Mmcp.market

Rebar MCP server

by navapbc·io.github.navapbc/rebar·v0.13.1

Event-sourced ticket tracker + Jira reconciler, exposed as a Python library, CLI, and MCP server.

C60/100grade C
What users say
No reviews yet
Be the first
Safety scan
C60/100

full report

Adoption
Growing

4 stars89 downloads/wk

Reviews

Write one

Nobody has reviewed Rebar yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Rebar tools (61, 12 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • archive_ticket

    Archive a ticket (excludes it from the default list).

  • attach_commits

    Retroactively link commits to a ticket by SHA (union-add, idempotent).

  • audit_trail

    The full audit read surface for a ticket (story 46f0): its FULL retained plan-review sidecar history (newest-first), its completion attestation + sidecar record, and the associated code reviews (``code_review`` tickets that link ``relates_to`` this ticket, each with its own retained sidecar history). Best-effort aggregation over the observability sidecars — individual reader failures degrade to ``

  • bridge_check_accesswrite action

    Run the six-step live Jira capability check and return its typed verdict.

  • bridge_fsck

    Offline bridge audit -> {unknown_event_types, binding_drift, store_integrity}.

  • bridge_pause

    Persist a durable reconciliation pause with its operator reason.

  • bridge_preview

    Compute proposed Jira changes without applying them.

  • bridge_projects_list

    Return the store's bridge-projects sync mapping ``{key: {"repos": [...]}}``.

  • bridge_projects_removewrite action

    Remove a bridge project key from the mapping (error if absent).

  • bridge_projects_set

    Set a bridge project key's repos (REPLACE semantics; idempotent).

  • bridge_resume

    Clear the durable reconciliation pause.

  • bridge_runwrite action

    Run one scheduled bridge profile and strictly deliver its ticket events.

  • bridge_status

    Read the durable bridge status snapshot and optional freshness assertion.

  • bridge_sync

    Apply proposed Jira changes, optionally with an explicit change limit.

  • check_ac

    Check the ticket has an Acceptance Criteria block ({verdict, criteria_count, reason, passed}).

  • claim_ticket

    Atomically claim an OPEN ticket (-> in_progress + assignee).

  • clarity_check

    Score ticket clarity (score / verdict / threshold / passed).

  • comment_ticket

    Append a comment to a ticket.

  • compact_ticket

    Compact a ticket's event log (or all tickets if id omitted).

  • create_ideawrite action

    Capture an undesigned idea: create an epic in status 'idea' atomically.

  • create_identitywrite action

    Create an identity entity: a gate-/graph-exempt ticket recording a person/agent. ``name`` is the title; ``email`` plus ``mappings`` (list of {provider, external_id}) and ``keys`` (OpenSSH authorized-keys lines) ride the CREATE and surface in show_ticket. Returns {id, alias}.

  • create_ticketwrite action

    Create a ticket; returns {id, alias} (agents get the alias without a second show()). A non-null description_warning means the description exceeds the plan-review admission cap while the claim gate is on — the ticket was still created, but claiming it needs a review that refuses the description as-is. A non-null duplicate_warning means another ticket with the same normalized title was created insid

  • declare_no_file_impact

    Declare that a ticket has no repository-file impact, with a reason.

  • edit_ticket

    Edit ticket fields (title/priority/assignee/description/ticket_type).

  • explain_criterion

    Explain a plan-review criterion — its authoring-guide section (epic cite-stone-sea / WS10) — OR print an author-facing prose guide when ``criterion_id`` is a guide name (``plan`` = how to write a passing plan; ``review`` = how to pass code review; ``commit-trailer`` = the required ``rebar-ticket:`` commit-trailer format). A pure registry/guide READ (no LLM, so it is NOT gated on REBAR_MCP_ALLOW_LL

  • fsck

    Check ticket-store integrity (JSON validity, CREATE presence, lock cleanup). Set recover=True to run the recovery path.

  • get_file_impact

    Get the file-impact array (consumed by next-batch conflict scheduling).

