{
  "markdown": "# upkeep-mcp\n\nAn MCP server for the recurring checks behind ongoing website maintenance:\ndomains, SSL certificates, uptime, technical SEO and accessibility — all from\npublicly available information.\n\nBuilt for people who look after a portfolio of client sites on a retainer, not\njust a single domain. The goal is to answer one question quickly: **what needs\nattention this week?**\n\n## Status\n\nEarly development, built in public phase by phase. Everything that needs no\nbrowser is implemented and useful today.\n\n| Tool                  | Purpose                                                                     | Status    |\n| --------------------- | --------------------------------------------------------------------------- | --------- |\n| `domain_check`        | Registration expiry, registrar, nameserver agreement, DNS records, DNSSEC   | Available |\n| `ssl_check`           | Certificate expiry, issuer, chain validity, SAN coverage, TLS version       | Available |\n| `uptime_check`        | HTTP status, response time, redirect chain, HTTPS upgrade, security headers | Available |\n| `health`              | Server name, version, Node.js version, uptime                               | Available |\n| `seo_audit`           | Title, meta, headings, canonical, robots.txt, sitemap, broken links         | Available |\n| `site_crawl`          | Duplicate titles, broken links and stray noindex across a whole site        | Available |\n| `portfolio_report`    | All of the above across a portfolio, sorted by urgency                      | Available |\n| `accessibility_audit` | WCAG violations via axe-core, in a real browser                             | Available |\n\nIt also exposes the `portfolio://sites` resource (the site list, for a client to\nread without spending a tool call) and the `quarterly_report` prompt (turns a\nportfolio run into the report a client actually reads).\n\nPublished on npm, so it installs with one command — see\n[Installation](#installation). A public instance is also running, for anyone who\nwould rather point a client at a URL than run anything — see\n[The hosted instance](#the-hosted-instance).\n\n## What it looks like\n\n```\n> Is example.com about to expire?\n\nexample.com expires 2027-08-13 (346 days).\nRegistrar: RESERVED-Internet Assigned Numbers Authority.\nNameservers: elliott.ns.cloudflare.com, hera.ns.cloudflare.com.\nResolves: apex yes, www yes. DNSSEC: delegation signed.\n```\n\n```\n> Check the certificate on expired.badssl.com\n\nexpired.badssl.com:443 certificate expires 2015-04-12 (-4159 days).\nIssued by COMODO RSA Domain Validation Secure Server CA.\nChain does not verify (CERT_HAS_EXPIRED). Negotiated TLSv1.2.\nHost matched via *.badssl.com.\nRevocation not established: http://ocsp.comodoca.com could not answer: the\nresponder is not authorised to answer for this certificate.\n\nNeeds attention:\n- [critical] The certificate expired 4159 days ago.\n- [critical] The certificate chain does not verify: CERT_HAS_EXPIRED.\n```\n\n```\n> Check the certificate on revoked.grc.com\n\nrevoked.grc.com:443 certificate expires 2026-10-18 (42 days).\nIssued by Certera RSA DV SSL CA 2.\nChain verifies. Negotiated TLSv1.2.\nHost matched via revoked.grc.com.\nRevoked on 2025-09-18.\n\nNeeds attention:\n- [critical] The certificate was revoked on 2025-09-18; browsers that check\n  revocation will refuse the site.\n```\n\nNote what the second one does: the chain **verifies**. Node performs no\nrevocation lookup of its own, so that certificate completes a handshake and\nreports as trusted. Only asking its issuer finds the problem.\n\nEvery tool also returns structured data alongside the text, so results can be\nsorted, filtered and fed into a report. Full input and output for each tool is in\n[`examples/`](examples/), and a whole portfolio session — the weekly triage, a\ndrill-down, and what the comparison against the previous run will and will not\nclaim — is in [`examples/conversation.md`](examples/conversation.md).\n\n## The tools\n\n### `domain_check`\n\nInput: `domain` — a bare domain, a full URL, or an internationalised name. A\nsubdomain is reduced to its registrable domain, since that is what a registration\nbelongs to.\n\nReturns the expiry date and days remaining, the registrar and its IANA ID,\nregistry statuses, A/AAAA/NS/MX/TXT/CAA records, whether the apex and `www`\nresolve, whether the delegation is signed with DNSSEC, and what the domain's SPF\nand DMARC records say about who may send email as it.