GitHub
GitHub’s official server lets AI read and manage code, issues and pull requests in your account. Use GitHub’s hosted version or run it locally with Docker.
Computer or cloud
Garuda
Overview
Description from the maker (original English)
Impact analysis, architecture rules and a tamper-evident ledger for AI coding agents.
PopNx MCP’s three pillars
These three are never merged into one score: opinions, measurements and popularity are different things.
- User voiceiNo reviews yetReviews open together with accounts in a later step
- Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
- UsageiVery new★ –
What you can do with it
We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.
- Connection: Runs on your computer
- Transport: stdio
- Category: Developer tools
- You need to fill in: DATABASE_URL
Install
Pick the AI app you use, then copy the settings.
Before you install
- Basic checks: 1 of 1 passed
- Runs on your computer with your user’s permissions (files, network, apps).
- You fill in yourself:
DATABASE_URL,GARUDA_WORKSPACE
Values marked secret are keys to your account. Never share them or paste them into a chat.
You need
- DockerDocker installed
Which app do you use?
Pick your app above. We remember it, so next time the button says “Install in …”.
Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json
{
"mcpServers": {
"garuda": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"DATABASE_URL",
"-e",
"GARUDA_WORKSPACE",
"ghcr.io/myshra777-ai/garuda-mcp:1.9.11"
],
"env": {
"DATABASE_URL": "your-value",
"GARUDA_WORKSPACE": "your-value"
}
}
}
}Run this in your terminal
claude mcp add garuda --env DATABASE_URL=your-value --env GARUDA_WORKSPACE=your-value -- docker run -i --rm -e DATABASE_URL -e GARUDA_WORKSPACE ghcr.io/myshra777-ai/garuda-mcp:1.9.11Fill in the empty values before running it.
Or copy the settings yourself
Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json
{
"mcpServers": {
"garuda": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"DATABASE_URL",
"-e",
"GARUDA_WORKSPACE",
"ghcr.io/myshra777-ai/garuda-mcp:1.9.11"
],
"env": {
"DATABASE_URL": "your-value",
"GARUDA_WORKSPACE": "your-value"
}
}
}
}Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.
Or copy the settings yourself
Paste into .vscode/mcp.json in your project
{
"servers": {
"garuda": {
"type": "stdio",
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"DATABASE_URL",
"-e",
"GARUDA_WORKSPACE",
"ghcr.io/myshra777-ai/garuda-mcp:1.9.11"
],
"env": {
"DATABASE_URL": "your-value",
"GARUDA_WORKSPACE": "your-value"
}
}
}
}Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.
This one runs on your computer, and ChatGPT can only connect to servers on the internet. Pick another app.
Your choice stays on this device in a cookie; no account needed.
Values you fill in
- PostgreSQL connection URL for the Garuda graph and ledger
GARUDA_WORKSPACEenvWorkspace name to govern
These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.
What it can do
Runs on your computer; the tool list appears in your AI app after you install it.
Basic checksi
We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 8, 2026
- ✓ Pass
Maker matches the repo
The registry name was verified with the GitHub account myshra777-ai, which owns the repo
- … Not checked yet
Still maintained
We have not read this repo from GitHub yet
- … Not checked yet
Has a licence
We have not read this repo from GitHub yet
- – Not applicable
Endpoint responds
This one runs on your computer; there is no internet endpoint
- – Not applicable
Sign-in with OAuth
Runs on your computer and uses local settings instead
- … Not checked yet
No hidden instructions in tool descriptions
Runs on your computer; we can only read tool lists from internet endpoints
Compared with others in Developer toolsi
- More stars than 0% of the other 4937 servers in this category
- Published to the registry more recently than 88% of the other 4937 servers in this category
- Basic checks equal to or better than 100% of the other 4937 servers in this category
Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.
Common questions
Is Garuda safe?
It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.
What keys or codes does it need?
You need to fill in: DATABASE_URL
Does it run on my computer or in the cloud?
It runs on your computer. Your AI app starts it when needed, and data does not pass through the maker’s servers (unless it calls an online service itself).
Is it still maintained?
The GitHub repo last changed –, and the latest version (1.9.11) reached the registry 5 days ago.
Which apps can use it?
Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. You also need Docker on your computer.
What can I use instead?
In the same category: GitHub, Desktop Commander, Cloudflare MCP
Alternatives
Servers in the same category from other makers, sorted by stars.
Reading a card:↓ Downloads per weeki★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi
Desktop Commander
MCP server for terminal commands, file operations, and process management
Runs on your computer
README from the maker
Open the README
Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.
Garuda
AI can write the code. Garuda makes sure the change respects your system.
Change control for AI-written code.
Leading an engineering team? The business case in two minutes →
▶ Watch the dashboard demo video
What is this?
You let an AI assistant (Claude Code, Cursor, Codex…) change your code. It works. The tests pass. But did it quietly skip your service layer, break a rule your team agreed on last year, or change a number your finance team relies on?
Your assistant is good at writing code. It does not automatically know every decision your team made, every part of the system that depends on the code, or every rule that has to stay true.
Garuda is a safety check that sits between your AI assistant and your codebase:
- Before the assistant edits something, Garuda tells it who depends on that code and which rules apply.
- After the edit, Garuda checks the change against your rules and says allow, warn, review or block, with plain instructions for fixing it.
- Saved decisions are sealed into a tamper-evident log, so you can prove later what was checked and when.
Know the impact. Enforce the rules. Keep the evidence.
Works with Go, Python, TypeScript, and Java (Beta), with more languages on the way.
One change, start to finish
Say your assistant is asked to add a feature to the payment handler.
- It asks Garuda first. Garuda replies: "12 other things depend on this. It is high-risk code. Rule: the payment handler must not talk to the database directly."
- The assistant makes its edit. In a hurry, it calls the database straight from the handler.
- Garuda checks the change. It sees the broken rule, says BLOCK, and tells the assistant exactly what to move and where.
- The assistant fixes it. The second check says ALLOW.
- The result is saved. You get a receipt you can look up later.
Garuda also separates problems this change introduced from problems that were already there. You are not asked to clean up years of old code before you can move forward. You only answer for what is new.
It reads Go with the compiler's full type checker (go/types), and its Beta Python, TypeScript, and Java analyzers resolve cross-file imports (__init__.py, barrel index.ts, tsconfig.json @/* paths, JAVA_IMPORT package/static imports), import aliases, type annotations (Optional[T], Promise , CompletableFuture ), constructor fields (self.attr / private readonly / Spring @Autowired DI), interface implementations, inheritance (super()), and return-type method calls at 0.95 confidence with exact file and line evidence (see What Garuda does not do).
Take the tour (about 10 minutes)
1. Install it · *3 minutes*
git clone https://github.com/myshra777-ai/garuda.gitcd garuda ./setup.sh
setup.sh starts a local PostgreSQL database, builds the tools into bin/, and starts the dashboard. It prints your login at the end. On Windows use setup.ps1.
Just want to look first? npx garuda-guard demo runs the demo below with no database (needs Node 18 or newer). Prefer to let an AI assistant do it? Copy a prompt for ChatGPT, Claude, Codex or Cursor.
Prefer one line? curl -fsSL https://raw.githubusercontent.com/myshra777-ai/garuda/main/install.sh | bash does the same. (As with any installer you pipe into a shell, read it first.)
2. Watch it catch three planted bugs · *1 minute*
./bin/garuda demoThis builds a tiny fake payments service with three problems planted on purpose, runs Garuda's analyzer on it, and lists the problems Garuda is built to catch. It needs no database:
| Planted problem | Why it matters |
|---|---|
| The payment handler talks to the database directly | Skips the layer that is supposed to guard money movement |
Money is calculated with float64, and one report is off by 10× (48 Cr vs 4.8 Cr) | Silent wrong numbers |
| The storage layer imports the payment layer | Dependencies pointing the wrong way |
You'll see each problem, the exact file and line, and a short "how to fix it" an AI assistant can follow. The service and its three problems are made up for the demo, and the demo lists them rather than detecting them. To see real detection on real code, finish step 1 and run garuda check in step 4. On Windows, run .\bin\garuda.exe demo.
3. Open the dashboard · *2 minutes*
Go to http://localhost:8080/login and sign in with the login setup.sh printed.
