GitHub
Connect AI assistants to GitHub - manage repos, issues, PRs, and workflows through natural language.
电脑或云端
Agentic SDLC MCP
概览
作者提供的说明（英文原文）
Agentic SDLC governance and security controls for AI coding agents working with GitHub.
PopNx MCP 的三大支柱
这三项永远不会合并成一个分数：意见、测量和人气是不同的东西。
- 用户评价i暂无评价评价功能将在后续阶段与账户功能一起开放
- 我们的基础检查i1 项中通过 1 项依据公开信息检查；尚未扫描代码
- 使用情况i非常新↓ 85/周 · ★ –
它能帮你做什么
我们还没有为它写通俗的介绍。下面是我们从注册中心读取到的事实。
- 连接方式: 在你的电脑上运行
- 传输方式: stdio
- 分类: 开发者工具
- 你需要填写：GITHUB_TOKEN
安装
选择你使用的 AI 应用，然后复制设置。
安装之前
- 基础检查：1 项中通过 1 项
- 在你的电脑上运行，拥有你的用户账户的权限（文件、网络、应用）。
- 需要你自己填写：
GITHUB_TOKEN,GITHUB_OWNER,GITHUB_REPO,SDLC_DEFAULT_BRANCH
标为机密的值是你账户的钥匙。千万不要分享给别人，也不要粘贴到聊天里。
你需要
- npm已安装 Node.js（用于 npx 命令）
你用的是哪个应用？
在上方选择你的应用。我们会记住它，下次按钮会显示“安装到 …”。
打开 Claude Desktop → Settings → Developer → Edit Config，把下面的内容粘贴到 claude_desktop_config.json
{
"mcpServers": {
"agentic-sdlc": {
"command": "npx",
"args": [
"-y",
"agentic-sdlc-mcp"
],
"env": {
"GITHUB_TOKEN": "your-value",
"GITHUB_OWNER": "your-value",
"GITHUB_REPO": "your-value",
"SDLC_DEFAULT_BRANCH": "your-value"
}
}
}
}在终端中运行这条命令
claude mcp add agentic-sdlc --env GITHUB_TOKEN=your-value --env GITHUB_OWNER=your-value --env GITHUB_REPO=your-value --env SDLC_DEFAULT_BRANCH=your-value -- npx -y agentic-sdlc-mcp运行前请先填写空着的值。
或者自己复制设置
粘贴到项目中的 .cursor/mcp.json，或 ~/.cursor/mcp.json
{
"mcpServers": {
"agentic-sdlc": {
"command": "npx",
"args": [
"-y",
"agentic-sdlc-mcp"
],
"env": {
"GITHUB_TOKEN": "your-value",
"GITHUB_OWNER": "your-value",
"GITHUB_REPO": "your-value",
"SDLC_DEFAULT_BRANCH": "your-value"
}
}
}
}浏览器会先询问是否打开应用，然后应用会显示设置并请你确认。密钥的值会留空，由你自己填写。
或者自己复制设置
粘贴到项目中的 .vscode/mcp.json
{
"servers": {
"agentic-sdlc": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"agentic-sdlc-mcp"
],
"env": {
"GITHUB_TOKEN": "your-value",
"GITHUB_OWNER": "your-value",
"GITHUB_REPO": "your-value",
"SDLC_DEFAULT_BRANCH": "your-value"
}
}
}
}浏览器会先询问是否打开应用，然后应用会显示设置并请你确认。密钥的值会留空，由你自己填写。
这个服务器在你的电脑上运行，而 ChatGPT 只能连接互联网上的服务器。请选择其他应用。
你的选择通过 Cookie 保存在这台设备上，无需账户。
需要你填写的值
- GitHub token with the least privileges required by the tools you call.
GITHUB_OWNERenvOptional default GitHub organization or user name.GITHUB_REPOenvOptional default GitHub repository name.SDLC_DEFAULT_BRANCHenvOptional default branch used when repository metadata is unavailable.
