{
  "markdown": "# Obra CTO\n\nA local-first MCP server that scores your codebase's Build Readiness. You install\nit in your own Claude. Your Claude reads your code on your machine and runs your\ntests there. Nothing is uploaded.\n\nThis is the free preview of Obra's role lineup, and it stays free and local. The CTO\nreads your code and tells you what an investor's technical diligence would find: real\nsecurity holes, weak design decisions, and the gaps that stop a serious review. The\nrest of the team (the Obra CFO for funding-ready materials, and more) lives in the\nBuild with Obra community.\n\n## The Obra founders' toolkit\n\nTwo free, local, open-source MCPs built to work as a pair:\n\n- **Obra CTO** (this one): is it built? Scores your codebase and surfaces what a technical diligence would flag. [GitHub](https://github.com/lilycip/obra-cto) · [npm](https://www.npmjs.com/package/obra-cto)\n- **Obra CFO**: is it fundable? Runs the investment committee on your pitch and turns your verified build into a funding case. [GitHub](https://github.com/lilycip/obra-cfo) · [npm](https://www.npmjs.com/package/obra-cfo)\n\nRun the CTO first. The CFO reads its report as grade-A technical evidence. The method, the deep versions, and Obra in beta live in [Build with Obra](https://www.skool.com/build-with-obra-5361/about).\n\n## Why local-first\n\nA tool that reads your code should not ship your code somewhere. Your source never\nleaves your machine. This server makes exactly one kind of network call, and only\nwhen you run the dependency check: it sends your package names and versions to the\nOSV vulnerability database, never a line of your code (you can see the single call\nin `src/deps.ts`). Everything else is local: it returns counts, presence flags, a\nredacted secrets scan, and a score. You can read every line of this server before\nyou run it, which is the point of keeping it open.\n\n## What you get\n\nThe Obra CTO Score, out of 100, calibrated to your stage (prototype, MVP, or\ngrowth), across six dimensions:\n\n| Dimension | Weight |\n|---|---|\n| Security | 25 |\n| Product reality (what is actually built) | 20 |\n| Robustness | 15 |\n| Architecture | 15 |\n| Maintainability | 15 |\n| Deploy readiness | 10 |\n\nEvery finding carries an evidence grade: A verified, B multiple sources, C partial\nor inferred, D claim only, E speculation. The score is built from grade A and C\nevidence, what is true in your code, not what a deck says. When the CTO runs your\ntests and they pass, reliability becomes grade A. A deck-scorer can never earn that.\n\n## What a run looks like\n\nPoint it at a real project and you get a scored report with a ranked risk register.\nHere is a run on a scrappy Supabase app (anonymized):\n\n```\n# Obra CTO Score: financeapp\n## 46 / 100 · Not yet ready\nAssessed as: mobile (react-native, expo)  |  Backend: supabase\n\n| Dimension        | Score | Evidence |\n|------------------|-------|----------|\n| Security         | 6/25  | A |\n| Product reality  | 20/20 | A |\n| Robustness       | 3/15  | A |\n| Architecture     | 9/15  | A |\n| Maintainability  | 6/15  | A |\n| Deploy readiness | 2/10  | C |\n\n## Top Risks\n- [critical] RLS policies defined but never enabled; data may be open to any authenticated user\n    Fix: enable row level security on every table, then verify a second user cannot read your rows.\n- [high] Access control gap: a privileged action checks only that the user is logged in, not that they own the resource\n- [medium] No tests found\n```\n\nOn a well-built app it scores high and credits the good engineering. It is calibrated,\nnot a fear machine.\n\n## Tools\n\n- `scan_project` reads the project and returns mechanical signals.\n- `check_dependencies` checks your locked dependencies against the OSV vulnerability\n  database. Only package names and versions leave your machine, never your code.\n- `run_tests` runs your test suite (this executes code, so your Claude asks first)\n  and parses the pass and fail counts.\n- `prepare_code_review` selects your highest-signal files (schema and policy files,\n  entry points, security-relevant code) and hands them to your Claude with a checklist\n  tuned to your stack, including a Backend-as-a-Service lens (Supabase, Firebase) and a\n  design red-team that critiques the architecture, not just the code.\n- `score_build_readiness` produces the Obra CTO Score with a Top Risks register.\n\nA normal run is: scan, check dependencies, run tests, prepare the code review, then score.\n\n## Install\n\nAdd it to your Claude MCP config (Claude Desktop or Claude Code):\n\n```json\n{\n  \"mcpServers\": {\n    \"obra-cto\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"obra-cto\"]\n    }\n  }\n}\n```\n\nThen ask your Claude: \"Score this project's build readiness with Obra CTO.\"\n\nPrefer to run from source? Clone the repo, run `npm install && npm run build`, and\npoint the config at `node /absolute/path/to/obra-cto/dist/index.js`.\n\n## What this is not\n\nNot a linter, not a security scanner, not a replacement for your own Claude reading\nthe code. It is technical-diligence readiness inside funding readiness: the question\nan investor's CTO would ask, answered from your real code.\n\n## What's next\n\nThe Obra CTO is the free preview. To go further:\n\n- **The Method:** the full playbook for shipping production software with AI, the\n  disciplines that make code score like the example above, each lesson with a paste-in\n  prompt or tool you can use today.\n- **The rest of the team:** the Obra CFO for funding-ready materials, and each new\n  role as it ships.\n- **Obra itself, in beta:** the AI employee that runs your back office. Members go first.\n\nSee the whole toolset and where it is going at https://get-obra.com/build\n\nThe full method and the community live in Build with Obra: https://www.skool.com/build-with-obra-5361/about\n\n## License\n\nApache-2.0.\n",
  "bytes": 5774,
  "sha": "3d5b0cc7cc3e0a327f9beb174d4504935b838e388fe5a59cffba98dc0397e8ae",
  "repo_slug": "lilycip/obra-cto",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_com_get_obra_obra_cto_f68f006b/readme"
}