Marboba MCP server

Read from the package source without running it. The installed server may list more.

• create_apiwrite action

  Register an API in the catalog (REST/GraphQL/gRPC/AsyncAPI). Requires `write` scope. Defaults kind to 'rest' and lifecycle to 'experimental' if omitted.

• create_dependencywrite action

  Create a dependency edge between two catalog entities (for impact analysis). Requires `write` scope. Both endpoints must already exist; self-edges and duplicates are rejected.

• create_domainwrite action

  Create a business domain — a top-level grouping of systems (e.g. 'Payments'). Requires `write` scope.

• create_issuewrite action

  File an issue (bug / enhancement / feature / task) against a project. Requires `write` scope. appId and title are required.

• create_oncall_bindingwrite action

  Bind an on-call schedule to a team or component. Requires `write` scope. scheduleId is required unless provider is 'manual'.

• create_projectwrite action

  Create a new project (app/component) in the catalog. Requires the PAT's `write` scope. Returns the created project.

• create_resourcewrite action

  Register an infrastructure resource (database, queue, bucket, vault). Requires `write` scope. Defaults kind/provider to 'other' and lifecycle to 'experimental'.

• create_runbookwrite action

  Create a runbook. Requires `write` scope. title and runbookType are required (e.g. incident / deployment / rollback).

• create_slowrite action

  Create an SLO for a project. Requires `write` scope. name, appId, type, target, and window are required.

• create_systemwrite action

  Create a system — a group of components, APIs, and resources that ship together. Requires `write` scope.

• create_teamwrite action

  Create a new team. Requires `write` scope. Returns the created team.

• delete_apiwrite action

  Delete a catalog API. Requires the PAT's `admin` scope.

• delete_dependencywrite action

  Delete a dependency edge by its edge id. Requires the PAT's `admin` scope. (Edges are immutable — to change one, delete and recreate.)

• delete_domainwrite action

  Delete a business domain. Requires the PAT's `admin` scope.

• delete_issuewrite action

  Delete an issue and its activity history. Requires the PAT's `admin` scope.

• delete_oncall_bindingwrite action

  Delete an on-call binding. Requires the PAT's `admin` scope.

• delete_projectwrite action

  Permanently delete a project from the catalog. Requires the PAT's `admin` scope. This cannot be undone.

• delete_resourcewrite action

  Delete an infrastructure resource. Requires `admin` scope.

• delete_runbookwrite action

  Delete a runbook (soft-delete). Requires the PAT's `admin` scope.

• delete_slowrite action

  Delete an SLO and its snapshot history. Requires the PAT's `admin` scope.

• delete_systemwrite action

  Delete a system. Requires the PAT's `admin` scope.

• delete_teamwrite action

  Delete a team. Requires the PAT's `admin` scope.

• fetch_api_spec

  Fetch the live OpenAPI / AsyncAPI / GraphQL schema for an API by id. Returns the raw spec content + format. Use this when the LLM needs to call the API and wants endpoint shapes.

• get_agent_runwrite action

  Fetch a single agent run by id — status, approver, action, payload, audit trail.

• get_api

  Fetch a single API by id with owner, spec format, and metadata.

• get_deployment

  Fetch a single deployment by id with status, app, environment, build artifact, and timestamps.

• get_domain

  Fetch a single domain by id.

• get_issue

  Fetch a single issue (bug / feature / task) by id with its full activity stream.

• get_oncall_binding

  Fetch a single on-call binding by id with the full rotation schedule.

• get_project

  Fetch a single project by id, with full catalog detail (owner team, on-call binding, scorecard summary, environments, dependencies). Use this when the user names a specific project or after list_projects narrows the choice.

• get_resource

  Fetch a single resource by id.

• get_runbook

  Fetch a single runbook by id with the full markdown body, linked apps, and execution metadata. Use this when the user identifies a specific runbook to read or follow.

• get_scorecard

  Fetch a single scorecard by id with the full check list.

• get_slo

  Fetch a single SLO by id with full metric history.

• get_system

  Fetch a single system by id with its full membership list.

• get_team

  Fetch a single team by id with full member + ownership detail.

• list_agent_actions

  List the agent actions registered in this org (rotate-vault-secret, scale-service, rollback-to-last-green, etc) — what they do, blast radius, approval requirements.

• list_apis

  List every API in the org's catalog (REST/GraphQL/gRPC/AsyncAPI). Returns id, name, owner, spec format, and link to the live OpenAPI/AsyncAPI spec. Use this when the user asks 'what APIs are there', 'where's the auth API', or wants to discover endpoints to call.

• list_dependencies

  List every cross-component dependency edge in the catalog. Useful for impact analysis.

• list_domains

  List business domains — top-level groupings of systems (e.g., 'Payments', 'Identity').

