housekeeping every repo, one question.
One sweep collects CI, pull requests, releases, security alerts, lockfiles and Actions billing for a whole GitHub organization into SQLite, then audits it against written rules. An AI agent reads it over MCP and coordinates work across every repository. Read-only. It changes nothing on GitHub.
Sweep
hk refresh
Ask
hk ci
Dig
hk sql "SELECT ..."
What it answers
For the whole organization at once, without opening each repository.
Which default branches are red
A broken mainline is kept apart from a failing Dependabot branch, a failing nightly job, and history left behind by a workflow that no longer runs on push.
Which pull requests can never merge
A required status check that no job reports blocks every pull request, and every other view still reads green. This finds it.
Which deploys the settings refuse
Pages switched off under a deploy workflow, or an environment that does not admit the default branch. Neither shows in a workflow file.
Where versions have drifted
The version in package.json, the newest semver tag, the newest Release and npm, side by side.
What Actions cost, and which job spent it
Per-job cost rebuilt from run durations, then checked against the invoice. A repository whose numbers disagree is reported as not measured.
Which advisories GitHub is not counting
Every committed npm and pnpm lockfile is read directly and checked against the advisory registry, because an unparsed manifest reports zero alerts.
An agent over every repository
The MCP server hands the whole organization to one AI agent, which can then coordinate the work.
Triage in one call
What is red, what is blocked, what got worse since the last sweep, with stale history and conflicted pull requests already told apart from real breakage.
One fix, every repository
A read-only SQL query finds every repository with the same shape, so a fix becomes one pull request per repository instead of a hunt.
Verified by the next sweep
housekeeping never writes. The agent does the work with its own tools and permissions, and the next sweep shows whether the finding is gone.
Paired with Atlas
Atlas maps one repository: its workflows, what they run and what a change reaches. housekeeping reads every map, says where a red run broke, and flags repositories with no map or an old one.
How it stays trustworthy
An audit that is confident and wrong is worse than none.
Every finding cites a written rule
The rule files ship in the repository. A finding is arguable against a standard, not against taste.
Not measured is never clean
A refused API call, an unscanned repository and an unread setting are reported as unknown. None of them is recorded as zero.
Snapshots are the source of truth
Each sweep is one immutable JSON file. The database is derived and rebuilds offline, so drift between two dates is a join.
Rules are tested in both directions
The shape that must fire, and the neighbouring shape that must not. A separate verifier re-derives findings from live GitHub.
Use it
Node 22.5 or later, and the GitHub CLI signed in.
Install
npm install -g \
@mcptoolshop/housekeeping
mkdir warehouse && cd warehouseSweep
hk refresh your-orgAsk
hk ci # red mainlines
hk findings # by severity
hk health # worst first
hk cost # gross and netHand it to an agent
hk-mcp
# hk_ci, hk_findings, hk_repo,
# hk_cost, hk_sql and moreKeep the data private
The tool is public. What a sweep writes is not.
| A snapshot contains | Why it matters |
|---|---|
| Private repository names | Their existence is not public. |
| Open security alerts | GitHub hides these from everyone but maintainers. |
| The Actions invoice | Your spending, line by line. |