dev.agnes/agnesv1.0.0 Domain verified
Health scores for your team's frontend repos: findings, the fixes worth most points, and SBOMs.
Maintained by@Agnes-HQ(verified)Also a maintainer?
Try it
Call this server's tools from your browser. Nothing to install.
https://app.agnes.dev/api/mcp
"Bearer " plus an API token from Agnes (Settings → API and agents)
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
get_findings Read-only
A project's findings, most severe first, 50 per page, with file, line, message and a documentation link where there is one. Filter by rule, category, severity or file (or folder).
The project: its id from list_projects, or "owner/repo", or "owner/repo@branch" when the repository has several branches as projects
A file path, or a folder such as src/components
A specific run's id; leave out for the latest successful analysis
Only this rule, as rank_fixes names it
Install
Pick your client. Values in capitals, like YOUR_TOKEN, are yours to fill in.
One click: Add to Cursor Add to VS Code Add to LM StudioThen replace the YOUR_ values and {placeholders} with your own.
Run in a terminal
claude mcp add --transport http agnes https://app.agnes.dev/api/mcp \ --header 'Authorization: Bearer YOUR_TOKEN'
Headers
Authorization(required): "Bearer " plus an API token from Agnes (Settings → API and agents)
Tools (6)
get_findingsA project's findings, most severe first, 50 per page, with file, line, message and a documentation link where there is one. Filter by rule, category, severity or file (or folder).
read-only
get_findings
A project's findings, most severe first, 50 per page, with file, line, message and a documentation link where there is one. Filter by rule, category, severity or file (or folder).
| Argument | Type | Description |
|---|---|---|
| file | string | A file path, or a folder such as src/components |
| page | integer | |
| runId | string | A specific run's id; leave out for the latest successful analysis |
| ruleId | string | Only this rule, as rank_fixes names it |
| project* | string | The project: its id from list_projects, or "owner/repo", or "owner/repo@branch" when the repository has several branches as projects |
| category | string | |
| severity | string |
Input schema (JSON)
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"project"
],
"properties": {
"file": {
"type": "string",
"maxLength": 500,
"description": "A file path, or a folder such as src/components"
},
"page": {
"type": "integer",
"default": 1,
"maximum": 9007199254740991,
"minimum": 1
},
"runId": {
"type": "string",
"format": "uuid",
"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$",
"description": "A specific run's id; leave out for the latest successful analysis"
},
"ruleId": {
"type": "string",
"maxLength": 200,
"description": "Only this rule, as rank_fixes names it"
},
"project": {
"type": "string",
"maxLength": 300,
"minLength": 1,
"description": "The project: its id from list_projects, or \"owner/repo\", or \"owner/repo@branch\" when the repository has several branches as projects"
},
"category": {
"enum": [
"smells",
"dependencies",
"security",
"duplication",
"tests",
"accessibility"
],
"type": "string"
},
"severity": {
"enum": [
"error",
"warning",
"info"
],
"type": "string"
}
}
}get_reportThe overall score, the score per category, the findings per category and severity, and which checks did not run, for a project's latest successful analysis.
read-only
get_report
The overall score, the score per category, the findings per category and severity, and which checks did not run, for a project's latest successful analysis.
| Argument | Type | Description |
|---|---|---|
| runId | string | A specific run's id; leave out for the latest successful analysis |
| project* | string | The project: its id from list_projects, or "owner/repo", or "owner/repo@branch" when the repository has several branches as projects |
Input schema (JSON)
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"project"
],
"properties": {
"runId": {
"type": "string",
"format": "uuid",
"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$",
"description": "A specific run's id; leave out for the latest successful analysis"
},
"project": {
"type": "string",
"maxLength": 300,
"minLength": 1,
"description": "The project: its id from list_projects, or \"owner/repo\", or \"owner/repo@branch\" when the repository has several branches as projects"
}
}
}get_sbomThe software bill of materials of a project's latest successful analysis (or the given run) as CycloneDX 1.6 JSON: every installed package with its purl, licence where known and dependencies, and the known vulnerabilities that affect them. Large for big projects; save it to a file rather than reading it all.
read-only
get_sbom
The software bill of materials of a project's latest successful analysis (or the given run) as CycloneDX 1.6 JSON: every installed package with its purl, licence where known and dependencies, and the known vulnerabilities that affect them. Large for big projects; save it to a file rather than reading it all.
| Argument | Type | Description |
|---|---|---|
| runId | string | A specific run's id; leave out for the latest successful analysis |
| project* | string | The project: its id from list_projects, or "owner/repo", or "owner/repo@branch" when the repository has several branches as projects |
Input schema (JSON)
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"project"
],
"properties": {
"runId": {
"type": "string",
"format": "uuid",
"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$",
"description": "A specific run's id; leave out for the latest successful analysis"
},
"project": {
"type": "string",
"maxLength": 300,
"minLength": 1,
"description": "The project: its id from list_projects, or \"owner/repo\", or \"owner/repo@branch\" when the repository has several branches as projects"
}
}
}get_scoringHow Agnes turns findings into scores: the categories, their weights in the overall score, and how severity, confidence and codebase size count.
read-only
get_scoring
How Agnes turns findings into scores: the categories, their weights in the overall score, and how severity, confidence and codebase size count.
No arguments.
Input schema (JSON)
{
"type": "object",
"properties": {}
}list_projectsThe projects of your team: each repository branch Agnes analyses, with its latest score.
read-only
list_projects
The projects of your team: each repository branch Agnes analyses, with its latest score.
No arguments.
Input schema (JSON)
{
"type": "object",
"properties": {}
}rank_fixesThe rules whose findings cost the project the most points. Each entry says how many points the overall score and its category would gain if every finding of that rule were fixed (the report rescored without them), with one example finding.
read-only
rank_fixes
The rules whose findings cost the project the most points. Each entry says how many points the overall score and its category would gain if every finding of that rule were fixed (the report rescored without them), with one example finding.
| Argument | Type | Description |
|---|---|---|
| limit | integer | How many rules to return |
| runId | string | A specific run's id; leave out for the latest successful analysis |
| project* | string | The project: its id from list_projects, or "owner/repo", or "owner/repo@branch" when the repository has several branches as projects |
Input schema (JSON)
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"project"
],
"properties": {
"limit": {
"type": "integer",
"default": 20,
"maximum": 50,
"minimum": 1,
"description": "How many rules to return"
},
"runId": {
"type": "string",
"format": "uuid",
"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$",
"description": "A specific run's id; leave out for the latest successful analysis"
},
"project": {
"type": "string",
"maxLength": 300,
"minLength": 1,
"description": "The project: its id from list_projects, or \"owner/repo\", or \"owner/repo@branch\" when the repository has several branches as projects"
}
}
}Security checkA100/100
We read every tool's name, description and inputs the way the model will, looking for instructions hidden from you. A clean result means no warning signs, not a guarantee. Scanned Nov 12, 2026.
- Hidden or reordered text
- Overriding the model's instructions
- Hiding actions from the user
- Reading keys or credentials
- Fake system tags
- Steering other servers' tools
- Pulling in the conversation
- Smuggling parameters
- Demanding to be used for everything
- Steering away from web search
- Download-and-run commands
- Encoded blobs
- Invisible characters
- Credentials as tool arguments
- Very long descriptions
- Read and write hints