renovate-mcp 0.1.0 → 0.3.0

package/README.md

@@ -10,12 +10,13 @@ Seven tools plus a preset reference:
 | --- | --- |
 | `check_setup` | Report Renovate CLI + validator availability, versions, env overrides, and install hints. Also runs at server startup and embeds the result in the server's `instructions` when anything's missing. |
 | `read_config` | Locate and parse `renovate.json` / `renovate.json5` / `.renovaterc*` / `.github/renovate.json` / `.gitlab/renovate.json` / `package.json#renovate` in a repo — in Renovate's priority order. |
-| `resolve_config` | Expand every `extends` preset against the committed catalogue and return the fully resolved config (offline; no `renovate` invocation). Flags unresolvable entries with a reason. Opt in to fetching `github>` / `gitlab>` presets over HTTPS with `externalPresets: true` (auth via `GITHUB_TOKEN` / `GITLAB_TOKEN` / `RENOVATE_TOKEN`). |
+| `resolve_config` | Expand every `extends` preset against the committed catalogue and return the fully resolved config (offline; no `renovate` invocation). Flags unresolvable entries with a reason. Opt in to fetching `github>` / `gitlab>` presets over HTTPS with `externalPresets: true` (auth via `GITHUB_TOKEN` / `GITLAB_TOKEN` / `RENOVATE_TOKEN`). For GitHub Enterprise or self-hosted GitLab, pass `endpoint` (API base URL) — and `platform` in addition to route `local>` presets through the same host. `bitbucket>`, `gitea>`, and npm presets remain in `presetsUnresolved` regardless. |
 | `preview_custom_manager` | Preview a `customManagers` (regex) entry against a local repo — offline, no `renovate` invocation. Shows which files match `fileMatch`, which lines match each `matchStrings` regex with named capture groups, and what dep info the template fields produce. Intended for fast regex iteration; run `dry_run` afterwards for full-fidelity confirmation. |
 | `validate_config` | Run `renovate-config-validator` against a file or inline object. |
 | `dry_run` | Run Renovate with `--platform=local --dry-run`, return the structured JSON report (no PRs, no pushes). |
 | `write_config` | Validate, then write a config to disk (temp-file → validate → atomic rename). Refuses to save invalid configs unless `force: true`. |
-| `renovate://presets` (resource) | Markdown index of every built-in preset (1000+), grouped by namespace. Snapshot from the installed `renovate` devDep. |
+| `renovate://presets` (resource) | Thin markdown index of every namespace (with preset counts) covering all 1000+ built-in presets. Snapshot from the installed `renovate` devDep. |
+| `renovate://presets/{namespace}` (resource template) | Markdown listing of every preset in a single namespace (e.g. `renovate://presets/config`). Fetch this instead of the full index when the LLM only cares about one namespace — cuts token cost by roughly 1/N where N is the number of namespaces. |
 | `renovate://preset/{name}` (resource template) | Expanded JSON body (description, extends, packageRules, …) for any single built-in preset. E.g. `renovate://preset/config:recommended`. |
 
 ## Requirements
@@ -23,7 +24,7 @@ Seven tools plus a preset reference:
 - Node.js ≥ 24 (aligns with Renovate's own engine requirement).
 - Renovate available on your `PATH` — either a global install (`npm i -g renovate`) or a project-local install that exposes `renovate` and `renovate-config-validator` via `npm exec`. Only needed for `validate_config`, `dry_run`, and `write_config`; the offline tools (`read_config`, `resolve_config`, `preview_custom_manager`) work without it.
 - Override binary locations with env vars if needed: `RENOVATE_BIN`, `RENOVATE_CONFIG_VALIDATOR_BIN`.
-- Optional for `resolve_config` with `externalPresets: true`: `GITHUB_TOKEN` / `GITLAB_TOKEN` (or `RENOVATE_TOKEN` as a fallback) for fetching presets from private repos or to avoid rate limits.
+- Optional for `resolve_config` with `externalPresets: true`: `GITHUB_TOKEN` / `GITLAB_TOKEN` (or `RENOVATE_TOKEN` as a fallback) for fetching presets from private repos or to avoid rate limits. For GitHub Enterprise / self-hosted GitLab, pass the `endpoint` tool input (and `platform` if you also want `local>` presets routed there); `RENOVATE_ENDPOINT` is **not** read. Any env vars the tool does read must be set on the MCP server process itself — via the `env` key in `claude_desktop_config.json` / `.mcp.json`, not your shell, since the MCP server runs as a child of Claude and does not inherit shell env.
 
