Solumbe

io.github.BASHBOP由 GitHub 帳號 BASHBOP 發布v4.10.0更新於 Nov 1, 2026

Deterministic local repository context, impact analysis, and merge-readiness evidence for AI agents.

概覽

AI 產生的概覽

在本機執行的確定性 MCP 伺服器,為 AI 程式助理提供儲存庫脈絡、變更影響排序、收斂度評分與合併就緒閘門。

可以做什麼
  • 檢視與對應儲存庫:儲存庫結構、語言、套件管理器、指令碼、進入點、git 中繼資料,以及依領域、檔案類型或路由產生的精簡 JSON 程式碼地圖
  • 建立索引並搜尋本機儲存庫,可依路徑、領域、類型、路由、匯入、匯出與符號查詢
  • 產生任務感知的脈絡包,包含主要檔案、相關檔案、測試與驗證指令
  • 依自然語言變更請求排序最可能涉及的檔案,並附上風險標記、建議測試與實作計畫
  • 比對宣告意圖與實際 git diff 計算收斂度,並對變更給出 PASS、WARN 或 FAIL 閘門結論,可選擇針對 GitHub PR
  • 評估 Agent Experience、建議模型等級、產生 PR 審查脈絡、產生 harness 指令,以及跨多個儲存庫的工作區報告
適用情境
適合助理要修改真實程式碼庫的情況:在編輯前找到正確檔案、把變更限制在已宣告範圍內,並取得確定性的合併就緒結論,而不是依賴模型自我評分。它的設計是與現有 agent 主機並行使用,而非取代它們。
執行需求
以本機 stdio 程序執行,透過 npm 全域安裝或 npx 啟動,需要 Node.js。不需要帳號或託管服務。選用的線上模型解讀需要 TYPESAFE_API_KEY,缺少時會退回離線模式。對 GitHub PR 執行閘門需要 gh 命令列工具;以 diff 為基礎的工具需要 git 儲存庫。
安裝前請注意
未使用 dryRun 的索引作業會在儲存庫之外寫入依使用者區分的索引與本機目錄。review_gate 傳入 pr 時會透過 gh 操作 GitHub。設定 TYPESAFE_API_KEY 後,線上模式會把請求送往模型。本機閘門通過不代表自動核准合併,託管 CI、程式碼審查與人工發布決策仍各自獨立。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Solumbe,將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Desktop only,透過 STDIO。 STDIO 服務會啟動本機處理程序,因此需要 SourceWeft 桌面主機。

其他 MCP 客戶端

參照 儲存庫 中的啟動說明。

README

Solumbe

Models generate the change. Solumbe proves whether it is safe to merge.

Formerly Òtítọ́ (@bashbop/otito), renamed in 4.0.0; the CHANGELOG maps every old name to its new one.

[CI] [npm] [license: MIT] [node] [Listed on mcpservers.org] [Solumbe MCP server – quality and maintenance score on Glama]

[solumbe demo]

[Solumbe MCP server – quality and maintenance score on Glama]

Solumbe is a local-first, deterministic, model-agnostic trust layer for AI-assisted development. It builds task-aware repository context before an agent edits, scores how much a change actually touches, and gates merge readiness against the exact staged tree, with no server, no account, and no code leaving the machine.

It does not replace Claude Code, Codex, Cursor, Gemini, or any native agent harness. It runs beside them and keeps working as the models change underneath.

A passing local gate is never an automatic merge approval: hosted CI, GitHub review, CODEOWNERS, and the human release decision remain separate authorities.

Install

bash
npm install -g @bashbop/solumbesolumbe doctorsolumbe install --host all

The last command connects Solumbe's MCP server to every agent host it finds: Claude Code, Claude Desktop, Codex CLI, Cursor, VS Code, Gemini CLI and Kimi Code CLI. Add --dry-run to see the plan first, or name hosts with --host claude-code,cursor. Restart each host afterwards.

Or without installing: npx -y @bashbop/solumbe doctor.

