Replore MCP server

Replore

The repo scout for vibe coders. Find it before you build it.

A repo finder for your AI coding agent — a one-command plugin for Claude Code, and an MCP server for Codex, Cursor, Gemini CLI, Copilot, Windsurf, Cline or any other agent (setup). Describe your project in plain words and get the open-source GitHub repos that best fit it — ranked by relevance, popularity, and how freely you can use the license — as a comparison table: stars, what it does, relevance, license, whether you can use it in a paid product, whether it's completely free, and how to start.

/replore:find a portfolio website with smooth scroll animations and good design taste

Example prompts

Type /replore:find followed by what you're building. Plain English is fine.

• Website: /replore:find a portfolio website with smooth scroll animations, starting from scratch
• Website: /replore:find landing page for my SaaS in Next.js, I'll sell it
• Mobile app: /replore:find my first iPhone app, a habit tracker, no coding experience
• Mobile app: /replore:find diet app for Android and iPhone
• AI agent: /replore:find a chatbot that answers questions from my PDFs, Python
• AI agent: /replore:find generate PowerPoint decks from my notes
• Data: /replore:find dashboard to show my sales spreadsheet as charts
• Games: /replore:find a simple 2D browser game engine for beginners
• Learning: /replore:find learn web security by hacking a practice app
• Learning: /replore:find offline maps for my trip planner app

Prompt template

Copy, fill in what you know, delete the rest. Only the first line is needed.

/replore:find
What I'm building: <one sentence>
Platform: <web / iPhone / Android / desktop / not sure>
Stack: <React, Python, Swift... or not sure>
Selling it?: <yes / no>
Starting from scratch?: <yes / no>

The plugin answers with a comparison table of up to 20 repos. Ask for "as a sheet" to get CSV for Excel or Google Sheets.

Got a PRD or spec? Attach it (or paste it) and the plugin reads every feature, searches per feature, and returns all the suitable open-source repos grouped by need — not just the top 20. "All suitable" means every open-source match that passes the filters, not every repo on GitHub.

Web page (no install)

Try it live: replore.cardzo.co.in — type a project and see the top repos in your browser, no Claude and no Python needed.

What you can do there:

• Search in plain words. Describe what you're building; filters (tech stack, minimum stars) are optional. Repos an AI check thinks don't fit move to the end, under "Less likely to fit".
• Read each result at a glance. Results come three to a row (SPEC RS63, RS67). Each card shows the owner, the repo name and its rank, when it was last updated, what the repo does, one license verdict ("Free for commercial use", "Must open-source your app", …), a Starter tag for ready-made templates, its main language and its stars. A bookmark (or a tap on the card) adds it to your plan; Details opens the rest in a side panel.
• Narrow and sort what you got. The filter panel on the left has Licence (free for commercial use), Type (starters and templates), Language (the languages found in your results), Stars (any, 1k+, 10k+) and Updated (any time, past year, past month). The sort menu offers best fit (the default), most stars and recently updated. Filters and sorting only rearrange the cards already fetched; the ranking itself never changes.
• Look inside a repo before you pick it. In a card's Details: a "Matches:" line with the words it matched, Open on GitHub, and three tools under "Look inside", each opening a free site in a new tab (SPEC RS51, RS63):
  • Diagram (GitDiagram): see the structure as an architecture diagram.
  • Wiki (DeepWiki): AI-written docs for the repo that you can ask questions.
  • Code (GitHub1s): read the files in a VS Code-style viewer.
  • Also: Digest (Gitingest), all the code as one text file for an AI chat, and Edit (github.dev), GitHub's web editor.
• Selling it? Switch on I'll sell it (closed source) in the filter panel and every GPL- or AGPL-style repo says plainly that building on it would make you open-source your app; the build-plan prompt names the picks that conflict. Nothing is hidden or re-ordered (SPEC RS83). The plugin does the same with --selling (or "Selling it?: yes").
• Sort by trust, if you want. Pick Trust (top 5) in the sort menu to re-order the top five by their safety check: Scorecard score + half the Maintained score + 2 when no known vulnerabilities (SPEC RS82). Best fit stays the default; the plugin's --rank trust and the MCP tool's rank: "trust" do the same.
• Check it's safe to build on. Open Is it safe to build on? in a card's Details (SPEC RS53) to see its security health score (OpenSSF Scorecard), known vulnerabilities in its latest published package (OSV.dev, via deps.dev), a copy-paste install command (npm install, pip install, go get, …), whether it has a README, contributing guide and good first issues, and its latest release. Nothing is fetched until you open it, and it never changes the ranking.
• Find similar repos. Paste a repo you like (owner/repo or its GitHub link) and get others like it.
• Match a whole plan. Upload a plan or PRD; it's read in your browser (never uploaded) and searched feature by feature.
• Turn picks into a build plan. Tick Add to plan on the repos you want (or Select all shown), then Copy prompt, Open in Claude, Open in ChatGPT or Open in Gemini to have your own AI write the plan. The page itself calls no AI and holds no key for this. Tip: give your agent the free Context7 MCP server so it reads each repo's current docs (SPEC RS53e).
• Browse what's popular. The Trending view lists Rising, Most stars and Most forks repos without a search.
• Pick up where you left off. A refresh brings your last results back; repeat searches within an hour come from your browser instead of GitHub. The search bar's clear button or the logo clears them.
• Light and dark themes, keyboard and screen-reader friendly, and a Feedback form for bugs and ideas.

