Mcp Phab — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Mcp Phab (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
phab-arc-mcp is a small MCP stdio server for reviewing Phabricator revisions.
The public MCP surface is intentionally small:
review-phabinline-comments-phabreview-phab Doesreview-phab is the tool you call when you want an AI reviewer to review a Differential properly.
You give it a revision ID like D35297. It fetches the revision title, summary, changed files, raw diff, and the linked Maniphest task context, then packages all of that together with the review prompt the model should use.
From a user point of view, this means you do not have to manually open the revision, copy the diff, inspect related tasks, and explain the background before asking for a review. The tool gives the model the code changes and the surrounding context in one shot.
That makes reviews more useful because the model can judge the change against the actual task being solved, not just the raw code diff. It can use the overall repository context to reason about likely bugs, regressions, and edge cases, and it can also check whether the revision actually does what the linked task says it should do. In practice.
After that, inline-comments-phab can take the review findings and create draft inline comments directly on the Differential.
Important details:
npmgit clone https://github.com/wxomi/node-chat.git
cd mcp-phabnpm installnpm run buildThis produces the MCP server entrypoint at dist/server.js.
Set these before starting the server or before wiring it into your MCP client:
PHAB_API_TOKENCONDUIT_TOKENPHAB_API_TOKENPHAB_CONDUIT_TOKENPHAB_API_TOKENPHAB_CONDUIT_URIhttps://phab.instahyre.com/PHAB_ARC_TIMEOUT_MS30000Example:
export PHAB_CONDUIT_URI="https://phabricator.example.com/"
export PHAB_API_TOKEN="api-xxxxxxxxxxxxxxxx"
export PHAB_ARC_TIMEOUT_MS="30000"If you do not set PHAB_CONDUIT_URI, the server will try https://phab.instahyre.com/.
You usually do not need this step when using the server through an MCP client. In the normal setup, the MCP client launches the stdio server process for you using its mcpServers configuration.
Run the built server manually only if you want to verify that the binary starts correctly:
npm startFor local development without building on every change:
npm run devThe server uses stdio transport, so manual npm start is optional and is not a required installation step.
{
"mcpServers": {
"phab-arc-mcp": {
"command": "node",
"args": ["/absolute/path/to/phab-arc-mcp/dist/server.js"],
"env": {
"PHAB_CONDUIT_URI": "https://phab.instahyre.com/",
"PHAB_API_TOKEN": "api-xxxxxxxxxxxxxxxx"
}
}
}
}Use this to verify the installation quickly:
npm install completes successfullynpm run build creates dist/server.jsPHAB_API_TOKENPHAB_CONDUIT_URI points to the correct Phabricator base URLreview-phab and inline-comments-phab toolsCall review-phab with:
{
"revision_id": "D35297"
}inline-comments-phab are draft inlines and are not published automatically.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.