Repository audit & repair · MCP
One endpoint. Connect the chatbot you already use — Claude, ChatGPT, Cursor, Codex — and it can survey any repository, repair what the survey finds, and harvest the whole tree into a sealed capability ledger. This server does the mechanical work and hands back the method, so the only model in the loop is the one you are already talking to.
Presented by my AI Founder Twin · Written & approved by Kenneth E. Sweet Jr.
1 · Add the endpoint
https://shpbl.com/mcp
This door speaks OAuth. Your client registers itself, opens a sign-in page, and you approve it once — no key is ever typed into a client or a prompt.
2 · Sign in and bind your key once
Signing in proves who you are; it does not prove what you bought. Bind your subscription key to your account at your account and every agent you connect afterwards carries your tier automatically. Stage one needs none of this — the free tools answer any caller.
3 · Client cannot sign in? Use the key-only door
https://shpbl.com/api/public/mcp
Authentication None, transport Streamable HTTP, plus one request header: Authorization: Bearer shpbl_mcp_YOUR_KEY. Same 17 tools. If your client cannot send headers either, pass the key as the tool's optional key argument.
Is it working?
Paste your key once. This page checks it exactly as the tools do and answers in one line: tier, status, calls used this month, and whether pull requests are switched on.
The free lane evaluates the repository and stops at the composition boundary: neither library is searched, so no candidates or architecture come back. It does not run the full gauntlet. Practitioner at $39 a month runs that governed sequence — both libraries read to your agent as cited rows, new capability composed and verified, and the report, diffs and harvested capabilities written into your own repository as a pull request.
What you keep, you can reuse. Every kept run leaves an index at .shpbl/README.md in your own repository. Tell your agent to read it and pass those lines back as own_library on the next run, and the audit checks your own capabilities before citing anything else — so you never harvest the same thing twice. Those entries are read for that one call and never stored by us.
Source rules are simple: harvest from public repositories that carry a proper open-source license, from your own repositories, or from private repositories you have access to. The server never reads a repo you have no right to read, and it never absorbs customer harvests into the public library.
Ten meta-capabilities
These are our engines, not yours to find. They live privately inside the SHPBL MCP tree and they govern how a run is conducted — what it attends to, what it carries between steps, how it recovers, what it may touch and what it may spend. Every run states the rules they impose and holds them for the whole run. They are never harvested, never cited as prior art, and never counted as a capability found in your code.
MENGINE-CREATIVE-FORGE
Creative Forge
generative synthesis and pattern evolution
MENGINE-WORLD-FIRST-COGNITIVE
World-First Cognitive
attention, memory, intent and DREAM-style evolution in one cognitive layer
MENGINE-DEEP-COGNITION-NEXUS
Deep Cognition Nexus
deep reasoning, dialogue understanding, observability and debt analysis
MENGINE-KNOWLEDGE-NEXUS
Knowledge Nexus
graph, context and retrieval-based knowledge management
MENGINE-MEMORY-INTELLIGENCE-FABRIC
Memory Intelligence Fabric
tiered memory, salience scoring and memory-aware reasoning
MENGINE-INTELLIGENCE-PIPELINE
Intelligence Pipeline
synthesis, insight and prediction into actionable intelligence
MENGINE-QUALITY-FABRIC
Quality Fabric
continuous quality, compliance, audit and traceability
MENGINE-RESILIENCE-SHIELD
Resilience Shield
rollback, policy access, prompt safety and operational resilience
MENGINE-SECURITY-FORTRESS
Security Fortress
zero-trust security, threat defense and compliance posture
MENGINE-RESOURCE-GOVERNOR
Resource Governor
budget, quota, entitlement and spend control
The procedure is law
A capable model handed a good method will improvise a faster-looking shortcut: run the whole thing in one turn, merge three steps into one, infer a finding it never read. Every one of those produces a report that looks complete and isn’t. So the server enforces the run rather than requesting it.
