Bring evidence
to your tools.

01 / CONNECT

One local adapter. Your own session.

Download and extract the archive, then install its integrity-pinned dependencies. No package hooks, API key or paid model is required.

tar -xzf repoproof-mcp-0.3.0.tgz
cd repoproof-mcp
npm ci --ignore-scripts --no-audit --no-fund

Add this configuration to a trusted MCP host that supports local stdio. Replace the example path with the folder you extracted.

{
  "mcpServers": {
    "repoproof": {
      "command": "node",
      "args": ["/absolute/path/repoproof-mcp/src/stdio.mjs"]
    }
  }
}

Execution starts disabled. The adapter exposes no local files or arbitrary website access. It connects only to RepoProof’s existing public tenant API.

02 / REVIEW & APPROVE

Inspection is never permission to run.

Use repoproof_inspect with a public GitHub URL and optional full commit SHA. Review repoproof_plan: the pinned revision, environment, exact commands and unsupported stages.

To permit execution, the operator adds this field beside command and args in the MCP configuration:

"env": { "REPOPROOF_MCP_ALLOW_EXECUTION": "1" }

repoproof_request_execution asks your MCP host to display a fresh human confirmation form for that exact plan. Declined, changed, expired or unsupported confirmations fail closed. A tool argument cannot supply approval.

Trust your MCP host to present the form honestly. Elicitation is not cryptographic proof of human presence; do not enable automatic acceptance.

Try the complete MCP flow in a terminal

node examples/mcp-workflow.mjs \
  https://github.com/owner/repo FULL_COMMIT_SHA --run

This actual MCP client shows the plan and asks you to type RUN <full SHA> <plan digest>. It refuses piped acceptance. Omit --run to inspect only.

03 / READ THE EVIDENCE

Keep the outcome attached to its proof.

Follow-up questions use the same stored-evidence answer engine on web, private Telegram and API/MCP. Ask about tests, failures, dependencies, coverage or a pinned commit. Each accepted command answer carries its exact argv, exit and output hash; provisional/simulated or altered output cannot become proof. No question triggers a run or acquires another source. Receipt web links require the owning web session; they do not transfer a Telegram/MCP identity.

Claim mappings are your interpretations. Supported or contradicted command criteria do not establish the broader quotation, test quality or a product-wide verdict. Changed tests, environments or incomplete receipts make outcome comparisons incomparable. These tools read stored evidence; they do not acquire source, persist mappings or approve execution.

Resources: repoproof://policy and repoproof://runs/{runId}. The adapter supports the 2025-11-25 and 2026-07-28 protocol flows.

Provisional progress, real sandbox evidence, explicit simulations, blocked checks and untested behavior remain distinct. Repository text and output are untrusted data. A passing metadata check is not a project-wide verdict.

04 / USE REST

The same engine, without an MCP host.

The OpenAPI schema documents the existing visitor endpoints. Open a session, inspect source, review the plan, then submit only its actual human-approved digest with a stable UUID request ID.

import {RepoProofClient} from './src/rest-client.mjs';

const api = new RepoProofClient();
const plan = await api.inspect('https://github.com/owner/repo');
const exactPlan = await api.inspection(plan.id);
// Show the full plan to the human before any execution.

examples/rest-workflow.mjs offers a separate interactive REST workflow. It also requires exact human confirmation for --run. Q&A and artifact helpers read an owned report; they do not call an undisclosed model or endpoint.

On an uncertain request, reconcile the same request ID. Never invent a new approval, silently replace the visitor session or retry a mutating request automatically.

05 / SESSIONS & LIMITS

Private evidence. Shared, bounded capacity.

A 24-hour visitor cookie stays in the adapter’s memory. It is never returned to the model or written to disk. Restarting the adapter loses that identity and access to its earlier private reports. Web and Telegram identities are separate. A report ID alone grants no access.

All channels use the same limits: three inspections/hour per visitor, twelve globally; three run attempts/day per visitor, twenty-four globally; one active job per visitor and one leased job globally. Session churn cannot bypass global budgets. Read repoproof_session for current limits and availability.

Guest checks retain ½ CPU, 256 MiB RAM, 64 tasks, 15 seconds/check, 48 KiB output and networking off. Initial source limits remain 64 files / 256 KiB. Unsupported dependencies and stages stay blocked or not tested. Existing storage caps remain enforced.

No admin key, OAuth grant, persistent credential, account creation, paid inference or hosted MCP listener is part of this setup. Dependency versions, integrity hashes and third-party notices are included in the source archive; dependencies are installed separately from npm.