Screens public GitHub repositories and pull requests, fetching metadata and files for local risk analysis.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@gitlumen-mcp Screen https://github.com/facebook/react for risks"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
GitLumen MCP Server is a Node.js project that exposes a GitLumen-style review intelligence layer through the Model Context Protocol (MCP), so AI agents can call it as tools.
This project focuses on:
AI Agent / MCP Client
-> GitLumen MCP Server
-> GitHub public repo / PR reader
-> local risk analyzer
-> GitLumen-style reportThis project intentionally does not execute onchain transactions yet and does not use Base MCP send_calls. A Base MCP custom plugin can be attached in Path 2 after this intelligence server is ready.
MCP stdio server that can be used by Claude Desktop, Cursor, Claude Code, or other MCP clients.
Screens public GitHub repository URLs.
Screens GitHub Pull Request URLs /pull/<number>.
No GitHub token required for small/medium public repositories.
Optional GITHUB_TOKEN for higher rate limits and private repositories (depending on token scope).
Local analyzer: source code is not sent to external LLMs.
Produces:
risk score
category risk map
findings
review chapters
decision questions
merge-readiness signal
recommended next actions
Stores reports locally in .gitlumen-mcp/reports/*.json.
Includes a CLI for local testing without an MCP client.
Related MCP server: agentic-sdlc-mcp
gitlumen-mcp-server/
|- package.json
|- README.md
|- .env.example
|- examples/
| |- claude_desktop_config.example.json
| \- cursor_mcp.example.json
|- docs/
| |- ARCHITECTURE.md
| \- TOOLS.md
\- src/
|- index.js # MCP stdio server entrypoint
|- cli.js # CLI local test
|- doctor.js # environment checker
|- config.js
|- types.js
|- services/
| |- github.js # GitHub API + raw file loader
| |- analyzer.js # local heuristic risk engine
| |- gitlumen.js # service orchestrator
| \- reportStore.js # local report persistence
\- utils/
|- githubUrl.js
|- ids.js
\- text.jsNode.js 20+
npm
Internet access to fetch metadata/files from GitHub
Check Node version:
node -vIf your version is Node 18 or below, upgrade to Node 20+.
Open the project directory:
cd gitlumen-mcp-serverInstall dependencies:
npm installCopy env example:
cp .env.example .envFill optional values:
GITHUB_TOKEN=ghp_xxx_or_fine_grained_token
GITLUMEN_MCP_DATA_DIR=.gitlumen-mcp
GITLUMEN_MAX_FILE_BYTES=120000For public repositories, GITHUB_TOKEN can be empty. A token is still recommended to avoid low GitHub rate limits.
npm run doctorExpected output:
GitLumen MCP Doctor
✅ Node version: v20.x.x
✅ GITHUB_TOKEN configured: no (public unauthenticated mode)
✅ Data directory: /path/to/gitlumen-mcp-server/.gitlumen-mcp
✅ Reports directory writable: /path/to/gitlumen-mcp-server/.gitlumen-mcp/reportsnpm run sampleThis command generates a report from a local fixture so you can verify analyzer and report-store behavior without GitHub connectivity.
npm run screen -- https://github.com/modelcontextprotocol/typescript-sdk quicknpm run screen -- https://github.com/modelcontextprotocol/typescript-sdk/pull/1 quickquick = fastest, fewer files
standard = balanced defaultExamples:
npm run screen -- https://github.com/owner/repo standard
npm run screen -- https://github.com/owner/repo quick mainAfter completion, CLI prints a markdown report and saves JSON to:
.gitlumen-mcp/reports/<reportId>.jsonnpm run list -- 10Take a reportId, then:
npm run report -- glr_xxxxxxxxxxxxxxxx markdownOr full JSON:
npm run report -- glr_xxxxxxxxxxxxxxxx jsonThe MCP server uses stdio, so it is normally started by an MCP client instead of being run manually.
node /ABSOLUTE/PATH/TO/gitlumen-mcp-server/src/index.jsTo debug MCP protocol, use MCP Inspector:
npm run inspectThen open the Inspector URL printed in terminal.
This project also includes a Streamable HTTP transport endpoint at /mcp.
