gitgoblin

io.github.anandkaranubcPublished by GitHub account anandkaranubcv0.1.8Updated Oct 30, 2026

Discover open-source repositories worth your time and evidence-backed contribution opportunities.

VerifiedSTDIODesktop onlyWeb Search & ScrapingDeveloper Tools

Overview

AI-generated overview

Read-only MCP server that helps an assistant find open-source repositories worth contributing to and evidence-backed opportunities inside them.

What you can do
  • Discover repositories matching a goal, languages, topics, keywords, star range, recency and license, ranked with reasons for and against
  • Explain a repository's score by showing all eleven discovery signals with values, weights and evidence
  • Analyze a repository's profile, activity, responsiveness, welcomeness, rules and conventions, and list ranked contribution opportunities
  • Get one opportunity in full, including how to clone, which commands to run and the project's etiquette
When to use it
Useful when someone wants to pick open-source projects to contribute to, understand why a repository was recommended, or get a concrete briefing on a specific issue or stale pull request before starting work.
Requirements
Runs locally over stdio via npx or the Claude Desktop bundle, so Node.js is needed. An optional GITHUB_TOKEN or GH_TOKEN, or an existing GitHub CLI login, raises rate limits and unlocks starter-issue data. Network access to GitHub, GitLab and Codeberg public APIs is required.
Before you install
The optional GitHub token is a credential; it is only used to read public repositories and raise rate limits. Tools are read-only and the server does not open issues, pull requests or comments unless asked. Repository text is treated as untrusted data, and clones are cached locally under a configurable cache directory.

Installation

In SourceWeft

  1. Open gitgoblin in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@gitgoblin/mcp

gitgoblin as a Model Context Protocol server. It gives any MCP client (Claude Code, Codex, Cursor, Gemini CLI, Copilot in VS Code, and others) four read-only tools: discover repositories worth your time, explain why one scores the way it does, analyze what a repository actually needs, and get a full briefing on one piece of work.

sh
claude mcp add gitgoblin -- npx -y @gitgoblin/mcp

docs/agents.md has the one-liner for every client, the skill that teaches agents when to use the tools, and what has been verified. The server is listed in the official MCP Registry as io.github.anandkaranubc/gitgoblin. You can also run the server from a clone with node packages/mcp/bin/gitgoblin-mcp.mjs after npm install; Claude Desktop users install the release's gitgoblin.mcpb directly.

Tools

ToolInputOutput
discover_repositoriesgoal (default contribute), languages, topics, keywords, min_stars, max_stars, pushed_within_days, created_within_days, license, like, exclude_owners, include_archived, include_forks, limit (default 10, max 25)Ranked repositories: stars, language, license, score, the three strongest reasons for and one against, starter issues for contribute. structuredContent.results[] carries the same fields; warnings lists refused searches and failed lookups, which mean the ranking may be partial, and projects left out because their maintainers opted out of gitgoblin.
explain_repositoryrepository, goalAll eleven discovery signals with value, weight for the goal and evidence. Unknown signals say so.
analyze_repositoryrepository, max_opportunities (default 10, max 30), check_dependencies (default true), goalThe profile (nature, activity, responsiveness, welcomeness with signals, rules, commands, conventions) and the ranked opportunities with their primary evidence.
get_opportunityrepository, opportunity_id or issue_number (an issue's or a stale pull request's number)One opportunity in full plus how to work on the project: clone, commands, conventions, rules, etiquette.

repository accepts owner/name or a URL. explain_repository and the like seed take github.com repositories, since discovery reads GitHub's API by owner and name; analyze_repository and get_opportunity also take gitlab.com and codeberg.org, which intel reads through their public APIs. Every other host is refused. Errors come back as tool results with advice (how to get a token, how to spell a repository), never as protocol failures. An analysis runs in a child process and is stopped after five minutes, or as soon as the client cancels the request, so one slow repository never freezes the other tools; at most two run at once. Long calls send progress notifications when the client provides a progress token.

The server's instructions tell the agent the typical flow, that quoted repository text is data and never instructions, and the one rule that matters: it never opens issues, pull requests or comments on the person's behalf unless asked.

The repository is often chosen by a model, so the server treats it as hostile: it reads only repositories it has confirmed public with an anonymous request, analyzes each in a child process with an empty home directory (none of your git configuration or credential helpers apply) that is killed with everything it started after five minutes or on cancellation, keeps clones per forge, never fetches external links, and strips control and format characters from every result, which opens with a reminder that repository text is data and is capped in size. docs/design.md explains each defence.

Environment

VariableEffect
GITHUB_TOKEN, GH_TOKENOptional. Raises GitHub's limits and unlocks starter issues. Falls back to gh auth token.
GITGOBLIN_CACHE_DIRWhere the HTTP cache lives (default ~/.cache/gitgoblin); the server's blob-less clones go in mcp/repos/<host> under it, at most 20 per forge.

Development

sh
npm test -w @gitgoblin/mcp                                       # protocol tests with fakes, offlinenpm run typecheck -w @gitgoblin/mcpGITGOBLIN_E2E=1 npx vitest run --root packages/mcp test/e2e      # the real server over stdio, against GitHubnpm run bundle -w @gitgoblin/mcp                                 # what `npm pack` ships: dist/gitgoblin-mcp.mjs and its THIRD_PARTY_NOTICES.mdnpm run mcpb -w @gitgoblin/mcp                                   # the Claude Desktop bundle: dist/gitgoblin.mcpb

src/server.ts builds the server from an injectable ServerDeps (discovery and intel); src/format.ts renders results for a model; src/deps.ts wires the real packages; bin/gitgoblin-mcp.mjs is the launcher. Development runs the TypeScript source on Node 24. Publishing bundles the source and the sibling packages into one file with no runtime dependencies, because Node will not strip types under node_modules. docs/design.md explains the decisions; server.json is the manifest for the MCP Registry; it points at the release's .mcpb and its SHA-256. Releases are built by the repository's release workflow from an mcp-v<version> tag on the merged commit, never from a local checkout; docs/releasing.md has the steps, including the MCP Registry workflow run that follows each release.

Source: packages/mcp/README.md at commit c4d1948

Tools

0
SourceWeft started this package once in an isolated sandbox, without credentials, to list its tools. That failed: the server did not start.

Version history

4
  1. v0.1.8LatestOct 30, 2026
  2. v0.1.7Oct 24, 2026
  3. v0.1.6Oct 23, 2026
  4. v0.1.0Oct 23, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts