feat(mcp): slop self-check tools + release @jsonbored/gittensory-mcp v0.6.0

[JSONbored]

What

Cuts @jsonbored/gittensory-mcp v0.6.0 (last published 0.5.0, 2026-06-12) and brings the npm (stdio) package up to date with the miner-facing tooling shipped since — including two new agent-native slop self-checks newly wired into the package.

New capability — slop self-checks in the package

The hosted /mcp endpoint already served gittensory_check_slop_risk / gittensory_check_issue_slop; this surfaces them to stdio-package users too. They're pure local-metadata (paths + line counts / issue title+body — no repo data, no secrets), so they mirror the lint/pr-text pattern exactly:

• New routes POST /v1/lint/slop-risk + POST /v1/lint/issue-slop (in the session path-allowlist, like /v1/lint/pr-text).
• Both bin tools registered, calling those routes.
• Integration coverage: happy path, schema-invalid, malformed-JSON, and session-token access.

Release mechanics

• packages/gittensory-mcp/package.json: 0.5.0 → 0.6.0.
• CHANGELOG.md: generated mcp-v0.6.0 section (26 MCP-relevant commits — new tools, output-schema hardening, scope/bound fixes, refactor(signals): shared public-safe redaction module #542/feat(learning): calibrate slop & recommendations vs merge outcomes #543 refactors).
• Version pins → latest 0.6.0, minimum stays 0.5.0 (minor, backward compatible): apps/gittensory-ui/src/lib/mcp-package.ts + src/services/mcp-compatibility.ts (the /v1/mcp/compatibility surface).

Not in this release (deliberate)

The other tools added to the hosted /mcp since 0.5.0 — watch_issues, pr_outcome, notifications, predict_gate — are self-scoped / stateful and need per-contributor identity the token-auth stdio bin doesn't carry. They're live on the hosted /mcp endpoint, which is their canonical surface; bringing them to the stdio package is a separate auth-design decision, not bundled here.

Verification

• mcp:release-candidate ✅ SAFE to tag (tag↔version, changelog section, tarball allowlist + secret scan, CLI smoke, tokenless trusted publishing)
• build:mcp ✅ · test:mcp-pack ✅ · typecheck ✅ · test:coverage ✅ (1849 passed; all metrics ≥97) · ui:openapi:check ✅ · UI lint/test ✅ · git diff --check ✅

Merging then tagging mcp-v0.6.0 triggers npm-publish.yml (tokenless --provenance publish + GitHub release).

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	4dc0c17	Commit Preview URL Branch Preview URL	Jun 14 2026, 08:16 PM

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#745 is no longer open.	No action.

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[ghost]

gittensory · advisory review

Reviewed 7 changed file(s) — two independent AI reviewers.

Suggested action: ✅ Safe to merge — both reviewers found no blocking issues.

Reviewer A · gpt-oss-120b — recommends ✅ merge
This PR adds new slop‑risk self‑check tools to the MCP, registers corresponding API routes, updates version constants, compatibility settings, and adds integration tests. The changes are well‑scoped, type‑safe, and respect the public/private boundaries.

Suggestions

• Add a brief comment in the new route handlers documenting that they are advisory‑only and do not perform any repo data fetches.
• Consider adding a test that verifies unauthorized (no token) requests to the new slop endpoints are rejected if that is intended.
• Update the public API documentation to include the new /v1/lint/slop-risk and /v1/lint/issue-slop endpoints.

Worth double-checking

• Ensure that the imported symbols buildSlopAssessment, buildIssueSlopAssessment, SLOP_RUBRIC_MARKDOWN, and ISSUE_SLOP_RUBRIC_MARKDOWN exist and are exported correctly from ../signals/slop.
• Confirm that allowing any session to access the new slop endpoints aligns with the intended security model.

Reviewer B · mistral-small-3.1-24b-instruct — recommends ✅ merge
This PR adds new slop self-check tools to the MCP package and updates the API to support these tools. The changes are well-structured and include necessary updates to the package version, compatibility checks, and tests. The overall quality is high.

Suggestions

• Consider adding detailed comments to the new tools in bin/gittensory-mcp.js to explain their purpose and usage.
• Ensure that the new API endpoints are documented in the API documentation.

Worth double-checking

• Verify that the new slop self-check tools do not introduce any regressions in existing functionality.
• Check that the new API endpoints are properly secured and do not expose sensitive information.
• Ensure that the tests cover all edge cases for the new slop self-check tools.

Before = production · After = this PR's preview deploy.

Route	Viewport	Before	After
/	desktop
	mobile