The dashboard's front page walks you through five steps. Here is what each part gives you:
Add your own project. Click New Workspace, paste a GitHub link or a folder path, and Garuda reads the code for you.
See your system without the spaghetti. Instead of one giant tangled graph, Garuda shows the small neighbourhood around the thing you care about: who calls it, and what it calls.
Turn written decisions into enforced rules. Drop in your design docs or decision records (ADRs). Garuda pulls out the "must" and "must not" lines and links them to the code they talk about. No docs yet? It drafts a rulebook from your code for you to approve.
Spot numbers that disagree. When two teams calculate the same metric differently, or one query divides by 1e7 and another by 1e8, Garuda helps you line up the two versions, shows the formulas it found in the code, and asks a human to decide which one is right. It does not guess.
Learn the signals. Every badge has one fixed meaning:
| You see | It means |
|---|---|
| ALLOW / WARN / REVIEW / BLOCK | The verdict on a change. BLOCK stops it and tells the assistant how to repair it. |
| SUPPORTED | The evidence backs this claim, within what was checked. Safe to rely on. |
| UNVERIFIED | Found in the code or docs but not confirmed yet. Not an error. |
| CONTRADICTED | The evidence conflicts with a rule or claim you wrote down. |
| HIGH / MEDIUM / LOW tier | How many things depend on this code. High-tier code is protected from silent AI rewrites. |
4. Point it at your own code · *3 minutes*
cd /path/to/your/project/path/to/garuda/bin/garuda init . --wizard # five short questions /path/to/garuda/bin/garuda rulebook generate # drafts rules from your code /path/to/garuda/bin/garuda check . --diff HEAD # checks what you just changed
Not sure which rules to start with? Pick a ready-made set: garuda init . --template layered (also hexagonal, microservices, no-circular-imports, financial, zero-trust-auth, ai-agent-safety, pii-gdpr-hipaa, idempotent-mutations, or all). They live in policies/templates/.
Coming from ArchUnit, Dependency-Cruiser or Import Linter? garuda import --from archunit --input converts your existing rules.
If something looks off, run ./bin/garuda doctor. It checks your database, migrations and hooks and tells you what is wrong.
Plug it into your AI assistant
garuda init sets this up automatically for Claude Code, Claude Desktop and Cursor. To install it as a plugin instead:
| Tool | How |
|---|---|
| Claude Code | /plugin marketplace add myshra777-ai/garuda then /plugin install garuda@garuda |
| OpenAI Codex | codex plugin marketplace add myshra777-ai/garuda |
| Cursor | Run garuda init; it writes the rules and MCP settings into your project (.cursor-plugin/ has the plugin manifest) |
| Anything that speaks MCP | Run garuda-mcp over stdio (example config) |
The plugin needs the garuda-mcp program and a database, so do step 1 above first.
What your assistant gets: 54 tools (41 read-only, 13 that can change state) and 6 skills, short playbooks that tell it when to use them:
| Skill | When the assistant uses it |
|---|---|
pre-edit-governance | Before changing code: proceed, revise or ask a human? |
change-impact | Who calls this, and how far does the damage spread? |
post-edit-verification | After the edit: any new violations in this diff? |
violation-repair | A change was blocked; fix it without breaking something else |
architecture-review | Does the real code match the documented design? |
evidence-verification | Is this claim backed by code, and is the receipt genuine? |
Check every pull request
Your assistant's good behaviour is a request. A pull request check is a rule. Add the GitHub Action and every pull request gets a verdict:
- the verdict (ALLOW, WARN, REVIEW or BLOCK) and a receipt hash in the run summary, with a one-line command to reproduce it on your machine;
- a BLOCK fails the check;
- with the ready-made workflow,
.github/workflows/garuda-gate.yml, you also get a verdict comment on the pull request and findings in GitHub's Security tab; - optional Slack or Teams alerts through
garuda check --notify-slack/--notify-teams.
Copy a ready-to-paste snippet from docs/GITHUB_MARKETPLACE_STRATEGY.md, or use action.yml directly.
One more step makes it real: in your repository go to Settings → Rules (or Branches), and make the Garuda check a required status check. Until you do, a failing check is only a warning that people can merge past.
What Garuda does
Only the beginning is shown; read the rest in the repo