  • get_verify_commands

    Get the DD-level verify-commands array for a ticket.

  • get_workflow_result

    Read a workflow run's outputs via replay -> {run_id, status, terminal_step, terminal_output, outputs, error}. The terminal step's output is the run result.

  • get_workflow_status

    Read a workflow run's current status via replay (no execution) -> {run_id, ticket_id, workflow_name, status, terminal_step, error, steps}.

  • grounding_info

    The STATIC code-grounding oracle integration contract (epic 8f6c): the closed dimension-ID vocabulary + version, the reference kinds, the closed abstain-reason enum (+ outcome/job/tier vocabularies), and the available backends with their detected availability/version. A fast, deterministic, repo-independent discovery surface (no repo is scanned). Takes no args.

  • link_tickets

    Link two tickets (one of the seven canonical relations: blocks | depends_on | relates_to | duplicates | supersedes | discovered_from | caused_by).

  • list_tickets

    List tickets as a JSON array, with optional filters.

  • log_session

    Append a verbose entry to the current session_log, creating one on first use (write-gated: refused under REBAR_MCP_READONLY=1). Returns the log's {id, alias}; optional relates_to / discovered_from link it to the work it documents.

  • next_batch

    Next parallel batch of unblocked tickets under an epic's hierarchy.

  • plan_review_status

    Is this ticket's plan-review attestation current RIGHT NOW? Read-only.

  • quality_check

    Check ticket dispatch readiness ({verdict, line_count, keyword_count, ac_items, file_impact, reason, passed}).

  • ready_tickets

    List tickets ready to work (all blockers closed). ``sort`` orders by ``priority|created|updated|id|status`` (prefix ``-`` for descending; unset values sort last).

  • recent_session_logs

    The newest session_log tickets, newest first (by created_at; default limit 5). session_logs are hidden from list_tickets; this is the type-specific read that surfaces them.

  • reconcilewrite action

    Run the Jira reconciler. Defaults to a non-mutating dry-run.

  • render_workflow

    Render a workflow (a .rebar/workflows/<name> name or a file path) to a read-only Mermaid flowchart (TEXT; the host renders it to SVG, never committed). Large graphs degrade to a text outline. Read tool, always available.

  • reopen_ticket

    Reopen a closed ticket (closed -> open). Optimistic-concurrency: raises a tool error if the ticket is not currently closed.

  • review_codewrite action

    Run a multi-reviewer LLM code review of a git range (base..head) -> an aggregated review_result dict (findings carry agreement + reviewers).

  • review_planwrite action

    Run the plan-review gate on a ticket -> a plan_review_verdict dict {verdict: "PASS"|"BLOCK"|"INDETERMINATE", blocking[], advisory[], coaching[], indeterminate[], coverage, signature?, source, verified_at_sha, ...}. A deterministic Layer-1 floor (P1-P9) plus a four-pass (find -> verify -> decide -> coach) review of the ticket's whole plan — the inverse of verify_completion. On a non-blocking PASS i

  • run_workflowwrite action

    Start a workflow run; returns {run_id, ticket_id, status:'running'} IMMEDIATELY (async — the run executes on a background **daemon thread**, so it survives client request timeouts). Poll get_workflow_status / get_workflow_result to read its outcome. DURABILITY IS LIMITED: the daemon thread does NOT survive the MCP process exiting, and there is NO reaper or automatic resume — if the process dies mi

  • scan_spec

    Batch-scan the store's open epics against a specification -> a review_result dict (gaps/conflicts/overlaps), epics evaluated in batches.

  • search

    Search titles/descriptions/comments/tags with bounded discovery results.

  • set_file_impact

    Record file impact (list of {path, reason}) for conflict-aware next-batch scheduling.

  • set_verify_commands

    Record DD-level verify commands (list of {dd_id, dd_text, command}).

  • show_ticket

    Show compiled ticket state (accepts full id, short id, or alias). Includes the computed ``inbound_deps`` (inbound edges: other tickets linking TO this one, with the source's status) alongside the stored outgoing ``deps``.