What it does

Rank what a change actually touches, from the request alone, with no model, no embeddings, and no network:

console
$ solumbe impact . "add refund handling to checkout" --top 3
  concepts: money flow
   1.  src/payment/checkout.service.ts    score 155       |- role: required       |- path matches: checkout       |- symbol matches: checkout, refund       |- concept match: money flow (×1.4 + 6.0)       |- risk: money flow
   2.  src/payment/stripe.webhook.ts    score 6       |- role: advisory       |- concept match: money flow (×1.4 + 6.0)

Gate the exact staged tree, and say precisely why:

console
$ solumbe gate . --staged --base origin/main --request "add refund handling to checkout" --min-convergence 80
  [OK]    Changed files          1 changed file found.  [OK]    Staged snapshot        Changed-file scope and convergence evidence are captured from the exact staged Git tree.     |- Tree: 7d0b513dd256877d6bd309a6406468a9b1eaeedc     |- Base: b776f04fcfbd02c8ce8d63e1a0c2450be58de039  [OK]    Secret safety          No secret file paths and no credential values found in the changed content.  [WARN]  Risk review            Risk-sensitive files changed; maintainer review should be explicit.     |- src/payment/checkout.service.ts  [OK]    Convergence            Task and diff satisfy the convergence requirement.     |- Score: 100/100 (aligned)     |- Receipt handle: rcpt_a8d31efae06e     |- Subject tree: 7d0b513dd256877d6bd309a6406468a9b1eaeedc
  VERDICT  WARN

The convergence score is the part a model cannot grade for itself: it compares the stated intent against the files the diff actually changed, and produces a receipt bound to the exact base, parent, and staged-tree identity.

Hold the change to what was declared. Record the files a request is expected to touch before the edit, and the gate names any file that was never declared:

console
$ solumbe declare . "add refund handling to checkout"$ # ... the agent edits ...$ solumbe gate . --staged --base HEAD --intent .solumbe/intent.json
  [FAIL]  Scope contract         Touched `src/auth/session.ts`, which was never declared. Amend the intent with the reason it belongs (`solumbe amend <file> --reason "<why>"`), or take it out of the change.     |- Request: "add refund handling to checkout"     |- Contract: fe655c2af2b31b7e3edec6aedd248b379235811d1228c829f87ff73796ace487     |- Changed files: 3 (1 declared, 0 amended, 1 implied, 1 undeclared)     |- Implied: tests/checkout.service.test.ts (owner-test of src/payment/checkout.service.ts)     |- Undeclared on a risk-sensitive path: src/auth/session.ts [auth/security]

An amendment adds a file with its reason, hashed onto the contract, so a reviewer reads why the scope grew. Over MCP it is change_impact with declare: true, and review_gate with intent.

The core

Four commands are the product. They call no model, open no socket, and read nothing outside the repository.

StepCommandWhat it proves
Before the editsolumbe context "add refund handling" --path .Which files, tests and commands the request needs
After the editsolumbe converge . "add refund handling" --base origin/main --stagedHow far the diff is from the request, with a receipt
Before the mergesolumbe gate . --staged --base origin/main --request "add refund handling"PASS / WARN / FAIL on the exact staged tree
After the mergesolumbe attest . --verdict verdict.json --merge <sha>A hash-chained record of what shipped, under which verdict

solumbe help shows these and how to set up; solumbe help --all lists every command, including the ones that support them (impact, declare, pr, review, map, calibrate, route, ax, dashboard and the rest). Nothing was removed.

Nothing hosted is required, and nothing hosted can change a verdict. Local Core, Optional Hosted lists exactly what the optional pieces send, and where.

Supporting commands

GoalCommand
Rank change blast radiussolumbe impact . "add refund handling" --top 12
Score intent vs. executionsolumbe converge "add refunds" --path . --base HEAD --staged
Score a committed change exactlysolumbe converge "add refunds" --path . --base HEAD~1 --head HEAD
Gate a product change across repossolumbe workspace-gate ../web ../api --request "ship change"
Grade risk flags against historysolumbe calibrate . --window 30
Grade route tiers against historysolumbe regret . --window 30 --offline
Regrade a saved run, same answerssolumbe regret --rescore run.json
Score Agent Experiencesolumbe ax . "add a new MCP tool"
Recommend a model tiersolumbe route . "add a new MCP tool"
Sharpen context with a model readsolumbe context "add a new MCP tool" --path . --online
Inspect one reposolumbe repo . --json
Build a code mapsolumbe map . --json
Index and search local projectssolumbe index ~/projects --discover then solumbe search "events controller"
Generate an agent harnesssolumbe harness . --out .solumbe/harness.md
Run the MCP serversolumbe mcp

Every command takes --json, and solumbe help lists the full set with flags.

