{"_id":"@8nobletruths/magga","_rev":"3-32a844ff2ca4249b1b3f4cbc70ff8a72","name":"@8nobletruths/magga","dist-tags":{"latest":"0.3.0"},"versions":{"0.1.0":{"name":"@8nobletruths/magga","version":"0.1.0","keywords":["mcp","pull-request","verification","ci","coding-agent","ai-slop","github-action"],"author":{"name":"8NobleTruths"},"license":"Apache-2.0","_id":"@8nobletruths/magga@0.1.0","maintainers":[{"name":"nobal","email":"jonsaw567@gmail.com"}],"homepage":"https://github.com/8NobleTruths/magga#readme","bugs":{"url":"https://github.com/8NobleTruths/magga/issues"},"bin":{"magga":"dist/cli.js"},"dist":{"shasum":"205159734d597596a29514eb7adc7a6b4b49f557","tarball":"https://registry.npmjs.org/@8nobletruths/magga/-/magga-0.1.0.tgz","fileCount":21,"integrity":"sha512-tyfmNDCQzrjvQWzlb2AeWs7NXvkdYOd8ZfFRlph1/qixHaebd54mCfxTgDO0KSeYYs3TmDsG6V7Fvrfv5K6NwQ==","signatures":[{"sig":"MEQCIAWJRraRbM6Cb4PGW/ta1ggr8vG+t8C1QTDjNetlfIY/AiBk41+PpSTaTRph48GS08SeZi1t7Jh67h1NePOshekfAg==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":40681},"main":"./dist/index.js","type":"module","types":"./dist/index.d.ts","engines":{"node":">=18"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"}},"gitHead":"77e5d33ec1769eb556f7416d2a902c1653504dd7","scripts":{"dev":"tsx src/cli.ts","test":"vitest run","build":"tsc","typecheck":"tsc --noEmit","prepublishOnly":"npm run build"},"_npmUser":{"name":"nobal","email":"jonsaw567@gmail.com"},"repository":{"url":"git+https://github.com/8NobleTruths/magga.git","type":"git"},"_npmVersion":"11.6.2","description":"Prove that a code change actually works, whether an agent wrote it or a pull request did.","directories":{},"_nodeVersion":"25.1.0","dependencies":{"zod":"^3.23.8","@modelcontextprotocol/sdk":"^1.12.0"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.19.0","vitest":"^4.1.10","typescript":"^5.7.0","@types/node":"^22.10.0"},"_npmOperationalInternal":{"tmp":"tmp/magga_0.1.0_1783683226160_0.2325144441233502","host":"s3://npm-registry-packages-npm-production"}},"0.2.0":{"name":"@8nobletruths/magga","version":"0.2.0","keywords":["mcp","pull-request","verification","ci","coding-agent","ai-slop","github-action"],"author":{"name":"8NobleTruths"},"license":"Apache-2.0","_id":"@8nobletruths/magga@0.2.0","maintainers":[{"name":"nobal","email":"jonsaw567@gmail.com"}],"homepage":"https://github.com/8NobleTruths/magga#readme","bugs":{"url":"https://github.com/8NobleTruths/magga/issues"},"bin":{"magga":"dist/cli.js"},"dist":{"shasum":"d929890abc52afe9a2bd6464fc324e5941620cf2","tarball":"https://registry.npmjs.org/@8nobletruths/magga/-/magga-0.2.0.tgz","fileCount":21,"integrity":"sha512-b3N4JRA2sv/gR/s15sABLKB7KiukP4LS+Tqqu8Y7gMXmHNp8GDGQKEMRkypTMHnlUj0XMlX1prDwXY8VAr86ng==","signatures":[{"sig":"MEUCIEyNf4nXlkRTNOtfQecTWsMQ5w5nyZNMmAp8hFNcmr9xAiEA0CKezsmMukDdJFHcO7YHXVfr/zakeIg7F3F2FxQjjMY=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":46363},"main":"./dist/index.js","type":"module","types":"./dist/index.d.ts","engines":{"node":">=18"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"}},"gitHead":"21596927545a807d50fe4329c66948797ab77599","scripts":{"dev":"tsx src/cli.ts","test":"vitest run","build":"tsc","typecheck":"tsc --noEmit","prepublishOnly":"npm run build"},"_npmUser":{"name":"nobal","email":"jonsaw567@gmail.com"},"repository":{"url":"git+https://github.com/8NobleTruths/magga.git","type":"git"},"_npmVersion":"11.6.2","description":"Prove that a code change actually works, whether an agent wrote it or a pull request did.","directories":{},"_nodeVersion":"25.1.0","dependencies":{"zod":"^3.23.8","@modelcontextprotocol/sdk":"^1.12.0"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.19.0","vitest":"^4.1.10","typescript":"^5.7.0","@types/node":"^22.10.0"},"_npmOperationalInternal":{"tmp":"tmp/magga_0.2.0_1783686278772_0.7374439769015686","host":"s3://npm-registry-packages-npm-production"}},"0.3.0":{"name":"@8nobletruths/magga","version":"0.3.0","description":"Prove that a code change actually works, whether an agent wrote it or a pull request did.","type":"module","bin":{"magga":"dist/cli.js"},"main":"./dist/index.js","types":"./dist/index.d.ts","exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"}},"engines":{"node":">=18"},"scripts":{"build":"tsc","dev":"tsx src/cli.ts","typecheck":"tsc --noEmit","test":"vitest run","prepublishOnly":"npm run