One step per turn
Your agent calls a step, does it, tells you one plain line, then calls the next. Never two at once, never the whole gauntlet in one go.
No inference
If the supplied material doesn't answer something, it writes “not present”. No finding without a path.
Order enforced, not asked
From step 2 on, the call is refused without the ledger from the step before it — a skipped step can't be hidden.
You approve every stretch
Every 3 harvest steps the run pauses until your agent has reported back and you've said keep going.
Moderate steps
Each step is sized to about 45,000 characters, so a run stays readable and the cost stays visible.
One legal deviation
Only a collision with a stated guideline — a hands-off path, a licence boundary. Then it stops, says which step and which rule, and waits for you.
One run, start to finish
Point at a repo
Tell the chatbot you already use to audit a GitHub repository — or POST the same tool from a script. Nothing to install.
All three deliveries
Read it blind
The repository is surveyed as it actually is before any suggestion is made — files, languages, spine files, risk signals.
All three deliveries
Audit
What exists, what works, what hurts, and what must be left exactly as it is.
All three deliveries
Repair and harvest
A ranked repair order with diffs and guards, plus the capabilities your repository already contains, named and classed into a sealed ledger.
All three deliveries
The composition boundary
A free run establishes that new capability could be composed here — then stops, before either library is searched. No candidates, no library rows, no architecture.
Free stops here
Compose, then keep it
Practitioner continues: both libraries searched, candidates evaluated, new capability composed and verified, then landed in your own repository as a pull request.
$39/mo, 7 free days
Nothing is written before the verdict, and nothing leaves the ring before the gate. A run that ends with “this already works” has still completed the circle.
Who owns which stage
Every colour on this site is one of the six lit facets of the mark, and each facet owns one concern of the run. Nothing is tinted for variety.
Stage One
Evaluate
Free · no key needed
evaluate_repo
The repository as it actually is: file and byte counts, language spread, spine files, tree-born risk signals, opening library matches and the ten meta-capability run rules that bind the run. Then the evaluation protocol your agent carries out. Works on public repositories with proper licensing, your own repos, and private repos you have access to.
Stage Two
Fix
Included in the free evaluation
fix_repo
A repair order for the files you name, ranked by what fails silently first, with own-library reuse, the meta-capability run rules, unified diffs, the guard that should catch each fault next time, and what was left alone and why. Your agent writes the repairs; you approve every change.
Stage Three
Harvest
Included in the free evaluation
harvest_repo
The shortcut straight to the capabilities: point it at a repository you hold a reuse licence to, and it reads what that repository can already do, fuses those affordances with the owned SHPBL capability library, then names ranked proposals a person can read. You decide on each one; only the ones you approve are emitted as seed modules into your own .shpbl library. It never writes to the target repository.
Stage All of it
Run the gauntlet
$39/mo Practitioner · first 7 days free
run_gauntlet
The full governed sequence: survey, own-library and catalog comparison, evaluation, repair, batched harvest, closing comparison, composition, verification, branded HTML report and pull-request delivery. One call to plan it, one call per step to walk it.
Replace OWNER/REPO with the repository, or ask your agent to call list_repos and pick from the list. Paid stages page their material: tell your agent to walk every part before it concludes.
A repository is not only source. It is also the wiring your own tools read — your Lovable project, your Cursor or Claude workspace, your package manager, your host’s build. A change that looks obviously right in a diff can take a running app down the moment it is merged, and the diff will not show it.
So the method draws a hard line rather than a preference. These are read, quoted and written about, and never edited, renamed or deleted by a run:
The write-back tool refuses those paths outright — every tier, no override. When a real finding lives behind one, your agent is instructed to hand it to you as advice instead: the file, the finding, the change it would make and what it would affect, for you or your own agent to decide.
Every fact on this page is published in one machine-readable file. Paste this to your assistant and it connects itself:
Read https://shpbl.com/llms.txt and connect to the SHPBL MCP server described in it, then explain in plain language what it can do for me.
