Log inSubmit server
Umbra logo

Umbra

Scan repositories, guard agent-written content, and retrieve deterministic 0–100 trust scores through MCP tools.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Umbra

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "umbra": {
      "command": "npx",
      "args": [
        "-y",
        "@elberacasa/umbra"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

We couldn’t confirm it starts correctly

We ran the install command but it didn't respond within our test window — this can mean a slow first-time install rather than a real problem.

npx -y @elberacasa/umbra

No response to initialize.

This is an experimental automated check and can have false negatives — missing environment variables, a slow cold install, etc. It doesn’t necessarily mean something’s wrong. Last checked 5d ago.

Overview

The Umbra MCP server connects AI agents to Umbra’s local code-trust checks for repository scanning, write guarding, and score retrieval. It exposes `scan_repo`, `guard_content`, and `get_score` through the MCP interface, while Umbra’s underlying scanner reports evidence-backed findings and a 0–100 score. Reach for it when an MCP-native coding agent needs to verify generated code or inspect content before it is written. The package runs locally through `npx` and requires Node.js 20 or newer.

Use cases

  • Scan an AI-generated repository before review
  • Guard agent-written file content before it lands
  • Retrieve a repository trust score in an MCP workflow
  • Gate generated code using Umbra’s score

Key features

  • Repository scanning
  • Pre-write content guarding
  • 0–100 trust scores
  • File-and-line finding evidence
  • Confidence-based scoring
  • Local MCP execution

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 1d ago

Recent health check succeeded.

9/9 checks healthy over the last 51d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 15d ago via OSV.dev · @elberacasa/umbra (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars1Stargazers on the source repository.
npm downloads254Package downloads in the last 30 days.
Last commit3mo agoMost recent push to the default branch.
Install checkInconclusiveDidn't respond in our test window — often a slow first install.

How Umbra works

What Umbra MCP server does

The Umbra MCP server gives MCP-compatible agents access to checks for AI-generated code. Its three documented tools are scan_repo, guard_content, and get_score. Together, they let an agent inspect a repository, evaluate proposed file content before it lands, and request the current trust score.

Umbra’s scanner produces a deterministic score from 0 to 100. Findings include confidence information and file-and-line evidence. High- and medium-confidence findings affect the score, while lower-confidence observations are reported as notes rather than changing the result.

The underlying command-line package can scan a repository, produce JSON output, write an UMBRA.md task list, apply fixes described as provably safe, and create or use a baseline. Those command-line flags are separate from the three MCP tools documented for agent use.

How it works

Static rules form the first layer of analysis. A second layer applies evidence and confidence gating. With the deeper scanner mode, Umbra builds and starts the repository inside a locked-down Docker sandbox, probes it over HTTP, and replays claims such as test status against the running result.

The score uses four axes: SAFE, RUNS, HONEST, and CLEAN. Without deep verification, RUNS and HONEST are not measured. A score below 50 produces exit code 1 in the command-line interface, which can be used as a CI gate.

The Umbra MCP server is appropriate when an agent needs repository-level verification during a coding workflow, or when proposed content should be checked before an agent writes it.

Setup and configuration

Run the MCP server with the package command shown in the README:

Terminal
npx --yes -p @elberacasa/umbra umbra-mcp

The package requires Node.js 20 or newer. The README presents the MCP server as a local process and does not list required environment variables or additional configuration values. The regular command-line entry points are umbra-scan, umbra, and umbra mcp; the canonical npm package is @elberacasa/umbra.

For agent guardrails outside MCP, Umbra also provides umbra setup, umbra init, and umbra protect. The README specifically describes PreToolUse hooks for Claude Code and Kimi Code, but those hooks are separate from the MCP server tools.

Tools and capabilities

  • scan_repo: scan a repository for Umbra findings and scoring data.
  • guard_content: check content associated with an agent file-write workflow.
  • get_score: retrieve the repository’s trust score.
  • Evidence-backed findings with file-and-line locations.
  • Local scanning with optional deeper Docker-based verification in the broader Umbra CLI.
  • Machine-readable CLI output through the --json flag.

Limitations and notes

Umbra’s score is rubric-based and versioned; the README identifies the current rubric as version 4. Low-confidence findings can appear as notes without affecting the score. The scanner is designed for repositories and generated code, not as a general-purpose runtime security monitor. The project is licensed under MIT.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Umbra

Umbra is an MCP server that connects AI agents to local code-trust checks for repositories and proposed file content. Its main tools are `scan_repo` for repository analysis, `guard_content` for write-time checks, and `get_score` for retrieving a 0–100 trust score with evidence-backed findings.

Run `npx --yes -p @elberacasa/umbra umbra-mcp` to start it. Umbra requires Node.js 20 or newer, and the README presents the server as a local process without required environment variables.

It provides `scan_repo`, `guard_content`, and `get_score`. These tools cover repository scanning, checks on content involved in agent file writes, and retrieval of the repository trust score.

Yes. The README names Cursor among the agents that can use Umbra workflows, including its trust-review skill. It also describes `umbra-mcp` for MCP-native agents, but does not provide Cursor-specific setup details.

Docker is required for Umbra’s optional deep verification mode, which builds and boots a repository in a locked-down sandbox.

Related MCP servers

All in Developer Tools All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewUmbra AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/umbra?style=directory)](https://allmcps.com/mcp/umbra)
HTML Embed
<a href="https://allmcps.com/mcp/umbra"><img src="https://allmcps.com/api/badge/umbra?style=directory" alt="Umbra on AllMCPs" /></a>