renovate-mcp 0.5.0 → 0.7.0

package/README.md

@@ -13,6 +13,7 @@ An MCP server for designing [Renovate](https://github.com/renovatebot/renovate)
 - [What this is NOT](#what-this-is-not)
 - [Requirements](#requirements)
 - [Install](#install)
+- [Platform setup](#platform-setup)
 - [Example prompts](#example-prompts)
 - [Example session](#example-session)
 - [Development](#development)
@@ -21,17 +22,19 @@ An MCP server for designing [Renovate](https://github.com/renovatebot/renovate)
 
 ## What it does
 
-Eight tools plus a preset reference:
+Ten tools plus a preset reference:
 
 | Tool | Purpose |
 | --- | --- |
-| `check_setup` | Report Renovate CLI + validator availability, versions, and install hints. Also runs at startup. |
+| `check_setup` | Report Renovate CLI + validator availability, versions, and install hints. Also surfaces a `platformContext` block (`RENOVATE_PLATFORM` / `RENOVATE_ENDPOINT` values, token-presence booleans, the platform `dry_run` would pick when its input is unset, and notes about likely misconfigurations) so callers can verify env before invoking `dry_run`. Token values are never echoed — only presence booleans. Also runs at startup. |
+| `get_version` | Report the renovate-mcp server version and whether it's a released build (running from `node_modules`) or a local/dev build (typically launched via `command: node` against a checkout). |
 | `read_config` | Locate and parse a repo's Renovate config (`renovate.json`, `renovate.json5`, `.renovaterc*`, `package.json#renovate`, …) in priority order. |
 | `resolve_config` | Expand every `extends` preset offline. Opt in to fetching `github>` / `gitlab>` presets over HTTPS with `externalPresets: true`. |
 | `preview_custom_manager` | Preview a `customManagers` (regex) entry against a local repo — shows file/line hits and extracted dep info. Offline. |
 | `validate_config` | Run `renovate-config-validator` against a file or inline object. |
-| `lint_config` | Semantic lint for Renovate-specific footguns schema validation misses (mostly malformed `/…/` regex patterns). Offline. |
-| `dry_run` | Run Renovate with `--platform=local --dry-run` and return the structured JSON report. No PRs, no pushes. Emits MCP progress notifications during the run when the caller supplies a `progressToken`. |
+| `lint_config` | Semantic lint for Renovate-specific footguns schema validation misses — malformed `/…/` regex patterns plus unknown manager names in `matchManagers` / `excludeManagers`. Offline. |
+| `dry_run` | Run Renovate with `--dry-run` and return the structured JSON report. Defaults to `--platform=local` against `repoPath`; pass `platform` + `endpoint` + `token` + `repository` to run as a real GitHub/GitLab client (needed when the config extends `local>` presets on a private host). When `platform` is not passed, the tool reads `RENOVATE_PLATFORM` from the MCP server's env before defaulting to `local`. When `token` is not passed, falls back to `RENOVATE_TOKEN` from MCP env, then to `GITLAB_TOKEN` (when `platform=gitlab`) or `GITHUB_TOKEN` (when `platform=github`) — auto-translated to `RENOVATE_TOKEN` for the spawned Renovate CLI, since Renovate itself only reads that one var. `repository` accepts GitHub-style `owner/repo` and GitLab nested-group paths like `group/subgroup/project`. `endpoint`/`token` also flow through in local mode so `gitlab>…` / `github>…` preset shortcuts can be redirected at a self-hosted host without setting up a full remote run. No PRs, no pushes. Emits MCP progress notifications during the run when the caller supplies a `progressToken`. |
+| `dry_run_diff` | Semantic diff between two `dry_run` reports — `added` / `removed` / `changed` proposed updates plus a compact text rendering. Stateless; takes both reports as inputs. Useful when iterating on a config to see exactly what each tweak did. |
 | `write_config` | Validate, then atomically write a config to disk. Refuses to save invalid configs unless `force: true`. |
 | `renovate://presets` (resource) | Markdown index of all 1000+ built-in presets grouped by namespace. |
 | `renovate://presets/{namespace}` (resource template) | Markdown listing for a single namespace (e.g. `renovate://presets/config`) — cheaper than the full index. |
@@ -57,7 +60,7 @@ See [Design notes](#design-notes) for implementation details (timeouts, safety c
 
 - `RENOVATE_BIN` / `RENOVATE_CONFIG_VALIDATOR_BIN` — override binary locations.
 - `RENOVATE_MCP_REQUIRE_CLI=false` — suppress the startup "partial availability" notice when you only intend to use the offline tools.
-- `RENOVATE_TOKEN` (preferred) or `GITHUB_TOKEN` / `GITLAB_TOKEN` as platform-specific fallbacks — only needed by `resolve_config` with `externalPresets: true` for fetching presets from private repos or avoiding rate limits. `RENOVATE_TOKEN` wins when both are set. For GitHub Enterprise / self-hosted GitLab, pass the `endpoint` tool input (and `platform` to route `local>` presets through the same host); `RENOVATE_ENDPOINT` is **not** read.
+- Platform env vars — `RENOVATE_PLATFORM`, `RENOVATE_ENDPOINT`, and a token (`RENOVATE_TOKEN` / `GITHUB_TOKEN` / `GITLAB_TOKEN`). Needed for `dry_run` against a remote platform and for `resolve_config` with `externalPresets: true`. See [Platform setup](#platform-setup) for the matrix and a worked example.
 - Private-registry credentials for `dry_run` — whatever Renovate itself would need at lookup time (`COMPOSER_AUTH`, `NPM_TOKEN` / `.npmrc`, Docker registry creds, or a `RENOVATE_HOST_RULES` JSON blob). Alternatively encode these as `hostRules` in the Renovate config, or pass them per-call via the `hostRules` input on `dry_run` (no MCP restart needed). Per-call `hostRules` are appended to whatever the repo's own config declares. Values reach Renovate as JSON through the tool-call transport, so the calling LLM sees them in its context — prefer the env route if that matters. Without any of these, Renovate's lookup often returns 0 updates silently; `dry_run` scans its logs for auth failures and surfaces them under `problems`.
 
 > **Note:** all env vars (tokens, `COMPOSER_AUTH`, `RENOVATE_HOST_RULES`, binary overrides, …) must be set on the MCP server process itself — via the `env` key in `claude_desktop_config.json` / `.mcp.json`, not your shell — since the MCP server runs as a child of the client and does not inherit shell env.
@@ -106,6 +109,51 @@ Restart your client and prompt it:
 
 A response listing namespaces like `config`, `docker`, `npm`, `helpers`, … confirms the server is reachable and the resource is exposed. If the client reports the tool or resource as unavailable, re-check the config file path and command.
 
+## Platform setup
+
+The four common configurations differ in three settings: `RENOVATE_PLATFORM`, `RENOVATE_ENDPOINT`, and which token env var you set. Pick the row that matches your environment and put the values in your client's `mcpServers.renovate.env` block.
+
+| Setup | `RENOVATE_PLATFORM` | `RENOVATE_ENDPOINT` | Token env var |
+| --- | --- | --- | --- |
+| github.com | `github` | (omit — defaults to `https://api.github.com`) | `RENOVATE_TOKEN` *or* `GITHUB_TOKEN` |
+| GitHub Enterprise | `github` | `https://github.example.com/api/v3/` | `RENOVATE_TOKEN` *or* `GITHUB_TOKEN` |
+| gitlab.com | `gitlab` | (omit — defaults to `https://gitlab.com/api/v4`) | `RENOVATE_TOKEN` *or* `GITLAB_TOKEN` |
+| Self-hosted GitLab | `gitlab` | `https://gitlab.example.com/api/v4/` | `RENOVATE_TOKEN` *or* `GITLAB_TOKEN` |
+
+Notes that apply to every row:
+
+- All env vars must be on the MCP server process — set them via the `env` key in `.mcp.json` / `claude_desktop_config.json`, not your shell, since the MCP server runs as a child of the client and does not inherit shell env.
+- `RENOVATE_TOKEN` wins when both it and the platform-specific var are set. `dry_run` and `resolve_config` honour the same precedence; for `dry_run` the platform-specific var is auto-translated to `RENOVATE_TOKEN` for the spawned Renovate CLI (Renovate itself only reads that one var).
+- For repository identifiers, GitLab accepts nested-group paths like `group/subgroup/project`, not just `group/project`.
+- If you only intend to use the offline tools (`read_config`, `resolve_config` without `externalPresets`, `preview_custom_manager`, `lint_config`), you can skip all of the above.
+
+### Worked example — self-hosted GitLab
+
+```jsonc
+{
+  "mcpServers": {
+    "renovate": {
+      "command": "npx",
+      "args": ["-y", "renovate-mcp"],
+      "env": {
+        "RENOVATE_PLATFORM": "gitlab",
+        "RENOVATE_ENDPOINT": "https://gitlab.example.com/api/v4/",
+        "GITLAB_TOKEN": "<your token>"
+      }
+    }
+  }
+}
+```
+
+This is enough for both `dry_run` (remote-platform runs) and `resolve_config` (private preset fetches). With this set, `dry_run` against `group/subgroup/project` works without passing `platform` / `endpoint` / `token` per call: `RENOVATE_PLATFORM` and the auto-translated `GITLAB_TOKEN` cover the platform side, and `RENOVATE_ENDPOINT` is inherited naturally by the spawned Renovate CLI. For `resolve_config`, `platform` and `endpoint` are tool *inputs* (not env vars) — pass them when you need `local>` presets routed through your host, since `resolve_config` is in-process and doesn't read `RENOVATE_*` env vars itself.
+
+### `local>` presets
+
+A config that extends `local>owner/repo:preset` only resolves when there's a platform context to expand it against:
+
+- **For `dry_run`** — pass `platform` + `endpoint` + `repository` (token falls back to env). Use `dryRunMode=extract` if you only need manifest extraction; the preset preflight is skipped in that mode.
+- **For `resolve_config`** — pass `platform` + `endpoint` as inputs and the tool rewrites `local>` into `<platform>>` and fetches over HTTPS. Without these inputs, `local>` stays in `presetsUnresolved` with a pointer to the workaround. Run `dry_run` afterwards for full-fidelity merging.
+
 ## Example prompts
 
 Once the server is wired up, try prompts like these. They're written for Claude but work with any MCP-capable client.
@@ -121,12 +169,11 @@ Once the server is wired up, try prompts like these. They're written for Claude
 - "What does `config:recommended` actually enable? Show me its expanded JSON."
 - "Find a built-in preset that pins GitHub Actions digests."
 
-**Self-hosted GitLab / GitHub Enterprise**
+**Self-hosted GitLab / GitHub Enterprise** (env set per [Platform setup](#platform-setup))
 
 - "Resolve my config with external presets enabled, fetching `gitlab>platform/renovate-presets` from our self-hosted GitLab at `https://gitlab.example.com/api/v4`. Route `local>` presets through the same host."
 - "Expand `github>acme/renovate-config//base` from our GitHub Enterprise at `https://github.acme.corp/api/v3`."
-
-(Reminder: auth tokens must be set on the MCP server process — via the `env` key in `.mcp.json` / `claude_desktop_config.json`, not your shell.)
+- "Dry-run `infrastructure/kubernetes/our-platform` (a nested-group GitLab project) so Renovate can fetch the `local>` presets the config extends."
 
 **Authoring a custom manager (regex)**
 
@@ -176,9 +223,10 @@ npm test                 # vitest run (builds first)
 npm run test:watch       # vitest watch mode
 npm run test:coverage    # vitest run --coverage (writes coverage/ report)
 npm run generate:presets # regenerate src/data/presets.generated.ts from the renovate devDep
+npm run generate:managers # regenerate src/data/managers.generated.ts from the renovate devDep
 ```
 
-The preset catalogue at `src/data/presets.generated.ts` is a committed snapshot of Renovate's built-in presets. Runtime code never imports the `renovate` package — only `scripts/generate-presets.mjs` does. Regenerate after bumping the `renovate` devDependency.
+The preset catalogue at `src/data/presets.generated.ts` and the manager-name list at `src/data/managers.generated.ts` are committed snapshots of Renovate's built-in presets and manager registry. Runtime code never imports the `renovate` package — only the `scripts/generate-*.mjs` scripts do. Regenerate both after bumping the `renovate` devDependency.
 
 CI runs `typecheck`, `build`, and `test:coverage` on Node 24 for every PR and push to `main` (see `.github/workflows/ci.yml`). Coverage is uploaded as a per-run artifact; no threshold is enforced yet.
 
@@ -201,7 +249,7 @@ Scope and non-goals are summarized in [What this is NOT](#what-this-is-not); thi
 
 - `validate_config`, `dry_run`, and `write_config` shell out to the Renovate CLI rather than importing Renovate as a library — this decouples our Node version from Renovate's (currently Node 24).
 - `resolve_config`, `preview_custom_manager`, and `lint_config` are fully in-process and never invoke the Renovate CLI, so they work without a Renovate install.
-- `lint_config` is a semantic lint pass that sits alongside `validate_config` rather than replacing it: schema validation catches structural bugs, the linter catches Renovate-specific footguns that schema validation declares valid — most commonly a pattern like `"matchPackageNames": ["/devops\\/pipelines\\/.+"]` where a trailing `/` is missing and Renovate silently degrades the value to an exact-string match that never hits. The ruleset is intentionally small (two rules: `dead-regex-missing-slash`, `unwrapped-regex`), scoped to the four regex-aware fields named in the proposal, and tuned to avoid false positives on benign exact strings containing a `.`. Rule IDs are stable so findings can be suppressed by callers.
+- `lint_config` is a semantic lint pass that sits alongside `validate_config` rather than replacing it: schema validation catches structural bugs, the linter catches Renovate-specific footguns that schema validation declares valid — most commonly a pattern like `"matchPackageNames": ["/devops\\/pipelines\\/.+"]` where a trailing `/` is missing and Renovate silently degrades the value to an exact-string match that never hits, or a typo like `"matchManagers": ["npmm"]` that silently applies the rule to zero packages. The ruleset is intentionally small (three rules: `dead-regex-missing-slash`, `unwrapped-regex`, `matchManagers-unknown-name`), scoped to the four regex-aware fields plus `matchManagers` / `excludeManagers`, and tuned to avoid false positives on benign exact strings containing a `.`. The valid-manager list is snapshotted from the `renovate` devDep at `src/data/managers.generated.ts` (regenerate with `npm run generate:managers`), and unknown names get a Damerau-Levenshtein "did you mean?" suggestion when something close enough exists. Rule IDs are stable so findings can be suppressed by callers.
 - `preview_custom_manager` honors `.gitignore` (including nested `.gitignore`s and `.git/info/exclude`) when walking the repo, so generated/vendored directories like `dist/`, `.next/`, `target/`, `__pycache__/` don't crowd out real hits against the `maxFilesWalked` cap. `node_modules/` and `.git/` are always skipped as a safety net even when no `.gitignore` is present.
 - `preview_custom_manager` exposes two separate safety caps so the warning text can name which one tripped: `maxFilesWalked` (default 2000) bounds the directory walk before any `fileMatch` testing, and `maxFilesMatched` (default 500) bounds the result set after `fileMatch` is applied. Previously a single `maxFilesScanned` conflated the two, leaving the user unable to tell whether to narrow `fileMatch` or widen the walk.
 - `preview_custom_manager` runs every user-supplied regex on a `worker_threads` worker with a wall-clock budget per operation (default 2 s, configurable via `matchTimeoutMs`). Catastrophic backtracking — e.g. `^(a+)+b$` against `aaaa…c`, or `(.*)*=` against a modestly sized file — would otherwise pin the MCP server's event loop indefinitely. On timeout the worker is terminated and a warning is appended identifying which `fileMatch[i]` or `matchStrings[i]` was aborted, so the user can simplify the pattern or raise the budget.
@@ -209,6 +257,9 @@ Scope and non-goals are summarized in [What this is NOT](#what-this-is-not); thi
 - `resolve_config` expands `extends` against a committed snapshot of Renovate's built-in presets (`src/data/presets.generated.ts`). External `github>` / `gitlab>` fetching is opt-in, uses each platform's contents API with a 10 s timeout, and caches results per call. The `endpoint` input swaps in a custom API base for GHE / self-hosted GitLab; `platform` additionally rewrites `local>` presets to be fetched against that endpoint.
 - `resolve_config` merges preset bodies with a close approximation of Renovate's own `mergeChildConfig` — arrays concat, objects recursively merge, scalars overwrite — not a bit-identical port. Rule-specific semantics for `hostRules`, `regexManagers` / `customManagers`, and certain boolean flags aren't modeled here. Every response carries `mergeQuality: "preview"` plus a human-readable `disclaimer` so callers can't miss the limitation; run `dry_run` for authoritative output.
 - When `resolve_config` encounters template tokens outside its supported subset, it records a structured entry in `warnings`: under-argument cases (`{{arg2}}` referenced when only one arg was passed) substitute an empty string, while non-positional tokens (`{{packageRules}}`, Handlebars helpers like `{{#if …}}`) pass through verbatim.
-- `dry_run` uses `--report-type=file` so we get a structured JSON report instead of scraping stdout. When a `hostRules` input is passed it's written to a mode-0600 temp file in `os.tmpdir()`, handed to Renovate via `--config-file=`, and deleted in a `finally` block. Token/password values are scrubbed from both the detected `problems` list and the `logTail` fallback before returning.
+- `dry_run` uses `--report-type=file` so we get a structured JSON report instead of scraping stdout. When a `hostRules` input is passed it's written to a mode-0600 temp file in `os.tmpdir()`, handed to Renovate via the `RENOVATE_CONFIG_FILE` env var (the CLI has no `--config-file` flag), and deleted in a `finally` block. Token/password values — including the platform `token` input — are scrubbed from the detected `problems` list and the `logTail` fallback before returning.
+- `dry_run` defaults to `--platform=local` so no host token is required, but that mode can't resolve `local>` presets (they have no platform context to expand against) and silently hides non-default-host GitHub/GitLab setups. When the caller doesn't pass a `platform` input, the tool first falls back to `RENOVATE_PLATFORM` from the MCP server's env (if it's one of `local`/`github`/`gitlab`) before defaulting to `local` — without that fallback, the wrapper would unconditionally pass `--platform=local` and silently override an env var the user had set in their `mcp.json`. Passing `platform` + `endpoint` + `token` + `repository` (or relying on the `RENOVATE_PLATFORM` / `RENOVATE_ENDPOINT` env vars) switches the run to a real platform client so the preset-fetch path works end-to-end; `--dry-run` is still set, so no PRs are opened. The repository is passed to Renovate as a positional argument because the CLI has no `--repository` flag. `endpoint` and `token` are also forwarded in the default `platform=local` mode so `gitlab>…` / `github>…` preset shortcuts (which are otherwise hardcoded to gitlab.com/github.com) can be redirected at a self-hosted host. As a guard against the silent-failure mode, `dry_run` preflight-checks the repo's config: if it extends any `local>…` preset while the effective platform is `local`, the tool fails fast with specific remediation rather than spawning a Renovate run that would opaquely report `config-validation`. The preflight is skipped for `dryRunMode=extract` so manifest-only extraction can still be attempted.
+- `dry_run` returns a top-level `ok` boolean that is `false` whenever the CLI exited non-zero OR the structured report contains a validation/error-level problem (`level >= 40`, `message === "config-validation"`, or a non-empty `validationError` field). Renovate frequently writes exit-code 0 alongside report-level failures — trusting the exit code alone hides runs that did nothing.
