits: Subject to standard GitHub API limits (heavy usage across multiple endpoints). - Return shape: Returns a JSON object with a grade (A-F), total score, detailed category breakdown (CI, freshness, security, community, maintenance), improvement suggestions, and historical trend data. - Usage guidelines: Use this tool ONLY for deep analytical grading and overall repository health assessment. DO NOT use this tool for quick metadata checks: - For basic raw metadata (stars, language, etc.), use 'get_repo_health' instead. - For raw CI workflow statuses, use 'check_ci_status' instead. - For deep code vulnerability scanning, use 'analyze_code_scanning' instead. - For DORA metrics, use 'get_dora_metrics' instead.
Fetches raw repository metadata and basic statistics for a GitHub repository
No formal error classification or recovery guidance. Descriptions mention rate limits and permission failures but do not guide LLMs on retry eligibility, user-fixable errors, or next steps.
Example values (owner='modelcontextprotocol', repo='sdk') embedded in descriptions risk being reused literally by LLMs in subsequent calls, causing unintended repository analysis.
get_repo_health description is minimal (68 chars). Lacks explanation of what metrics compose 'health', when to call it vs get_health_score or check_ci_status, and what output structure is returned.
analyze_code_scanning has a destructive parameter (trigger_scan=true triggers CodeQL workflow) but does not use tool annotations (destructiveHint metadata) to signal this to the agent.