这些设置是根据作者在注册中心的条目生成的。如果 README 的写法不同，请以 README 为准。
它能做什么
它在你的电脑上运行；安装后，工具列表会显示在你的 AI 应用中。
基础检查i
我们检查的是任何人都能看到的信息；我们没有阅读代码。不适用的检查项不计入总数。 · 检查于 2026年11月9日
- ✓ 通过
作者与仓库一致
注册名称已通过 GitHub 账户 SakuraCianna 验证，该账户拥有此仓库
- … 尚未检查
仍在维护
我们还没有从 GitHub 读取这个仓库
- … 尚未检查
有许可证
我们还没有从 GitHub 读取这个仓库
- – 不适用
端点有响应
它在你的电脑上运行，没有互联网端点
- – 不适用
使用 OAuth 登录
在你的电脑上运行，改用本地设置
- … 尚未检查
工具描述中没有隐藏指令
它在你的电脑上运行；我们只能读取互联网端点的工具列表
与“开发者工具”中的其他服务器比较i
- 星标数多于此分类中其他 5571 个服务器的 0%
- 发布到注册中心的时间比此分类中其他 5571 个服务器的 54% 更新
- 基础检查结果等于或优于此分类中其他 5571 个服务器的 100%
与注册中心里这个分类中所有活跃的服务器比较。只有当发布者拥有该仓库时，星标数才计入。
常见问题
Agentic SDLC MCP 安全吗？
它在 1 项适用的基础检查中通过了 1 项。我们没有阅读代码。在添加密钥或令牌之前，请先看看这个服务器要求哪些权限，并使用只具备所需权限的密钥。
它需要哪些密钥或代码？
你需要填写：GITHUB_TOKEN
它在我的电脑上运行还是在云端？
它在你的电脑上运行。你的 AI 应用会在需要时启动它，数据不会经过作者的服务器（除非它自己调用在线服务）。
它还在维护吗？
GitHub 仓库最后更新于–，最新版本（1.11.0）于25天前进入注册中心。
哪些应用可以使用它？
支持 MCP 的应用，例如 Claude Desktop、Claude Code、Cursor 和 VS Code。你的电脑上还需要有 Node.js。
有什么可以替代它？
同一分类中有：GitHub, Desktop Commander, Cloudflare MCP
替代选择
同一分类中其他作者的服务器，按星标数排序。
如何看卡片：↓ 每周下载量i★ GitHub 星标i三大支柱：评价 · 检查 · 使用情况i更新 = 最新版本发布到注册中心的时间i
Desktop Commander
MCP server for terminal commands, file operations, and process management
在你的电脑上运行
作者的 README
打开 README
按原文从作者的仓库复制。PopNx MCP 没有审查或背书其内容。HTML、图片和脚本已被移除。链接会离开本站。
agentic-sdlc-mcp
Governance and evidence controls for AI coding agents working in real GitHub repositories.
Let Claude Code, Cursor, and other Model Context Protocol (MCP) clients work with repository context, review gates, security evidence, and human approval points.
中文 · npm · MCP Registry · Roadmap
agentic-sdlc-mcp is a software development lifecycle (SDLC) governance layer for teams that already let AI coding agents change production repositories. It turns GitHub context, policy, checks, reviews, security alerts, and release signals into 13 workflow-level MCP tools. Twelve tools are read-only. The only GitHub write tool previews changes by default.
Version 1.11.0 also provides agentic-sdlc, a read-only CLI for PR assessment, portable evidence, snapshot comparisons, and acceptance traceability. agentic-sdlc-mcp remains the MCP server entry point. Verify the exact package and release metadata when installing this version.