 - `dry_run` emits MCP progress notifications only when the caller's `tools/call` includes `_meta.progressToken` — no-op otherwise, so legacy clients see zero overhead. A 5-second heartbeat ticks while the child runs; each tick's message is best-effort enriched with the latest Renovate JSON-log `msg` seen on stdout. Notifications are also emitted at start and completion. We deliberately don't couple to Renovate's log schema beyond reading `msg`, since that schema isn't a stable API.
+- `dry_run_diff` is stateless on purpose: both reports are passed as inputs, no per-repo state is kept on the server. Updates are keyed by `(manager, packageFile, depName)` so a version bump on the same dep shows up once under `changed` rather than twice as `removed + added`. Compared per identity: `newValue`, `newVersion`, `updateType`, `branchName`, `groupName`, `schedule`. Either input can be the raw Renovate report or the full `dry_run` summary (with the `report` key) — the tool unwraps `report` automatically.
 - `write_config` writes to a temp file, validates, then atomically renames — so a failed validation never leaves a broken config on disk.

package/dist/data/managers.generated.d.ts

@@ -0,0 +1,12 @@
+export declare const RENOVATE_VERSION = "43.141.5";
+/**
+ * All manager names accepted by Renovate's `matchManagers` /
+ * `excludeManagers` fields. Includes both regular managers and custom
+ * managers (which may also be referenced with a `custom.` prefix).
+ */
+export declare const ALL_MANAGERS: readonly string[];
+/**
+ * Custom manager names. Each of these may also be referenced as
+ * `custom.<name>` in `matchManagers` / `excludeManagers`.
+ */
+export declare const CUSTOM_MANAGERS: readonly string[];

package/dist/data/managers.generated.js

@@ -0,0 +1,132 @@
+// AUTO-GENERATED by scripts/generate-managers.mjs from renovate@43.141.5.
+// Do not edit by hand. Run `npm run generate:managers` to refresh.
+export const RENOVATE_VERSION = "43.141.5";
+/**
+ * All manager names accepted by Renovate's `matchManagers` /
+ * `excludeManagers` fields. Includes both regular managers and custom
+ * managers (which may also be referenced with a `custom.` prefix).
+ */
+export const ALL_MANAGERS = Object.freeze([
+    "ansible",
+    "ansible-galaxy",
+    "ant",
+    "argocd",
+    "asdf",
+    "azure-pipelines",
+    "batect",
+    "batect-wrapper",
+    "bazel",
+    "bazel-module",
+    "bazelisk",
+    "bicep",
+    "bitbucket-pipelines",
+    "bitrise",
+    "buildkite",
+    "buildpacks",
+    "bun",
+    "bun-version",
+    "bundler",
+    "cake",
+    "cargo",
+    "cdnurl",
+    "circleci",
+    "cloudbuild",
+    "cocoapods",
+    "composer",
+    "conan",
+    "copier",
+    "cpanfile",
+    "crossplane",
+    "crow",
+    "deps-edn",
+    "devbox",
+    "devcontainer",
+    "docker-compose",
+    "dockerfile",
+    "droneci",
+    "fleet",
+    "flux",
+    "fvm",
+    "git-submodules",
+    "github-actions",
+    "gitlabci",
+    "gitlabci-include",
+    "glasskube",
+    "gleam",
+    "gomod",
+    "gradle",
+    "gradle-wrapper",
+    "haskell-cabal",
+    "helm-requirements",
+    "helm-values",
+    "helmfile",
+    "helmsman",
+    "helmv3",
+    "hermit",
+    "homeassistant-manifest",
+    "homebrew",
+    "html",
+    "jenkins",
+    "jsonata",
+    "jsonnet-bundler",
+    "kotlin-script",
+    "kubernetes",
+    "kustomize",
+    "leiningen",
+    "maven",
+    "maven-wrapper",
+    "meteor",
+    "mint",
+    "mise",
+    "mix",
+    "nix",
+    "nodenv",
+    "npm",
+    "nuget",
+    "nvm",
+    "ocb",
+    "osgi",
+    "pep621",
+    "pep723",
+    "pip-compile",
+    "pip_requirements",
+    "pip_setup",
+    "pipenv",
+    "pixi",
+    "poetry",
+    "pre-commit",
+    "pub",
+    "puppet",
+    "pyenv",
+    "quadlet",
+    "regex",
+    "renovate-config-presets",
+    "ruby-version",
+    "runtime-version",
+    "sbt",
+    "scalafmt",
+    "setup-cfg",
+    "sveltos",
+    "swift",
+    "tekton",
+    "terraform",
+    "terraform-version",
+    "terragrunt",
+    "terragrunt-version",
+    "tflint-plugin",
+    "travis",
+    "typst",
+    "unity3d",
+    "velaci",
+    "vendir",
+    "woodpecker",
+    "xcodegen"
+]);
+/**
+ * Custom manager names. Each of these may also be referenced as
+ * `custom.<name>` in `matchManagers` / `excludeManagers`.
+ */
+export const CUSTOM_MANAGERS = Object.freeze([
+    "jsonata",
+    "regex"
+]);

package/dist/index.js

@@ -8,9 +8,12 @@ import { registerLintConfig } from "./tools/lintConfig.js";
 import { registerResolveConfig } from "./tools/resolveConfig.js";
 import { registerPreviewCustomManager } from "./tools/previewCustomManager.js";
 import { registerDryRun } from "./tools/dryRun.js";
+import { registerDryRunDiff } from "./tools/dryRunDiff.js";
 import { registerWriteConfig } from "./tools/writeConfig.js";
+import { registerGetVersion } from "./tools/getVersion.js";
 import { registerPresetResources } from "./resources/presets.js";
 import { checkSetup, startupBanner } from "./lib/setupCheck.js";
+import { SERVER_VERSION } from "./lib/version.js";
 const BASE_INSTRUCTIONS = [
     "Design and debug Renovate configurations interactively.",
     "",
@@ -21,7 +24,8 @@ const BASE_INSTRUCTIONS = [
     "  4. validate_config        — check a proposed config against Renovate's schema",
     "  5. lint_config            — semantic lint pass: catches Renovate-specific footguns schema validation misses (e.g. malformed /…/ regex patterns)",
     "  6. dry_run                — preview what Renovate would actually do (no PRs)",
-    "  7. write_config           — save the agreed-upon config (validates first)",
+    "  7. dry_run_diff           — semantic diff between two dry_run reports (added/removed/changed updates)",
+    "  8. write_config           — save the agreed-upon config (validates first)",
     "",
     "If any tool fails unexpectedly, call check_setup to diagnose CLI availability.",
     "Built-in preset reference: renovate://presets (namespace index), renovate://presets/{namespace} (one namespace), renovate://preset/{name} (one preset's expanded JSON).",
@@ -33,7 +37,6 @@ const requireCliRaw = process.env.RENOVATE_MCP_REQUIRE_CLI?.trim().toLowerCase()
 const suppressBanner = requireCliRaw === "false" || requireCliRaw === "0";
 const banner = suppressBanner ? null : startupBanner(setup);
 const instructions = banner ? [BASE_INSTRUCTIONS, "", banner].join("\n") : BASE_INSTRUCTIONS;
-const SERVER_VERSION = "0.5.0"; // x-release-please-version
 const server = new McpServer({ name: "renovate-mcp", version: SERVER_VERSION }, { instructions });
 registerCheckSetup(server);
 registerReadConfig(server);
@@ -42,7 +45,9 @@ registerPreviewCustomManager(server);
 registerValidateConfig(server);
 registerLintConfig(server);
 registerDryRun(server);
+registerDryRunDiff(server);
 registerWriteConfig(server);
+registerGetVersion(server);
 registerPresetResources(server);
 const transport = new StdioServerTransport();
 await server.connect(transport);

package/dist/lib/configLinter.d.ts

@@ -1,4 +1,4 @@
-export type LintRuleId = "dead-regex-missing-slash" | "unwrapped-regex";
+export type LintRuleId = "dead-regex-missing-slash" | "unwrapped-regex" | "matchManagers-unknown-name";
 export interface LintFinding {
     ruleId: LintRuleId;
     path: string;

package/dist/lib/configLinter.js

@@ -1,9 +1,15 @@
+import { ALL_MANAGERS, CUSTOM_MANAGERS } from "../data/managers.generated.js";
 const REGEX_AWARE_FIELDS = new Set([
     "matchPackageNames",
     "matchDepNames",
     "matchSourceUrls",
     "matchCurrentVersion",
 ]);
+const MANAGER_FIELDS = new Set(["matchManagers", "excludeManagers"]);
+const VALID_MANAGER_NAMES = new Set([
+    ...ALL_MANAGERS,
+    ...CUSTOM_MANAGERS.map((m) => `custom.${m}`),
+]);
 export function lintConfig(config) {
     const findings = [];
     walk(config, "", findings);
@@ -29,6 +35,18 @@ function walk(node, pathStr, findings) {
                     checkPattern(value, childPath, findings);
                 }
             }
+            else if (MANAGER_FIELDS.has(key)) {
+                if (Array.isArray(value)) {
+                    value.forEach((entry, i) => {
+                        if (typeof entry === "string") {
+                            checkManager(entry, `${childPath}[${i}]`, findings);
+                        }
+                    });
+                }
+                else if (typeof value === "string") {
+                    checkManager(value, childPath, findings);
+                }
+            }
             else {
                 walk(value, childPath, findings);
             }
@@ -65,6 +83,64 @@ function checkPattern(raw, path, findings) {
         });
     }
 }
+function checkManager(raw, path, findings) {
+    if (VALID_MANAGER_NAMES.has(raw))
+        return;
+    const suggestion = nearestManager(raw);
+    const hint = suggestion ? ` Did you mean '${suggestion}'?` : "";
+    findings.push({
+        ruleId: "matchManagers-unknown-name",
+        path,
+        value: raw,
+        message: `'${raw}' is not a known Renovate manager. Renovate will silently apply this rule to zero packages.${hint}`,
+    });
+}
+function nearestManager(name) {
+    let best = null;
+    let bestDistance = Infinity;
+    for (const candidate of VALID_MANAGER_NAMES) {
+        const d = damerauLevenshtein(name, candidate);
+        if (d < bestDistance) {
+            bestDistance = d;
+            best = candidate;
+        }
+    }
+    // Tolerate up to ~30 % of the typed length (min 2) — keeps "nmp" → "npm"
+    // but avoids suggesting an unrelated name for something wildly off.
+    const threshold = Math.max(2, Math.floor(name.length * 0.3));
+    return bestDistance <= threshold ? best : null;
+}
+// Optimal String Alignment distance: like Levenshtein but counts a single
+// adjacent-character transposition (e.g. "nmp" ↔ "npm") as one edit instead
+// of two — important for catching common keystroke typos.
+function damerauLevenshtein(a, b) {
+    if (a === b)
+        return 0;
+    if (a.length === 0)
+        return b.length;
+    if (b.length === 0)
+        return a.length;
+    const m = a.length;
+    const n = b.length;
+    const d = Array.from({ length: m + 1 }, () => new Array(n + 1).fill(0));
+    for (let i = 0; i <= m; i++)
+        d[i][0] = i;
+    for (let j = 0; j <= n; j++)
+        d[0][j] = j;
+    for (let i = 1; i <= m; i++) {
+        for (let j = 1; j <= n; j++) {
+            const cost = a.charCodeAt(i - 1) === b.charCodeAt(j - 1) ? 0 : 1;
+            d[i][j] = Math.min(d[i - 1][j] + 1, d[i][j - 1] + 1, d[i - 1][j - 1] + cost);
+            if (i > 1 &&
+                j > 1 &&
+                a.charCodeAt(i - 1) === b.charCodeAt(j - 2) &&
+                a.charCodeAt(i - 2) === b.charCodeAt(j - 1)) {
+                d[i][j] = Math.min(d[i][j], d[i - 2][j - 2] + 1);
+            }
+        }
+    }
+    return d[m][n];
+}
 function hasStrongRegexSignal(s) {
     return (/\\[dwsbDWSB]/.test(s) ||
         /\.[+*?]/.test(s) ||

package/dist/lib/credentialResolver.d.ts

@@ -0,0 +1,13 @@
+export interface Credential {
+    envVar: string | null;
+    token: string | undefined;
+    triedVars: string[];
+}
+/**
+ * Resolve a credential by checking each env var name in order and returning
+ * the first one that's set. Used by both `resolve_config` (for `github>` /
+ * `gitlab>` preset fetches) and `dry_run` (when picking which token to export
+ * as `RENOVATE_TOKEN` to the spawned Renovate CLI). Keeping the precedence in
+ * one place ensures the two tools cannot drift out of sync.
