Tool reference · open
evaluate_repo
Audit a repository
Audit any GitHub repository and get back one complete result: a report (inventory, languages, spine files, risk signals), the capabilities found in it (name, signature, file and line, stated contract, dependencies), and how it stands against SHPBL's anonymous corpus of audited repositories. Works with no key: every caller gets the whole diagnosis of their own repository. A free run stops at the composition boundary — neither library is searched, so no library rows, candidates, parents or proposed architecture are returned — and nothing is retained (no pull request, no export, no recorded run). A Practitioner key (7-day free trial) continues past that boundary: both libraries searched, candidates identified and composed, and the result written back to your own repository. Whatever a run finds is yours. Follow with `fix_repo` for verbatim source and diffs, `harvest_repo` for the whole tree.
Call it
curl -X POST https://shpbl.com/api/public/v1/tools/evaluate_repo \
-H 'content-type: application/json' \
-H 'authorization: Bearer shpbl_mcp_…' \
-d '{}'Same handler over MCP. The free lane needs no key; a Practitioner key is what keeps a run.
Required arguments
repo
A GitHub repository: `owner/repo`, a github.com URL, or `owner/repo#branch`.
Optional arguments
key
Your SHPBL key (shpbl_mcp_…), if you have one. Optional — without it the audit runs at the free depth. Also read from the `Authorization: Bearer …` header.
github_token
Optional GitHub token (Contents: read) for a private repository. Not needed if the owner connected the SHPBL GitHub App to this key at https://shpbl.com/mcp-access.
brief
Default true: keep the audit compact and do not include the full method protocol. Set false to include the protocol block.
protocol_ack
Set true to say you already hold the SHPBL protocol. The discipline, the ten meta capabilities, the hands-off list and the return shape are then not reprinted even when `brief: false` — they are unchanged and they still bind the run.
as_free
Run at the free depth even when the key carries a paid tier, so you can see exactly what a caller without a subscription is handed. Costs no allowance and changes nothing else about the audit.
own_library
Your own previously harvested capabilities, read out of your repository's `.shpbl/` library and passed back in. Optional. When present, this run checks your concerns against your own library first and tells you which ones you already solved. It is held in memory for this call only — never stored, never added to SHPBL's library.
sections
Which sections to print, when you only need some of them. Omit it and the whole audit comes back, which is the right default on a first call. On a follow-up — re-reading the capability list after a repair, or checking the benchmark alone — name just what you need (for example `["capabilities"]`) rather than re-sending the whole audit into the conversation. Nothing is computed differently and nothing costs less; only the printed result is narrower, and the machine-readable payload is unchanged.