
Security News
GitHub to Block pull_request_target Workflows by Default Starting December 2
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.
@truealter/mcp-alter-collective
Advanced tools
Alter (collective) MCP server - ALTER's own organisational intelligence layer. 15 MCP tools spanning briefs, signals, decisions, drafts, escalations, metrics, roster, config, ingest, compliance, dev-state, mcp-readiness, token-usage, absence-brief, and pr
The Alter (collective) MCP server. Organisational intelligence layer for ALTER and any organisation running an Alter (collective) instance.
Part of the ALTER identity protocol.
A Model Context Protocol server exposing tools for organisational state. State lives in files (or proxies to a remote Alter (collective) instance); tools surface it to agents and editors that speak MCP.
The current tool surface is 15 tools:
alter_brief - generate morning/weekly/monthly briefalter_signals - list/get signals (filtered)alter_decisions - search and read the Strategic Decisions Registeralter_drafts - list/get/approve/reject draft responsesalter_metrics - agent health metricsalter_roster - list active agents and trust tiersalter_config - get/set routing rules and thresholdsalter_ingest - ingest a new signal from any adapteralter_compliance - compliance and legal-doc statusalter_dev_state - shipped vs not-wired vs not-built code statealter_mcp_readiness - eight-milestone launch readiness viewalter_token_usage - model token spend by principal and windowalter_absence_brief - standup-as-category deep-dive for an absent principalalter_escalations - get urgent items requiring human attentionalter_roster_principals - list principal ~handle identities (HTTP mode only)The intended path is via the alter CLI:
npm i -g @truealter/cli
alter login
alter pair org-alter
The CLI runs the server under the correct cap-token and identity binding, so each principal sees the surface their ~handle is authorised to see.
Direct npx invocation is supported for advanced agents:
npx @truealter/mcp-alter-collective
Direct invocation requires environment configuration. See MIGRATION.md for the full env-var reference.
local - file-based state from ${ALTER_DATA_DIR} (default).http - proxy to a remote Alter (collective) instance via cap-token.Mode is selected with ORG_ALTER_HTTP_MODE.
Apache-2.0. See LICENSE.
FAQs
Alter (collective) MCP server - ALTER's own organisational intelligence layer. 15 MCP tools spanning briefs, signals, decisions, drafts, escalations, metrics, roster, config, ingest, compliance, dev-state, mcp-readiness, token-usage, absence-brief, and pr
We found that @truealter/mcp-alter-collective demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.

Security News
/Application Security
A practical guide to securing GitHub Actions against supply chain attacks, covering malicious pull requests, credential theft, dependency risks, and release pipelines.

Security News
Composer 2.11 adds dependency cooldowns, joining package managers that delay new releases to reduce supply chain risks while allowing urgent security updates.