Plumb MCP server

Connect

One endpoint, Streamable HTTP transport, no authentication.

Endpoint	`https://plumbphp.dev/mcp/v1`
Transport	Streamable HTTP
Auth	None. No key, no signup.

Set up your client

Pick your editor or assistant. Every snippet points at the endpoint above.

Claude Code One command in your terminal

claude mcp add --transport http plumb https://plumbphp.dev/mcp/v1

Claude Code (shared with your team) .mcp.json in the project root, committed to git

{
    "mcpServers": {
        "plumb": {
            "type": "http",
            "url": "https://plumbphp.dev/mcp/v1"
        }
    }
}

Cursor .cursor/mcp.json in the project, or ~/.cursor/mcp.json for every project

{
    "mcpServers": {
        "plumb": {
            "url": "https://plumbphp.dev/mcp/v1"
        }
    }
}

VS Code .vscode/mcp.json in the project

{
    "servers": {
        "plumb": {
            "type": "http",
            "url": "https://plumbphp.dev/mcp/v1"
        }
    }
}

Windsurf ~/.codeium/windsurf/mcp_config.json

{
    "mcpServers": {
        "plumb": {
            "serverUrl": "https://plumbphp.dev/mcp/v1"
        }
    }
}

Claude Desktop Settings, then Connectors, then Add custom connector. No file to edit; paste the URL.

https://plumbphp.dev/mcp/v1

Try asking

Once connected, your agent picks the right tool on its own.

"Audit the dependencies in my composer.json with Plumb."
"Is spatie/laravel-permission well maintained?"
"Compare vendor/a and vendor/b on their Plumb scores and recommend one."
"Why does vendor/name fail the open advisories check, and how would I fix it?"

Tools

What the server exposes, exactly as an agent sees it.

get_package_score read-only

Get the Plumb score for one PHP package: composite and per-category scores with bands, vetoes, freshness, and every check with its verdict and reason. Returns status not_scanned (never an error) when Plumb has no scan yet. For more than one package use audit_packages.

composer_name string, required: Composer package name in vendor/name form, for example laravel/framework.

audit_packages read-only

Score many PHP packages in one call, for example every entry in a composer.json or composer.lock. Up to 50 Composer names per call. Returns each package's scores, band, status, freshness, and the checks needing attention, plus totals, sorted worst first. Use get_package_score for the full check list of a single package.

composer_names array, required: Composer package names in vendor/name form. Skip "php" and "ext-*" entries; they are not packages.
include_passing_checks boolean: Also list every passing check per package. Off by default to keep the result small.

search_packages read-only

Find PHP packages Plumb has scored whose Composer name contains a phrase, for example "permission" or "spatie/". Returns name, description, composite score with band, status, and page URL for each match, closest name match first: an exact name, then the packages of that vendor, then packages with exactly that name, then names that start with the phrase or contain it as a whole word. Among equally close matches, actively maintained packages come before dormant and abandoned ones. Ranking never uses popularity, so search the exact package name when you know it. Use get_package_score on a match for the full detail.

query string, required: Text to match inside the Composer name, for example "laravel-permission" or "spatie/".
limit integer: Maximum matches to return.

list_checks read-only

List every check Plumb runs: id, category, weight, whether it can veto, and a one-line description, optionally filtered to one category. Use explain_check for the full explanation and guide of a single check.

category string: Only list checks in this category.

explain_check read-only

Explain one Plumb check in full: why the practice matters, what is inspected, how the verdict is decided, its veto policy, and a guide to doing well on it. Use this before advising a maintainer how to fix a failing check.

check_id string, required: The check id as returned by other tools, for example security.advisories-open.

request_scan queues work

Ask Plumb to scan a PHP package it has not scored yet, or to refresh a stale score. Returns the current score at once when a fresh one exists; otherwise queues a scan and tells you when to ask again with get_package_score. Limited to a few requests per IP; shared with the public API.

composer_name string, required: Composer package name in vendor/name form, exactly as published on Packagist.

Resources and prompts

Reference material an agent can read directly, and prompt templates it can offer you.

plumb://checks application/json

The catalogue of every check Plumb runs, as JSON: id, category, weight, veto policy, description, and public page for each.

plumb://checks/{id} text/markdown

One check explained in full as Markdown: what it measures, how the verdict is decided, its veto policy, and the guide to the practice. The id is the check id, for example plumb://checks/security.advisories-open.

plumb://scoring text/markdown

How Plumb turns check results into scores: category weights, coverage gates, bands, vetoes, and freshness. Rendered from the scoring code itself.

audit-composer-json prompt · composer_json

Audit every dependency in a composer.json with Plumb and report the ones that need attention.

compare-packages prompt · packages

Compare two or more PHP packages on their Plumb scores and recommend one.

Reading a result

Every result carries the composite and per-category scores (0 to 100) with a band: Good 85 and up, Fair 70 to 84, Concerning 50 to 69, Poor below 50. A status says how to read the numbers: scored, unscored (too little evidence to score fairly, so unknown rather than bad), abandoned (every category pinned to 0), or not_scanned. Vetoes cap a category when a critical check fails, and a stale result is returned with is_stale set rather than withheld. Each check comes with the reason for its verdict and a link to a guide on the practice.

The scoring page explains the weights and vetoes in full, and the checks page lists every check the tools report on.

Rate limits and attribution

Limits are enforced per IP address. Scan requests share one allowance with the public API.

What	Limit
Any request to the endpoint	60 per minute
Package names per `audit_packages` call	50 per call · 300 names per minute
`request_scan`	3 per 15 minutes · 30 per day, shared with the API

Scores an agent shows publicly follow the same rule as the API: "Powered by Plumb", linked to the package page. See the API usage guidelines for caching and attribution, or the API reference if you would rather call the JSON API directly.