 ## Install
 
@@ -77,6 +78,39 @@ Add to `~/Library/Application Support/Claude/claude_desktop_config.json`:
 }
 ```
 
+## Example prompts
+
+Once the server is wired up, try prompts like these. They're written for Claude but work with any MCP-capable client.
+
+**Understanding an existing config**
+
+- "Read the Renovate config in this repo and summarize what it actually does — expand every preset so I can see the real effective behavior."
+- "Resolve my config and list anything that landed in `presetsUnresolved`, with the reason for each."
+
+**Browsing presets**
+
+- "List the presets in the `config` namespace." (uses the `renovate://presets/config` sub-resource — cheaper than pulling the whole index)
+- "What does `config:recommended` actually enable? Show me its expanded JSON."
+- "Find a built-in preset that pins GitHub Actions digests."
+
+**Self-hosted GitLab / GitHub Enterprise**
+
+- "Resolve my config with external presets enabled, fetching `gitlab>platform/renovate-presets` from our self-hosted GitLab at `https://gitlab.example.com/api/v4`. Route `local>` presets through the same host."
+- "Expand `github>acme/renovate-config//base` from our GitHub Enterprise at `https://github.acme.corp/api/v3`."
+
+(Reminder: auth tokens must be set on the MCP server process — via the `env` key in `.mcp.json` / `claude_desktop_config.json`, not your shell.)
+
+**Authoring a custom manager (regex)**
+
+- "I have `# renovate: datasource=docker depName=...` comments above image tags in my Dockerfiles. Draft a `customManagers` regex entry and preview it against this repo so I can see what it extracts."
+- "Here's a `customManagers` entry — preview it and tell me which files match, which lines hit each `matchStrings` regex, and what dep info gets extracted."
+
+**Validating, previewing, saving**
+
+- "Validate this proposed config against Renovate's schema without writing it anywhere."
+- "Do a dry run and show me which PRs Renovate would open — no pushes."
+- "Add `:semanticCommits` to my `extends`, validate it, and save back to `renovate.json`."
+
 ## Development
 
 ```bash
@@ -110,6 +144,7 @@ Secrets required on the repo: `RELEASE_PLEASE_TOKEN` (a PAT for release-please).
 
 - `validate_config`, `dry_run`, and `write_config` shell out to the Renovate CLI rather than importing Renovate as a library — this decouples our Node version from Renovate's (currently Node 24).
 - `resolve_config` and `preview_custom_manager` are fully in-process and never invoke the Renovate CLI, so they work without a Renovate install.
-- `resolve_config` expands `extends` against a committed snapshot of Renovate's built-in presets (`src/data/presets.generated.ts`). External `github>` / `gitlab>` fetching is opt-in, uses each platform's contents API with a 10 s timeout, and caches results per call.
+- `preview_custom_manager` honors `.gitignore` (including nested `.gitignore`s and `.git/info/exclude`) when walking the repo, so generated/vendored directories like `dist/`, `.next/`, `target/`, `__pycache__/` don't crowd out real hits against the `maxFilesScanned` cap. `node_modules/` and `.git/` are always skipped as a safety net even when no `.gitignore` is present.
+- `resolve_config` expands `extends` against a committed snapshot of Renovate's built-in presets (`src/data/presets.generated.ts`). External `github>` / `gitlab>` fetching is opt-in, uses each platform's contents API with a 10 s timeout, and caches results per call. The `endpoint` input swaps in a custom API base for GHE / self-hosted GitLab; `platform` additionally rewrites `local>` presets to be fetched against that endpoint.
 - `dry_run` uses `--report-type=file` so we get a structured JSON report instead of scraping stdout.
 - `write_config` writes to a temp file, validates, then atomically renames — so a failed validation never leaves a broken config on disk.

package/dist/index.js

@@ -22,13 +22,13 @@ const BASE_INSTRUCTIONS = [
     "  6. write_config           — save the agreed-upon config (validates first)",
     "",
     "If any tool fails unexpectedly, call check_setup to diagnose CLI availability.",
-    "Built-in preset reference is available at renovate://presets.",
+    "Built-in preset reference: renovate://presets (namespace index), renovate://presets/{namespace} (one namespace), renovate://preset/{name} (one preset's expanded JSON).",
 ].join("\n");
 const setup = await checkSetup();
 const instructions = setup.ok
     ? BASE_INSTRUCTIONS
     : [BASE_INSTRUCTIONS, "", "Startup setup check:", describeSetup(setup)].join("\n");
-const SERVER_VERSION = "0.1.0"; // x-release-please-version
+const SERVER_VERSION = "0.3.0"; // x-release-please-version
 const server = new McpServer({ name: "renovate-mcp", version: SERVER_VERSION }, { instructions });
 registerCheckSetup(server);
 registerReadConfig(server);

