alexbypa/github-projectpulse-mcp

GitHub repository health monitoring for AI assistants — works with any language, any repo.
---
This Model Context Protocol (MCP) server gives AI assistants the ability to analyze health, security, CI/CD status, and delivery metrics of any GitHub repository — directly from your conversations.
📑 Table of Contents
- Features
- Examples
- Use Cases
- Prerequisites
- Quick Start
- Tools
- Compatibility
- Architecture
- Transport Modes
- Configuration
- Testing
- Contributing
- License
✨ Features
- 🏥 **Health Score** — comprehensive 0-100 score with grade (A-F), category breakdown, and improvement suggestions
- 🔒 **Security** — Dependabot alerts blended with OpenSSF Scorecard checks (60/40 weighted)
- 📊 **DORA Metrics** — proxy DORA metrics from GitHub data: deployment frequency, lead time, change failure rate, MTTR
- 🔍 **Code Scanning** — CodeQL and other code scanning alerts with severity, message, and creation date
- 📦 **Dependency Analysis** — Dependabot alerts with severity filtering
- ⚙️ **CI/CD Status** — recent GitHub Actions workflow runs and conclusions
- 📋 **Repository Info** — stars, forks, language, license, and general metadata
- 📝 **Best Practices** — 12-point checklist for open-source repo quality (README, LICENSE, SECURITY.md, templates, branch protection, etc.) with A-F grade
📸 Examples
> All screenshots taken live from MCP Inspector.
get_health_score — A-F grade with category breakdown
get_dora_metrics — DORA delivery metrics from GitHub data
compare_repos — Side-by-side health score ranking
check_ci_status — Recent GitHub Actions workflow runs
get_repo_health — Repository metadata and stats
analyze_dependencies — Dependabot vulnerability alerts
check_best_practices — Open-source repo quality checklist with A-F grade
💡 Use Cases
> Copy-paste these prompts into Claude, Cursor, Windsurf, or any MCP-compatible assistant.
Due Diligence — Library Adoption
> "Evaluate whether facebook/react is production-ready. Check the health score, security vulnerabilities (Dependabot and CodeQL), and whether the CI pipeline passes consistently."
*Tools used: get_health_score, analyze_dependencies, analyze_code_scanning, check_ci_status*
Compare Alternatives
> "I need to choose between expressjs/express, fastify/fastify, and koajs/koa. Compare their health scores and tell me which one has the lowest technical risk."
*Tools used: compare_repos*
Sprint Review — DORA Metrics
> "Calculate the DORA metrics for vercel/next.js over the last 30 days. I want to present delivery performance at our sprint review."
*Tools used: get_dora_metrics*
Trend Monitoring
> "Check the health score of microsoft/vscode. Has it improved or worsened since the last time we checked?"
*Tools used: get_health_score (includes trend comparison on repeated calls)*
Quick Security Audit
> "Run a security audit of pallets/flask: Dependabot alerts, CodeQL vulnerabilities, and CI build status. Give me a complete picture."
*Tools used: analyze_dependencies, analyze_code_scanning, check_ci_status*
---
📋 Prerequisites
- **Node.js** v18 or later — download
- **npm** (included with Node.js)
- **GitHub Personal Access Token** (optional for public repos, required for private repos and security data)
🚀 Quick Start
Claude Code (CLI)
> **Note:** You need a .env file with your GITHUB_TOKEN in the directory where you run Claude Code.
Claude Desktop
Step 1: Get a GitHub Token
1. Go to GitHub Settings > Developer settings > Personal access tokens > Fine-grained tokens
2. Give it a name (e.g., projectpulse)
3. Select the repositories you want to monitor (or "All repositories")
4. Under **Permissions**, grant **Read-only** access to:
- Code scanning alerts
- Dependabot alerts
- Metadata (enabled by default)
5. Click **Generate token** and copy it
Step 2: Configure Claude Desktop
1. Open Claude Desktop
2. Go to **Settings** (gear icon) > **Developer** > **Edit Config**
3. This opens claude_desktop_config.json. Add the projectpulse entry inside "mcpServers":