Read-only artifact queries for AI assistants: wiring AngusRepo MCP
A coding agent that asks “which repo holds this coordinate, and what are the dependency and vulnerability counts?” does not need mvn / npm / docker stuffed into the model context. AngusRepo exposes that as an in-process MCP read-only endpoint : the host connects, calls named tools, and the server l
Posted on Oct 19 • Originally published at anguskit.com
A coding agent that asks “which repo holds this coordinate, and what are the dependency and vulnerability counts?” does not need mvn / npm / docker stuffed into the model context. AngusRepo exposes that as an in-process MCP read-only endpoint: the host connects, calls named tools, and the server loops back to this process’s management API for metadata projections.
Takeaway: Repo MCP is read-only end to end —eight tools prefixed repo_ by default; it does not proxy /maven, /npm, /v2, or other protocol paths; it does not download binaries, mint tokens, or run cleanup. Community does not include MCP; Team / Enterprise / Cloud follow the docs. Identity must be a portal-issued user access token (PAT); a Deploy Token ( repod_ ) gets 401.
How console and clients wire MCP: Connect to AngusRepo via MCP. This article covers how the eight read-only tools split, why PAT and Deploy Token differ, plus rate limits and edition boundaries. Cache consistency: AngusRepo cache architecture.
In chat, the same five patterns show up:
Explicitly out of scope: upload, delete, publish, download, trigger scans, mint tokens. Protocol pulls keep using PAT or Deploy Token— they never enter MCP.
IDE / Agent --POST {gateway}/repo/mcp--> Boot /mcp --loopback Bearer--> /api/v1/** (GET whitelist) Enter fullscreen mode Exit fullscreen mode An in-process endpoint reuses the permissions and audit already on REST. A separate Node that re-wraps REST would duplicate policy. Loopback has no generic path parameter, so the model cannot invent protocol or download routes.
Instance switches (edition config, aligned with user docs):
Rate limit: at most 30 successful tools/call per account per minute; invalid args return before counting. Community does not seed the System → MCP tab and force-disables /mcp.
With a system admin or a role that holds every read permission, tools/list should show exactly eight:
Result projections deliberately drop downloadUrl, checksums, README, and full license text to shrink model misuse and leak surface.
Not in the list: repo_search, repo_compare_versions (follow-ups, not registered by default), repo_invoke_read, repo_connection_check, or any publish / delete / execute cleanup / mint token.
Empty secure or scanTrust=UNKNOWN means not scanned yet, not “safe.” Admission gate is off by default; Repo enforcement vs Security engines matches the product FAQ.
Visibility equals that user’s /api/v1 scope—same as the console. MCP does not re-interpret protocol-path repo:read / repo:write. repo:write on a PAT means protocol write— not MCP write.
Personal tokens: avatar → Me ( /profile ). CI should use a service account—do not commit a personal login into the repo.
Put the token in an env var—never in the repo:
{ "mcpServers": { "angus-repo": { "url": "https://<gateway-host>/repo/mcp", "headers": { "Authorization": "Bearer ${ANGUS_REPO_TOKEN}" } } } } Enter fullscreen mode Exit fullscreen mode Host Config file (trust each host’s docs) Cursor Project.cursor/mcp.json or user ~/.cursor/mcp.json Claude claude_desktop_config.json VS Code Workspace.vscode/mcp.json Stdio-only hosts can forward with @anguskit/mcp --product repo; that process reads ANGUS_TOKEN / ANGUS_BASE_URL — not the same names as ANGUS_REPO_TOKEN above. If the default npm source lacks the package, docs suggest https://repo.anguskit.com/npm/npm-public/. Full host table: MCP docs.
After connect, have the assistant tools/list to confirm exactly eight repo_*, then smoke one real Maven coordinate with repo_locate_version.
Contrast explains product trade-offs—not a procurement ranking. Trust each vendor’s docs of the day for detail.
No. Write switch stays off; cleanup is preview only.
Skills describe which artifact risks to ask about; MCP provides callable query tools. Both can be used together (product doc stance).
Named tools keep the loopback whitelist small, avoid exposing the whole admin API to the model, and make projection redaction easier.
repod_ is a single-repo CI credential. Letting it call management-plane MCP would turn an automation token into a chat identity—401 before auth proceeds.