package/dist/lib/customManagerPreview.js

@@ -1,5 +1,6 @@
 import { promises as fs } from "node:fs";
 import path from "node:path";
+import ignore from "ignore";
 const DEFAULT_MAX_FILES_SCANNED = 2000;
 const DEFAULT_MAX_HITS_PER_FILE = 100;
 const SKIP_DIRS = new Set([".git", "node_modules"]);
@@ -125,29 +126,79 @@ function lineNumberAt(content, index) {
     }
     return line;
 }
-async function* walk(root) {
-    const stack = [""];
-    while (stack.length > 0) {
-        const relDir = stack.pop();
-        const absDir = path.join(root, relDir);
-        let entries;
-        try {
-            entries = await fs.readdir(absDir, { withFileTypes: true });
-        }
-        catch {
+async function readMaybe(abs) {
+    try {
+        return await fs.readFile(abs, "utf8");
+    }
+    catch {
+        return null;
+    }
+}
+async function loadGitignore(root, relDir, levels) {
+    const content = await readMaybe(path.join(root, relDir, ".gitignore"));
+    if (!content)
+        return levels;
+    const posixPrefix = relDir === "" ? "" : `${toPosix(relDir)}/`;
+    return [...levels, { prefix: posixPrefix, ig: ignore().add(content) }];
+}
+function isIgnored(relPath, isDir, levels) {
+    for (const level of levels) {
+        const sub = level.prefix === ""
+            ? relPath
+            : relPath.startsWith(level.prefix)
+                ? relPath.slice(level.prefix.length)
+                : null;
+        if (sub === null || sub === "")
             continue;
+        // `ignore` treats a trailing slash as "this is a directory", which is what
+        // lets patterns like `dist/` match directory paths.
+        if (level.ig.ignores(isDir ? `${sub}/` : sub))
+            return true;
+    }
+    return false;
+}
+function toPosix(p) {
+    return p.split(path.sep).join("/");
+}
+async function* walk(root) {
+    // Seed the root level with `.gitignore` plus `.git/info/exclude` (the
+    // per-clone exclude file). Both are optional.
+    const rootIg = ignore();
+    const rootGitignore = await readMaybe(path.join(root, ".gitignore"));
+    if (rootGitignore)
+        rootIg.add(rootGitignore);
+    const infoExclude = await readMaybe(path.join(root, ".git", "info", "exclude"));
+    if (infoExclude)
+        rootIg.add(infoExclude);
+    const rootLevels = [{ prefix: "", ig: rootIg }];
+    yield* walkDir(root, "", rootLevels);
+}
+async function* walkDir(root, relDir, levels) {
+    let entries;
+    try {
+        entries = await fs.readdir(path.join(root, relDir), { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    // A nested `.gitignore` only affects this directory's subtree — add it to
+    // the stack on entry. (The root `.gitignore` is already in `levels`.)
+    const dirLevels = relDir === "" ? levels : await loadGitignore(root, relDir, levels);
+    for (const entry of entries) {
+        const relPath = relDir === "" ? entry.name : `${toPosix(relDir)}/${entry.name}`;
+        if (entry.isDirectory()) {
+            if (SKIP_DIRS.has(entry.name))
+                continue;
+            if (isIgnored(relPath, true, dirLevels))
+                continue;
+            yield* walkDir(root, path.join(relDir, entry.name), dirLevels);
         }
-        for (const entry of entries) {
-            if (entry.isDirectory()) {
-                if (SKIP_DIRS.has(entry.name))
-                    continue;
-                stack.push(path.join(relDir, entry.name));
-            }
-            else if (entry.isFile()) {
-                // Always emit POSIX-style paths so users on macOS/Linux/Windows write
-                // the same fileMatch regexes.
-                yield path.join(relDir, entry.name).split(path.sep).join("/");
-            }
+        else if (entry.isFile()) {
+            if (isIgnored(relPath, false, dirLevels))
+                continue;
+            // Always emit POSIX-style paths so users on macOS/Linux/Windows write
+            // the same fileMatch regexes.
+            yield toPosix(relPath);
         }
     }
 }

package/dist/lib/externalPresetFetcher.d.ts

@@ -1,7 +1,14 @@
-import type { ParsedPreset } from "./presetResolver.js";
+import { type ParsedPreset } from "./presetResolver.js";
 export interface FetchOptions {
     timeoutMs?: number;
     cache?: Map<string, Promise<FetchResult>>;
+    /**
+     * Override the API base URL. For `github>` presets, defaults to
+     * `https://api.github.com` (pass `https://ghe.example.com/api/v3` for GitHub
+     * Enterprise). For `gitlab>`, defaults to `https://gitlab.com/api/v4` (pass
+     * `https://gitlab.example.com/api/v4` for self-hosted).
+     */
+    endpoint?: string;
     /** Injectable for tests. Defaults to globalThis.fetch. */
     fetchImpl?: typeof fetch;
 }