\n\nEmail authentication is read from the domain's own DNS — the SPF record at the\napex, the DMARC record at `_dmarc`. A record that is **absent** is reported as\ninformation, because it is a standing improvement rather than something that\nbroke this week. A record that is **present and wrong** is a warning, because it\nfails right now: two SPF records make receivers skip SPF entirely, and `+all`\nauthorises the whole internet to send as the domain.\n\nDKIM is deliberately not reported. A DKIM key lives at `<selector>._domainkey`,\nand a selector cannot be discovered — only guessed, one DNS query per guess.\nThat is subdomain enumeration, which this project does not do, so a domain with\nno DKIM and one whose selector was not guessed are left indistinguishable rather\nthan the second being reported as the first.\n\n**Each of the domain's own nameservers is then asked about the zone directly**,\nover TCP port 53 with recursion off, which is the one question a recursive\nresolver cannot answer: it replies with whatever one server told it and does not\nsay which. That finds a server left in the delegation after a migration — it\nanswers `REFUSED`, or its own hostname stopped resolving, and every resolver\nquery landing there is slow or fails — and it finds nameservers holding\ndifferent versions of the zone, which is the \"it works for me but not for my\ncolleague\" outage.\n\nWhat is a fault and what is only unestablished are graded apart. Resolvers ask\nover UDP first and this server can only use TCP, so a nameserver that refuses\nTCP is not a broken one: `sapo.pt`'s four all refuse it and the domain resolves\nperfectly. Different serials are `info` too — `github.com` runs two providers\nthat do not transfer between them, so four of its nameservers report\n`1656468023` and four report `1`, and nothing is wrong. A hostname that does not\nresolve, or an answer without authority for the zone, is broken for everybody\nand is a warning. Pass `checkNameservers: false` to skip the whole thing —\n`portfolio_report` does, because a portfolio would pay this per site and a\ndeployment that cannot open port 53 would grade every site at once as\nunestablished.\n[`docs/adr/0020`](docs/adr/0020-asking-the-nameservers-over-tcp.md) records why\nit speaks DNS by hand and what it deliberately does not check.\n\n### `ssl_check`\n\nInput: `domain`, optional `port` (443 by default).\n\nReturns expiry and days remaining, issuer, whether the chain verifies and why not\nwhen it does not, which hostnames the certificate covers and via which SAN entry,\nthe negotiated TLS version and cipher, and whether the certificate has been\nrevoked. Expired, self-signed and untrusted certificates are inspected and\nreported rather than refused — those are the ones worth finding.\n\nRevocation is checked over OCSP. The response a server staples to the handshake\nis preferred, because it costs no request at all; when there is none, the\nresponder named in the certificate is asked directly. An answer is only believed\nonce its signature verifies against the issuing authority, and only once its\n`CertID` is shown to be about the certificate that was actually served — a server\nserving a revoked certificate alongside a valid response for a different one is\notherwise the easy way to fake a clean result.\n\nMany healthy certificates cannot be checked at all: since 2025 the two largest\nissuers, Let's Encrypt and Google Trust Services, publish no OCSP responder and\ndistribute revocation by CRL. That is reported as an `unavailableReason` and\nproduces **no finding**, because it is a decision of the certificate authority\nand nothing the site owner can act on. A responder that was asked and would not\nanswer is different, and gets one `unknown`.\n\n### `uptime_check`\n\nInput: `url` — a full URL, or a bare domain, which is tried over HTTPS.\n\nReturns the status code, response time, every hop of the redirect chain, whether\nplain HTTP is upgraded to HTTPS, the HSTS policy, and the security headers worth\nreporting on.\n\n### `seo_audit`\n\nInput: `url` — the page to audit, plus optional `checkLinks` (true by default)\nand `maxLinks` (25 by default).\n\nReturns title and meta description with their lengths, the heading structure,\ncanonical, `lang`, viewport, Open Graph, `hreflang` alternates, the images with\nno `alt` attribute, the state of `robots.txt` and the sitemap, and which\ninternal links are broken.\n\nA gzipped sitemap is unpacked before it is read. Whether it is gzipped is decided\nby the first two bytes rather than by the file name or the content type, because\nplenty of files called `.xml.gz` are not, and plenty that are get labelled\n`text/xml`.