A static page at web/index.html powers it. It auto-deploys (Cloudflare Pages) to replore.cardzo.co.in (Cloudflare Pages) on every push to main. To self-host it, serve the web/ folder from any static host; only the relevance check and the trust check (functions/api/, Cloudflare Pages Functions) need Cloudflare.

The page's code is in web/app.js (plus web/theme.js); its security headers and Content-Security-Policy are in web/_headers (SPEC RS49), so a new third-party script or API must be added there or the browser blocks it. web/robots.txt, web/sitemap.xml, the canonical link and web/404.html are the SEO basics (SPEC RS80). web/evals.html publishes the ranking evals (SPEC RS84); after editing evals/*.json, run python3 ops/build_evals_page.py to refresh web/evals.json, and after editing a script run python3 ops/stamp_assets.py (a test fails until both are done). Pages' _redirects can't redirect a whole domain, so the 301 from replore.pages.dev to replore.cardzo.co.in is a Cloudflare Bulk Redirect rule (dashboard: Rules, Redirect Rules, Bulk Redirects; source replore.pages.dev, target https://replore.cardzo.co.in, 301, preserve path suffix and query string, include subpaths). Leave preview hosts (*.replore.pages.dev) out of it.

It calls the public GitHub search API from the browser (about 10 searches a minute, no login, no key) and runs the same filters, ranking and license labels as the plugin. The searches are keyword-based; then a small server-side relevance check (functions/api/relevance.js, SPEC RS34) asks an AI which of the top 30 repos don't fit what you described, and moves them to the end under a "Less likely to fit" divider. If the check is unavailable or over its free limit, you get the plain keyword results. The outcome is in the results' data-gate attribute for debugging. With the router on (SPEC RS95, RS96, below), the page shows one quiet line with the visitor's AI searches left today, and a plain note when AI ranking is used up or busy; other failures stay silent. Failed checks are logged as codes and timings only (SPEC RS34d) to the Cloudflare log (Pages → your project → the deployment → Functions → Real-time logs; live only, not stored). To keep them, enable Workers Analytics Engine on the account, then uncomment the [[analytics_engine_datasets]] block in wrangler.toml. The plugin goes further: your AI writes the searches, and its PRD mode returns every suitable repo per feature.