MCP

Solumbe ships a stdio MCP server exposing 14 tools: repo_inspect, repo_map, repo_index, repo_search, context_pack, change_impact, agent_experience, model_route, convergence_score, review_context, review_gate, review_verdict, workspace_report, and repo_harness.

json
{  "mcpServers": {    "solumbe": {      "command": "npx",      "args": ["-y", "@bashbop/solumbe", "mcp"]    }  }}

solumbe install --host all writes this entry for you, using absolute paths so hosts that do not inherit your shell PATH can still start it. Published in the MCP Registry as io.github.BASHBOP/solumbe. Repo-map lookups use an external per-user cache and never write into the inspected repository. Host-specific setup for Claude Code, Claude Desktop, Codex, Cursor, VS Code, Gemini CLI, and Kimi Code is in MCP and Agent Workflows.

How it compares

ApproachStrengthsWhere solumbe differs
Sourcegraph / Cody contextPowerful hosted code search and embedding-based context across an orgLocal-first and deterministic: no server, no account, no code leaves the machine, and the same query always yields the same packet
Hand-written CLAUDE.md / rules filesCurated, intent-rich guidanceHand-written context goes stale; solumbe regenerates context from the actual code (symbols, imports, routes, tests) on every run and complements a short CLAUDE.md
grep / ripgrepFast, universal text matchingsolumbe ranks whole files by task intent across paths, symbols, exports, and tests, then adds patterns and validation commands, producing a context packet rather than a list of matching lines

Documentation

Full command reference, agent workflows, release process, evaluation method, and the design theses behind the trust layer:

bashbop.github.io/solumbe

Contributing

bash
git clone https://github.com/BASHBOP/solumbe.gitcd solumbe && npm ci && npm run ci

npm run ci is the full gate: format, lint, typecheck, version check, tests, coverage floors (70% lines / 60% branches / 75% functions), three evaluation corpora, dependency audit, and a packaged-tarball smoke test. Run it before requesting review.

Start with CONTRIBUTING.md and the Code of Conduct. All changes need maintainer review; main requires passing gates and resolved conversations. Solumbe follows Semantic Versioning, so say whether a PR is no-impact, patch, minor, or major.


Part of the toolchain

solumbe is one of four tools that form a deterministic trust layer for AI-assisted development. Each uses static analysis to answer a question people keep handing to an LLM.

  • solumbe (this tool), for context: what does this change actually touch?
  • tieline, for contracts: did the front end and back end quietly stop agreeing?
  • bouncer, for compliance: could you defend this to Ofcom?
  • aiglare, for governance: where can the model do something you can't undo?

More at segunolumbe.com. static analysis, never the model.

來源:README.md,提交 02eaad0

工具

14

repo_inspect

Inspect Repository

Inspect repository shape, languages, package managers, script names, entrypoints, and git metadata. Returns up to 200 representative file paths; pass includeScripts:true to get full script command bodies instead of just names.

輸入參數pathincludeScripts

repo_map

Map Repository

Map a repository into a compact JSON code map, optionally narrowed by domain, file kind, or controller route. Pass domain to find files for a feature, kind to find files of a type (route, controller, service, apiClient, component, test), or route to match Nest controller routes by substring/regex.

輸入參數kindpathlimitroutedomainincludeFiles

repo_index

Index Repositories

Index local repositories: generate per-user external indexes and add them to the local catalog. Pass discover:true to find repository roots under the given paths first. Pass dryRun:true to discover and report without writing any indexes or catalog (read-only). Without dryRun this mutates the persistent local catalog, so it is not a pure read.

輸入參數pathdepthlimitpathsdryRuncatalogdiscover

context_pack

Context Pack

Generate a task-aware local context packet with primary files, related files, tests, and validation commands. Deterministic by default; online:true also asks a read model for the request's intent and which candidate files it needs, reported under modelRead.

輸入參數pathlimitpathsquery必填onlineincludeEvidenceincludeMarkdown

change_impact

Change Impact

Given a plain-English change request, rank the files most likely to own the change, with risk flags, suggested tests, and an implementation plan. Optional diff base surfaces exact changed-file evidence alongside the heuristic. When the repository's .solumberc.json lists companions, companions also carries the top few files each companion repository would own for the same request.

