Solumbe

io.github.BASHBOP由 GitHub 账号 BASHBOP 发布v4.10.0更新于 Nov 1, 2026

Deterministic local repository context, impact analysis, and merge-readiness evidence for AI agents.

概览

AI 生成的概览

本地运行的确定性 MCP 服务器,为 AI 编程助手提供仓库上下文、改动影响排序、收敛度评分与合并就绪门禁。

可以做什么
  • 检查与映射仓库:仓库结构、语言、包管理器、脚本、入口点、git 元数据,以及按领域、文件类型或路由生成的紧凑 JSON 代码地图
  • 索引并检索本地仓库,可按路径、领域、类型、路由、导入、导出和符号搜索
  • 生成任务感知的上下文包,包含主要文件、相关文件、测试与验证命令
  • 根据自然语言改动请求排序最可能涉及的文件,并给出风险标记、建议测试与实施计划
  • 对比声明的意图与实际 git diff 计算收敛度,并对改动给出 PASS、WARN 或 FAIL 门禁结论,可选针对 GitHub PR
  • 评估 Agent Experience、推荐模型档位、生成 PR 评审上下文、生成 harness 命令以及多仓库工作区报告
适用场景
适合助手需要修改真实代码库的场景:在编辑前定位正确文件、把改动限制在已声明范围内,并获得确定性的合并就绪结论,而不是依赖模型自评。它设计为与现有 agent 宿主并行使用,而非替代它们。
运行要求
以本地 stdio 进程运行,通过 npm 全局安装或 npx 启动,需要 Node.js。无需账号或托管服务。可选的在线模型解读需要 TYPESAFE_API_KEY,缺失时会回退。对 GitHub PR 执行门禁需要 gh 命令行工具;基于 diff 的工具需要 git 仓库。
安装前请注意
不带 dryRun 的索引操作会在仓库之外写入按用户区分的索引和本地目录。review_gate 传入 pr 时会通过 gh 操作 GitHub。设置 TYPESAFE_API_KEY 后,在线模式会把请求发送给模型。本地门禁通过并不等于自动批准合并,托管 CI、代码评审与人工发布决策仍各自独立。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Solumbe,将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Desktop only,通过 STDIO。 STDIO 服务会启动本地进程,因此需要 SourceWeft 桌面宿主。

其他 MCP 客户端

参照 仓库 中的启动说明。

README

Solumbe

Models generate the change. Solumbe proves whether it is safe to merge.

Formerly Òtítọ́ (@bashbop/otito), renamed in 4.0.0; the CHANGELOG maps every old name to its new one.

[CI] [npm] [license: MIT] [node] [Listed on mcpservers.org] [Solumbe MCP server – quality and maintenance score on Glama]

[solumbe demo]

[Solumbe MCP server – quality and maintenance score on Glama]

Solumbe is a local-first, deterministic, model-agnostic trust layer for AI-assisted development. It builds task-aware repository context before an agent edits, scores how much a change actually touches, and gates merge readiness against the exact staged tree, with no server, no account, and no code leaving the machine.

It does not replace Claude Code, Codex, Cursor, Gemini, or any native agent harness. It runs beside them and keeps working as the models change underneath.

A passing local gate is never an automatic merge approval: hosted CI, GitHub review, CODEOWNERS, and the human release decision remain separate authorities.

Install

bash
npm install -g @bashbop/solumbesolumbe doctorsolumbe install --host all

The last command connects Solumbe's MCP server to every agent host it finds: Claude Code, Claude Desktop, Codex CLI, Cursor, VS Code, Gemini CLI and Kimi Code CLI. Add --dry-run to see the plan first, or name hosts with --host claude-code,cursor. Restart each host afterwards.

Or without installing: npx -y @bashbop/solumbe doctor.