How the relevance check runs (maintainer, SPEC RS34a): wrangler.toml binds Cloudflare Workers AI as AI, so the check works on deploy with no key (optional variable WORKERS_AI_MODEL, comma-separated; default @cf/mistralai/mistral-small-3.1-24b-instruct, then @cf/meta/llama-3.3-70b-instruct-fp8-fast if the first is retired, missing or busy; SPEC RS34e). Keep the account on the Workers Free plan if you want it to stop at the daily free allocation rather than bill. Optional fallback for when Workers AI is over its allocation or failing: in Cloudflare → your Pages project → Settings → Variables and Secrets, add a secret LLM_API_KEY (e.g. a free Groq API key from console.groq.com) and redeploy; optional LLM_BASE_URL (any OpenAI-compatible endpoint; default Groq) and LLM_MODEL (default openai/gpt-oss-20b; Groq retired llama-3.1-8b-instant on 2026-08-16, so remove an LLM_MODEL that still names it). With neither the binding nor the key, the page shows plain keyword results with no note. Quota-aware router and daily AI credits (maintainer, SPEC RS95, RS96; off until you deploy it). One Durable Object in a small separate Worker (router/) decides, per check, which AI to use: the free pool first (Workers AI, then Groq free GROQ_FREE_MODELS on the one LLM_API_KEY, then Mistral free if MISTRAL_API_KEY is set), then Groq paid inside a hard, paced daily budget, then keyword results with a note. It learns each provider's limits, cools down a provider that rate-limits or errors, and hands out the free pool as daily credits (5 per anonymous IP, 20 per signed-in user once RS94 sign-in exists, Pro uncapped). Without the binding the function runs the chain above, unchanged. To go live:

1. Deploy the router Worker: cd router && npx wrangler deploy (it needs no secrets; it is the Free plan's SQLite Durable Object, 100,000 requests and 100,000 rows written a day, which the design keeps under 40,000 each at 25,000 checks a day; node tests/sim_router.mjs shows the numbers).
2. In wrangler.toml (this Pages project) uncomment the [[durable_objects.bindings]] block (name = "ROUTER", class_name = "RouterDO", script_name = "replore-router"), then redeploy Pages.
3. Optional, in Pages → Settings → Variables and Secrets: Mistral (only after you switch off training on your data in Mistral's Admin Console, and only a standard model, never Labs or Preview): secret MISTRAL_API_KEY, optional MISTRAL_MODEL (default mistral-small-latest) and MISTRAL_LIMITS (default rpm=2,rpd=2000,tpm=50000,tpd=1000000; copy your real limits from Mistral's Limits page). Paid overflow (off while the budget is 0, the default): secret PAID_LLM_API_KEY (a Groq key on a paid plan; set a spending limit in Groq's billing too, as a second net) and variable ROUTER_DAILY_BUDGET_USD (for example 4: about 12,700 to 20,500 more checks a day on openai/gpt-oss-20b). Pro (off while 0): PRO_LLM_DAILY_BUDGET_USD (for example 1); the Pro model PRO_LLM_MODEL (default openai/gpt-oss-120b) uses PAID_LLM_API_KEY unless PRO_LLM_API_KEY is set. Credits: ROUTER_CREDITS_ANON (default 5) and ROUTER_CREDITS_SIGNED_IN (default 20).
4. Check it: curl -H "X-Replore-Eval-Key: $REPLORE_EVAL_KEY" "https://replore.cardzo.co.in/api/relevance?router=status" returns the owner-only snapshot (JSON plus an ASCII dashboard: per-provider state, use against limits, cooldowns, budget spent and paced, credit totals, keyword fallbacks, errors, the DO's own requests and rows today). Without the key the address returns the normal public config. If the Durable Object is unreachable (250 ms deadline), no paid call is made: the free chain runs in the function and credits are not enforced until it is back. Bot check (SPEC RS34c, recommended): in Cloudflare → Turnstile, add a widget for your site's hostname (Invisible or Managed), then in the Pages project add the variable TURNSTILE_SITE_KEY (public) and the secret TURNSTILE_SECRET, and redeploy. Every AI check then needs a fresh Turnstile token. Without TURNSTILE_SECRET the function refuses every AI check (SPEC RS34g, fail closed). For local wrangler pages dev or a Preview deployment without Turnstile, set the variable ALLOW_NO_TURNSTILE = 1 on that environment only — never on Production. The function also limits each IP to 10 checks per 10 seconds in memory (best effort; the WAF rule below is the real limit). Two optional secrets (16+ random characters each) let callers that can't run Turnstile in, and skip the per-IP limit: EVAL_KEY opens the paid AI check and the meaning route, for the live eval and ops/rag_smoke.py only — keep it in CI (repository secret REPLORE_EVAL_KEY for the relevance-eval-live workflow) or on your machine as REPLORE_EVAL_KEY, and never hand it out. PLUGIN_KEY opens only the cheap meaning route (mode:"semantic"), so it is the one you may give to plugin users, who set it as REPLORE_PLUGIN_KEY. Replore Pro keys (SPEC RS87, RS90): sold with a Stripe Payment Link; set three things in Pages, then redeploy: the secret STRIPE_SECRET_KEY, which must be a Stripe restricted key (Developers, API keys, Create restricted key) with Read on Checkout Sessions and Subscriptions and nothing else; the secret PRO_SIGNING_SECRET, 32 or more random characters (for example python -c "import secrets; print(secrets.token_urlsafe(32))"), which signs every key, so changing it invalidates every key already issued; and the plain variable PRO_PRICE_IDS, the monthly and yearly Pro price ids comma-separated (copy them from the Replore Pro product page in Stripe; PRO_PRODUCT_ID, the product id, works instead). The price list matters because the same Stripe account sells other things (templates): only a subscription carrying a Pro price gets or keeps a key. Without all three the Pro route answers pro_off. Set each Payment Link's success URL (After payment, "Don't show confirmation page", redirect) to exactly https://replore.cardzo.co.in/pro?session_id={CHECKOUT_SESSION_ID}, switch on Stripe Tax on the links (you are the seller of record), then paste the links into PRO_URL and PRO_URL_YEAR in web/pro-core.js. A buyer's key, rp.<subscription id>.<signature>, gets the same rights as PLUGIN_KEY while the subscription is active or trialing, checked with Stripe and cached 10 minutes, never stored. Plugin --semantic without a key: the server answers 403 and the plugin silently keeps its keyword + BM25 order (no error, no meaning scores, no indexed repos). Also add a rate-limiting rule (Security → WAF → Rate limiting rules) on the path /api/relevance, per IP. On the Free plan, the worst that abuse can do is use up the day's allowance, never bill you. Page-view counts (maintainer, SPEC RS33): Cloudflare Web Analytics is switched on for the Pages project, so Cloudflare injects its cookieless beacon (static.cloudflareinsights.com) into every page; PRIVACY.md and the page's privacy window say so. To turn it off: Cloudflare dashboard → Workers & Pages → the Replore project → Web Analytics → disable; then remove the Web Analytics wording from PRIVACY.md, the privacy window and this README, and drop the two cloudflareinsights.com hosts from web/_headers. Before adding or switching a provider, check its data-use terms (free tiers intended for prototyping, such as GitHub Models, don't qualify) and update PRIVACY.md. Trust check (maintainer, SPEC RS53): functions/api/trust.js (GET /api/trust?repo=owner/repo&lang=…) needs no key, binding or setting. It asks OpenSSF Scorecard and deps.dev server-side (public repo names only, never search words or visitor IPs) and keeps each answer in Cloudflare's edge cache for 24 hours. It accepts a package only when the package itself names the repo as its source, because deps.dev's repo→package list includes spoofed claims. A per-IP limit of 10 requests per 10 seconds runs in memory; for a hard limit, add a WAF rate-limiting rule on /api/trust.

Install (Claude Code)

/plugin marketplace add chittychat-studio/replore
/plugin install replore@replore

Needs Python 3.11+ (the plugin tells you how to install it if it's missing). Once installed, it is available in every project.

