
Security News
Lovable’s OJ Rewrites Vite’s Dev Server in Rust as AI Lowers the Cost of Forking Open Source
Lovable’s OJ rewrites Vite’s dev server in Rust, reducing memory use and preview times as AI lowers the cost of open source reimplementation.
@thedhruv07/github-repo-mcp
Advanced tools
MCP server exposing repo health, commit summaries, good-first-issue triage, and RAG-based Q&A over any public GitHub repository.
An MCP (Model Context Protocol) server that lets any AI agent — Claude Desktop, Claude Code, Cursor — reason about a public GitHub repository directly, instead of the human manually reading READMEs, commit logs, and issue trackers.
Evaluating an unfamiliar repo ("is this actively maintained? is this issue actually beginner-friendly? what changed recently?") is repetitive manual work every developer does. This server turns that into four callable tools any MCP-compatible agent can use.
| Tool | What it does |
|---|---|
get_repo_health | Deterministic 0–100 health score from commit recency, issue-triage ratio, and contributor count. Flags archived repos immediately. |
summarize_recent_commits | Groups commits from the last N days by type (feature/fix/docs/refactor/chore) for a quick "what changed" view. |
find_good_first_issues | Finds beginner-labeled issues, scores each for genuine clarity, and flags ones that look mislabeled (e.g. touches core architecture despite the "good first issue" tag). |
ask_repo | Free-text Q&A over README + docs/*.md + top issue threads via embeddings-based semantic search (Voyage AI + Qdrant cosine similarity). |
npm install
cp .env.example .env
# Add a GitHub personal access token to .env — raises the rate limit from 60/hr to 5000/hr.
# No special scopes needed for public repo data: https://github.com/settings/tokens
#
# ask_repo also needs, both free tier:
# VOYAGE_API_KEY — https://dashboard.voyageai.com/ (API Keys -> Create new key)
# QDRANT_URL, QDRANT_API_KEY — https://cloud.qdrant.io/ (create a free cluster)
npm run build
Add this to your Claude Desktop MCP config (claude_desktop_config.json):
{
"mcpServers": {
"github-repo-mcp": {
"command": "node",
"args": ["/absolute/path/to/github-repo-mcp/build/index.js"],
"env": { "GITHUB_TOKEN": "your_token_here" }
}
}
}
Restart Claude Desktop, then try: "Use github-repo-mcp to check the health of facebook/react and find me a good first issue."
get_repo_health's score is a fixed
formula (recency + issue triage + contributor diversity), not an LLM guess. This keeps
the number reproducible; an LLM (in the calling agent) can narrate why on top of it.find_good_first_issues — real "good first issue" labels are
often wrong. The tool checks body length, red-flag keywords (architecture, migration,
security), and comment count to catch issues that are mislabeled, not just present them
at face value.See docs/demo.md for a real (not mocked) protocol exchange against
facebook/react, including the embeddings-based ask_repo retrieving the correct
answer for a query that shares no words with the source text.
ask_repo retrieval worksask_repo started as keyword-window retrieval over the README (see git history) and
was upgraded to embeddings-based RAG, implemented in src/rag.ts:
docs/*.md (top-level, cap 15 files) +
top 8 most-discussed issue threads (title + body, ~500-word chunks, 50-word overlap)voyage-3.5-lite)repo_<owner>_<name>)points_count) — only the query itself gets embeddedWhy embeddings over keyword matching: keyword overlap requires literal shared words — "how do I install React?" and a README section titled "Getting Started" share zero words and would never match. Embeddings place semantically similar text near each other in vector space regardless of exact wording, so retrieval survives paraphrasing and synonyms — the actual failure mode keyword search hits in practice.
Known simplifications (marked ponytail: in src/rag.ts), each with a stated
upgrade path:
/issues/{n}/comments if answers need to reflect
resolution discussion, not just the original report.pushed_at check against the stored index if content goes stale.MIT
FAQs
MCP server exposing repo health, commit summaries, good-first-issue triage, and RAG-based Q&A over any public GitHub repository.
The npm package @thedhruv07/github-repo-mcp receives a total of 143 weekly downloads. As such, @thedhruv07/github-repo-mcp popularity was classified as not popular.
We found that @thedhruv07/github-repo-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Lovable’s OJ rewrites Vite’s dev server in Rust, reducing memory use and preview times as AI lowers the cost of open source reimplementation.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.