# Umbra [Health: Active]

**Category:** 💻 Developer Tools  
**Repository:** https://github.com/elberacasa/umbra  
**GitHub Stars:** 1  
**npm Downloads (last month):** 254  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/umbra

## Description
Trust score for AI-generated code: scan repos, guard agent file writes, get a 0-100 score.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "umbra": {
    "command": "npx",
    "args": ["-y","@elberacasa/umbra"]
  }
}
```

## Documentation

## What Umbra MCP server does

The Umbra MCP server gives MCP-compatible agents access to checks for AI-generated code. Its three documented tools are `scan_repo`, `guard_content`, and `get_score`. Together, they let an agent inspect a repository, evaluate proposed file content before it lands, and request the current trust score.

Umbra’s scanner produces a deterministic score from 0 to 100. Findings include confidence information and file-and-line evidence. High- and medium-confidence findings affect the score, while lower-confidence observations are reported as notes rather than changing the result.

The underlying command-line package can scan a repository, produce JSON output, write an `UMBRA.md` task list, apply fixes described as provably safe, and create or use a baseline. Those command-line flags are separate from the three MCP tools documented for agent use.

## How it works

Static rules form the first layer of analysis. A second layer applies evidence and confidence gating. With the deeper scanner mode, Umbra builds and starts the repository inside a locked-down Docker sandbox, probes it over HTTP, and replays claims such as test status against the running result.

The score uses four axes: SAFE, RUNS, HONEST, and CLEAN. Without deep verification, RUNS and HONEST are not measured. A score below 50 produces exit code 1 in the command-line interface, which can be used as a CI gate.

The Umbra MCP server is appropriate when an agent needs repository-level verification during a coding workflow, or when proposed content should be checked before an agent writes it.

## Setup and configuration

Run the MCP server with the package command shown in the README:

```bash
npx --yes -p @elberacasa/umbra umbra-mcp
```

The package requires Node.js 20 or newer. The README presents the MCP server as a local process and does not list required environment variables or additional configuration values. The regular command-line entry points are `umbra-scan`, `umbra`, and `umbra mcp`; the canonical npm package is `@elberacasa/umbra`.

For agent guardrails outside MCP, Umbra also provides `umbra setup`, `umbra init`, and `umbra protect`. The README specifically describes PreToolUse hooks for Claude Code and Kimi Code, but those hooks are separate from the MCP server tools.

## Tools and capabilities

- `scan_repo`: scan a repository for Umbra findings and scoring data.
- `guard_content`: check content associated with an agent file-write workflow.
- `get_score`: retrieve the repository’s trust score.
- Evidence-backed findings with file-and-line locations.
- Local scanning with optional deeper Docker-based verification in the broader Umbra CLI.
- Machine-readable CLI output through the `--json` flag.

## Limitations and notes

Umbra’s score is rubric-based and versioned; the README identifies the current rubric as version 4. Low-confidence findings can appear as notes without affecting the score. The scanner is designed for repositories and generated code, not as a general-purpose runtime security monitor. The project is licensed under MIT.

_Full upstream README: https://allmcps.com/mcp/umbra/readme_