GitLumen MCP

io.github.gitlumen-team由 GitHub 账号 gitlumen-team 发布v1.0.0更新于 Oct 24, 2026

Screens public GitHub repos and PRs to generate risk maps, findings, and merge-readiness signals.

已验证Streamable HTTP可网页运行开发者工具安全与监控

概览

AI 生成的概览

GitLumen MCP 筛查公开 GitHub 仓库和拉取请求，向 AI 助手返回风险图、发现项和可合并性信号。

可以做什么
筛查公开 GitHub 仓库或拉取请求链接，生成风险评分、分类风险图、发现项和可合并性信号，支持紧凑、Markdown 或 JSON 输出。查看仓库或 PR 结构，而不生成完整风险报告。按报告 ID 获取此前保存的报告，或列出已存报告。说明该服务器的审查流程，以及后续链上支付阶段如何接入。
适用场景
适合让助手对公开 GitHub 仓库或拉取请求快速给出风险与可合并性判断，例如在审查或合并第三方代码之前。也适合在审查对话中调取此前的筛查报告。
运行要求
远程端点，通过 streamable HTTP 访问，需在 Authorization 请求头中提供 bearer 令牌。README 还描述了本地 Node.js 20+ 版本，需要访问 GitHub 的网络，可选 GITHUB_TOKEN 以提高速率上限或访问私有仓库。
安装前请注意
Authorization bearer 令牌为必需项，属于机密。筛查会从 GitHub 获取仓库元数据和部分源文件；README 称本地分析器不会把源代码发送给外部大模型。保存的报告可能包含文件路径、发现项和代码片段元数据，私有仓库的报告应安全存放。README 说明目前不执行链上交易。

安装

在 SourceWeft 中

  1. 打开 控制台中的 GitLumen MCP，将其添加到工作区。
  2. 连接 Authorization token 凭据。它们会被私密存储，绝不会在公开页面上展示。
  3. 为需要使用其工具的对话启用该服务。

Web executable，通过 Streamable HTTP。 远程服务在工作区中配置后即可从网页运行时运行。

交给智能体安装

把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体，或 SourceWeft 对话中。智能体会读取该服务器的安装指南，先向你展示发布者、端点和登录方式，经你同意后再把它添加到你的客户端。密钥不会写进任何命令。

阅读 https://sourceweft.com/mcp/io.github.gitlumen-team%2Fgitlumen-mcp/install.md，并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前，先告诉我它的发布者、端点和登录方式，等我确认。不要把 API 密钥写进命令或我会提交的文件；问我密钥应从哪里获取。

查看智能体所依据的安装指南

其他 MCP 客户端

把它添加到你客户端的 mcpServers 配置中。

{
  "mcpServers": {
    "gitlumen": {
      "type": "http",
      "url": "https://mcp-github-screen.gitlumen.com/mcp",
      "headers": {
        "Authorization": "Bearer <YOUR_TOKEN>"
      }
    }
  }
}

README

GitLumen MCP Server - Version 1.0.0

GitLumen MCP Server is a Node.js project that exposes a GitLumen-style review intelligence layer through the Model Context Protocol (MCP), so AI agents can call it as tools.

This project focuses on:

txt
AI Agent / MCP Client-> GitLumen MCP Server-> GitHub public repo / PR reader-> local risk analyzer-> GitLumen-style report

This project intentionally does not execute onchain transactions yet and does not use Base MCP send_calls. A Base MCP custom plugin can be attached in Path 2 after this intelligence server is ready.

Features

  • MCP stdio server that can be used by Claude Desktop, Cursor, Claude Code, or other MCP clients.
  • Screens public GitHub repository URLs.
  • Screens GitHub Pull Request URLs /pull/<number>.
  • No GitHub token required for small/medium public repositories.
  • Optional GITHUB_TOKEN for higher rate limits and private repositories (depending on token scope).
  • Local analyzer: source code is not sent to external LLMs.
  • Produces:
    • risk score
    • category risk map
    • findings
    • review chapters
    • decision questions
    • merge-readiness signal
    • recommended next actions
  • Stores reports locally in .gitlumen-mcp/reports/*.json.
  • Includes a CLI for local testing without an MCP client.