+ */
+export declare function resolveCredential(vars: string[]): Credential;

package/dist/lib/credentialResolver.js

@@ -0,0 +1,15 @@
+/**
+ * Resolve a credential by checking each env var name in order and returning
+ * the first one that's set. Used by both `resolve_config` (for `github>` /
+ * `gitlab>` preset fetches) and `dry_run` (when picking which token to export
+ * as `RENOVATE_TOKEN` to the spawned Renovate CLI). Keeping the precedence in
+ * one place ensures the two tools cannot drift out of sync.
+ */
+export function resolveCredential(vars) {
+    for (const envVar of vars) {
+        const value = process.env[envVar];
+        if (value)
+            return { envVar, token: value, triedVars: vars };
+    }
+    return { envVar: null, token: undefined, triedVars: vars };
+}

package/dist/lib/dryRunDiff.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Pure semantic diff over Renovate dry-run reports.
+ *
+ * The Renovate report shape is not a stable API, so we walk it defensively:
+ * we extract a flat list of "proposed updates" — the entries that would
+ * become PRs — keyed by `(manager, packageFile, depName)` and compare on the
+ * fields that meaningfully describe what each PR would do.
+ *
+ * Identity: a coarse key (manager, packageFile, depName) groups version
+ * bumps as `changed` rather than `removed + added` — the common case when a
+ * user is iterating on config.
+ */
+declare const COMPARED_FIELDS: readonly ["newValue", "newVersion", "updateType", "branchName", "groupName", "schedule"];
+type ComparedField = (typeof COMPARED_FIELDS)[number];
+export interface ProposedUpdate {
+    manager: string;
+    packageFile: string;
+    depName: string;
+    currentValue?: string;
+    currentVersion?: string;
+    newValue?: string;
+    newVersion?: string;
+    updateType?: string;
+    branchName?: string;
+    groupName?: string;
+    schedule?: unknown;
+}
+export interface AddedUpdate extends ProposedUpdate {
+}
+export interface RemovedUpdate extends ProposedUpdate {
+}
+export interface FieldChange {
+    field: ComparedField;
+    before: unknown;
+    after: unknown;
+}
+export interface ChangedUpdate {
+    manager: string;
+    packageFile: string;
+    depName: string;
+    before: ProposedUpdate;
+    after: ProposedUpdate;
+    changes: FieldChange[];
+}
+export interface DryRunDiff {
+    summary: {
+        added: number;
+        removed: number;
+        changed: number;
+        unchanged: number;
+    };
+    added: AddedUpdate[];
+    removed: RemovedUpdate[];
+    changed: ChangedUpdate[];
+    text: string;
+}
+/**
+ * Walk the report and collect every proposed update found under
+ * `repositories[*].branches[*].upgrades[]`. Renovate emits the same dep info
+ * in `packageFiles` too, but only `branches[].upgrades[]` reflects what
+ * would actually become a PR — which is what the diff is about.
+ */
+export declare function collectProposedUpdates(report: unknown): ProposedUpdate[];
+export declare function diffDryRunReports(beforeInput: unknown, afterInput: unknown): DryRunDiff;
+export {};

package/dist/lib/externalPresetFetcher.js

@@ -1,3 +1,4 @@
+import { resolveCredential } from "./credentialResolver.js";
 import { classifyExternalSource } from "./presetResolver.js";
 const DEFAULT_TIMEOUT_MS = 10_000;
 const DEFAULT_GITHUB_API_BASE = "https://api.github.com";
@@ -69,14 +70,6 @@ async function fetchGitLab(parsed, timeoutMs, fetchImpl, endpoint) {
         headers["PRIVATE-TOKEN"] = credential.token;
     return fetchJson(url, headers, timeoutMs, parsed.original, fetchImpl, "gitlab", credential);
 }
-function resolveCredential(vars) {
-    for (const envVar of vars) {
-        const value = process.env[envVar];
-        if (value)
-            return { envVar, token: value, triedVars: vars };
-    }
-    return { envVar: null, token: undefined, triedVars: vars };
-}
 function presetFileName(parsed) {
     if (parsed.subpath)
         return ensureJson(parsed.subpath);

package/dist/lib/hostRulesConfig.d.ts

@@ -5,8 +5,10 @@ export type HostRule = Record<string, unknown>;
  * responsible for unlinking the file (in a `finally` block) once Renovate has
  * consumed it — we do not keep a reference here.
  *
- * Renovate merges CLI `--config-file` rules with any repo-level `hostRules`
- * (array concatenation, most-specific match wins), so callers can combine
+ * The caller points Renovate at this file via the `RENOVATE_CONFIG_FILE` env
+ * var (not a CLI flag — `--config-file` is not a real Renovate option).
+ * Renovate merges its rules with any repo-level `hostRules` via array
+ * concatenation (most-specific match wins), so callers can combine
  * per-invocation credentials with whatever the repo itself already declares.
  */
 export declare function writeHostRulesConfig(hostRules: HostRule[]): Promise<string>;

package/dist/lib/hostRulesConfig.js

@@ -8,8 +8,10 @@ import { randomUUID } from "node:crypto";
  * responsible for unlinking the file (in a `finally` block) once Renovate has
  * consumed it — we do not keep a reference here.
  *
- * Renovate merges CLI `--config-file` rules with any repo-level `hostRules`
- * (array concatenation, most-specific match wins), so callers can combine
+ * The caller points Renovate at this file via the `RENOVATE_CONFIG_FILE` env
+ * var (not a CLI flag — `--config-file` is not a real Renovate option).
+ * Renovate merges its rules with any repo-level `hostRules` via array
+ * concatenation (most-specific match wins), so callers can combine
  * per-invocation credentials with whatever the repo itself already declares.
  */
 export async function writeHostRulesConfig(hostRules) {

package/dist/lib/presetResolver.js

@@ -20,7 +20,7 @@ export function classifyExternalSource(source) {
         case "local":
             return {
                 fetchable: false,
-                reason: "local> presets require platform/repo context that resolve_config does not have; out of scope.",
+                reason: "local> presets need a platform context. Pass `platform` (`github` or `gitlab`) plus `endpoint` to resolve_config so they're routed through your platform's API. For full-fidelity merging (hostRules, regexManagers, etc.), run `dry_run` with the same params instead.",
             };
         case "bitbucket":
         case "gitea":

package/dist/lib/setupCheck.d.ts

@@ -6,15 +6,51 @@ export interface BinaryStatus {
     version?: string;
     error?: string;
 }
+export type DryRunPlatform = "local" | "github" | "gitlab";
+export interface PlatformContext {
+    /** Raw `RENOVATE_PLATFORM` value from the MCP server's env, or null. */
+    renovatePlatform: string | null;
+    /** Raw `RENOVATE_ENDPOINT` value from the MCP server's env, or null. */
+    renovateEndpoint: string | null;
+    /** Presence-only — never echo the value, since these are secrets. */
+    tokensPresent: {
+        RENOVATE_TOKEN: boolean;
+        GITHUB_TOKEN: boolean;
+        GITLAB_TOKEN: boolean;
+    };
+    /**
+     * What `dry_run` would pick for `--platform=` when its `platform` input is
+     * unset. Mirrors the env fallback in `src/tools/dryRun.ts`: only values
+     * inside the dry_run schema enum (`local`/`github`/`gitlab`) are honored,
+     * anything else silently degrades to `local`.