  • sign_manifest

    Sign a manifest of verified steps as an asymmetric op-cert.

  • sign_review

    Cheaply (re)persist the plan-review attestation for an already-computed, still-valid PASS verdict from the latest REVIEW_RESULT sidecar -> {ok, signed, ticket_id, verdict, reason, signature?}. WITHOUT re-running the multi-pass LLM review (no LLM, no network).

  • summary

    One-line-per-ticket summary [{ticket_id, alias, status, title, blocking_summary}].

  • tag_ticket

    Add a tag to a ticket.

  • ticket_deps

    Show the dependency graph for a ticket.

  • transition_ticket

    Transition a ticket's status (optimistic concurrency). Returns the engine result {ticket_id, from, to, newly_unblocked}.

  • unlink_ticketswrite action

    Remove a link between two tickets, optionally selecting its relation.

  • untag_ticketwrite action

    Remove a tag from a ticket.

  • validate

    Repo-wide quality health check (JSON report: score, critical/major/ minor issues, warnings, suggestions). Takes no ticket id.

  • verify_completion

    Verify a ticket's completion requirements are met -> a completion_verdict dict {verdict: "PASS"|"FAIL", findings[], summary?, target, reviewers, runner, model, trace_id, source, verified_at_sha, signable}. Checks every acceptance/success/close criterion + definition of done (for bugs, that the bug is resolved) against the implementation; on FAIL, each finding carries the failing criterion, an expl

  • verify_signature

    Certify a ticket's verified-steps manifest against its signature.

Public scan report

scanner v0.1.9 · 2026-09-20 · same rubric, same numbers if you re-run it

1 high2 medium
  • Code scan785 source files scanned3/25
  • Live reliabilityno gateway calls yet and no remote to proben/a
  • Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 0 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year9/10

Findings (3)

  • mediumsubprocess with shell=Trueexec.shell-true
    nava_rebar-0.13.1/src/rebar/_commands/compact_txn.py: …-out (no such subcommand existed; ``shell=True`` injection smell).""" from rebar._…
  • mediumeval / new Function usedexec.eval
    nava_rebar-0.13.1/src/rebar/grounding/detectors/builtin/security_owasp_cwe.yaml: … message: "Dynamic code execution via eval()/exec() — code-injection risk (CWE-94).…
  • highShell command built from a string (injection risk)exec.shell-concat
    nava_rebar-0.13.1/src/rebar/llm/eval_specs/code-review-base.eval.yaml: …git.py @@ -4,2 +4,3 @@ - subprocess.run(f"git -C {d} add -A", shell=True) + …
Overall 60/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

Install directly

claude mcp add rebar -- uvx nava-rebar
Add to Cursor

Rebar: common questions

Is Rebar MCP server safe?
With care: it is graded C, so read the findings first (60/100). Read the Rebar safety report
How do I install Rebar?
It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.
Does Rebar need an API key?
No secret keys are declared. It reads 36 settings from the environment.
Is Rebar maintained?
The last commit was in the last day (2026-09-20). The latest release is v0.13.1.
What can I use instead of Rebar?
Servers from other publishers that do the same job: Cal Auto Python MCP server, walkerOS Flow MCP server and Atlassian Rovo MCP Server. Compare all Rebar alternatives.

Alternatives to Rebar

Same job from other publishers: the closest match first, then the best rated.

All Rebar alternatives →
  • Cal Auto Python
    Schedule a GitHub Projects backlog into Google Calendar, as a CLI or an MCP server.
    B
  • walkerOS Flow
    Build, validate, simulate, and deploy walkerOS event pipelines
    B
  • Atlassian Rovo MCP Server
    Connect to Atlassian Jira, Confluence, Loom, and more to search, create, and manage your work.
    A
  • Atlassian Dc Jira
    MCP server for Atlassian Jira Data Center - search, view, and create issues
    B
  • Jira Stdio
    MCP server for Jira Cloud — issues, search, comments, attachments, transitions.
    B

More from navapbc