Project Structure

txt
gitlumen-mcp-server/|- package.json|- README.md|- .env.example|- examples/|  |- claude_desktop_config.example.json|  \- cursor_mcp.example.json|- docs/|  |- ARCHITECTURE.md|  \- TOOLS.md\- src/   |- index.js                  # MCP stdio server entrypoint   |- cli.js                    # CLI local test   |- doctor.js                 # environment checker   |- config.js   |- types.js   |- services/   |  |- github.js              # GitHub API + raw file loader   |  |- analyzer.js            # local heuristic risk engine   |  |- gitlumen.js            # service orchestrator   |  \- reportStore.js         # local report persistence   \- utils/      |- githubUrl.js      |- ids.js      \- text.js

Requirements

  • Node.js 20+
  • npm
  • Internet access to fetch metadata/files from GitHub

Check Node version:

bash
node -v

If your version is Node 18 or below, upgrade to Node 20+.

1. Install Dependencies

Open the project directory:

bash
cd gitlumen-mcp-server

Install dependencies:

bash
npm install

2. Optional Env Setup

Copy env example:

bash
cp .env.example .env

Fill optional values:

bash
GITHUB_TOKEN=ghp_xxx_or_fine_grained_tokenGITLUMEN_MCP_DATA_DIR=.gitlumen-mcpGITLUMEN_MAX_FILE_BYTES=120000

For public repositories, GITHUB_TOKEN can be empty. A token is still recommended to avoid low GitHub rate limits.

3. Run Doctor

bash
npm run doctor

Expected output:

txt
GitLumen MCP Doctor
✅ Node version: v20.x.x✅ GITHUB_TOKEN configured: no (public unauthenticated mode)✅ Data directory: /path/to/gitlumen-mcp-server/.gitlumen-mcp✅ Reports directory writable: /path/to/gitlumen-mcp-server/.gitlumen-mcp/reports

4. Test Screening via CLI

Offline test without GitHub network

bash
npm run sample

This command generates a report from a local fixture so you can verify analyzer and report-store behavior without GitHub connectivity.

Screen a public repository

bash
npm run screen -- https://github.com/modelcontextprotocol/typescript-sdk quick

Screen a public PR

bash
npm run screen -- https://github.com/modelcontextprotocol/typescript-sdk/pull/1 quick

Available scopes

txt
quick     = fastest, fewer filesstandard  = balanced default

Examples:

bash
npm run screen -- https://github.com/owner/repo standardnpm run screen -- https://github.com/owner/repo quick main

After completion, CLI prints a markdown report and saves JSON to:

txt
.gitlumen-mcp/reports/<reportId>.json

5. Read Previous Reports

bash
npm run list -- 10

Take a reportId, then:

bash
npm run report -- glr_xxxxxxxxxxxxxxxx markdown

Or full JSON:

bash
npm run report -- glr_xxxxxxxxxxxxxxxx json

6. Run as MCP Server

The MCP server uses stdio, so it is normally started by an MCP client instead of being run manually.

bash
node /ABSOLUTE/PATH/TO/gitlumen-mcp-server/src/index.js

To debug MCP protocol, use MCP Inspector:

bash
npm run inspect

Then open the Inspector URL printed in terminal.

Optional: Run as Remote MCP HTTP Server (for VPS/PM2)

This project also includes a Streamable HTTP transport endpoint at /mcp.

Run locally:

bash
npm run start:http

Environment variables:

bash
PORT=3333HOST=0.0.0.0MCP_AUTH_TOKEN=replace_with_a_long_random_token
  • MCP_AUTH_TOKEN is optional but strongly recommended for production.
  • When set, clients must send Authorization: Bearer <token>.

Health check:

bash
curl -s http://localhost:3333/health

Production deployment guide:

Client configuration templates (Copilot / VS Code / Codex):

7. Install in Claude Desktop

Open Claude Desktop config.

Common location:

macOS

txt
~/Library/Application Support/Claude/claude_desktop_config.json

Windows

txt
%APPDATA%\Claude\claude_desktop_config.json

Add:

json
{  "mcpServers": {    "gitlumen": {      "command": "node",      "args": ["/ABSOLUTE/PATH/TO/gitlumen-mcp-server/src/index.js"],      "env": {        "GITHUB_TOKEN": "optional_github_token_here",        "GITLUMEN_MCP_DATA_DIR": "/ABSOLUTE/PATH/TO/gitlumen-mcp-server/.gitlumen-mcp"      }    }  }}

Replace /ABSOLUTE/PATH/TO/... with your real path.

Restart Claude Desktop.

Example prompt:

txt
Use GitLumen to screen https://github.com/modelcontextprotocol/typescript-sdk with quick scope. Return the risk map and top findings.

8. Install in Cursor

Create or edit Cursor MCP config (format may vary by Cursor version):

json
{  "mcpServers": {    "gitlumen": {      "command": "node",      "args": ["/ABSOLUTE/PATH/TO/gitlumen-mcp-server/src/index.js"],      "env": {        "GITHUB_TOKEN": "optional_github_token_here"      }    }  }}

Restart Cursor, then ask the agent to use GitLumen tools.