What it does

Rank what a change actually touches, from the request alone, with no model, no embeddings, and no network:

console
$ solumbe impact . "add refund handling to checkout" --top 3
  concepts: money flow
   1.  src/payment/checkout.service.ts    score 155       |- role: required       |- path matches: checkout       |- symbol matches: checkout, refund       |- concept match: money flow (×1.4 + 6.0)       |- risk: money flow
   2.  src/payment/stripe.webhook.ts    score 6       |- role: advisory       |- concept match: money flow (×1.4 + 6.0)

Gate the exact staged tree, and say precisely why:

console
$ solumbe gate . --staged --base origin/main --request "add refund handling to checkout" --min-convergence 80
  [OK]    Changed files          1 changed file found.  [OK]    Staged snapshot        Changed-file scope and convergence evidence are captured from the exact staged Git tree.     |- Tree: 7d0b513dd256877d6bd309a6406468a9b1eaeedc     |- Base: b776f04fcfbd02c8ce8d63e1a0c2450be58de039  [OK]    Secret safety          No secret file paths and no credential values found in the changed content.  [WARN]  Risk review            Risk-sensitive files changed; maintainer review should be explicit.     |- src/payment/checkout.service.ts  [OK]    Convergence            Task and diff satisfy the convergence requirement.     |- Score: 100/100 (aligned)     |- Receipt handle: rcpt_a8d31efae06e     |- Subject tree: 7d0b513dd256877d6bd309a6406468a9b1eaeedc
  VERDICT  WARN

The convergence score is the part a model cannot grade for itself: it compares the stated intent against the files the diff actually changed, and produces a receipt bound to the exact base, parent, and staged-tree identity.

Hold the change to what was declared. Record the files a request is expected to touch before the edit, and the gate names any file that was never declared:

console
$ solumbe declare . "add refund handling to checkout"$ # ... the agent edits ...$ solumbe gate . --staged --base HEAD --intent .solumbe/intent.json
  [FAIL]  Scope contract         Touched `src/auth/session.ts`, which was never declared. Amend the intent with the reason it belongs (`solumbe amend <file> --reason "<why>"`), or take it out of the change.     |- Request: "add refund handling to checkout"     |- Contract: fe655c2af2b31b7e3edec6aedd248b379235811d1228c829f87ff73796ace487     |- Changed files: 3 (1 declared, 0 amended, 1 implied, 1 undeclared)     |- Implied: tests/checkout.service.test.ts (owner-test of src/payment/checkout.service.ts)     |- Undeclared on a risk-sensitive path: src/auth/session.ts [auth/security]

An amendment adds a file with its reason, hashed onto the contract, so a reviewer reads why the scope grew. Over MCP it is change_impact with declare: true, and review_gate with intent.

The core

Four commands are the product. They call no model, open no socket, and read nothing outside the repository.

StepCommandWhat it proves
Before the editsolumbe context "add refund handling" --path .Which files, tests and commands the request needs
After the editsolumbe converge . "add refund handling" --base origin/main --stagedHow far the diff is from the request, with a receipt
Before the mergesolumbe gate . --staged --base origin/main --request "add refund handling"PASS / WARN / FAIL on the exact staged tree
After the mergesolumbe attest . --verdict verdict.json --merge <sha>A hash-chained record of what shipped, under which verdict

solumbe help shows these and how to set up; solumbe help --all lists every command, including the ones that support them (impact, declare, pr, review, map, calibrate, route, ax, dashboard and the rest). Nothing was removed.

Nothing hosted is required, and nothing hosted can change a verdict. Local Core, Optional Hosted lists exactly what the optional pieces send, and where.

Supporting commands

GoalCommand
Rank change blast radiussolumbe impact . "add refund handling" --top 12
Score intent vs. executionsolumbe converge "add refunds" --path . --base HEAD --staged
Score a committed change exactlysolumbe converge "add refunds" --path . --base HEAD~1 --head HEAD
Gate a product change across repossolumbe workspace-gate ../web ../api --request "ship change"
Grade risk flags against historysolumbe calibrate . --window 30
Grade route tiers against historysolumbe regret . --window 30 --offline
Regrade a saved run, same answerssolumbe regret --rescore run.json
Score Agent Experiencesolumbe ax . "add a new MCP tool"
Recommend a model tiersolumbe route . "add a new MCP tool"
Sharpen context with a model readsolumbe context "add a new MCP tool" --path . --online
Inspect one reposolumbe repo . --json
Build a code mapsolumbe map . --json
Index and search local projectssolumbe index ~/projects --discover then solumbe search "events controller"
Generate an agent harnesssolumbe harness . --out .solumbe/harness.md
Run the MCP serversolumbe mcp

Every command takes --json, and solumbe help lists the full set with flags.