\n\nThe sitemap is then checked against the rules of the protocol, because a file\nthat answers `200` and parses is not the same as a file that works: a root\nelement with no sitemaps.org namespace is dropped whole, an entry on another\nhost is discarded, and one unescaped `&` makes the document ill-formed XML and\ncosts every entry after it. Each broken rule is reported once with the number of\nentries that break it and one example, so a mistake repeated across fifty\nthousand URLs reads as one thing to fix. A rule that only costs a hint — a\n`<lastmod>` that is not a W3C Datetime, a `<changefreq>` outside its seven\nvalues — is graded `info`; one that costs the entry or the file is a `warning`.\n\n`robots.txt` is read **before** anything else is requested and is obeyed — for\nthe page itself and for every internal link. A page this crawler is not allowed\nto read is reported as such and is never fetched, and an unreadable `robots.txt`\nis treated as forbidding everything, as RFC 9309 requires.\n\n```\n> Audit the homepage of example.com\n\nhttps://example.com/ answered 200. Title: \"Example Domain\".\n1 h1, 0 images without alt, 0 internal links (0 checked, 0 broken).\nSitemap: the sitemap URL answered 404.\n\nNeeds attention:\n- [warning] The page has no meta description, so search engines will write their own summary of it.\n- [info] The page declares no canonical URL, which is how duplicate addresses for the same page get separated.\n- [info] The page has no og:title or no og:image, so it will share poorly on social networks and in messaging apps.\n- [info] There is no sitemap at https://example.com/sitemap.xml: the sitemap URL answered 404.\n- [info] The site publishes no robots.txt. Nothing is blocked, but the sitemap cannot be declared there either.\n```\n\n### `site_crawl`\n\nInput: `url` — the page to start from — plus optional `maxPages` (25 by default,\n100 at most) and `maxDepth` (3 by default).\n\nWalks the site breadth-first from that page and reports **what one page cannot\ntell you about itself**: which pages share a title, and therefore compete with\neach other for the same search result; which share a meta description; which\ninternal links are broken and, crucially, which page links to them; which pages\nstill ask not to be indexed after a rebuild; and how much of the site was\nreachable at all.\n\nIt stays on the origin you start it on — `https://example.com` and\n`https://www.example.com` are different origins, and a crawl that wandered\nbetween them would report one site's pages as duplicates of the other's. A link\nthat redirects off the site is counted and left alone: `robots.txt` was read for\nthis origin and does not speak for anybody else.\n\nThree budgets bound it: pages, depth, and a two-minute deadline. Whichever one\nended the crawl is reported along with how many URLs were found and not visited,\nbecause a report that does not say it saw a quarter of the site is worse than no\nreport. `robots.txt` is read first and obeyed for every URL before it is\nrequested; an unreadable one refuses the crawl outright, per RFC 9309.\n\nIt is deliberately not part of `portfolio_report`. Twenty-five pages per site\nacross a portfolio is a different order of cost, and\n[`docs/adr/0021`](docs/adr/0021-a-crawl-as-its-own-tool.md) — which\n[`docs/adr/0010`](docs/adr/0010-one-page-audit-instead-of-crawl-depth.md)\npredicted — records why it is a tool of its own rather than a `depth` parameter\non `seo_audit`.\n\n```\n> Crawl example.com and tell me what needs fixing\n\nCrawled 25 pages of https://example.com, 3 levels deep.\n2 broken internal links, 1 title used more than once.\nStopped at the page budget; 11 URLs were not visited.\n\nNeeds attention:\n- [warning] 2 internal links are broken: https://example.com/old-pricing (it answered 404) linked from https://example.com/, https://example.com/team/ana (it answered 404) linked from https://example.com/team.\n- [warning] 1 title is used by more than one page, so those pages compete with each other in search results; the widest is \"Services\" on 4 pages.\n- [info] 6 of 25 pages have no meta description, so search engines will write their own summary of them.\n- [info] The crawl stopped at the page budget with 11 URLs found and not visited, so everything here describes the part of the site that was looked at.\n```\n\n### `portfolio_report`\n\nInput: `sites` inline, or `file` (defaults to `sites.json`), plus optional\n`checks` and `tags`.