Run locally:
npm run start:httpEnvironment variables:
PORT=3333
HOST=0.0.0.0
MCP_AUTH_TOKEN=replace_with_a_long_random_tokenMCP_AUTH_TOKEN is optional but strongly recommended for production.
When set, clients must send Authorization: Bearer <token>.
Health check:
curl -s http://localhost:3333/healthProduction deployment guide:
PM2 example config: examples/ecosystem.pm2.example.cjs
Client configuration templates (Copilot / VS Code / Codex):
VS Code remote endpoint template: examples/vscode_mcp.gitlumen.remote.example.json (copy into .vscode/mcp.json, which is gitignored)
Open Claude Desktop config.
Common location:
~/Library/Application Support/Claude/claude_desktop_config.json%APPDATA%\Claude\claude_desktop_config.jsonAdd:
{
"mcpServers": {
"gitlumen": {
"command": "node",
"args": ["/ABSOLUTE/PATH/TO/gitlumen-mcp-server/src/index.js"],
"env": {
"GITHUB_TOKEN": "optional_github_token_here",
"GITLUMEN_MCP_DATA_DIR": "/ABSOLUTE/PATH/TO/gitlumen-mcp-server/.gitlumen-mcp"
}
}
}
}Replace /ABSOLUTE/PATH/TO/... with your real path.
Restart Claude Desktop.
Example prompt:
Use GitLumen to screen https://github.com/modelcontextprotocol/typescript-sdk with quick scope. Return the risk map and top findings.Create or edit Cursor MCP config (format may vary by Cursor version):
{
"mcpServers": {
"gitlumen": {
"command": "node",
"args": ["/ABSOLUTE/PATH/TO/gitlumen-mcp-server/src/index.js"],
"env": {
"GITHUB_TOKEN": "optional_github_token_here"
}
}
}
}Restart Cursor, then ask the agent to use GitLumen tools.
screen_repositoryScreen a repository or PR.
Input:
{
"repoUrl": "https://github.com/owner/repo",
"scope": "standard",
"output": "compact"
}For PR:
{
"repoUrl": "https://github.com/owner/repo/pull/123",
"scope": "quick",
"output": "markdown"
}Output modes:
compact = concise JSON for agent replies
markdown = full markdown report
json = full JSON reportget_review_reportFetch a previous report by reportId.
{
"reportId": "glr_xxxxxxxxxxxxxxxx",
"output": "markdown"
}list_review_reportsList local reports.
{
"limit": 20
}get_repository_structureGet repository/PR structure without generating a full risk report.
{
"repoUrl": "https://github.com/owner/repo",
"limit": 300
}explain_gitlumen_mcp_flowExplain Path 1 flow and how Path 2 Base MCP can be attached later.
The local analyzer reads:
repository metadata
default branch
recursive tree
selected source/config files
PR metadata and changed files (for PR URLs)
Then it generates signals:
language/framework detection
dependency surface
lockfile presence
lifecycle script risk
test presence
CI presence
Dockerfile/container risk
possible hardcoded secret patterns
dynamic code execution
command execution pattern
SQL interpolation pattern
GitHub Actions supply-chain pattern
merge-readiness estimate
Risk categories:
security
dependencies
tests
architecture
operations
maintainabilitySeverity:
critical
high
medium
low
info{
"reportId": "glr_abc123...",
"risk": {
"score": 42,
"level": "medium",
"mergeReadiness": "review_required",
"categoryScores": {
"security": 24,
"dependencies": 13,
"tests": 24,
"architecture": 0,
"operations": 13,
"maintainability": 5
}
},
"summary": "The repository/PR has medium risk signals...",
"findings": [],
"decisionQuestions": [],
"recommendations": []
}Repo/PR intelligence
Risk map
Review chapters
Decision questions
Report retrievalBase MCP get_wallets
GitLumen quote endpoint
GitLumen prepare endpoint
Base MCP send_calls
Review credit purchase
Reward claim
Reviewer reputationThis project is intentionally standalone for Path 1 first. Later, Path 2 can read reportId and connect it with onchain payment/reward/reputation flows.
