Octopilot Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Octopilot Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Model Context Protocol (MCP) server for Octopilot — enables AI agents to detect, generate, build, and wire up new repositories end-to-end using the Octopilot CI/CD toolchain.
| Tool | Description |
|---|---|
detect_project_contexts | Parse skaffold.yaml → pipeline-context JSON (languages, versions, matrix) |
generate_skaffold_yaml | Generate a skaffold.yaml for given artifacts |
generate_ci_workflow | Full .github/workflows/ci.yml using the standard octopilot pipeline |
onboard_repository | One-call onboarding: detect → generate files → return next steps |
run_op_build | Run op build via local binary or ghcr.io/octopilot/op container |
list_actions | All Octopilot GitHub Actions from the bundled registry |
get_action_details | Full spec, inputs, examples, gotchas for one action |
`op promote-image` is intentionally not exposed. Image promotion between environments is operationally sensitive and must only run through a GitHub Actions workflow (with audit trail, OIDC credentials, and environment protection rules). Use generate_ci_workflow to produce the workflow that handles promotion safely.Connect directly to the public server at https://mcp.octopilot.app — no cloning, no Python, no pip required.
# Cursor
fastmcp install cursor https://mcp.octopilot.app --name octopilot
# Claude Desktop
fastmcp install claude https://mcp.octopilot.app --name octopilotAvailable hosted tools (stateless, no local dependencies):
| Tool | Description |
|---|---|
list_actions | Browse the Octopilot GitHub Actions registry |
get_action_details | Full spec, inputs, examples, gotchas for one action |
generate_skaffold_yaml | Generate a skaffold.yaml for given artifacts |
generate_ci_workflow | Full .github/workflows/ci.yml for a project |
Need `detect_project_contexts`, `onboard_repository`, or `run_op_build`? Those tools need Docker and local filesystem access — use Option B below.
# Clone and install
git clone https://github.com/octopilot/octopilot-mcp
cd octopilot-mcp
uv syncDocker or Colima is the only external dependency. Most tools are pure Python; run_op_build pulls ghcr.io/octopilot/op:latest automatically with --pull always, so you always run the latest release.
# Cursor
uv run fastmcp install cursor src/octopilot_mcp/server.py --name octopilot
# Claude Desktop
uv run fastmcp install claude src/octopilot_mcp/server.py --name octopilotuv run fastmcp dev src/octopilot_mcp/server.py --reload# List all available tools
uv run fastmcp list src/octopilot_mcp/server.py
# Call a tool directly
uv run fastmcp call src/octopilot_mcp/server.py tool_list_actionsuv run octopilot-mcpfastmcp install){
"mcpServers": {
"octopilot": {
"command": "uv",
"args": ["run", "--directory", "/path/to/octopilot-mcp", "octopilot-mcp"]
}
}
}Pin to a specific op release (optional):
{
"mcpServers": {
"octopilot": {
"command": "uv",
"args": ["run", "--directory", "/path/to/octopilot-mcp", "octopilot-mcp"],
"env": { "OP_IMAGE": "ghcr.io/octopilot/op:v1.0.0" }
}
}
}| Variable | Default | Description |
|---|---|---|
OP_IMAGE | ghcr.io/octopilot/op:latest | Pin to a specific op release for reproducibility |
User: Onboard this Rust API project to use Octopilot CI.
Agent: [calls onboard_repository("/path/to/my-api", "ghcr.io/my-org")]
→ Detected: rust (stable) in api/
→ Generated: skaffold.yaml, .github/workflows/ci.yml
→ Next steps: add .pre-commit-config.yaml, push changesuv sync --all-extras
# Run tests
uv run pytest tests/ -v
# Run with coverage
uv run pytest tests/ --cov=src/octopilot_mcp --cov-report=term-missingTool module coverage target: ≥95% (actions, detect, generate, op_runner). See CONTRIBUTING.md for details.
The server also exposes MCP resources for agent context:
octopilot://actions — Full actions registry JSONoctopilot://pipeline-context-schema — JSON Schema for pipeline-contextoctopilot://docs/getting-started — Plain-text onboarding guideoctopilot://docs/skaffold-patterns — Common skaffold.yaml patterns~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.