Available MCP Tools

screen_repository

Screen a repository or PR.

Input:

json
{  "repoUrl": "https://github.com/owner/repo",  "scope": "standard",  "output": "compact"}

For PR:

json
{  "repoUrl": "https://github.com/owner/repo/pull/123",  "scope": "quick",  "output": "markdown"}

Output modes:

txt
compact   = concise JSON for agent repliesmarkdown  = full markdown reportjson      = full JSON report

get_review_report

Fetch a previous report by reportId.

json
{  "reportId": "glr_xxxxxxxxxxxxxxxx",  "output": "markdown"}

list_review_reports

List local reports.

json
{  "limit": 20}

get_repository_structure

Get repository/PR structure without generating a full risk report.

json
{  "repoUrl": "https://github.com/owner/repo",  "limit": 300}

explain_gitlumen_mcp_flow

Explain Path 1 flow and how Path 2 Base MCP can be attached later.

How the Analyzer Works

The local analyzer reads:

  • repository metadata
  • default branch
  • recursive tree
  • selected source/config files
  • PR metadata and changed files (for PR URLs)

Then it generates signals:

  • language/framework detection
  • dependency surface
  • lockfile presence
  • lifecycle script risk
  • test presence
  • CI presence
  • Dockerfile/container risk
  • possible hardcoded secret patterns
  • dynamic code execution
  • command execution pattern
  • SQL interpolation pattern
  • GitHub Actions supply-chain pattern
  • merge-readiness estimate

Risk categories:

txt
securitydependenciestestsarchitectureoperationsmaintainability

Severity:

txt
criticalhighmediumlowinfo

Example Compact Report Output

json
{  "reportId": "glr_abc123...",  "risk": {    "score": 42,    "level": "medium",    "mergeReadiness": "review_required",    "categoryScores": {      "security": 24,      "dependencies": 13,      "tests": 24,      "architecture": 0,      "operations": 13,      "maintainability": 5    }  },  "summary": "The repository/PR has medium risk signals...",  "findings": [],  "decisionQuestions": [],  "recommendations": []}

Path 1 vs Path 2

Path 1 (this project)

txt
Repo/PR intelligenceRisk mapReview chaptersDecision questionsReport retrieval

Path 2 (future)

txt
Base MCP get_walletsGitLumen quote endpointGitLumen prepare endpointBase MCP send_callsReview credit purchaseReward claimReviewer reputation

This project is intentionally standalone for Path 1 first. Later, Path 2 can read reportId and connect it with onchain payment/reward/reputation flows.

Troubleshooting

Unable to reach GitHub API or fetch failed

Check internet connection, DNS, proxy/VPN, or retry. For offline verification:

bash
npm run sample

GitHub API 403 rate limit exceeded

Add GITHUB_TOKEN in .env or MCP client config.

Only github.com repositories are supported

This prototype does not support GitLab/Bitbucket yet. Add a new adapter in src/services/github.js or create a separate service.

MCP client cannot see tools

Check:

  1. args path is absolute.
  2. npm install has been run.
  3. Node 20+ is installed.
  4. MCP client was restarted.
  5. Verify with npm run inspect.

Report is not saved

Run:

bash
npm run doctor

Ensure .gitlumen-mcp/reports is writable.

Important Files for Future Changes

Add a new detector

Edit:

txt
src/services/analyzer.js

Change repository fetching behavior

Edit:

txt
src/services/github.js

Replace local analyzer with hosted GitLumen API

Edit:

txt
src/services/gitlumen.js

Potential production direction:

txt
screen_repository MCP tool-> GitLumen hosted API /v1/screenings-> GitLumen Review Intelligence Engine-> reportId-> get_review_report MCP tool

Security Notes

  • Do not commit .env.
  • Do not hardcode GitHub tokens in publicly shared config.
  • For private repositories, use least-privilege fine-grained GitHub tokens.
  • Local reports may contain paths, findings, and snippet metadata. Store them securely for private repositories.

License

MIT

来源：README.md，提交 81e5132

工具

0
SourceWeft 尚未读取此服务器的工具。

版本历史

1
  1. v1.0.0最新Sep 16, 2026

评分

已满足适用检查项的 75%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通必需25 分
  • 已声明认证方式必需10 分
  • 已列出工具必需15 分

    请让服务器在无凭据时响应 tools/list，或发布可在沙箱中无凭据启动的软件包。

  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分

    请在仓库或注册中心条目中声明许可证。