govreposcrape

govreposcrape

Semantic code search and dependency intelligence over 24,500+ UK government repositories. Exposes an MCP API so AI assistants like Claude can search government code and query its entire software supply chain (SBOM dependency graph) directly.

Ask things like "who's running a vulnerable Log4j?", "who uses Express < 2?", "what does HMRC build on?", or "which departments share the most dependencies?" — and get exhaustive, structured answers in seconds.

Built on Google Cloud (Cloud Run, BigQuery, Vertex AI Search, Cloud Storage).

Production API: https://govreposcrape-api-1060386346356.us-central1.run.app

Use it

Claude Code (Recommended)

claude mcp add --transport http govreposcrape https://govreposcrape-api-1060386346356.us-central1.run.app/mcp

Or install the plugin:

/plugin marketplace add chrisns/govreposcrape
/plugin install govreposcrape@govreposcrape

Then ask Claude about UK government code — all nine tools (see MCP tools) become available automatically.

Claude Desktop

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "govreposcrape": {
      "url": "https://govreposcrape-api-1060386346356.us-central1.run.app/mcp",
      "description": "Semantic search over 24,500+ UK government code repositories"
    }
  }
}

Config file location: ~/Library/Application Support/Claude/claude_desktop_config.json (macOS), %APPDATA%\Claude\claude_desktop_config.json (Windows), ~/.config/Claude/claude_desktop_config.json (Linux).

Any MCP Client

Add the .mcp.json from this repo, or point any MCP-compatible client at:

https://govreposcrape-api-1060386346356.us-central1.run.app/mcp

Direct API

curl -X POST https://govreposcrape-api-1060386346356.us-central1.run.app/mcp/search \
  -H "Content-Type: application/json" \
  -d '{"query": "NHS authentication FHIR patient data", "limit": 5}'

No authentication required. See examples/ for Node.js and Python examples.

MCP tools

Nine tools are exposed over the MCP endpoint. Semantic search answers "what does this code do"; the dependency-intelligence tools answer structured "who depends on what" questions that semantic search cannot.

Tool	What it answers
search_uk_gov_code	Semantic code search — "show me NHS FHIR authentication code"
search_dependency	Who depends on a package, with ecosystem-aware version ranges — "who uses express", "who runs express < 2"
vulnerability_exposure	CVE blast-radius via live OSV.dev — "who is exposed to Log4Shell", "what CVEs is alphagov running"
package_popularity	Most-depended-on packages + licence rollups — "top npm packages", "who uses GPL code"
dependency_landscape	Per-org tech profile: ecosystems, top packages, frameworks with end-of-life flags (endoflife.date), licences
dependency_compare	Shared / unique dependencies + overlap % between two repos — spot duplicated effort across departments
repo_dependencies	Full, untruncated dependency list for one repo
sbom_export	Full dependency set + per-ecosystem counts + canonical SBOM URL
dependency_trends	Package usage across daily snapshots (90-day retention)

The dependency tools cover the ~15,600 repositories that have a generatable SBOM (semantic search covers all 24,500+). The aggregate SBOM carries direct dependencies only (no transitive graph).

Examples

Who uses Express, and is anyone on a pre-2.0 version?

// search_dependency { "package": "express", "ecosystem": "npm" }
{ "total_repo_count": 1830,
  "top_versions": [["4.22.1", 277], ["5.2.1", 272], ["4.21.2", 258], ["4.17.1", 232]],
  "excluded": { "declared_range": 131, "empty_version": 1 } }

// search_dependency { "package": "express", "ecosystem": "npm", "version_range": "<2" }
{ "total_repo_count": 1830, "matched_repo_count": 0, "range_exact": true }   // exhaustive, not fuzzy

Who is exposed to a vulnerable Log4j? (live OSV.dev cross-reference)

// vulnerability_exposure { "package": "org.apache.logging.log4j/log4j-core", "ecosystem": "maven" }
{ "scope": "maven package \"org.apache.logging.log4j/log4j-core\"",
  "osv_available": true, "vulnerable_versions": 19,
  "findings": [
    { "package": "org.apache.logging.log4j/log4j-core", "version": "2.25.3",
      "affected_repo_count": 9,
      "repos_sample": ["govuk-one-login/ipv-core-back", "dwp/ms-fitnote-controller",
                       "nationalarchives/tdr-file-checks", "companieshouse/search.api.ch.gov.uk"],
      "vulnerabilities": [{ "cve": "CVE-2026-34480", "severity": "MODERATE",
                            "url": "https://osv.dev/vulnerability/GHSA-3pxv-7cmr-fjr4" }] }
  ] }