build"},"keywords":["mcp","pull-request","verification","ci","coding-agent","ai-slop","github-action"],"license":"Apache-2.0","author":{"name":"8NobleTruths"},"repository":{"type":"git","url":"git+https://github.com/8NobleTruths/magga.git"},"bugs":{"url":"https://github.com/8NobleTruths/magga/issues"},"homepage":"https://github.com/8NobleTruths/magga#readme","dependencies":{"@modelcontextprotocol/sdk":"^1.12.0","zod":"^3.23.8"},"devDependencies":{"@types/node":"^22.10.0","tsx":"^4.19.0","typescript":"^5.7.0","vitest":"^4.1.10"},"gitHead":"a5a21530cb21f7dfaf24f1289373d8c008c3c19f","_id":"@8nobletruths/magga@0.3.0","_nodeVersion":"25.1.0","_npmVersion":"11.6.2","dist":{"integrity":"sha512-Vii9Y3TiS45HCJPA/5gFJBlMJybJN7jzXotCTpdjBsfgOFlW60cVOlPEvdkmdO518jmD75gAO1OO/9mN4tvbgw==","shasum":"9c4e6b6cdf396602f83d55bc73c8c114400aa0d4","tarball":"https://registry.npmjs.org/@8nobletruths/magga/-/magga-0.3.0.tgz","fileCount":21,"unpackedSize":49327,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIH9ZlZ9er0ox8qfR/Ci5aevJrmniibn646F/kCuJJAYuAiEAg5QlvBCddzxbgn4oIQ0txyu/10y1zXez1IZeiNoepjE="}]},"_npmUser":{"name":"nobal","email":"jonsaw567@gmail.com"},"directories":{},"maintainers":[{"name":"nobal","email":"jonsaw567@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/magga_0.3.0_1783688883487_0.3828860601729711"},"_hasShrinkwrap":false}},"time":{"created":"2026-07-10T11:33:45.978Z","modified":"2026-07-10T13:08:03.804Z","0.1.0":"2026-07-10T11:33:46.318Z","0.2.0":"2026-07-10T12:24:38.911Z","0.3.0":"2026-07-10T13:08:03.679Z"},"bugs":{"url":"https://github.com/8NobleTruths/magga/issues"},"author":{"name":"8NobleTruths"},"license":"Apache-2.0","homepage":"https://github.com/8NobleTruths/magga#readme","keywords":["mcp","pull-request","verification","ci","coding-agent","ai-slop","github-action"],"repository":{"type":"git","url":"git+https://github.com/8NobleTruths/magga.git"},"description":"Prove that a code change actually works, whether an agent wrote it or a pull request did.","maintainers":[{"name":"nobal","email":"jonsaw567@gmail.com"}],"readme":"# Magga\n\n[![npm](https://img.shields.io/npm/v/@8nobletruths/magga)](https://www.npmjs.com/package/@8nobletruths/magga) [![ci](https://github.com/8NobleTruths/magga/actions/workflows/ci.yml/badge.svg)](https://github.com/8NobleTruths/magga/actions/workflows/ci.yml) [![license](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)\n\nProve that a code change actually works, whether an AI agent wrote it or a stranger's pull request did.\n\nMagga runs the change in a sandbox and checks it against reality instead of scoring how plausible it looks. The name is the Pali word for \"the path\": a change has to walk the path (build, test, prove) before it is trusted.\n\n## Why this exists\n\nTwo problems, one root cause.\n\nA coding agent tells you \"fixed the crash\" and you have no fast way to know if that is true or if it just wrote something that looks right. At the same time, maintainers are buried under pull requests that were generated the same way: plausible on the surface, hollow underneath. Scoring tools try to guess which ones are real by reading them. But slop is written to read well, so reading it is exactly the wrong test.\n\nMagga does not read and guess. It builds the change and runs it.\n\n## The core idea: the change earns its verdict by execution\n\nThe signal a plain reviewer cannot get is whether a change is backed by a test that actually exercises it. Magga's main check is simple and hard to fake:\n\nIf a change adds a test, that test must fail on the code before the change and pass on the code after it.\n\nA genuine fix comes with a test that reproduces the bug (fails on the old code) and closes it (passes on the new code). A hollow change comes with a test that passes either way, because it does not really cover anything. No amount of good-looking prose survives this, because it is decided by running the code.\n\nOn top of that, Magga confirms the change builds and the existing suite still passes, so a break or a regression is caught before anything else.\n\n## Two ways to use it, one engine\n\nMagga is one verification engine behind a few thin surfaces.\n\n### For developers, as an MCP tool\n\nPoint your coding agent at Magga and it can prove its own work before telling you it is done. Register the server with Claude Code, Codex, or opencode:\n\n```json\n{\n  \"mcpServers\": {\n    \"magga\": { \"command\": \"npx\", \"args\": [\"-y\", \"@8nobletruths/magga\", \"mcp\"] }\n  }\n}\n```\n\nAfter the agent edits code, it calls the `verify_change` tool. Magga builds, runs the tests, runs the fails-on-base check, and returns a verdict with evidence. If the change is not verified, the agent iterates instead of claiming success.