Tangled Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Tangled Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCP server for Tangled - a git collaboration platform built on AT Protocol.
reads go through bobbin, tangled's public XRPC API (api.tangled.org) — no credentials needed. writes (issues, comments, labels) are atproto records put directly on your PDS and require an app password.
note: pushes tomaindeploy the hosted server through tangled CI, which uploads the source to Prefect Horizon (scripts/horizon_deploy.py). the GitHub mirror only publishes releases to PyPI and the MCP registry onv*tags.
a hosted instance runs at `https://nate-tangled-mcp.fastmcp.app/mcp` — no install needed:
claude mcp add --transport http tangled https://nate-tangled-mcp.fastmcp.app/mcpfor write access, pass credentials per request via headers:
claude mcp add --transport http tangled https://nate-tangled-mcp.fastmcp.app/mcp \
--header "x-tangled-handle: your.handle" \
--header "x-tangled-password: your-app-password"your PDS is auto-discovered from your handle — self-hosted PDS works with no extra config.
git clone https://tangled.org/zzstoatzz/tangled-mcp
cd tangled-mcp
just setup[!IMPORTANT] requiresuvandjust
credentials are optional — only write tools need them. hosted/multi-tenant deployments can send them per request via x-tangled-handle / x-tangled-password headers, which take precedence over env. for local use, create .env:
TANGLED_HANDLE=your.handle
TANGLED_PASSWORD=your-app-password<details> <summary>MCP client installation instructions</summary>
# read-only (no credentials)
claude mcp add tangled -- uvx tangled-mcp
# with write access
claude mcp add tangled \
-e TANGLED_HANDLE=your.handle \
-e TANGLED_PASSWORD=your-app-password \
-- uvx tangled-mcpadd to your cursor settings (~/.cursor/mcp.json or .cursor/mcp.json):
{
"mcpServers": {
"tangled": {
"command": "uvx",
"args": ["tangled-mcp"],
"env": {
"TANGLED_HANDLE": "your.handle",
"TANGLED_PASSWORD": "your-app-password"
}
}
}
}codex mcp add tangled \
--env TANGLED_HANDLE=your.handle \
--env TANGLED_PASSWORD=your-app-password \
-- uvx tangled-mcpfor clients that support MCP server configuration, use:
uvx["tangled-mcp"]TANGLED_HANDLE, TANGLED_PASSWORD</details>
uv run tangled-mcprepositories are owner/repo (e.g. zzstoatzz.io/tangled-mcp); handles (with or without @) and DIDs both work for the owner. issues are identified by at-uri.
search(query, limit) - full-text search across repos, issues, and stringslist_repos(owner, limit) - list a user's repositoriesget_repo(repo) - metadata: knot, default branch, languages, labelsget_record(uri) - fetch the full record behind any at-uri (strings/pastes, comments, ...)list_branches(repo, limit) / list_tags(repo, limit)list_files(repo, path, ref) - browse the treeread_file(repo, path, ref) - file contentscommit_log(repo, ref, limit) - recent commitscompare(repo, rev1, rev2) - diff two revisionslist_issues(repo, state, limit) - filterable by open/closedget_issue(issue)list_pulls(repo, status, limit) - filterable by open/closed/mergedget_pull(pull) - single PR with live state (derived from PDS status records, no index lag)list_pipelines(repo, limit) - CI pipeline runscreate_pull(repo, title, patch | edits, target_branch, body) - open a PR from git format-patch output, or from whole-file edits (no clone needed — the server synthesizes the patch)create_issue(repo, title, body, labels)update_issue(issue, title, body)set_issue_state(issue, state) - close/reopenset_pull_state(pull, state) - close/reopen a PRcomment_on_issue(issue, body)delete_issue(issue)just test # run tests
just check # run pre-commit checkssee docs/bobbin-api.md for notes on tangled's public API.
mcp-name: io.github.zzstoatzz/tangled-mcp
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.