Rebar MCP server
Event-sourced ticket tracker + Jira reconciler, exposed as a Python library, CLI, and MCP server.
4 stars89 downloads/wk
Reviews
Write oneNobody has reviewed Rebar yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
Rebar tools (61, 12 write)
write = sends, deletes, buys or postsRead from the package source without running it. The installed server may list more.
archive_ticketArchive a ticket (excludes it from the default list).
attach_commitsRetroactively link commits to a ticket by SHA (union-add, idempotent).
audit_trailThe full audit read surface for a ticket (story 46f0): its FULL retained plan-review sidecar history (newest-first), its completion attestation + sidecar record, and the associated code reviews (``code_review`` tickets that link ``relates_to`` this ticket, each with its own retained sidecar history). Best-effort aggregation over the observability sidecars — individual reader failures degrade to ``
bridge_check_accesswrite actionRun the six-step live Jira capability check and return its typed verdict.
bridge_fsckOffline bridge audit -> {unknown_event_types, binding_drift, store_integrity}.
bridge_pausePersist a durable reconciliation pause with its operator reason.
bridge_previewCompute proposed Jira changes without applying them.
bridge_projects_listReturn the store's bridge-projects sync mapping ``{key: {"repos": [...]}}``.
bridge_projects_removewrite actionRemove a bridge project key from the mapping (error if absent).
bridge_projects_setSet a bridge project key's repos (REPLACE semantics; idempotent).
bridge_resumeClear the durable reconciliation pause.
bridge_runwrite actionRun one scheduled bridge profile and strictly deliver its ticket events.
bridge_statusRead the durable bridge status snapshot and optional freshness assertion.
bridge_syncApply proposed Jira changes, optionally with an explicit change limit.
check_acCheck the ticket has an Acceptance Criteria block ({verdict, criteria_count, reason, passed}).
claim_ticketAtomically claim an OPEN ticket (-> in_progress + assignee).
clarity_checkScore ticket clarity (score / verdict / threshold / passed).
comment_ticketAppend a comment to a ticket.
compact_ticketCompact a ticket's event log (or all tickets if id omitted).
create_ideawrite actionCapture an undesigned idea: create an epic in status 'idea' atomically.
create_identitywrite actionCreate an identity entity: a gate-/graph-exempt ticket recording a person/agent. ``name`` is the title; ``email`` plus ``mappings`` (list of {provider, external_id}) and ``keys`` (OpenSSH authorized-keys lines) ride the CREATE and surface in show_ticket. Returns {id, alias}.
create_ticketwrite actionCreate a ticket; returns {id, alias} (agents get the alias without a second show()). A non-null description_warning means the description exceeds the plan-review admission cap while the claim gate is on — the ticket was still created, but claiming it needs a review that refuses the description as-is. A non-null duplicate_warning means another ticket with the same normalized title was created insid
declare_no_file_impactDeclare that a ticket has no repository-file impact, with a reason.
edit_ticketEdit ticket fields (title/priority/assignee/description/ticket_type).
explain_criterionExplain a plan-review criterion — its authoring-guide section (epic cite-stone-sea / WS10) — OR print an author-facing prose guide when ``criterion_id`` is a guide name (``plan`` = how to write a passing plan; ``review`` = how to pass code review; ``commit-trailer`` = the required ``rebar-ticket:`` commit-trailer format). A pure registry/guide READ (no LLM, so it is NOT gated on REBAR_MCP_ALLOW_LL
fsckCheck ticket-store integrity (JSON validity, CREATE presence, lock cleanup). Set recover=True to run the recovery path.
get_file_impactGet the file-impact array (consumed by next-batch conflict scheduling).
get_verify_commandsGet the DD-level verify-commands array for a ticket.
get_workflow_resultRead a workflow run's outputs via replay -> {run_id, status, terminal_step, terminal_output, outputs, error}. The terminal step's output is the run result.
get_workflow_statusRead a workflow run's current status via replay (no execution) -> {run_id, ticket_id, workflow_name, status, terminal_step, error, steps}.
grounding_infoThe STATIC code-grounding oracle integration contract (epic 8f6c): the closed dimension-ID vocabulary + version, the reference kinds, the closed abstain-reason enum (+ outcome/job/tier vocabularies), and the available backends with their detected availability/version. A fast, deterministic, repo-independent discovery surface (no repo is scanned). Takes no args.
link_ticketsLink two tickets (one of the seven canonical relations: blocks | depends_on | relates_to | duplicates | supersedes | discovered_from | caused_by).
list_ticketsList tickets as a JSON array, with optional filters.
log_sessionAppend a verbose entry to the current session_log, creating one on first use (write-gated: refused under REBAR_MCP_READONLY=1). Returns the log's {id, alias}; optional relates_to / discovered_from link it to the work it documents.
next_batchNext parallel batch of unblocked tickets under an epic's hierarchy.
plan_review_statusIs this ticket's plan-review attestation current RIGHT NOW? Read-only.
quality_checkCheck ticket dispatch readiness ({verdict, line_count, keyword_count, ac_items, file_impact, reason, passed}).
ready_ticketsList tickets ready to work (all blockers closed). ``sort`` orders by ``priority|created|updated|id|status`` (prefix ``-`` for descending; unset values sort last).
recent_session_logsThe newest session_log tickets, newest first (by created_at; default limit 5). session_logs are hidden from list_tickets; this is the type-specific read that surfaces them.
reconcilewrite actionRun the Jira reconciler. Defaults to a non-mutating dry-run.
render_workflowRender a workflow (a .rebar/workflows/<name> name or a file path) to a read-only Mermaid flowchart (TEXT; the host renders it to SVG, never committed). Large graphs degrade to a text outline. Read tool, always available.
