Proofline

What Proofline MCP server does

Proofline MCP server gives coding agents access to Proofline review information and review workflows through MCP. Its tools cover review status, findings, captured fix context, review requests, review reruns, and re-verification of pushed fixes. Agents can also retrieve repository guidance, wiki content, codebase answers, architecture documents, and plans.

The server is intended for organizations using Proofline to manage repository reviews and related engineering knowledge. A personal Proofline token selects the organization it belongs to, so the agent does not need a separate organization ID.

How it works

Agents can connect to Proofline in two ways. Clients that support remote HTTP and OAuth can connect directly to https://proofline.sh/mcp. Alternatively, the @proofline/mcp npm package provides a local stdio bridge that forwards requests to the hosted service.

The bridge reads newline-delimited JSON-RPC from standard input and writes protocol responses to standard output; diagnostics are sent to standard error. It discovers the hosted tool catalog at runtime and forwards tool results without rewriting them. Requests are processed one at a time, with no automatic retries.

The bridge uses Proofline's stateless JSON transport with protocol version 2025-11-25. Clients must initialize the connection and then send notifications/initialized before invoking tools.

Setup and configuration

For the local bridge, configure an MCP client to run:

{
  "command": "npx",
  "args": ["-y", "@proofline/mcp"],
  "env": {
    "PROOFLINE_TOKEN": "YOUR_PROOFLINE_TOKEN"
  }
}

The package requires Node.js 22 or later and does not require a separate CLI installation or runtime dependency setup. Keep the token in local client configuration or provide it through the environment. On Windows, clients that cannot launch npx directly can invoke it through cmd /c.

Create the token in the Proofline console for the target organization. The default service origin is https://proofline.sh; set PROOFLINE_BASE_URL to the HTTPS origin of a dedicated Proofline deployment. The bridge does not open a browser or store credentials.

Tools and capabilities

Available operations are controlled by token scopes, repository access, and organization policy. Suggested scopes include:

• reviews:read for review information
• guidance:read for repository guidance
• knowledge:read for knowledge resources
• reviews:request for requesting reviews
• reviews:rerun for rerunning reviews
• plans:implement for plan-related implementation workflows

The hosted tool catalog may include review findings, review requests and reruns, fix context, pushed-fix verification, guidance, wiki pages, codebase questions, architecture documents, and plans.

Limitations and notes

Input frames are limited to 8 KiB, responses to 8 MiB, and requests to 30 seconds. The bridge refuses redirects, SSE, and MCP-Session-Id headers. Transport failures exit with status 1, while clean end-of-file input exits with status 0.

A failed mutation may have completed on the service, so inspect the resulting state before retrying. Tool refusals preserve isError: true. Model and repository text is marked as untrusted_text and should be treated as data. States such as PENDING, UNAVAILABLE, incomplete assessments, and NOT_VERIFIED do not prove safety or establish that a fix was verified. No tool grants authority to record a human finding disposition.