What changes with this MCP
AI coding agents can create code and pull requests without understanding every repository rule. This server gives the agent bounded context and gives reviewers explicit evidence gaps instead of another free-form summary.
| Concern | Without this MCP | With agentic-sdlc-mcp |
|---|---|---|
| Repository context | The agent starts from the prompt and guesses project conventions | repo_context reads bounded metadata, scripts, policy, issues, pull requests, and agent instructions |
| High-risk work | Authentication, payment, migration, and workflow changes receive a generic plan | prepare_work_item adds risk reasons, defensive requirements, negative scenarios, rollback, and observability |
| Issue planning | A human reformats the plan into GitHub work items | plan_from_context creates structured drafts and create_issue_set previews the exact write |
| Pull request gates | A green continuous integration (CI) badge may be treated as sufficient evidence | quality_gate_status separates checks, reviews, ownership, protection, labels, and missing evidence |
| Secret risk | Scanner names or keyword matches may be accepted without provenance | PR review separates trusted scanner evidence, bounded patch heuristics, and unverified gaps |
| Release and handoff | Readiness depends on free-form status summaries | Release and handoff tools preserve blockers, policy obligations, evidence warnings, and human approval points |
This server does not write code, merge pull requests, force-push, create releases, deploy software, or replace human security review.
How it fits into a production agent workflow
The MCP sits between an AI coding agent and GitHub evidence. Repository changes still happen through the agent's normal development environment, and high-impact decisions remain with your team.
flowchart LRPolicy["Engineering policy and repository rules"] --> MCP["agentic-sdlc-mcp"] Agent["AI coding agent Claude Code · Cursor · MCP client"] --> MCP MCP --> GitHub["GitHub API evidence"] GitHub --> MCP MCP --> Reports["Briefs · plans · gates reviews · release reports"] Reports --> Agent Reports --> Human["Human review and approval"] Agent -. "Code · commits · pull requests" .-> GitHub Human -. "Merge · release · deploy" .-> GitHub
Where it helps
Use the tools as decision support at the points where an autonomous agent would otherwise guess or rely on stale prose.
| Production scenario | Recommended tools | Decision artifact |
|---|---|---|
| Onboard an agent into an unfamiliar repository | repo_context | Repository briefing with scripts, workflows, policy, open work, and known gaps |
| Turn a feature, bug, or security goal into reviewable work | plan_from_context → create_issue_set | Work-type-aware plan, issue drafts, and preview-first GitHub issues |
| Prepare auth, payment, migration, or infrastructure work | prepare_work_item | Risk-aware brief with defensive requirements, negative tests, rollback, and observability |
| Detect dynamic credential construction in a patch | review_pr_against_standard | Patch-local findings for concatenation, interpolation, decoding, aliases, and auth-header sinks |
| Decide whether a pull request is ready for human review | create_pr_summary → quality_gate_status → review_pr_against_standard | Diff summary, merge-gate evidence, findings, blockers, and next actions |
| Audit repository governance | branch_protection_status → workflow_permissions_audit | Branch/ruleset evidence and GitHub Actions least-privilege findings |
| Assess release readiness | security_triage → release_readiness_check | Security-alert summary, CI evidence, release blockers, changelog status, and rollback requirements |
| Transfer work to another agent | agent_handoff_packet | Bounded continuation packet that labels caller assertions and evidence warnings |
| Archive a decision snapshot | sdlc_evidence_packet | Versioned Issue, PR, or release evidence with provenance, freshness, completeness, and a stable content digest |
Review a PR without an agent
Collect a human-readable decision and a JSON snapshot with one command. The assessment combines existing gate and rule-based review evidence, binds it to the PR head/base and policy digest, and preserves blockers, missing evidence, request counts, and collection duration.