package/dist/lib/externalPresetFetcher.js

@@ -1,4 +1,10 @@
+import { classifyExternalSource } from "./presetResolver.js";
 const DEFAULT_TIMEOUT_MS = 10_000;
+const DEFAULT_GITHUB_API_BASE = "https://api.github.com";
+const DEFAULT_GITLAB_API_BASE = "https://gitlab.com/api/v4";
+function trimTrailingSlash(url) {
+    return url.replace(/\/+$/, "");
+}
 export async function fetchExternalPreset(parsed, options = {}) {
     const cache = options.cache;
     const cacheKey = parsed.key;
@@ -10,43 +16,36 @@ export async function fetchExternalPreset(parsed, options = {}) {
     return promise;
 }
 function dispatch(parsed, options) {
+    if (!parsed.source) {
+        return Promise.resolve({ ok: false, reason: "Unknown preset source: (none)" });
+    }
+    const classification = classifyExternalSource(parsed.source);
+    if (!classification.fetchable) {
+        return Promise.resolve({ ok: false, reason: classification.reason });
+    }
     const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
     const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+    const endpoint = options.endpoint ? trimTrailingSlash(options.endpoint) : undefined;
     switch (parsed.source) {
         case "github":
-            return fetchGitHub(parsed, timeoutMs, fetchImpl);
+            return fetchGitHub(parsed, timeoutMs, fetchImpl, endpoint);
         case "gitlab":
-            return fetchGitLab(parsed, timeoutMs, fetchImpl);
-        case "bitbucket":
-        case "gitea":
-            return Promise.resolve({
-                ok: false,
-                reason: `${parsed.source}> presets are not yet supported. Track progress in issue #10.`,
-            });
-        case "local":
-            return Promise.resolve({
-                ok: false,
-                reason: "local> presets require platform/repo context that resolve_config does not have; out of scope.",
-            });
-        case "npm":
-            return Promise.resolve({
-                ok: false,
-                reason: "npm-hosted presets are not yet supported. Host the preset on GitHub or GitLab, or track progress in issue #10.",
-            });
+            return fetchGitLab(parsed, timeoutMs, fetchImpl, endpoint);
         default:
             return Promise.resolve({
                 ok: false,
-                reason: `Unknown preset source: ${parsed.source ?? "(none)"}`,
+                reason: `Unknown preset source: ${parsed.source}`,
             });
     }
 }
-async function fetchGitHub(parsed, timeoutMs, fetchImpl) {
+async function fetchGitHub(parsed, timeoutMs, fetchImpl, endpoint) {
     if (!parsed.repoPath || !parsed.repoPath.includes("/")) {
         return { ok: false, reason: `Invalid github preset: ${parsed.original}` };
     }
     const file = presetFileName(parsed);
     const ref = parsed.ref ?? "HEAD";
-    const url = `https://api.github.com/repos/${parsed.repoPath}/contents/${encodeFilePath(file)}?ref=${encodeURIComponent(ref)}`;
+    const apiBase = endpoint ?? DEFAULT_GITHUB_API_BASE;
+    const url = `${apiBase}/repos/${parsed.repoPath}/contents/${encodeFilePath(file)}?ref=${encodeURIComponent(ref)}`;
     const token = process.env.GITHUB_TOKEN || process.env.RENOVATE_TOKEN;
     const headers = {
         Accept: "application/vnd.github.raw",
@@ -56,13 +55,14 @@ async function fetchGitHub(parsed, timeoutMs, fetchImpl) {
         headers.Authorization = `Bearer ${token}`;
     return fetchJson(url, headers, timeoutMs, parsed.original, fetchImpl);
 }
-async function fetchGitLab(parsed, timeoutMs, fetchImpl) {
+async function fetchGitLab(parsed, timeoutMs, fetchImpl, endpoint) {
     if (!parsed.repoPath) {
         return { ok: false, reason: `Invalid gitlab preset: ${parsed.original}` };
     }
     const file = presetFileName(parsed);
     const ref = parsed.ref ?? "HEAD";
-    const url = `https://gitlab.com/api/v4/projects/${encodeURIComponent(parsed.repoPath)}/repository/files/${encodeURIComponent(file)}/raw?ref=${encodeURIComponent(ref)}`;
+    const apiBase = endpoint ?? DEFAULT_GITLAB_API_BASE;
+    const url = `${apiBase}/projects/${encodeURIComponent(parsed.repoPath)}/repository/files/${encodeURIComponent(file)}/raw?ref=${encodeURIComponent(ref)}`;
     const token = process.env.GITLAB_TOKEN || process.env.RENOVATE_TOKEN;
     const headers = { "User-Agent": "renovate-mcp" };
     if (token)