輸入參數toppathamendquery必填intentdeclarediffBaseincludeMarkdownincludeUntracked

agent_experience

Agent Experience (AX)

Score Agent Experience (AX): a single 0–100 number answering "how cheap and safe is it for an agent to make this change here?", blending Changeability (token cost), Containment (blast radius), Guardrails (tests / validation / CODEOWNERS / CI), and Clarity (task groundedness). Returns sub-scores, drivers, and concrete recommendations for raising AX.

輸入參數toppathquery必填includeMarkdown

model_route

Model Route

Recommend a model tier (cheap, mid or premium) for a coding request before any work starts. Combines solumbe's deterministic repository half (AX, containment, top-severity risk paths) with a System One model's calibrated read of the request (specificity, blast radius, novelty). The model is called only when TYPESAFE_API_KEY is set in this server's environment and offline is not true; otherwise the read is a labelled offline estimate, and model.source says which. Advisory: it recommends a tier and never feeds review_gate or review_verdict. Pass host to map the tier to that host's model id.

輸入參數tophostpathquery必填offlineincludeMarkdown

convergence_score

Convergence Score

Score convergence: a deterministic 0–100 measure of the distance between a stated task (intent) and the actual git diff (execution), with sub-scores for Coverage (did the intent happen?), Scope (did only the intent happen?), and Risk alignment (did unrequested drift land on risk-sensitive paths?). No model. A task that predicts no owner file is band inconclusive, with no score. Emits a recomputable receipt (a hash anyone can regenerate). Requires a base git ref to diff against; scores the working tree's tracked changes unless head or staged selects an exact subject.

輸入參數topbase必填headpathquery必填intentstagedincludeMarkdownincludeUntracked

review_gate

Review Gate

Gate a change for merge and return a PASS / WARN / FAIL verdict. Omit pr to run the local, no-GitHub gate against a base ref (changed files, secret safety, risk-sensitive paths, release discipline, validation commands, dependency audit, policy profile). Set pr to gate an open GitHub PR via `gh` (PR state, review decision, CODEOWNERS approvals, unresolved conversations, branch protection, status checks). A check the mode cannot evaluate is SKIPPED and never changes the verdict. Use review_verdict instead when you want the full impact + review + gate composite, or review_context when you want diff/comment context with no verdict.

輸入參數prbaseheadpathintentpolicystagedreceiptrequestgovernanceminConvergence

review_verdict

Review Verdict

Run the full review pipeline in one shot: change_impact plus review_context plus review_gate, returning a unified verdict with a derived confidence score. When the repository's .solumberc.json lists companions and a request is given, impactSummary.companions names the top few files each companion repository would own for that request. Use review_verdict when you want the complete picture of a change in a single call. Use review_context instead for diff metadata only (no verdict), or review_gate for the gate verdict alone.

輸入參數prbaseheadpathintentpolicyreceiptrequestimpactTopgovernanceminConvergence

workspace_report

Workspace Report

Generate a product-level report across multiple related repositories.

輸入參數paths必填includeMarkdown

review_context

Review Context

Produce PR review context from local git diff metadata, optionally enriched with GitHub PR comments. Use review_context when you want the raw diff/comment context for a change, not a verdict. Use review_verdict instead for the full impact + review + gate composite, or review_gate for the gate verdict alone.

輸入參數baseheadpathgithubnumbercommentincludeMarkdown

repo_harness

Repository Harness

Generate setup, validation, runtime, and context commands for an agent or CI harness.

輸入參數pathincludeMarkdown

版本歷史

13
  1. v4.10.0最新Nov 1, 2026
  2. v4.9.0Oct 29, 2026
  3. v4.8.0Oct 23, 2026
  4. v4.7.2Oct 19, 2026
  5. v4.7.1Oct 18, 2026
  6. v4.6.0Oct 18, 2026
  7. v4.5.0Oct 11, 2026
  8. v4.4.0Oct 10, 2026
  9. v4.3.0Oct 10, 2026
  10. v4.2.1Oct 6, 2026
  11. v4.2.0Oct 4, 2026
  12. v4.1.0Oct 1, 2026
  13. v4.0.0Sep 30, 2026

評分

已滿足適用檢查項的 90%

該評分衡量此收錄條目的完整程度,依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價,也不表示伺服器安全或目前可用:可連通性是帶日期的檢查結果,評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通25 分
  • 已宣告認證方式10 分

    請在註冊中心條目中宣告憑證請求標頭,或保持端點能夠回應探測,以便判定其認證方式。

  • 已列出工具必需15 分
  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分