dispatch (misospace/dispatch) is an MCP server listed on the M8ven Trust Index. It scores 74 out of 100, grade C. It declares 13 tools. No publisher has claimed this listing.

Emerging

74/100

dispatch

Item: dispatch
Rating: 74
Author: M8ven

Harness-agnostic Kanban and work dispatch for AI agents working GitHub Issues and PRs.

→ misospace/dispatch · listed on github_repo_search

Emerging. No concerning findings. Grades remain capped until the project builds reputation through adoption. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every push why connect →

Who stands behind it

misospace

Source: github_repo_search

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

GitHub

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

🔐

You'll be asked for 9 credentials: DISPATCH_AGENT_TOKEN, DISPATCH_AUTH_PASSWORD, DISPATCH_GROOMER_TOKEN, DISPATCH_LLM_API_KEY, DISPATCH_OIDC_CLIENT_SECRET, GITHUB_APP_PRIVATE_KEY, GITHUB_TOKEN, NEXTAUTH_SECRET, OPENAI_API_KEY

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// tools this server exposes13 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

resolve_issue

Resolve a Dispatch issue by repo full name and issue number. Returns issue ID, title, URL, labels, status, and lane classification.

claim_issue

Claim a Dispatch issue for an agent. Adds the agent/* label on GitHub and in the local cache. Use force=true to override existing assignments. If agentName is omitted, falls back to DISPATCH_AGENT_NAME env var. Error if neither is set — do not use generic identities like 'Dispatch MCP'.

unclaim_issue

Release an agent's claim on a Dispatch issue: removes the agent/* label, releases the lease (and AgentWork records on the operator path), and reports the resulting status in the response. Status handling: status/in-progress flips to status/ready, so it is immediately re-claimable; status/blocked fli…

get_queue

Fetch an agent's ranked work queue (PR-fix items first, then ranked issues). Optionally filter by lane. If agentName is omitted, falls back to DISPATCH_AGENT_NAME env var.

list_issues

List Dispatch-tracked issues with optional filters: repo, status (backlog|ready|in-progress|in-review|done), lane, agent, priority. Open issues only unless includeClosed.

list_pr_fixes

List queued PR-fix items (CI failures, CHANGES_REQUESTED reviews, merge conflicts) awaiting a fix push. Optionally filter by lane (e.g. 'NORMAL', 'ESCALATED') or include BLOCKED items.

mark_pr_fix

Mark a PR-fix queue item's outcome after working it: status one of 'fixed', 'blocked', 'stale', or 'ignored', with an optional note. Writes an audit row.

requeue_pr_fix

Return a BLOCKED pr-fix item to QUEUED with its attempt counter reset, so the loop works it again. Refuses if the upstream PR is already merged or closed. Writes an audit row.

run_groomer

Trigger a hosted groomer run immediately instead of waiting for the scheduled cron: grooms one backlog candidate into a claimable lane. Optionally target a specific issue via repoFullName + issueNumber. Rate-limited server-side.

set_issue_status

Set the status label on a Dispatch issue (e.g. 'in-progress', 'in-review', 'done', 'blocked'). Transitions the status/ label on GitHub and in the local cache. Setting 'blocked' requires a non-empty blockedReason and parks the issue out of agent circulation until a human or targeted groomer run revis…

claim_work

Convenience tool that resolves, claims, and sets status on an issue in one call. Returns a compact task contract with issue context for the agent to work against. Automatically refreshes the issue from GitHub if not found in cache (refreshBeforeClaim defaults to true). If agentName is omitted, falls…

refresh_issue

Refresh a single issue from GitHub and upsert it into the Dispatch cache. Useful for syncing newly-created issues before claiming them.

sync_repo

Sync all open issues for a specific tracked repository. Faster than a full sync when you only need one repo updated.

// environment variables

To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.

configAUTH_URLPublic base URL used to construct the OIDC callback (/api/auth/callback/...). Optional; falls back to NEXTAUTH_URL. Set this when Dispatch sits behind a reverse proxy that rewrites the public origin.

configDISPATCH_AGENT_NAMEDisplay name used by the agent when posting heartbeats. Defaults to the host's HOSTNAME env var.