package/dist/lib/presetResolver.d.ts

@@ -7,13 +7,47 @@ export interface ResolveResult {
     presetsResolved: string[];
     presetsUnresolved: UnresolvedPreset[];
 }
+export type FetchPlatform = "github" | "gitlab";
 export interface ResolveOptions {
     /** When true, fetch external presets (github>, gitlab>, …) over the network. */
     fetchExternal?: boolean;
     /** Per-request fetch timeout; forwarded to the external fetcher. */
     timeoutMs?: number;
+    /**
+     * Override the API base URL used for `github>` / `gitlab>` fetches — e.g.
+     * `https://ghe.example.com/api/v3` for GitHub Enterprise or
+     * `https://gitlab.example.com/api/v4` for self-hosted GitLab. When unset,
+     * defaults to `https://api.github.com` and `https://gitlab.com/api/v4`.
+     */
+    endpoint?: string;
+    /**
+     * Platform flavour of `endpoint`. Required only when it's not derivable from
+     * the preset source (e.g. to resolve `local>` presets against a self-hosted
+     * GitHub/GitLab). When set, `local>owner/repo` is fetched as if it were
+     * `<platform>>owner/repo`.
+     */
+    platform?: FetchPlatform;
 }
 export type ExternalSource = "github" | "gitlab" | "bitbucket" | "gitea" | "local" | "npm";
+export type SourceClassification = {
+    fetchable: true;
+} | {
+    fetchable: false;
+    reason: string;
+};
+/**
+ * Single source of truth for "can resolve_config ever fetch this external
+ * preset?". Used by both the resolver (to short-circuit before branching on the
+ * `externalPresets` flag) and the fetcher (to produce the same reason once the
+ * flag is on) — so a `local>` preset, say, returns the identical unresolved
+ * reason regardless of the flag.
+ *
+ * - `github`, `gitlab`: fetchable over HTTPS.
+ * - `local`: structurally unsupported — requires platform/repo context the
+ *   tool does not have.
+ * - `bitbucket`, `gitea`, `npm`: not yet implemented.
+ */
+export declare function classifyExternalSource(source: string): SourceClassification;
 export interface ParsedPreset {
     /** Canonical identifier used as map key and for cycle detection. */
     key: string;

package/dist/lib/presetResolver.js

@@ -1,5 +1,45 @@
 import { PRESETS } from "../data/presets.generated.js";
 import { fetchExternalPreset } from "./externalPresetFetcher.js";
+/**
+ * Single source of truth for "can resolve_config ever fetch this external
+ * preset?". Used by both the resolver (to short-circuit before branching on the
+ * `externalPresets` flag) and the fetcher (to produce the same reason once the
+ * flag is on) — so a `local>` preset, say, returns the identical unresolved
+ * reason regardless of the flag.
+ *
+ * - `github`, `gitlab`: fetchable over HTTPS.
+ * - `local`: structurally unsupported — requires platform/repo context the
+ *   tool does not have.
+ * - `bitbucket`, `gitea`, `npm`: not yet implemented.
+ */
+export function classifyExternalSource(source) {
+    switch (source) {
+        case "github":
+        case "gitlab":
+            return { fetchable: true };
+        case "local":
+            return {
+                fetchable: false,
+                reason: "local> presets require platform/repo context that resolve_config does not have; out of scope.",
+            };
+        case "bitbucket":
+        case "gitea":
+            return {
+                fetchable: false,
+                reason: `${source}> presets are not yet supported. Track progress in issue #10.`,
+            };
+        case "npm":
+            return {
+                fetchable: false,
+                reason: "npm-hosted presets are not yet supported. Host the preset on GitHub or GitLab, or track progress in issue #10.",
+            };
+        default:
+            return {
+                fetchable: false,
+                reason: `Unknown preset source: ${source}`,
+            };
+    }
+}
 /**
  * Resolve a Renovate config by expanding every preset in `extends`. Built-in
  * presets resolve offline against the committed catalogue; external presets
@@ -13,6 +53,8 @@ export async function resolveConfig(config, options = {}) {
     const ctx = {
         fetchExternal: options.fetchExternal ?? false,
         timeoutMs: options.timeoutMs,
+        endpoint: options.endpoint,
+        platform: options.platform,
         cache: new Map(),
     };
     const resolved = await expand(config, presetsResolved, presetsUnresolved, stack, ctx);
@@ -66,15 +108,27 @@ async function loadPresetBody(parsed, ctx, unresolvedList) {
         }
         return preset.body;
     }
+    // If a `platform` is configured, route `local>` presets through it — the
+    // self-hosted case where the user's "local" presets actually live on their
+    // private GitHub/GitLab at `endpoint`.
+    const effective = parsed.source === "local" && ctx.platform
+        ? { ...parsed, source: ctx.platform }
+        : parsed;
+    const classification = classifyExternalSource(effective.source);
+    if (!classification.fetchable) {
+        unresolvedList.push({ preset: parsed.original, reason: classification.reason });
+        return null;
+    }
     if (!ctx.fetchExternal) {
         unresolvedList.push({
             preset: parsed.original,
-            reason: "External preset (github>, gitlab>, bitbucket>, gitea>, local>, or npm). Fetching requires network access and potentially credentials; pass externalPresets: true to enable.",
+            reason: "External preset (github>, gitlab>). Fetching requires network access and potentially credentials; pass externalPresets: true to enable.",
         });
         return null;
     }
-    const result = await fetchExternalPreset(parsed, {
+    const result = await fetchExternalPreset(effective, {
         timeoutMs: ctx.timeoutMs,
+        endpoint: ctx.endpoint,
         cache: ctx.cache,
     });
     if (!result.ok) {