+     */
+    effectiveDryRunPlatform: DryRunPlatform;
+    /** Cross-checks that are mechanical to compute but easy for callers to miss. */
+    notes: string[];
+}
 export interface SetupStatus {
     node: string;
     renovate: BinaryStatus;
     renovateConfigValidator: BinaryStatus;
     envOverrides: Record<string, string>;
+    platformContext: PlatformContext;
     ok: boolean;
     hints: string[];
 }
 export declare function checkSetup(): Promise<SetupStatus>;
+/**
+ * Reads platform-related env (RENOVATE_PLATFORM/_ENDPOINT/_TOKEN, plus
+ * GITHUB_TOKEN / GITLAB_TOKEN) and reports what the `dry_run` tool would
+ * actually do when its inputs are unset. Tokens are surfaced as presence
+ * booleans only — values are never echoed.
+ *
+ * The `notes` array carries cross-checks mechanical enough to compute here
+ * but easy to miss when staring at a `dry_run` failure: missing token for the
+ * selected platform, an endpoint that looks like a UI URL instead of an API
+ * URL, and an unsupported `RENOVATE_PLATFORM` value (which silently degrades
+ * to `local` because of dry_run's enum whitelist).
+ */
+export declare function inspectPlatformContext(env: NodeJS.ProcessEnv): PlatformContext;
 export declare const OFFLINE_TOOLS: readonly ["read_config", "resolve_config", "preview_custom_manager"];
 export declare function unavailableTools(status: SetupStatus): string[];
 /**

package/dist/lib/setupCheck.js

@@ -1,4 +1,5 @@
 import { run, resolveRenovateTool } from "./renovateCli.js";
+const DRY_RUN_PLATFORMS = ["local", "github", "gitlab"];
 const VERSION_TIMEOUT_MS = 10_000;
 const INSTALL_HINT = "Install Renovate globally with `npm i -g renovate`, or set RENOVATE_BIN / RENOVATE_CONFIG_VALIDATOR_BIN to existing binaries.";
 async function checkBinary(tool) {
@@ -52,10 +53,75 @@ export async function checkSetup() {
         renovate,
         renovateConfigValidator,
         envOverrides,
+        platformContext: inspectPlatformContext(process.env),
         ok: renovate.found && renovateConfigValidator.found,
         hints,
     };
 }
+/**
+ * Reads platform-related env (RENOVATE_PLATFORM/_ENDPOINT/_TOKEN, plus
+ * GITHUB_TOKEN / GITLAB_TOKEN) and reports what the `dry_run` tool would
+ * actually do when its inputs are unset. Tokens are surfaced as presence
+ * booleans only — values are never echoed.
+ *
+ * The `notes` array carries cross-checks mechanical enough to compute here
+ * but easy to miss when staring at a `dry_run` failure: missing token for the
+ * selected platform, an endpoint that looks like a UI URL instead of an API
+ * URL, and an unsupported `RENOVATE_PLATFORM` value (which silently degrades
+ * to `local` because of dry_run's enum whitelist).
+ */
+export function inspectPlatformContext(env) {
+    const renovatePlatformRaw = env.RENOVATE_PLATFORM ?? null;
+    const renovateEndpoint = env.RENOVATE_ENDPOINT ?? null;
+    const tokensPresent = {
+        RENOVATE_TOKEN: Boolean(env.RENOVATE_TOKEN),
+        GITHUB_TOKEN: Boolean(env.GITHUB_TOKEN),
+        GITLAB_TOKEN: Boolean(env.GITLAB_TOKEN),
+    };
+    const allowedPlatform = DRY_RUN_PLATFORMS.find((p) => p === renovatePlatformRaw);
+    const effectiveDryRunPlatform = allowedPlatform ?? "local";
+    const notes = [];
+    if (renovatePlatformRaw && !allowedPlatform) {
+        notes.push(`\`RENOVATE_PLATFORM=${renovatePlatformRaw}\` is outside the \`dry_run\` schema enum (\`local\`/\`github\`/\`gitlab\`). The env fallback ignores it, so \`dry_run\` will silently use \`local\` — pass \`platform\` explicitly when calling \`dry_run\` if you need a different value.`);
+    }
+    if (allowedPlatform === "gitlab" && !tokensPresent.GITLAB_TOKEN && !tokensPresent.RENOVATE_TOKEN) {
+        notes.push("`RENOVATE_PLATFORM=gitlab` is set but neither `GITLAB_TOKEN` nor `RENOVATE_TOKEN` is present in the MCP server's env — `gitlab>` presets and private-repo lookups will likely fail to authenticate.");
+    }
+    else if (allowedPlatform === "gitlab"
+        && tokensPresent.GITLAB_TOKEN
+        && !tokensPresent.RENOVATE_TOKEN) {
+        notes.push("Info: `GITLAB_TOKEN` is set without `RENOVATE_TOKEN`. `dry_run` will export `GITLAB_TOKEN` as `RENOVATE_TOKEN` to the spawned Renovate CLI when `platform=gitlab` (Renovate itself only reads `RENOVATE_TOKEN`). `resolve_config` already accepts this fallback directly.");
+    }
+    if (allowedPlatform === "github" && !tokensPresent.GITHUB_TOKEN && !tokensPresent.RENOVATE_TOKEN) {
+        notes.push("`RENOVATE_PLATFORM=github` is set but neither `GITHUB_TOKEN` nor `RENOVATE_TOKEN` is present in the MCP server's env — `github>` presets and private-repo lookups will likely fail to authenticate.");
+    }
+    else if (allowedPlatform === "github"
+        && tokensPresent.GITHUB_TOKEN
+        && !tokensPresent.RENOVATE_TOKEN) {
+        notes.push("Info: `GITHUB_TOKEN` is set without `RENOVATE_TOKEN`. `dry_run` will export `GITHUB_TOKEN` as `RENOVATE_TOKEN` to the spawned Renovate CLI when `platform=github` (Renovate itself only reads `RENOVATE_TOKEN`). `resolve_config` already accepts this fallback directly.");
+    }
+    if (renovateEndpoint && looksLikeUiUrl(renovateEndpoint)) {
+        notes.push(`\`RENOVATE_ENDPOINT=${renovateEndpoint}\` looks like a UI URL. Renovate expects an API base URL — typically \`/api/v4/\` for GitLab or \`/api/v3/\` for GitHub Enterprise.`);
+    }
+    return {
+        renovatePlatform: renovatePlatformRaw,
+        renovateEndpoint,
+        tokensPresent,
+        effectiveDryRunPlatform,
+        notes,
+    };
+}
+/**
+ * Heuristic: a GitLab/GitHub endpoint is meant to be the API base, but users
+ * routinely paste the web UI URL. Trigger the note when the URL is missing
+ * any `/api/` segment. We avoid hard-coding `/api/v4/` vs `/api/v3/` since
+ * Renovate accepts either depending on platform. Applies regardless of the
+ * effective platform — `dry_run` forwards `--endpoint` even in local mode to
+ * redirect `gitlab>` / `github>` preset shortcuts at a self-hosted host.