The install also registers Replore's MCP server (mcpServers in .claude-plugin/plugin.json, SPEC RS32a), so Claude Code gets two tools, find_repos and check_repos, besides /replore:find. Windows: the server starts with python3. If python3 isn't on your PATH (or opens the Microsoft Store), edit the installed plugin's .claude-plugin/plugin.json (under ~/.claude/plugins/) and change "command": "python3" to "command": "python", then restart Claude Code. /mcp shows whether replore is connected. The /replore:find skill doesn't need this: it finds a working Python itself.

Optional safety log (off by default). The plugin also declares a UserPromptSubmit hook, python3 ${CLAUDE_PLUGIN_ROOT}/hooks/security_log.py (SPEC RS25). It is a no-op unless you set the environment variable REPLORE_SECURITY_LOG: unset, it exits at once without reading your prompt or writing anything. Set it to 1 (or a file path) to keep a local log of prompt-injection or harmful-request attempts; see PRIVACY.md. On Windows without python3, the hook simply fails to start (Claude Code carries on); to use the log there, edit the installed plugin's hooks/hooks.json and change "command": "python3" to "command": "python".

After the comparison table, ask "which of these are safe to build on?" and the plugin runs the same check as the web page's Is it safe to build on?: security health, known vulnerabilities, an install command, beginner-friendliness and the latest release (SPEC RS56). The web page and the plugin share one set of test cases, so they give the same answer.

Use in any other AI agent

Replore is model-agnostic. The /plugin install command above is Claude Code-only; every other agent loads the same engine through MCP (Model Context Protocol), the open tool-connection standard Codex, Cursor, Gemini CLI, VS Code Copilot, Windsurf and Cline all support — whatever model they run. No API key.

1. Get Replore. Needs Python 3.11+ and git (no git? on GitHub click Code → Download ZIP and unzip). On Windows, type python wherever this says python3.

git clone https://github.com/chittychat-studio/replore
cd replore
pwd          # Windows: cd     — prints the full path; use it in place of /path/to/replore below

2. Add the replore entry to your agent's MCP config. If the file already exists, add only the "replore": {…} entry inside its existing mcpServers block (VS Code: servers) — don't paste a second {…} or replace the file. Then restart the agent.

Agent	File	Entry
Codex CLI	~/.codex/config.toml	[mcp_servers.replore]command = "python3"args = ["/path/to/replore/scripts/mcp_server.py"]
Cursor	~/.cursor/mcp.json	"mcpServers": {"replore": {"command": "python3", "args": ["/path/to/replore/scripts/mcp_server.py"]}}
Gemini CLI	~/.gemini/settings.json	same mcpServers entry as Cursor
Windsurf	~/.codeium/windsurf/mcp_config.json	same mcpServers entry as Cursor
Cline	Cline panel → MCP Servers → Configure (opens cline_mcp_settings.json)	same mcpServers entry as Cursor
VS Code (Copilot)	.vscode/mcp.json in each project (or MCP: Add Server in the command palette)	"servers": {"replore": {"type": "stdio", "command": "python3", "args": ["/path/to/replore/scripts/mcp_server.py"]}}
Claude Code (MCP instead of the plugin)	terminal	claude mcp add --scope user replore -- python3 /path/to/replore/scripts/mcp_server.py

These are each agent's documented MCP locations at the time of writing; if one has moved, check that agent's MCP docs — the command and argument stay the same.

3. Ask your agent — "find repos for a diet app for iPhone". It calls Replore's find_repos tool and shows the comparison table. Then "which of these are safe to build on?" calls check_repos, the same check as the web page's Is it safe to build on? (SPEC RS56). Your AI writes the searches and judges which results fit; the feature-by-feature PRD mode is in the Claude Code plugin.

No MCP support? Open the cloned folder in your agent. Codex, Cursor, Copilot, Cline and Windsurf read AGENTS.md automatically; with any other agent, say "follow AGENTS.md". It then runs scripts/scout.py itself. Or run it by hand:

python3 scripts/scout.py "diet tracker app" "calorie counter" --markdown
python3 scripts/trust.py expressjs/express psf/requests      # is it safe to build on? (1-5 repos, SPEC RS56)

Same filters, ranking and license labels in every path. Browser-only chats with no local tools can't run it — use the web page there.