\n\nRuns every check across the whole portfolio with bounded concurrency and returns\none report ordered by what needs action first: what is down, what expires\nsoonest, what regressed since the last run. A site that cannot be checked\nbecomes a finding, never a failure of the whole report.\n\n```\n> What needs attention across my sites this week?\n\n3 sites checked: 0 critical, 2 warning, 0 unknown, 1 fine.\n\nNeeds action:\n- [warning] Example Ltd: Plain HTTP does not redirect to HTTPS.\n- [warning] Example Ltd: No Strict-Transport-Security header is sent.\n- [warning] Example Net: Plain HTTP does not redirect to HTTPS.\n- [warning] Example Net: No Strict-Transport-Security header is sent.\n\nNo change is reported: this server has not run a report on this portfolio before,\nand the portfolio names no history file, so nothing survived the last restart.\nHistory for this portfolio is kept in memory only. To compare across restarts,\nadd a \"history\" path to the portfolio file.\n\nNothing to do: Example Foundation.\n```\n\n**Comparing across restarts.** By default the previous run lives in this server\nprocess and nowhere else, so a client that restarts daily gets a comparison that\nnever spans more than a day — and a quarter-over-quarter report cannot be\nproduced from it at all. Add one line to the portfolio file:\n\n```json\n{ \"version\": 1, \"history\": \"upkeep-history.json\", \"sites\": [...] }\n```\n\nand the run is written there instead, beside the portfolio file itself. The next\nreport compares against it however many restarts later, up to ninety days. The\nfile names your clients and says which were broken, so it is created readable by\nyour account alone and replaced on every run; without that line nothing is\nwritten at all.\n[`docs/adr/0018`](docs/adr/0018-opt-in-history-file.md) records the reasoning.\n\nEach site can set `maxLinks` — how many internal links the `seo` check may\nrequest, `0` for none. It is the setting that decides what a run costs: measured\nover twenty sites, the portfolio takes about eight seconds without `seo` and\naround forty with it, because link checking is one request per link paced at\nhalf a second per host.\n\nThe portfolio file format is documented in\n[`sites.example.json`](sites.example.json). Copy it to `sites.json` — which is\ngitignored, so a real client list never gets committed. `file` is resolved\nagainst the directory the client started the server in, so give the full path\nwhen that directory is not yours.\n\n### `accessibility_audit`\n\nInput: `url`, plus optional `standard` (`wcag2aa` by default; also `wcag2a`,\n`wcag21aa`, `wcag22aa`, `best-practice`).\n\nOpens the page in a headless browser and runs axe-core over it. Returns the\nrules that failed, how many elements failed each, CSS selectors for the first\nfew, and how many rules axe could not decide on its own.\n\nThis is the only tool that needs a browser, and it is optional: nothing is\ndownloaded when you install this project. Run `npx playwright install chromium`\nonce if you want it. Without it the tool says so and names that command, and\nevery other check carries on.\n\nAutomated rules find roughly a third of accessibility problems. A page with no\nviolations passed the machine-checkable part, which is not the same as being\nusable — which is why the count of undecided rules is reported alongside.\n\n## Installation\n\nRequires **Node.js 22 or newer**. Nothing else: installing downloads no browser,\nand every check works without one except `accessibility_audit`.\n\n### Claude Code\n\n```bash\nclaude mcp add upkeep -- npx -y upkeep-mcp\n```\n\n### Claude Desktop\n\nAdd the server to `claude_desktop_config.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"upkeep\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"upkeep-mcp\"]\n    }\n  }\n}\n```\n\nRestart the client and ask it to run the `health` tool. It answers with the\nserver version, the Node.js version and how long the process has been up.\n\nA desktop client starts a server in a directory of its own choosing, usually\n`/`. That matters for one thing only: `portfolio_report` and the\n`portfolio://sites` resource look for `sites.json` there. Pass `sites` inline,\nor give `portfolio_report` the full path — `file: \"/Users/you/sites.json\"`.\n\n### From source\n\nFor development, or to run a branch:\n\n```bash\ngit clone https://github.com/tiagocalado86/upkeep-mcp.git\ncd upkeep-mcp\nnpm install\nnpm run build\nclaude mcp add upkeep -- node /absolute/path/to/upkeep-mcp/dist/index.js\n```\n\n### The hosted instance\n\nFor anyone who cannot or would rather not run a server, there is a public one:\n\n```\nhttps://upkeep-mcp-1080119881249.europe-west1.run.app/mcp\n```\n\nPoint any MCP client that takes a remote server URL at it — in Claude, as a\ncustom connector. Opening the host in a browser gives a plain page saying what\nit is.