package/dist/resources/presets.js

@@ -1,19 +1,60 @@
 import { ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { PRESETS, PRESET_NAMES, RENOVATE_VERSION, } from "../data/presets.generated.js";
+const BY_NAMESPACE = (() => {
+    const map = new Map();
+    for (const name of PRESET_NAMES) {
+        const preset = PRESETS[name];
+        const bucket = map.get(preset.namespace) ?? [];
+        bucket.push({ name, description: preset.description });
+        map.set(preset.namespace, bucket);
+    }
+    return map;
+})();
+const NAMESPACES = Array.from(BY_NAMESPACE.keys()).sort();
 export function registerPresetResources(server) {
     server.registerResource("renovate-presets", "renovate://presets", {
-        title: "Renovate built-in preset index",
-        description: `Markdown index of all ${PRESET_NAMES.length} built-in Renovate presets (from renovate v${RENOVATE_VERSION}). Grouped by namespace. Fetch renovate://preset/{name} for a single preset's expanded JSON.`,
+        title: "Renovate built-in preset namespace index",
+        description: `Thin markdown index of the ${NAMESPACES.length} namespaces covering all ${PRESET_NAMES.length} built-in Renovate presets (from renovate v${RENOVATE_VERSION}). Fetch renovate://presets/{namespace} for one namespace's preset list, or renovate://preset/{name} for a single preset's expanded JSON.`,
         mimeType: "text/markdown",
     }, async () => ({
         contents: [
             {
                 uri: "renovate://presets",
                 mimeType: "text/markdown",
-                text: renderIndex(),
+                text: renderNamespaceIndex(),
             },
         ],
     }));
+    server.registerResource("renovate-presets-namespace", new ResourceTemplate("renovate://presets/{namespace}", {
+        list: async () => ({
+            resources: NAMESPACES.map((ns) => ({
+                uri: `renovate://presets/${ns}`,
+                name: `renovate-presets-${ns}`,
+                description: `Markdown listing of the ${BY_NAMESPACE.get(ns).length} built-in presets in the \`${ns}\` namespace.`,
+                mimeType: "text/markdown",
+            })),
+        }),
+    }), {
+        title: "Renovate built-in presets — single namespace",
+        description: "Markdown listing of every built-in Renovate preset in a single namespace (e.g. `config`, `docker`, `default`). Fetch renovate://presets for the namespace index.",
+        mimeType: "text/markdown",
+    }, async (uri, variables) => {
+        const raw = variables.namespace;
+        const ns = typeof raw === "string" ? decodeURIComponent(raw) : "";
+        const bucket = BY_NAMESPACE.get(ns);
+        if (!bucket) {
+            throw new Error(`Unknown preset namespace: ${ns}. Fetch renovate://presets for the list of namespaces.`);
+        }
+        return {
+            contents: [
+                {
+                    uri: uri.href,
+                    mimeType: "text/markdown",
+                    text: renderNamespace(ns, bucket),
+                },
+            ],
+        };
+    });
     server.registerResource("renovate-preset", new ResourceTemplate("renovate://preset/{name}", {
         list: async () => ({
             resources: PRESET_NAMES.map((name) => {
@@ -53,30 +94,36 @@ export function registerPresetResources(server) {
         };
     });
 }
-function renderIndex() {
-    const byNamespace = new Map();
-    for (const name of PRESET_NAMES) {
-        const preset = PRESETS[name];
-        const bucket = byNamespace.get(preset.namespace) ?? [];
-        bucket.push({ name, description: preset.description });
-        byNamespace.set(preset.namespace, bucket);
-    }
-    const namespaces = Array.from(byNamespace.keys()).sort();
+function renderNamespaceIndex() {
     const lines = [
         "# Renovate built-in presets",
         "",
-        `Snapshot from renovate v${RENOVATE_VERSION} — **${PRESET_NAMES.length} presets** across ${namespaces.length} namespaces.`,
+        `Snapshot from renovate v${RENOVATE_VERSION} — **${PRESET_NAMES.length} presets** across ${NAMESPACES.length} namespaces.`,
+        "",
+        "Fetch `renovate://presets/<namespace>` for the full list of presets in one namespace, or `renovate://preset/<name>` for a single preset's expanded JSON.",
+        "",
+        "| Namespace | Presets | Resource |",
+        "| --- | ---: | --- |",
+    ];
+    for (const ns of NAMESPACES) {
+        const count = BY_NAMESPACE.get(ns).length;
+        lines.push(`| \`${ns}\` | ${count} | \`renovate://presets/${ns}\` |`);
+    }
+    lines.push("");
+    return lines.join("\n");
+}
+function renderNamespace(ns, bucket) {
+    const lines = [
+        `# Renovate \`${ns}\` presets`,
+        "",
+        `Snapshot from renovate v${RENOVATE_VERSION} — **${bucket.length} preset${bucket.length === 1 ? "" : "s"}** in the \`${ns}\` namespace.`,
         "",
         "Reference any of these in the `extends` array of your config. Fetch `renovate://preset/<name>` for the expanded JSON of a single preset.",
         "",
     ];
-    for (const ns of namespaces) {
-        const items = byNamespace.get(ns);
-        lines.push(`## \`${ns}\` (${items.length})`, "");
-        for (const { name, description } of items) {
-            lines.push(description ? `- \`${name}\` — ${description}` : `- \`${name}\``);
-        }
-        lines.push("");
+    for (const { name, description } of bucket) {
+        lines.push(description ? `- \`${name}\` — ${description}` : `- \`${name}\``);
     }
+    lines.push("");
     return lines.join("\n");
 }