• list_drift

  List drift snapshots — places where deployed config has diverged from what the catalog says it should be.

• list_integrations

  List every third-party integration the org has connected (GitHub / GitLab / Bitbucket / Slack / Jira / etc).

• list_oncall_schedules

  List every on-call binding for the org — which team or person is on-call for each project, the rotation cadence, and current+next on-call. Use this when the user asks 'who's on-call for X' or 'who do I page'.

• list_projects

  List every project (app/component/resource) in the org's MarBoba catalog. Returns id, name, internalCode, platform, environments, and lifecycle. Use this when the user asks 'what projects do we have', 'show me everything in the catalog', or before drilling into a specific project.

• list_resources

  List infrastructure resources (databases, queues, buckets, secrets-vaults). Returns id, kind, owner team, environment, and links to the underlying cloud resource.

• list_runbooks

  List every runbook in the org. Returns id, title, runbookType (incident/deployment/rollback/etc), linked apps, and severity links. Use this when the user is dealing with an outage or asks 'what's our runbook for X'.

• list_scaffold_templates

  List project scaffolding templates available in this org (org templates + first-party catalog).

• list_scorecards

  List every scorecard in the org (production-readiness, security, reliability, etc) with their checks and per-project pass/fail counts.

• list_secrets

  List vault secrets metadata (NEVER values — names, environments, last-rotated, expiry only).

• list_slos

  List every SLO in the org with target, error budget, and current burn rate.

• list_systems

  List logical systems — collections of projects + APIs + resources that ship together (e.g., 'Checkout', 'Auth Platform').

• list_teams

  List every team in the org. Returns id, name, members, and the projects each team owns. Use this when the user asks 'who owns X' or 'which team handles Y'.

• propose_agent_action

  Propose a privileged production action (rotate-vault-secret, rollback-to-last-green, scale-service). Requires `write` scope. This does NOT execute — it opens an agent run that a different human approves in the web app's two-person flow.

• refresh_oncall_binding

  Re-resolve an on-call binding against its provider to pull the current + next on-call. Requires `write` scope.

• update_apiwrite action

  Update a catalog API. Requires `write` scope. Pass apiId plus at least one field to change.

• update_domainwrite action

  Update a business domain. Requires `write` scope. Pass domainId plus at least one field to change.

• update_issuewrite action

  Update an issue. Requires `write` scope. Pass issueId plus at least one field. Enum fields (severity/status/issueType) are strictly validated.

• update_oncall_bindingwrite action

  Update an on-call binding's label (the only mutable field — structural changes need delete + recreate). Requires `write` scope.

• update_projectwrite action

  Update a project's name, description, owning team, or archived flag. Requires `write` scope. Pass projectId plus any fields to change.

• update_resourcewrite action

  Update an infrastructure resource. Requires `write` scope. Pass resourceId plus at least one field to change.

• update_runbookwrite action

  Update a runbook. Requires `write` scope. Pass runbookId plus at least one field to change.

• update_slowrite action

  Update an SLO. Requires `write` scope. Pass sloId plus at least one field. Changing type/target/window recomputes the error budget.

• update_systemwrite action

  Update a system's metadata or membership. Requires `write` scope. Pass systemId plus at least one field; id arrays replace the existing list.

• update_teamwrite action

  Update a team's name, description, color, Slack channel, lead, or members. Requires `write` scope. Pass teamId plus fields to change.

• Code scan11 source files scanned25/25
• –Live reliabilityno gateway calls yet and no remote to proben/a
• –Tool poisoningtools not inspected (local package is not executed); not countedn/a
• Auth qualitystatic API keys via environment variables6/15
• Maintenancerepository not readable: repo not found3/15
• Maintainer identityno repository or website to verify2/10

Safety score

55/100

higher than 12% of 4,460 AI and agents servers

Tools

64

the typical AI and agents server has 6

Tools that change things

52%

typical: 0%. Fewer write tools means less an agent can break

Downloads a week

18

more than 5% of 1,538 AI and agents servers with a package

Marboba: common questions

Is Marboba MCP server safe?

With care: it is graded C, so read the findings first (55/100). Read the Marboba safety report

How do I install Marboba?

It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.

Does Marboba need an API key?

Yes. The registry entry asks for MARBOBA_API_TOKEN.

Is Marboba maintained?

The latest release is v0.2.2.

What can I use instead of Marboba?

Servers from other publishers that do the same job: WaveSpeed MCP server, three.ws Marketplace MCP server and Ausca MCP server.

How does Marboba compare with other AI and agents MCP servers?

safety score 55/100 (higher than 12% of 4,460 AI and agents servers); tools 64 (the typical AI and agents server has 6); tools that change things 52% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.