\n\n### For maintainers, as a GitHub Action\n\nDrop the action into a repo and every incoming pull request is checked automatically. It posts a verdict and a label (verified, needs-info, or likely-slop) with the evidence behind it, and surfaces only the pull requests worth your time.\n\n```yaml\n# .github/workflows/magga.yml\nname: magga\non: pull_request\npermissions:\n  contents: read\n  pull-requests: write\n  issues: write\njobs:\n  verify:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          fetch-depth: 0\n          ref: ${{ github.event.pull_request.head.sha }}\n      - uses: 8NobleTruths/magga@v0.3.0\n        # accepting untrusted outside pull requests? isolate them:\n        # with:\n        #   sandbox: true\n```\n\nBy default the build and tests run directly on the runner, which is fine for pull requests you trust (your own, or a private repo). To accept untrusted outside pull requests, set `sandbox: true`: the pull request's setup, build, and tests then run inside an ephemeral Docker container with no network, resource limits, and none of the runner's secrets, while Magga's own git operations stay on the host. You can pin the image with `image:` (it defaults to a per-language image).\n\n### From the command line\n\n```\nmagga verify .                          # verify the current branch against its merge base\nmagga verify . --base main --head HEAD\nmagga verify . --json                   # machine-readable verdict\n```\n\n## How a verdict is reached\n\n```\n                MCP tool          GitHub Action          CLI\n             verify_change          PR gate           magga verify\n                   \\                    |                  /\n                    \\                   |                 /\n                     ------------- MAGGA CORE ------------\n                        sandbox    isolated build + run\n                        checks     build\n                                   test suite (regression)\n                                   test-fails-on-base (novelty)\n                        verdict    status + evidence\n```\n\nStatuses:\n\n- `verified` builds, the suite passes, and the new test fails on the base and passes on the head.\n- `needs-info` builds and passes, but nothing proves the change is real (for example a fix with no covering test). Magga asks a specific question rather than guessing.\n- `likely-slop` does not build, breaks the suite, or ships a test that passes on the base too.\n\n## Install\n\n```\nnpx @8nobletruths/magga verify .        # run without installing\nnpm install -g @8nobletruths/magga      # or install the CLI (the command is `magga`)\n```\n\nSupported project types: Rust (Cargo), Go, Solidity (Foundry), JavaScript/TypeScript (npm/pnpm and Deno), Python (pytest), and C/C++ (Make and CMake) are exercised end to end in CI. There is also best-effort detection for Java (Maven and Gradle), Ruby, PHP, C#/.NET, Elixir, Swift, and Zig. Anything the defaults miss can be set in `.magga.json`.\n\n## Configuration\n\nDetection covers the common cases. When your repo needs something else, override it with a `.magga.json` at the root (every field optional):\n\n```json\n{\n  \"setup\": \"npm ci\",\n  \"build\": \"cargo build --release\",\n  \"test\": \"cargo nextest run\",\n  \"testMarkers\": [\"tests/\", \"_test.rs\"]\n}\n```\n\n`setup` runs once before the checks (for example to install dependencies) and again in the base worktree during the novelty check. Commands can be a string or an array of arguments. The same overrides are available as flags: `--setup`, `--build`, `--test`. Flags win over `.magga.json`, which wins over detection.\n\n## Status\n\nAll three surfaces work today: the CLI, the MCP server (Claude Code, Codex, opencode), and the GitHub Action. Detection is proven in CI for Rust, Go, Solidity (Foundry), JavaScript/TypeScript, Python, and C/C++, with best-effort detection for several more and per-repo overrides in `.magga.json`. Untrusted pull requests can be isolated in a Docker container with `--sandbox` (or `sandbox: true` on the Action). Published as [`@8nobletruths/magga`](https://www.npmjs.com/package/@8nobletruths/magga).\n\nStill maturing: the novelty check runs the whole suite rather than the single affected test, and the set of supported project types will keep growing with use. See [ROADMAP.md](ROADMAP.md).\n\n## Contributing\n\nIssues and pull requests are welcome. Magga verifies changes by running them, so a good pull request comes with a test that fails without your change and passes with it.\n\n## License\n\nApache-2.0. See [LICENSE](LICENSE).\n","readmeFilename":"README.md"}