reopen_ticketReopen a closed ticket (closed -> open). Optimistic-concurrency: raises a tool error if the ticket is not currently closed.
review_codewrite actionRun a multi-reviewer LLM code review of a git range (base..head) -> an aggregated review_result dict (findings carry agreement + reviewers).
review_planwrite actionRun the plan-review gate on a ticket -> a plan_review_verdict dict {verdict: "PASS"|"BLOCK"|"INDETERMINATE", blocking[], advisory[], coaching[], indeterminate[], coverage, signature?, source, verified_at_sha, ...}. A deterministic Layer-1 floor (P1-P9) plus a four-pass (find -> verify -> decide -> coach) review of the ticket's whole plan — the inverse of verify_completion. On a non-blocking PASS i
run_workflowwrite actionStart a workflow run; returns {run_id, ticket_id, status:'running'} IMMEDIATELY (async — the run executes on a background **daemon thread**, so it survives client request timeouts). Poll get_workflow_status / get_workflow_result to read its outcome. DURABILITY IS LIMITED: the daemon thread does NOT survive the MCP process exiting, and there is NO reaper or automatic resume — if the process dies mi
scan_specBatch-scan the store's open epics against a specification -> a review_result dict (gaps/conflicts/overlaps), epics evaluated in batches.
searchSearch titles/descriptions/comments/tags with bounded discovery results.
set_file_impactRecord file impact (list of {path, reason}) for conflict-aware next-batch scheduling.
set_verify_commandsRecord DD-level verify commands (list of {dd_id, dd_text, command}).
show_ticketShow compiled ticket state (accepts full id, short id, or alias). Includes the computed ``inbound_deps`` (inbound edges: other tickets linking TO this one, with the source's status) alongside the stored outgoing ``deps``.
sign_manifestSign a manifest of verified steps as an asymmetric op-cert.
sign_reviewCheaply (re)persist the plan-review attestation for an already-computed, still-valid PASS verdict from the latest REVIEW_RESULT sidecar -> {ok, signed, ticket_id, verdict, reason, signature?}. WITHOUT re-running the multi-pass LLM review (no LLM, no network).
summaryOne-line-per-ticket summary [{ticket_id, alias, status, title, blocking_summary}].
tag_ticketAdd a tag to a ticket.
ticket_depsShow the dependency graph for a ticket.
transition_ticketTransition a ticket's status (optimistic concurrency). Returns the engine result {ticket_id, from, to, newly_unblocked}.
unlink_ticketswrite actionRemove a link between two tickets, optionally selecting its relation.
untag_ticketwrite actionRemove a tag from a ticket.
validateRepo-wide quality health check (JSON report: score, critical/major/ minor issues, warnings, suggestions). Takes no ticket id.
verify_completionVerify a ticket's completion requirements are met -> a completion_verdict dict {verdict: "PASS"|"FAIL", findings[], summary?, target, reviewers, runner, model, trace_id, source, verified_at_sha, signable}. Checks every acceptance/success/close criterion + definition of done (for bugs, that the bug is resolved) against the implementation; on FAIL, each finding carries the failing criterion, an expl
verify_signatureCertify a ticket's verified-steps manifest against its signature.
Public scan report
scanner v0.1.9 · 2026-09-20 · same rubric, same numbers if you re-run it
- Code scan785 source files scanned3/25
- –Live reliabilityno gateway calls yet and no remote to proben/a
- –Tool poisoningtools not inspected (local package is not executed); not countedn/a
- Auth qualitylocal package, no credentials required12/15
- Maintenancelast push 0 days ago15/15
- Maintainer identityregistry namespace matches repository owner; GitHub account older than a year9/10
Findings (3)
- mediumsubprocess with shell=True
exec.shell-truenava_rebar-0.13.1/src/rebar/_commands/compact_txn.py: …-out (no such subcommand existed; ``shell=True`` injection smell).""" from rebar._…
- mediumeval / new Function used
exec.evalnava_rebar-0.13.1/src/rebar/grounding/detectors/builtin/security_owasp_cwe.yaml: … message: "Dynamic code execution via eval()/exec() — code-injection risk (CWE-94).…
- highShell command built from a string (injection risk)
exec.shell-concatnava_rebar-0.13.1/src/rebar/llm/eval_specs/code-review-base.eval.yaml: …git.py @@ -4,2 +4,3 @@ - subprocess.run(f"git -C {d} add -A", shell=True) + …
Install directly
claude mcp add rebar -- uvx nava-rebar
Rebar: common questions
- Is Rebar MCP server safe?
- With care: it is graded C, so read the findings first (60/100). Read the Rebar safety report
- How do I install Rebar?
- It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.
- Does Rebar need an API key?
- No secret keys are declared. It reads 36 settings from the environment.
- Is Rebar maintained?
- The last commit was in the last day (2026-09-20). The latest release is v0.13.1.
- What can I use instead of Rebar?
- Servers from other publishers that do the same job: Cal Auto Python MCP server, walkerOS Flow MCP server and Atlassian Rovo MCP Server. Compare all Rebar alternatives.
Alternatives to Rebar
Same job from other publishers: the closest match first, then the best rated.
- Cal Auto PythonSchedule a GitHub Projects backlog into Google Calendar, as a CLI or an MCP server.not reviewedGrowingB
walkerOS FlowBuild, validate, simulate, and deploy walkerOS event pipelinesnot reviewedEstablishedB- Atlassian Rovo MCP ServerConnect to Atlassian Jira, Confluence, Loom, and more to search, create, and manage your work.not reviewedEstablishedA
- Atlassian Dc JiraMCP server for Atlassian Jira Data Center - search, view, and create issuesnot reviewedEstablishedB
- Jira StdioMCP server for Jira Cloud — issues, search, comments, attachments, transitions.not reviewedGrowingB