Skip to main content
Glama

SHPBL: Repository Audit & Repair

List the repositories I can work on (free)

list_repos
Read-onlyIdempotent

Lists real repository names so a run never starts on a guessed one, and answers whether a repository can be written to. Pass github_token to see everything that token can see, or owner to list a public account's repositories; with neither, it lists the repositories the SHPBL GitHub App is installed on for this key — the same ones a pull request can be opened on. Pass repo: "owner/name" to ask about one target instead of reading the whole list. Free — costs no allowance.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
keyNoYour SHPBL key (shpbl_mcp_…), only needed to list App-connected repositories. Optional if sent as the Authorization header.
pageNoWhich page of the connected-repository list to return, 1-based. Use this rather than a higher `limit` past 100; the response names the next page when there is one.
repoNoAsk about one target, `owner/repo`: whether this key may open a pull request on it. Call this before offering to write.
limitNoHow many repositories to return (default 30, max 100).
ownerNoA GitHub user or organisation to list the public repositories of, when no token is available.
github_tokenNoA GitHub token (PAT or fine-grained) to list with. Never stored, never logged — used for this call only.

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. First observed

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already carry readOnlyHint=true, openWorldHint=true, and idempotentHint=true, so the safety bar is low. The description adds genuine context beyond that: the App-installed scope tied to the key, the write-eligibility answer, and the cost note ('Free — costs no allowance'). It is fully consistent with the annotations — no contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The core purpose is front-loaded in the first sentence, and every subsequent clause earns its place — invocation modes, single-target navigation, and the free/allowance note. It is a dense single paragraph rather than tight bullets, but nothing is wasted relative to the information density needed for a 6-parameter tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only discovery tool whose safety profile is fully covered by annotations and whose parameters are all documented, the description is nearly complete: coverage of all three listing modes, the single-target path, and cost. The main absence is the response shape (no output schema exists), but for a 'list names + next-page' tool this is a minor gap, especially given the sibling ecosystem positions it as a pre-flight read.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds meaning beyond the schema by explaining the behavioral difference between github_token mode ('everything that token can see'), owner mode, and no-argument mode (App-installed repos), and positions repo as a targeted check. This enriches the six documented parameters without repeating their schema text.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb-resource pair ('Lists real repository names') plus a second capability (answers write-permission questions), and grounds it in a concrete problem: 'so a run never starts on a guessed one.' It clearly distinguishes from the write-side sibling (write_to_repo) by framing itself as the read/discovery half. An agent cannot mistake what this does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly maps three invocation modes to their conditions: with github_token, with owner, and with neither (App-installed repos, 'the same ones a pull request can be opened on'). It also tells when to use repo for a single-target check. It doesn't explicitly contrast with siblings by name or say what not to use it for, which keeps it just short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A3.7/5.0
Disambiguation3/5

Most tools have distinct roles, but the capability-discovery cluster is genuinely confusable: compose_capability calls itself 'the harvest lane' while harvest_repo is 'the harvest,' and evaluate_repo with a key also identifies candidates and composes — an agent must read long descriptions carefully to pick correctly. The free/key mode-switching also makes each tool's effective behavior conditional, raising misselection risk.

Naming Consistency4/5

The dominant pattern is verb_noun (build_intent, evaluate_repo, fix_repo, harvest_repo, list_repos, pin_source, run_contract, run_gauntlet, write_to_repo), and the library_document/library_index/library_search trio follows a deliberate resource-prefix convention. A few outliers break the pattern — welcome (bare verb), selfcheck_mcp, and subscription_status — but they are a small minority and still readable.

Tool Count4/5

At 17 tools the set is slightly past the ideal 3-15 range, but the domain genuinely spans an audit pipeline, a capability library, run orchestration, repo write-back, and billing/onboarding meta-tools. Roughly a third are lightweight informational endpoints (welcome, method_protocol, run_contract, library_index, subscription_status, selfcheck_mcp), which adds surface area, but each has a distinct job and none is redundant.

Completeness4/5

The lifecycle is well covered: pin_source → evaluate_repo → fix_repo → harvest_repo → compose_capability → write_to_repo, with run_gauntlet orchestrating the whole path and run_contract/method_protocol providing gates and discipline. Minor gaps exist — write_to_repo is create-only with no PR update/merge/close, and past run state is only resumable via ledger_digest — but there are no dead ends.

Resources