🔐 secretDISPATCH_AGENT_TOKENBearer token for agent API authentication

configDISPATCH_AUTH_MODEAuthentication mode: "basic" (HTTP Basic Auth), "oidc" (OIDC/SSO), "disabled" (no auth, local development only — see [Operational Notes](#operational-notes)), or unset (legacy mode)

🔐 secretDISPATCH_AUTH_PASSWORDPassword for Basic Auth — required when DISPATCH_AUTH_MODE=basic

configDISPATCH_AUTH_USERNAMEUsername for Basic Auth — required when DISPATCH_AUTH_MODE=basic

configDISPATCH_CI_FAILURE_LABELSComma-separated labels applied to those issues. Defaults to type/bug,status/ready. Set to an empty string to apply none.

configDISPATCH_CLOSED_ISSUE_RETENTION_DAYSDays that a closed issue is kept before /api/issues/prune-closed is allowed to remove it. Defaults to 30.

configDISPATCH_DATABASE_URLAlternative database URL alias — used if DATABASE_URL is not set

configDISPATCH_DEFERRAL_TTL_DAYS

configDISPATCH_DONE_RETENTION_DAYSDays that a done issue is kept before the issue list endpoint filters it out. Defaults to 7.

configDISPATCH_EXCLUDED_LABELSComma-separated label names excluded from triage, grooming, and queue calculations. Useful for hiding labels like wontfix or duplicate from the operator UI.

configDISPATCH_GROOMER_COMMENT_COOLDOWN_HOURSSuppresses repeated hosted-groomer comments on the same issue. Defaults to 24.

configDISPATCH_GROOMER_DRY_RUNDefaults to true; when true, returns a mutation plan without GitHub or DB writes.

configDISPATCH_GROOMER_MAX_CONTEXT_BYTESIssue context budget sent to the model. Defaults to 8192.

configDISPATCH_GROOMER_MAX_CONTEXT_FILESMaximum files included in repository context. Defaults to 5.

configDISPATCH_GROOMER_MAX_DIR_ENTRIES

configDISPATCH_GROOMER_MAX_FILE_BYTESMaximum bytes per fetched file snippet. Defaults to 4096.

configDISPATCH_GROOMER_MAX_ROUNDS

configDISPATCH_GROOMER_MAX_SEARCHESMaximum GitHub code searches per grooming run. Defaults to 3.

configDISPATCH_GROOMER_MAX_SEARCH_RESULTS

configDISPATCH_GROOMER_MAX_TOOL_CALLS

configDISPATCH_GROOMER_MODELModel name sent to the chat completions API. Required when hosted grooming is enabled.

configDISPATCH_GROOMER_REPO_CONTEXT_ENABLEDEnables bounded GitHub API repository context. Defaults to false.

configDISPATCH_GROOMER_TIMEOUT_MSLLM request timeout. Defaults to a scaled value of 60s + 5s/KB of maxContextBytes, clamped to 60s–300s.

🔐 secretDISPATCH_GROOMER_TOKENOptional bearer token for scheduled/admin groomer invocations.

configDISPATCH_GROOMER_TOOL_LOOP_ENABLED

configDISPATCH_HOSTED_GROOMER_ENABLEDEnables POST /api/groomer/run when set to true or 1. Defaults to disabled.

configDISPATCH_LANE_CONFIG_JSON2 } }. Tiers render as prioritized columns in the queue UI. When unset, lanes are auto-derived from labels prefixed with lane/.

configDISPATCH_LESSON_FEED_ENABLEDOpt-in gate for the lesson feed (#970). When unset, or anything other than the literal string "true", extractLessonFromFixOutcome() in src/lib/lesson-feed.ts returns no_lesson without making any LLM call. The pr-fix queue no longer fires the feed automatically — deployments that want their own downstream (dedupe via lessonAlreadyCovered + open an AGENTS.md PR) must enable this env var and wire the call themselves.

configDISPATCH_LESSON_FEED_MODELModel for the lesson feed. Takes precedence over DISPATCH_GROOMER_MODEL and OPENAI_MODEL.

