Softwareheritage MCP server

@pipeworx/softwareheritage

The Software Heritage archive of public source code: which repositories have been captured, when each was last captured successfully, and the commits inside them — addressed by content, so they keep resolving after a repository is renamed, moved or deleted.

Part of Pipeworx — an MCP gateway connecting AI agents to 1576+ live data sources.

Tools

matches a substring. Answers "is this project in the archive, and under which URL", which you need before anything else because the archive keys everything on the origin URL.

• originsearch(query, limit?, withvisit?) — find archived origins whose URL

produced a snapshot: date, snapshot id, visit type. Answers "is this code safe, and as of when".

• origin_status(url) — the most recent capture of one repository that actually

first, with each visit's outcome. Answers "how continuously has this been archived", and separates never-archived from archived-for-years-and-unreachable-today.

• origin_visits(url, limit?) — the capture history for one repository, newest

author, committer, dates, tree id, parents. Answers "what was in this commit" for a repository that may no longer exist anywhere else.

• revision(id) — one archived commit by its 40-hex id or SWHID: message,

Auth

Keyless. Anonymous callers get a lower rate-limit bucket than token holders, and the limit is per-IP, so a Worker sharing an egress address with other traffic can be throttled by calls that were not ours. The archive asks callers to identify themselves; this pack sends its own User-Agent.

Data sources

search. Returns a bare JSON array, not an object.

• — origin

latest visit for one origin.

• —

history, paginated with per_page.

• — visit

• — one commit.

Things worth knowing before you touch this:

latest visit whatever its outcome, so a repository archived continuously since 2015 answers status: "notfound" because today's crawl happened to fail — the exact opposite of the question "is this archived". Reproduced on https://github.com/torvalds/linux on 2026-09-03: visit 479 was notfound while visit 478, the day before, was full. origin_status always sets the flag; if you add an endpoint here, set it too.

• visit/latest without requiresnapshot=true is a trap.** It returns the

.git suffix or http vs https makes it a different origin with its own visit history. Resolve with origin_search rather than constructing the URL.

• The origin URL is the key, and it is matched exactly. A trailing slash, a

is the documented shape — do not URL-encode it, the API will not find it.

• The origin URL is embedded in the path, unescaped. /origin/https://…/get/

object. Anything reading these has to handle both.

• Origin endpoints return a bare JSON array, revision endpoints return an

explicit archived: false / error: "revision not archived" so an absence cannot arrive looking like an empty success.

• A 404 means "not archived", not "bad request". This pack turns it into an

Quick Start

Add to your MCP client (Claude Desktop, Cursor, Windsurf, etc.):

{
  "mcpServers": {
    "softwareheritage": {
      "url": "https://gateway.pipeworx.io/softwareheritage/mcp"
    }
  }
}

What this endpoint actually serves

Shortened. The full README is on GitHub.