MCP

Solumbe ships a stdio MCP server exposing 14 tools: repo_inspect, repo_map, repo_index, repo_search, context_pack, change_impact, agent_experience, model_route, convergence_score, review_context, review_gate, review_verdict, workspace_report, and repo_harness.

json
{  "mcpServers": {    "solumbe": {      "command": "npx",      "args": ["-y", "@bashbop/solumbe", "mcp"]    }  }}

solumbe install --host all writes this entry for you, using absolute paths so hosts that do not inherit your shell PATH can still start it. Published in the MCP Registry as io.github.BASHBOP/solumbe. Repo-map lookups use an external per-user cache and never write into the inspected repository. Host-specific setup for Claude Code, Claude Desktop, Codex, Cursor, VS Code, Gemini CLI, and Kimi Code is in MCP and Agent Workflows.

How it compares

ApproachStrengthsWhere solumbe differs
Sourcegraph / Cody contextPowerful hosted code search and embedding-based context across an orgLocal-first and deterministic: no server, no account, no code leaves the machine, and the same query always yields the same packet
Hand-written CLAUDE.md / rules filesCurated, intent-rich guidanceHand-written context goes stale; solumbe regenerates context from the actual code (symbols, imports, routes, tests) on every run and complements a short CLAUDE.md
grep / ripgrepFast, universal text matchingsolumbe ranks whole files by task intent across paths, symbols, exports, and tests, then adds patterns and validation commands, producing a context packet rather than a list of matching lines

Documentation

Full command reference, agent workflows, release process, evaluation method, and the design theses behind the trust layer:

bashbop.github.io/solumbe

Contributing

bash
git clone https://github.com/BASHBOP/solumbe.gitcd solumbe && npm ci && npm run ci

npm run ci is the full gate: format, lint, typecheck, version check, tests, coverage floors (70% lines / 60% branches / 75% functions), three evaluation corpora, dependency audit, and a packaged-tarball smoke test. Run it before requesting review.

Start with CONTRIBUTING.md and the Code of Conduct. All changes need maintainer review; main requires passing gates and resolved conversations. Solumbe follows Semantic Versioning, so say whether a PR is no-impact, patch, minor, or major.


Part of the toolchain

solumbe is one of four tools that form a deterministic trust layer for AI-assisted development. Each uses static analysis to answer a question people keep handing to an LLM.

  • solumbe (this tool), for context: what does this change actually touch?
  • tieline, for contracts: did the front end and back end quietly stop agreeing?
  • bouncer, for compliance: could you defend this to Ofcom?
  • aiglare, for governance: where can the model do something you can't undo?

More at segunolumbe.com. static analysis, never the model.

来源:README.md,提交 02eaad0

工具

14

repo_inspect

Inspect Repository

Inspect repository shape, languages, package managers, script names, entrypoints, and git metadata. Returns up to 200 representative file paths; pass includeScripts:true to get full script command bodies instead of just names.

输入参数pathincludeScripts

repo_map

Map Repository

Map a repository into a compact JSON code map, optionally narrowed by domain, file kind, or controller route. Pass domain to find files for a feature, kind to find files of a type (route, controller, service, apiClient, component, test), or route to match Nest controller routes by substring/regex.

输入参数kindpathlimitroutedomainincludeFiles

repo_index

Index Repositories

Index local repositories: generate per-user external indexes and add them to the local catalog. Pass discover:true to find repository roots under the given paths first. Pass dryRun:true to discover and report without writing any indexes or catalog (read-only). Without dryRun this mutates the persistent local catalog, so it is not a pure read.

输入参数pathdepthlimitpathsdryRuncatalogdiscover

context_pack

Context Pack

Generate a task-aware local context packet with primary files, related files, tests, and validation commands. Deterministic by default; online:true also asks a read model for the request's intent and which candidate files it needs, reported under modelRead.

输入参数pathlimitpathsquery必填onlineincludeEvidenceincludeMarkdown

change_impact

Change Impact

Given a plain-English change request, rank the files most likely to own the change, with risk flags, suggested tests, and an implementation plan. Optional diff base surfaces exact changed-file evidence alongside the heuristic. When the repository's .solumberc.json lists companions, companions also carries the top few files each companion repository would own for the same request.

输入参数toppathamendquery必填intentdeclarediffBaseincludeMarkdownincludeUntracked

agent_experience

Agent Experience (AX)

Score Agent Experience (AX): a single 0–100 number answering "how cheap and safe is it for an agent to make this change here?", blending Changeability (token cost), Containment (blast radius), Guardrails (tests / validation / CODEOWNERS / CI), and Clarity (task groundedness). Returns sub-scores, drivers, and concrete recommendations for raising AX.