Build from a reviewed checkout with Node.js 22 or newer:
npm cinpm run build node dist/cli.js doctor --repo acme/widget node dist/cli.js assess-pr --repo acme/widget --pr 42 --output artifacts/pr-42-first.json --summary artifacts/pr-42-first.md
Inject GITHUB_TOKEN through your process or secret manager before online collection. The CLI reads environment variables only; it does not load a home configuration or .env. doctor is offline unless --online is supplied, and missing configuration returns exit code 2. Once the package is installed, agentic-sdlc runs the same CLI as node dist/cli.js.
| Command | Result |
|---|---|
doctor --repo acme/widget --online --json | Read-only endpoint diagnostics; no credential values in the report |
assess-pr --repo acme/widget --pr 42 --standard strict --json | ready_for_review, blocked, or needs_evidence, with a versioned packet |
evidence --repo acme/widget --subject pr --number 42 --output artifacts/pr-42-evidence.json | Existing Issue, PR, or release evidence packet; use --subject issue --number N or --subject release --ref REF for other subjects |
diff --previous artifacts/pr-42-first.json --current artifacts/pr-42-next.json --json | Added, removed, changed, unchanged, and invalidated evidence; both files must already exist |
trace --packet artifacts/pr-42-evidence.json --acceptance acceptance.md --source openspec --json | Explicit checklist/numbered conditions linked to supplied evidence |
assess-pr and evidence also accept --previous, --acceptance, and optional --mappings for one collection plus local analysis. Mapping files use the strict array schema described in evidence continuity. --json changes stdout; --output always creates a JSON file. Existing files are never overwritten. --summary creates a new Markdown file, or appends when it points to GitHub Actions' exact GITHUB_STEP_SUMMARY path.
Assessments are advisory by default: a completed report returns 0 even when its decision is blocked or needs evidence. assess-pr --enforce returns 1 for blocked, 2 for needs_evidence, and 0 for ready_for_review. Configuration/input/unavailable-source errors return 2; cancellation returns 130. A successful diff or trace command means the analysis completed, not that the evidence or acceptance conditions passed.
Online collection defaults to a 30-second timeout and 120-request budget; supported overrides are --timeout-ms from 1 to 120000 and --max-requests from 2 to 500. doctor has its own bounded probes and accepts the timeout option. File inputs and serialized outputs are limited to 1 MiB.
An unchanged snapshot never inherits an earlier verification. Head/base, policy, producer version, freshness, and completeness changes can require recollection. Checked boxes, agent claims, and ordinary green CI do not prove business acceptance; the CLI has no trusted acceptance producer configured by default. Neither a ready report nor --enforce approves, merges, or deploys a PR.
For MCP review sessions, set SDLC_CONFIG_MODE=envonly to avoid home/.env configuration and SDLC_READ_ONLY=true to reject live Issue creation while retaining previews. Use a token restricted to the intended repositories and read permissions. Client configuration and the portable review skill are in client recipes; the unexecuted small-sample validation plan is in user pilot.
Install from npm
You need Node.js 22 or newer. Node 22 and 24 are tested in GitHub Actions. Run the published package directly from npm:
npx -y agentic-sdlc-mcpFor a global CLI installation:
npm install -g agentic-sdlc-mcpagentic-sdlc-mcp
The default transport is stdio. Most MCP clients should start the package for you instead of running it in a separate terminal.
These npm commands resolve published releases. Pin agentic-sdlc-mcp@1.11.0 to reproduce this version, verify its release/package metadata, and restart any existing MCP connection after an upgrade.
Let a coding agent set it up
Paste this prompt into Codex, Claude Code, or another coding agent:
Use npm install -g agentic-sdlc-mcp to install and configure this MCP globally. Repository: https://github.com/SakuraCianna/agentic-sdlc-mcpConfigure GITHUB_TOKEN and optional repository defaults through the MCP client's secret or environment configuration. On a trusted single-user machine, you may instead run agentic-sdlc-mcp configure or write them to ~/.agentic-sdlc-mcp.json. Never expose the token in chat, logs, or repository files; ask me for missing non-secret details. Then verify the connection with the read-only repo_context tool and summarize its capabilities, required GitHub permissions, and safety boundaries.
Review every command and configuration change before approving it. Node.js 22 or newer is required.
Connect an MCP client
Add the server to Claude Desktop, Cursor, Windsurf, or another MCP client. Inject the GitHub token through the client's secret or environment configuration.
{"mcpServers": { "agent
只显示了开头部分；其余内容请在仓库中阅读