package/dist/tools/previewCustomManager.js

@@ -28,7 +28,7 @@ export function registerPreviewCustomManager(server) {
             "  - Only `customType: \"regex\"` is supported.",
             "  - `matchStringsStrategy` other than `any` (the default) is not implemented; a warning is emitted.",
             "  - Template substitution handles only `{{groupName}}` references, not full Handlebars helpers.",
-            "  - `.gitignore` is not honored; `node_modules/` and `.git/` are always skipped.",
+            "  - `.gitignore` (and `.git/info/exclude`, plus nested `.gitignore`s) is honored like `git` does. `node_modules/` and `.git/` are always skipped as a safety net, even without a `.gitignore`.",
             "",
             "Run the `dry_run` tool afterwards for full-fidelity confirmation.",
         ].join("\n"),

package/dist/tools/resolveConfig.js

@@ -4,7 +4,7 @@ import { resolveConfig } from "../lib/presetResolver.js";
 export function registerResolveConfig(server) {
     server.registerTool("resolve_config", {
         title: "Resolve Renovate config (expand presets)",
-        description: "Expand every preset referenced by `extends` and return the fully resolved config. Built-in presets resolve offline against the committed catalogue. External presets (`github>`, `gitlab>`, `bitbucket>`, `gitea>`, `local>`, npm) are listed in `presetsUnresolved` by default; pass `externalPresets: true` to fetch `github>` / `gitlab>` over HTTPS (with optional `GITHUB_TOKEN` / `GITLAB_TOKEN` / `RENOVATE_TOKEN` for private repos). Pass either `repoPath` (reads the repo's config) or `configContent` (an inline config object).",
+        description: "Expand every preset referenced by `extends` and return the fully resolved config. Built-in presets resolve offline against the committed catalogue. Pass `externalPresets: true` to fetch `github>` and `gitlab>` presets over HTTPS (with optional `GITHUB_TOKEN` / `GITLAB_TOKEN` / `RENOVATE_TOKEN` for private repos). For GitHub Enterprise or self-hosted GitLab, pass `endpoint` (API base URL, e.g. `https://ghe.example.com/api/v3` or `https://gitlab.example.com/api/v4`); pass `platform` in addition to route `local>` presets through the same endpoint. `bitbucket>`, `gitea>`, and npm presets are structurally unsupported and remain in `presetsUnresolved` regardless. Endpoint and platform are **tool inputs only** — env vars like `RENOVATE_ENDPOINT` are not read, since the MCP server runs under Claude rather than in your shell. Pass either `repoPath` (reads the repo's config) or `configContent` (an inline config object).",
         inputSchema: {
             repoPath: z
                 .string()
@@ -17,9 +17,17 @@ export function registerResolveConfig(server) {
             externalPresets: z
                 .boolean()
                 .optional()
-                .describe("When true, fetch external presets (github>, gitlab>) over HTTPS. Credentials are read from GITHUB_TOKEN / GITLAB_TOKEN / RENOVATE_TOKEN env vars. Default false."),
+                .describe("When true, fetch external presets (github>, gitlab>) over HTTPS. Credentials come from GITHUB_TOKEN / GITLAB_TOKEN / RENOVATE_TOKEN env vars set on the MCP server process — via the `env` key in claude_desktop_config.json / .mcp.json, not your shell, since the MCP server runs as a child of Claude and does not inherit shell env. Default false."),
+            endpoint: z
+                .string()
+                .optional()