Unable to reach GitHub API or fetch failedCheck internet connection, DNS, proxy/VPN, or retry. For offline verification:
npm run sampleGitHub API 403 rate limit exceededAdd GITHUB_TOKEN in .env or MCP client config.
Only github.com repositories are supportedThis prototype does not support GitLab/Bitbucket yet. Add a new adapter in src/services/github.js or create a separate service.
Check:
args path is absolute.
npm install has been run.
Node 20+ is installed.
MCP client was restarted.
Verify with npm run inspect.
Run:
npm run doctorEnsure .gitlumen-mcp/reports is writable.
Edit:
src/services/analyzer.jsEdit:
src/services/github.jsEdit:
src/services/gitlumen.jsPotential production direction:
screen_repository MCP tool
-> GitLumen hosted API /v1/screenings
-> GitLumen Review Intelligence Engine
-> reportId
-> get_review_report MCP toolDo not commit .env.
Do not hardcode GitHub tokens in publicly shared config.
For private repositories, use least-privilege fine-grained GitHub tokens.
Local reports may contain paths, findings, and snippet metadata. Store them securely for private repositories.
MIT
Explain how this Path 1 MCP server fits into GitLumen and how it later connects to Base MCP Path 2.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description bears full responsibility for disclosing behavioral traits. It only states what the tool does, with no mention of side effects, safety, read-only nature, or authentication requirements. For a tool that likely performs no mutations, the lack of transparency is a significant gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that gets directly to the point. It is front-loaded with the core action 'Explain' and specifies the exact scope of the explanation. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the absence of output schema and annotations, the description is the sole source of context. It fails to define key terms like 'Path 1' and 'Base MCP Path 2', nor does it describe the output format or expected content. Sibling tools involve repository operations, so a user might need to understand the overall flow, but this description is too minimal to be fully informative.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, and schema coverage is 100% by definition. The description does not need to add parameter details. However, it misses the opportunity to clarify that no inputs are required, which would reinforce the schema. Baseline 4 is appropriate given the lack of parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: to explain how the Path 1 MCP server fits into GitLumen and connects to Base MCP Path 2. The verb 'explain' and the specific subject matter distinguish it from sibling tools like screen_repository or get_review_report. However, it assumes familiarity with 'Path 1' and 'Path 2' without defining them, which slightly reduces clarity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. It does not specify prerequisites, such as needing an existing GitLumen context, or scenarios where this tool is appropriate. The description is purely declarative with no contextual cues to aid selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Fetch public GitHub repository or PR structure without generating a full risk report.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum tree entries to return. | |
| branch | No | Optional branch/ref. | |
| repoUrl | Yes | GitHub repository or pull request URL. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must fully convey behavioral traits. It implies a read-only fetch operation with no side effects, which is appropriate. However, it does not mention authentication needs, rate limits, error handling for private repos, or the fact that results are limited (as indicated by the 'limit' parameter). The description is adequate but not exhaustive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that efficiently conveys the primary purpose and a key differentiator. It avoids unnecessary detail, making it easy to parse. A slight improvement could be to structure it with more detail about return format, but it is already concise and clear.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity (3 parameters, no output schema, no nested objects), the description is adequate but not complete. It omits the return type (e.g., tree of files) and any constraints like rate limits or authentication. An agent would need to infer or test to fully understand the output, which is a gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% (all three parameters have descriptions in the schema). The tool description adds no additional meaning beyond what the schema provides, so a baseline score of 3 is appropriate. It does not explain defaults, relationships, or usage tips for the parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the action ('Fetch') and the resource ('public GitHub repository or PR structure'), and distinguishes from sibling tools by adding 'without generating a full risk report'. It could more explicitly state that the structure is a directory tree, but it is specific enough for an AI agent to understand the tool's core function.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a usage hint ('without generating a full risk report') that contrasts with the sibling tool get_review_report, but it lacks explicit guidance on when to use this tool vs. alternative siblings like screen_repository. No when-not-to-use or prerequisite info is given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Get a previously generated GitLumen MCP report by reportId.