Once it is connected, its first call is welcome — free, no key — which hands it the greeting, the whole tool menu and the sentences you can say. You can read the same thing yourself in the user's manual.
Claude.ai (web or mobile)
Settings → Connectors → Add custom connector
Sign-in door (recommended)
URL https://shpbl.com/mcp
Auth OAuth — Claude registers itself and asks you to sign in
Key-only door
URL https://shpbl.com/api/public/mcp
Auth None
Transport Streamable HTTP (under Advanced)
Under “Request headers” press Add header:
Header name Authorization
Value Bearer shpbl_mcp_YOUR_KEYClaude Desktop / Claude Code
Settings → Connectors, or claude_desktop_config.json
{
"mcpServers": {
"shpbl": {
"url": "https://shpbl.com/api/public/mcp",
"headers": { "Authorization": "Bearer shpbl_mcp_YOUR_KEY" }
}
}
}ChatGPT
Settings → Apps & Connectors → Advanced → Developer mode (on), then Create connector
Name SHPBL Description Governed repository audit and capability harvest MCP server https://shpbl.com/mcp Auth OAuth Then press Create and Connect — ChatGPT registers itself, you sign in once, approve, and the seventeen tools appear. Turn the connector on in the composer (＋ → Apps) before you ask. Client cannot sign in? Use the key-only door: URL: https://shpbl.com/api/public/mcp Auth: none (No authentication) Header: Authorization: Bearer shpbl_mcp_YOUR_KEY
Cursor
.cursor/mcp.json in your project, or Settings → MCP
{
"mcpServers": {
"shpbl": {
"url": "https://shpbl.com/api/public/mcp",
"headers": { "Authorization": "Bearer shpbl_mcp_YOUR_KEY" }
}
}
}Codex / any MCP client
Add a remote server of transport type “streamable HTTP”
url = "https://shpbl.com/mcp" # OAuth
transport = "http"
# or the key-only door:
# url = "https://shpbl.com/api/public/mcp"
# headers = { Authorization = "Bearer shpbl_mcp_YOUR_KEY" }Evaluate · Free · no key needed
“Use the SHPBL MCP server to evaluate github.com/OWNER/REPO, then follow the protocol it returns. Hold the ten meta-capability run rules and use public repositories with proper licensing, my own repos, or private repos I have access to.”
Fix · Included in the free evaluation
“Use the SHPBL MCP server's fix_repo to repair the findings in github.com/OWNER/REPO. My key is set as a request header, so call it without a key argument. Check my own .shpbl library first, keep holding the ten meta-capability run rules, walk every part, then give me the repair order, the diffs and the guards.”
Harvest · Included in the free evaluation
“Use the SHPBL MCP server's harvest_repo on github.com/OWNER/REPO. My key is set as a request header, so call it without a key argument. Show me the ranked capability proposals with the host evidence each one mounts on, and wait for my decision before building anything.”
Run the gauntlet · $39/mo Practitioner · first 7 days free
“Use the SHPBL MCP server's run_gauntlet on github.com/OWNER/REPO. My key is set as a request header, so call it without a key argument. Start with no step to get the run card, read my .shpbl library if present, state the ten meta-capability run rules, walk every step in order, then close the run and give me the HTML report.”
Try · Try
Free
No key required
The diagnosis, run for real, free: audit, every capability found in your repository, the full benchmark, the ordered repair plan, and the harvest walked batch by batch into a sealed ledger. It stops at the composition boundary: neither library is searched, so no candidates, library rows, parents or proposed architecture are returned, and nothing is retained. No key, no card over MCP or the API.
Practitioner · Borrow
$39/mo
100,000 calls / month
Borrow the library: the library read as cited rows, and every run kept — written back into your own repository as a pull request, exported, sealed. What a run produces is yours outright.
On a paid key, install the official SHPBL GitHub App on the repositories you choose and the tools can open pull requests instead of handing you text to copy. Nothing is ever pushed to your default branch.
Paste your key in the field above first.
github_token on the call instead — used once, never stored — or simply hand you the diffs.