\n\n**It is a demo.** No authentication, no availability promise, no support, and it\nmay be switched off without notice. `npx -y upkeep-mcp` is the supported way to\nrun this, and it is what you want if these checks matter to your work.\n\n**Every tool works there, `accessibility_audit` included** — the image ships a\nbrowser, and every request that browser makes goes through the same rules as the\nrest of the server. Someone who cannot run a server themselves should not get a\nweaker tool than someone who can.\n\nOne thing genuinely differs, and it is a property of running in public rather\nthan a compromise: **it contacts only public addresses, and only three ports** —\n443, 80 when checking whether plain HTTP upgrades, and 53 for the nameservers a\ndomain itself publishes. So it refuses to check anything on your own network,\n`localhost` included. Use the stdio server for those.\n\n### Running your own over HTTP\n\nThe transport is the same one the hosted instance uses:\n\n```bash\nnpm run build\nnpm run start:http -- --port 8080\n```\n\nThe HTTP entrypoint is not the stdio one with a socket attached: a stranger is\nnot the person who started the process, so it applies the address and port rules\nabove and admits traffic through a per-caller rate limit.\n[`docs/deploying.md`](docs/deploying.md) covers running it on Google Cloud Run,\nand [`docs/adr/0012`](docs/adr/0012-public-target-guard.md) explains the guard\nand what it does not close.\n\n## Security & privacy\n\nThis server never asks for, accepts or stores credentials. It reads only\ninformation that any person with a browser or a DNS resolver could read.\n\n- No API keys, tokens or passwords — for any service, ever.\n- No intrusive behaviour: no port scanning, no subdomain brute-forcing, no\n  vulnerability probing. It inspects public configuration; it is not an\n  offensive tool.\n- `robots.txt` is respected on any page crawl, with per-host rate limiting and\n  an identifiable `User-Agent` carrying a contact URL.\n- No persistent sensitive state. Caching is in memory only, with a TTL. There is\n  no database. The one file this server ever writes is a portfolio run snapshot,\n  and only when a portfolio file names a `history` path for it.\n- The only third parties contacted are the ones that hold the answer: the\n  registry's own RDAP server, IANA's RDAP bootstrap file, and\n  `cloudflare-dns.com` for the one question `node:dns` cannot ask (whether a\n  DNSSEC delegation is signed). [`SECURITY.md`](SECURITY.md) lists them and what\n  each one learns.\n\n## Limitations\n\nStated plainly, because a tool that hides what it cannot do is worse than one\nthat does less.\n\n- **Certificate revocation lists are not downloaded.** Revocation is checked over\n  OCSP, and only over OCSP. A CRL is a file of every serial an authority has ever\n  revoked — megabytes, fetched to answer one question about one certificate — so\n  a certificate whose issuer publishes no responder is reported as unchecked,\n  with the reason, rather than being judged from a file this tool declined to\n  read. Since 2025 that covers Let's Encrypt and Google Trust Services, which is\n  a large share of the web. See\n  [`docs/adr/0017`](docs/adr/0017-ocsp-without-crl.md).\n- **An OCSP answer is a point in time, not a subscription.** Responders pre-sign\n  about a week ahead, so `good` means \"not revoked as of `thisUpdate`\", and a\n  certificate revoked an hour ago may still read as good until the authority\n  publishes its next answer. `producedAt`, `thisUpdate` and `nextUpdate` are all\n  reported so the age of the answer is visible rather than implied.\n- **Some registries publish no expiry date.** `.de`, `.nl`, `.no`, `.au` and\n  `.fi` do not publish one over any protocol. The result names the registry and\n  says so, instead of showing an indefinite \"unknown\". Registration data comes\n  from RDAP only; there is no WHOIS fallback, and\n  [`docs/adr/0004`](docs/adr/0004-rdap-without-whois.md) explains why.\n- **DNSSEC is not validated.** The tool reports whether a delegation is signed\n  and where it learned that. It never claims to have validated a chain.\n- **The parent's delegation is not compared with the zone's own.** \"The\n  nameservers at the registrar are not the nameservers in the zone\" is the other\n  classic delegation fault, and answering it means querying the parent zone's\n  servers for a referral — a second hop and a different feature. What is checked\n  is whether the zone's own nameservers agree with each other.