+                .describe("API base URL for github>/gitlab> fetches. Use for GitHub Enterprise (e.g. https://ghe.example.com/api/v3) or self-hosted GitLab (e.g. https://gitlab.example.com/api/v4). Defaults to https://api.github.com and https://gitlab.com/api/v4."),
+            platform: z
+                .enum(["github", "gitlab"])
+                .optional()
+                .describe("Platform flavour of `endpoint`. When set, `local>owner/repo` presets are fetched as if they were `<platform>>owner/repo` — useful for self-hosted setups where a config's `local>` presets actually live on your private GitHub/GitLab."),
         },
-    }, async ({ repoPath, configContent, externalPresets }) => {
+    }, async ({ repoPath, configContent, externalPresets, endpoint, platform }) => {
         if (!repoPath && !configContent) {
             return {
                 isError: true,
@@ -50,6 +58,8 @@ export function registerResolveConfig(server) {
         }
         const { resolved, presetsResolved, presetsUnresolved } = await resolveConfig(source, {
             fetchExternal: externalPresets ?? false,
+            endpoint,
+            platform,
         });
         return {
             content: [

package/dist/tools/writeConfig.js

@@ -2,6 +2,29 @@ import { z } from "zod";
 import path from "node:path";
 import { promises as fs } from "node:fs";
 import { run, resolveRenovateTool, formatMissingBinaryError } from "../lib/renovateCli.js";
+// Resolve symlinks in `p`, walking up to the nearest existing ancestor when
+// tail components don't exist yet (e.g. a new subdir we're about to mkdir).
+// This matters for the escape check: `fs.rename` follows symlinks along the
+// parent path, so the check must compare the same canonical tree.
+async function resolveWithExistingAncestor(p) {
+    const suffixes = [];
+    let current = p;
+    while (true) {
+        try {
+            const resolved = await fs.realpath(current);
+            return suffixes.length ? path.join(resolved, ...suffixes) : resolved;
+        }
+        catch (err) {
+            if (err.code !== "ENOENT")
+                throw err;
+            const parent = path.dirname(current);
+            if (parent === current)
+                throw err;
+            suffixes.unshift(path.basename(current));
+            current = parent;
+        }
+    }
+}
 export function registerWriteConfig(server) {
     server.registerTool("write_config", {
         title: "Write Renovate config",
@@ -22,7 +45,10 @@ export function registerWriteConfig(server) {
         const repoAbs = path.resolve(repoPath);
         const target = path.resolve(repoAbs, filename);
         const rel = path.relative(repoAbs, target);
-        if (rel.startsWith("..") || path.isAbsolute(rel)) {
+        const repoReal = await resolveWithExistingAncestor(repoAbs);
+        const parentReal = await resolveWithExistingAncestor(path.dirname(target));
+        const checkRel = path.relative(repoReal, parentReal);
+        if (checkRel.startsWith("..") || path.isAbsolute(checkRel)) {
             return {
                 isError: true,
                 content: [{ type: "text", text: "filename escapes repoPath" }],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "renovate-mcp",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "MCP server for designing Renovate configurations interactively.",
   "type": "module",
   "bin": {
@@ -50,6 +50,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
+    "ignore": "^7.0.5",
     "json5": "^2.2.3",
     "zod": "^4.0.0"
   },