🔐 secretDISPATCH_LLM_API_KEYLLM provider API key. Required when hosted grooming is enabled.

configDISPATCH_LLM_BASE_URLOpenAI-compatible base URL, without /chat/completions. Required when hosted grooming is enabled.

configDISPATCH_OIDC_CLIENT_IDOIDC client ID — required when DISPATCH_AUTH_MODE=oidc

🔐 secretDISPATCH_OIDC_CLIENT_SECRETOIDC client secret — required when DISPATCH_AUTH_MODE=oidc. Never exposed to the browser.

configDISPATCH_OIDC_ISSUEROIDC provider issuer URL (e.g., https://auth.example.com). Discovery URLs ending in /.well-known/openid-configuration are also accepted for compatibility. Required when DISPATCH_AUTH_MODE=oidc

configDISPATCH_QUEUE_AGING_DAYS_PER_TIERComma-separated numbers (days) defining the aging buckets per queue tier. The first entry applies to the highest-priority tier, the second to the next, and so on. Issues older than the matching bucket are highlighted in the queue UI.

configDISPATCH_QUEUE_AGING_MAX_TIERSMaximum number of aging buckets the queue UI will render, regardless of how many entries DISPATCH_QUEUE_AGING_DAYS_PER_TIER contains.

configDISPATCH_SYNC_LOCK_MAX_AGE_MSMaximum age (ms) before a stale sync lock is considered abandoned and may be reclaimed by a new sync run. Defaults to 1_800_000 (30 minutes).

configDISPATCH_URLBase URL of your Dispatch instance (used by outbound clients and MCP bridge)

configGITHUB_APP_IDYour GitHub App's numeric ID

configGITHUB_APP_INSTALLATION_IDThe installation ID for the GitHub App on your org/repo

🔐 secretGITHUB_APP_PRIVATE_KEYPEM-formatted private key (supports real newlines and escaped \n form)

configGITHUB_REPOSITORIESBootstrap seed config for repos to track. Accepts comma-separated or newline-separated values (e.g., myorg/repo1,myorg/repo2 or myorg/repo1 on separate lines). Repos can also be managed via Dispatch UI or /api/automation/repos after initial setup.

🔐 secretGITHUB_TOKENGitHub Personal Access Token or GitHub App token (fallback when GitHub App auth is not configured)

🔐 secretNEXTAUTH_SECRETSecret for NextAuth.js JWT signing — required when DISPATCH_AUTH_MODE=oidc. Generate with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"

configNEXTAUTH_URLPublic Dispatch base URL used by NextAuth to derive callback URLs. Set this in OIDC deployments.

🔐 secretOPENAI_API_KEYThe lesson feed shares DISPATCH_LLM_API_KEY and DISPATCH_LLM_BASE_URL with the hosted groomer; and OPENAI_BASE_URL are retained only as legacy fallbacks.

configOPENAI_BASE_URLThe lesson feed shares DISPATCH_LLM_API_KEY and DISPATCH_LLM_BASE_URL with the hosted groomer; OPENAI_API_KEY and are retained only as legacy fallbacks.

configOPENAI_MODELModel for the lesson feed. Takes precedence over DISPATCH_GROOMER_MODEL and OPENAI_MODEL.

configPR_FIX_MAX_ATTEMPTS

configPR_FOLLOWUP_BOT_IDENTITIESComma-separated bot logins whose PR events are ingested (default github-actions[bot]). Example: github-actions[bot],dependabot[bot].

configPR_FOLLOWUP_BRANCH_OWNERSComma-separated GitHub logins considered the canonical owner of a followup branch. Used to suppress "needs author" nudges.

Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.

deployDATABASE_URL

deployNEXT_PUBLIC_DISPATCH_VERSION

// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

13/13 tools missing one or more hints — resolve_issue (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); claim_issue (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); unclaim_issue (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +10 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

License file

No license file

Add a LICENSE file (MIT, Apache-2.0, etc.).

Tool test coverage

Only 3/13 tools referenced in tests (23%)

Write tests that reference each tool by name so every tool has at least one test.

No arbitrary install scripts

Has postinstall/preinstall script — runs arbitrary code on npm install

Remove postinstall/preinstall hooks unless they’re essential.

Dependency freshness

1/17 production deps stale: @dnd-kit/utilities@2023-11-06 (2.9y)

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail

The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.

// improvement guidance — verified publishers only

We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/misospace/dispatch)](https://m8ven.ai/mcp/misospace/dispatch)

Shows your grade and updates automatically. Prefer no grade? Append ?variant=verified to the badge URL.

commit: dc9893a881e9162c0d980d94e27f2a303b31e805

code hash: 385c250962177bc0577d65ad9d9b33688f15f25294ca750a89af8d28cca47b9c

view raw JSON →

Check MCPs from inside your assistant

Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check

check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern

How to add it →Free · no account needed · works in any MCP client