输入参数toppathquery必填includeMarkdown

model_route

Model Route

Recommend a model tier (cheap, mid or premium) for a coding request before any work starts. Combines solumbe's deterministic repository half (AX, containment, top-severity risk paths) with a System One model's calibrated read of the request (specificity, blast radius, novelty). The model is called only when TYPESAFE_API_KEY is set in this server's environment and offline is not true; otherwise the read is a labelled offline estimate, and model.source says which. Advisory: it recommends a tier and never feeds review_gate or review_verdict. Pass host to map the tier to that host's model id.

输入参数tophostpathquery必填offlineincludeMarkdown

convergence_score

Convergence Score

Score convergence: a deterministic 0–100 measure of the distance between a stated task (intent) and the actual git diff (execution), with sub-scores for Coverage (did the intent happen?), Scope (did only the intent happen?), and Risk alignment (did unrequested drift land on risk-sensitive paths?). No model. A task that predicts no owner file is band inconclusive, with no score. Emits a recomputable receipt (a hash anyone can regenerate). Requires a base git ref to diff against; scores the working tree's tracked changes unless head or staged selects an exact subject.

输入参数topbase必填headpathquery必填intentstagedincludeMarkdownincludeUntracked

review_gate

Review Gate

Gate a change for merge and return a PASS / WARN / FAIL verdict. Omit pr to run the local, no-GitHub gate against a base ref (changed files, secret safety, risk-sensitive paths, release discipline, validation commands, dependency audit, policy profile). Set pr to gate an open GitHub PR via `gh` (PR state, review decision, CODEOWNERS approvals, unresolved conversations, branch protection, status checks). A check the mode cannot evaluate is SKIPPED and never changes the verdict. Use review_verdict instead when you want the full impact + review + gate composite, or review_context when you want diff/comment context with no verdict.

输入参数prbaseheadpathintentpolicystagedreceiptrequestgovernanceminConvergence

review_verdict

Review Verdict

Run the full review pipeline in one shot: change_impact plus review_context plus review_gate, returning a unified verdict with a derived confidence score. When the repository's .solumberc.json lists companions and a request is given, impactSummary.companions names the top few files each companion repository would own for that request. Use review_verdict when you want the complete picture of a change in a single call. Use review_context instead for diff metadata only (no verdict), or review_gate for the gate verdict alone.

输入参数prbaseheadpathintentpolicyreceiptrequestimpactTopgovernanceminConvergence

workspace_report

Workspace Report

Generate a product-level report across multiple related repositories.

输入参数paths必填includeMarkdown

review_context

Review Context

Produce PR review context from local git diff metadata, optionally enriched with GitHub PR comments. Use review_context when you want the raw diff/comment context for a change, not a verdict. Use review_verdict instead for the full impact + review + gate composite, or review_gate for the gate verdict alone.

输入参数baseheadpathgithubnumbercommentincludeMarkdown

repo_harness

Repository Harness

Generate setup, validation, runtime, and context commands for an agent or CI harness.

输入参数pathincludeMarkdown

版本历史

13
  1. v4.10.0最新Nov 1, 2026
  2. v4.9.0Oct 29, 2026
  3. v4.8.0Oct 23, 2026
  4. v4.7.2Oct 19, 2026
  5. v4.7.1Oct 18, 2026
  6. v4.6.0Oct 18, 2026
  7. v4.5.0Oct 11, 2026
  8. v4.4.0Oct 10, 2026
  9. v4.3.0Oct 10, 2026
  10. v4.2.1Oct 6, 2026
  11. v4.2.0Oct 4, 2026
  12. v4.1.0Oct 1, 2026
  13. v4.0.0Sep 30, 2026

评分

已满足适用检查项的 90%

该评分衡量此收录条目的完整程度,依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价,也不表示服务器安全或当前可用:可连通性是带日期的检查结果,评分也不包含安装量或用户评价。

  • 近 30 天内可连通25 分
  • 已声明认证方式10 分

    请在注册中心条目中声明凭据请求头,或保持端点能够响应探测,以便判定其认证方式。

  • 已列出工具必需15 分
  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分