Read-only artifact queries for AI assistants: wiring AngusRepo MCP
A coding agent that asks “which repo holds this coordinate, and what are the dependency and vulnerability counts?” does not need mvn / npm / docker stuffed into the model context. AngusRepo exposes that as an in-process MCP read-only endpoint : the host connects, calls named tools, and the server loops back to this process’s management API for metadata projections. Takeaway: Repo MCP is read-only…
The AngusRepo MCP is a read-only interface for AI assistants to interact with repository metadata. It exposes eight tools prefixed with "repo_," and does not support any write operations or protocol paths like /maven, /npm, or /v2. The repository must be accessed using a PAT (Personal Access Token), not a deploy token, as deploy tokens receive a 401 error.
The MCP operates as an in-process endpoint with loopback, and does not proxy protocol paths or download binaries. It provides cache consistency through a five-question pattern that agents use to locate, inspect, and examine artifacts, dependencies, vulnerabilities, and security scores. There are no write tools, and the MCP does not support actions like upload, delete, publish, download, or trigger scans.
The eight tools include repo_find_artifact, repo_locate_version, repo_inspect_dependencies, repo_list_repositories, repo_client_setup, repo_artifact_security, repo_repository_score, and repo_cleanup_preview. The authentication is based on the PAT, and the host wiring involves setting up the token in an environment variable. The MCP tools return projections that omit sensitive data like checksums and full license text to prevent misuse.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