\n- **Response time includes connection setup.** It is wall clock to the first\n  response headers, covering DNS, TCP and TLS, so it is not a measure of server\n  processing time.\n- **`seo_audit` audits one page, not a site.** It requests the page's internal\n  links to find broken ones, but it does not crawl: there is no second level.\n  Auditing a site means calling it for the pages that matter.\n- **The sitemap is checked against the protocol's rules, not against its XSD.**\n  It establishes that the document exists, declares `<urlset>` or\n  `<sitemapindex>`, how many `<loc>` entries it holds, and whether it arrived\n  gzipped — a `sitemap.xml.gz` is unpacked before it is read, capped at 16 MiB so\n  that a decompression bomb is refused rather than unpacked. It then checks the\n  rules that decide whether a consumer keeps an entry: the namespace, `<loc>`\n  present, absolute, escaped, within 2048 characters and on the sitemap's own\n  host, `<lastmod>` a W3C Datetime, `<changefreq>` and `<priority>` within their\n  ranges, and the 50,000-entry limit. There is no XML parser and no schema\n  validator here, so four rules are deliberately left unchecked — the 50 MB size\n  limit, an index listing another index, duplicate entries, and whether a\n  `<lastmod>` is true. [`docs/adr/0019`](docs/adr/0019-sitemap-rules-without-a-schema-validator.md)\n  lists them and says why. The rules are checked against what was read, so a\n  sitemap past the read limit is judged on the entries before the cut and the\n  report says it was truncated — nodejs.org's stray entries on another host sit\n  past it, and are not reported.\n- **A page nested thousands of levels deep is refused, not audited.** HTML\n  parsing costs roughly the square of the nesting depth, so a document built to\n  be absurd would block the server for minutes. `seo_audit` measures the depth\n  first and reports the refusal.\n- **Accessibility is only checked as far as a machine can.** Automated rules\n  find roughly a third of real problems. The tool reports what axe could not\n  decide rather than counting it as a pass, but no green result here is an\n  accessibility statement.\n- **Nothing here judges how a page ranks.** `seo_audit` reports what is in the\n  HTML. Rankings depend on things no public endpoint exposes.\n- **\"What changed since last time\" lasts as long as the server process, unless\n  you ask for otherwise.** By default the previous run is held in memory and\n  never written anywhere, so a restarted server — which for a desktop MCP client\n  is a daily event — has nothing to compare against, and says so rather than\n  implying nothing changed. Adding a `history` path to the portfolio file makes\n  the comparison survive a restart, for up to ninety days; nothing is written\n  without it. Only sites both runs measured the same way are compared, so a quick\n  uptime-only pass never invents regressions in the run after it.\n  [`docs/adr/0011`](docs/adr/0011-in-memory-run-history.md) and\n  [`docs/adr/0018`](docs/adr/0018-opt-in-history-file.md) explain the trade.\n- **Only the previous run is kept, never a series.** Each run replaces the last.\n  A trend over quarters is a different feature with a different storage question,\n  and it has not been asked for.\n- **Certificates and domains are judged on different clocks.** A registration is\n  a warning inside 30 days; a certificate only inside 14. ACME clients renew with\n  30 days left, so warning that early would fire on nearly every healthy site.\n\n## Documentation\n\n- [`CONTRIBUTING.md`](CONTRIBUTING.md) — development setup, and how to add a tool\n- [`docs/architecture.md`](docs/architecture.md) — how a request flows, and how it\n  is tested without a network\n- [`docs/prior-art.md`](docs/prior-art.md) — the MCP servers that already do parts\n  of this, what they do better, and the gap this one fills\n- [`docs/deploying.md`](docs/deploying.md) — running the HTTP instance, and what\n  is different about it\n- [`docs/adr/`](docs/adr/) — one short record per structural decision, including\n  why the browser is\n  [optional](docs/adr/0013-playwright-core-and-an-optional-browser.md)\n- [`SECURITY.md`](SECURITY.md) — threat model and reporting policy\n- [`CHANGELOG.md`](CHANGELOG.md)\n\n## License\n\nMIT — see [LICENSE](LICENSE).\n",
  "bytes": 26899,
  "sha": "1423bdf88c1af6fc0ebf36d62262b283c11930bed3618de7eaa53c6421eb335d",
  "repo_slug": "tiagocalado86/upkeep-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_tiagocalado86_upkeep_mcp_85521dce/readme"
}