| Name | Required | Description | Default |
|---|---|---|---|
| output | No | compact | |
| reportId | Yes | Report id returned by screen_repository, for example glr_abcd1234abcd1234 |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, placing full burden on the description. It only indicates a read operation (Get) without disclosing aspects like authentication requirements, error handling for invalid reportId, or any side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no fluff, achieving brevity. However, it could include more useful context without being verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and no annotations, the description is too minimal. It lacks details about the report's structure, content, or any potential limitations, leaving the agent underinformed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50% (reportId has description, output does not). The description mentions 'reportId' but adds no additional meaning beyond what the schema already provides; the output parameter is not described at all.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (Get), the resource (previously generated GitLumen MCP report), and the identifier method (by reportId). It is specific and distinguishable from sibling tools like screen_repository which generates reports.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives such as list_review_reports. The description implies usage for retrieving a specific report, but lacks conditions or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List previously generated GitLumen MCP reports stored locally.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
As a listing tool, it is presumably non-destructive, but the description does not confirm this or disclose any additional behavioral traits like auth requirements or side effects. With no annotations, the description carries full burden and falls short.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Extremely concise: one sentence of 8 words. No wasted language. Appropriate length for a simple tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the basic purpose but omits details like return format, ordering, or relationship to sibling tools. For a simple list tool with one parameter, it is adequate but not comprehensive.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the tool description does not mention the limit parameter at all. The agent must infer its meaning solely from the schema's type and constraints, which is insufficient for full understanding.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'list' and the resource 'previously generated GitLumen MCP reports stored locally'. It adequately distinguishes from sibling tools like get_review_report (single report retrieval) and screen_repository (likely different scope).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives such as get_review_report. No exclusions or contextual cues provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Screen a public GitHub repository or GitHub pull request URL and generate a GitLumen-style risk report. Supports repo URLs and /pull/ URLs.
| Name | Required | Description | Default |
|---|---|---|---|
| scope | No | Screening depth. quick downloads fewer files; standard downloads more files. | standard |
| branch | No | Optional branch/ref. Ignored for PR URLs unless GitHub needs fallback. | |
| output | No | Response format returned to the MCP client. | compact |
| repoUrl | Yes | GitHub repository URL, for example https://github.com/owner/repo or https://github.com/owner/repo/pull/123 | |
| maxFiles | No | Optional hard cap for files downloaded and scanned. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description must disclose behavioral traits. It mentions supported URL types and scope depth but lacks details on side effects, permissions, rate limits, or whether tool is read-only.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no waste. Front-loaded with purpose. Efficient and clear.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 5 parameters, no output schema, and no annotations, the description should provide more context about output formats, behavior for different scopes, and fallback logic. It omits important details for agent to understand full behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema covers 100% of parameters, so baseline is 3. Description adds value by clarifying that repoUrl accepts both repo and PR URLs. No additional context for other parameters beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states action (screen), target (GitHub repo or PR URL), and output (GitLumen risk report). Distinguishes from sibling tools that retrieve existing reports.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like get_review_report or list_review_reports. Agent must infer from name and context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
v1.0.0explain_gitlumen_mcp_flowget_repository_structureget_review_reportlist_review_reportsscreen_repositoryEach tool has a clearly distinct purpose: generating reports, retrieving specific reports, listing reports, fetching repository structure, and explaining the flow. No overlap.
All tool names follow a consistent verb_noun pattern in snake_case (e.g., screen_repository, get_review_report, list_review_reports), making them predictable and easy to distinguish.
With 5 tools, the server is well-scoped for its purpose. Each tool serves a necessary function without bloat or insufficiency.
Core operations are covered: generate, get, list, and structure exploration. Missing delete or update functionality for reports, but the server's focus on one-time generation and review makes this a minor gap.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
Security reviews for coding agents: diffs checked against your org policy and live infrastructure.
Pay-per-call cybersecurity for AI agents: vuln scans, threat intel, compliance, code security.
Connect AI assistants to GitHub - manage repos, issues, PRs, and workflows through natural language.
Scan GitHub-hosted AI skills for vulnerabilities: prompt injection, malware, OWASP LLM Top 10.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/gitlumen-team/gitlumen-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server