+ */
+function looksLikeUiUrl(endpoint) {
+    return !/\/api\//.test(endpoint);
+}
 // Tools that do not depend on the Renovate CLI and are always callable.
 export const OFFLINE_TOOLS = ["read_config", "resolve_config", "preview_custom_manager"];
 // Returns the tool names that cannot currently run because their backing
@@ -100,6 +166,21 @@ export function describeSetup(status) {
         for (const key of overrideKeys)
             lines.push(`  ${key}=${status.envOverrides[key]}`);
     }
+    lines.push("");
+    lines.push("Platform context:");
+    const ctx = status.platformContext;
+    lines.push(`  RENOVATE_PLATFORM: ${ctx.renovatePlatform ?? "(unset)"}`);
+    lines.push(`  RENOVATE_ENDPOINT: ${ctx.renovateEndpoint ?? "(unset)"}`);
+    const tokens = Object.entries(ctx.tokensPresent)
+        .map(([k, v]) => `${k}=${v ? "set" : "unset"}`)
+        .join(", ");
+    lines.push(`  Tokens: ${tokens}`);
+    lines.push(`  Effective dry_run platform (when input unset): ${ctx.effectiveDryRunPlatform}`);
+    if (ctx.notes.length > 0) {
+        lines.push("  Notes:");
+        for (const n of ctx.notes)
+            lines.push(`    - ${n}`);
+    }
     if (status.hints.length > 0) {
         lines.push("");
         lines.push("Hints:");

package/dist/lib/version.d.ts

@@ -0,0 +1,9 @@
+export declare const SERVER_VERSION = "0.7.0";
+export type BuildMode = "local" | "released";
+export interface VersionInfo {
+    version: string;
+    mode: BuildMode;
+    scriptPath: string;
+}
+export declare function getVersionInfo(entryUrl?: string): VersionInfo;
+export declare function describeVersion(info: VersionInfo): string;

package/dist/lib/version.js

@@ -0,0 +1,21 @@
+import { fileURLToPath } from "node:url";
+export const SERVER_VERSION = "0.7.0"; // x-release-please-version
+// "released" = the server is running from a `node_modules/` install (global
+// `npm i -g`, project-local `npm i`, or `npx renovate-mcp`). Anything else —
+// most commonly an MCP config of `{"command": "node", "args": [".../dist/index.js"]}`
+// pointed at a checkout — is treated as a local/dev build.
+function detectMode(scriptPath) {
+    return /[\\/]node_modules[\\/]/.test(scriptPath) ? "released" : "local";
+}
+export function getVersionInfo(entryUrl = import.meta.url) {
+    const scriptPath = fileURLToPath(entryUrl);
+    return {
+        version: SERVER_VERSION,
+        mode: detectMode(scriptPath),
+        scriptPath,
+    };
+}
+export function describeVersion(info) {
+    const tag = info.mode === "local" ? " (local/dev build)" : "";
+    return `renovate-mcp ${info.version}${tag}\nRunning from: ${info.scriptPath}`;
+}

package/dist/tools/dryRun.js

@@ -4,18 +4,95 @@ import { promises as fs } from "node:fs";
 import { tmpdir } from "node:os";
 import { randomUUID } from "node:crypto";
 import { run, resolveRenovateTool, formatMissingBinaryError } from "../lib/renovateCli.js";
+import { resolveCredential } from "../lib/credentialResolver.js";
+import { locateConfig } from "../lib/configLocations.js";
 import { detectLookupProblems } from "../lib/lookupProblems.js";
 import { collectSecrets, scrubSecrets, writeHostRulesConfig, } from "../lib/hostRulesConfig.js";
 import { extractRenovateLogMsg, buildDryRunHeartbeatMessage, } from "../lib/dryRunProgress.js";
 const hostRuleSchema = z
     .record(z.string(), z.unknown())
     .describe("A single Renovate hostRule (matchHost, hostType, username, password, token, …). Structure is not validated here — Renovate's own config loader checks it when the temp file is read.");
+/**
+ * Walk Renovate's JSON report looking for `problems` arrays and collect the
+ * ones that represent failed runs — not informational notices. Criteria:
+ *   - `level >= 40` (Renovate's bunyan-derived ERROR/FATAL bands), or
+ *   - `message === "config-validation"` (Renovate's canonical config-failure
+ *     marker — it can appear with lower levels but still means the run was
+ *     effectively a no-op), or
+ *   - the problem object has a `validationError` field (preset/extends
+ *     resolution failures carry their explanation here).
+ *
+ * The report shape isn't a stable Renovate API, so we walk defensively: any
+ * nested `problems` array anywhere in the tree is inspected.
+ */
+function collectReportErrors(report) {
+    const out = [];
+    const seen = new Set();
+    const visit = (node) => {
+        if (node === null || typeof node !== "object")
+            return;
+        if (seen.has(node))
+            return;
+        seen.add(node);
+        if (Array.isArray(node)) {
+            for (const entry of node)
+                visit(entry);
+            return;
+        }
+        const obj = node;
+        const problems = obj.problems;
+        if (Array.isArray(problems)) {
+            for (const raw of problems) {
+                if (!raw || typeof raw !== "object")
+                    continue;
+                const p = raw;
+                const level = typeof p.level === "number" ? p.level : 0;
+                const isErrorLevel = level >= 40;
+                const isConfigValidation = p.message === "config-validation";
+                const hasValidationError = typeof p.validationError === "string" && p.validationError.length > 0;
+                if (isErrorLevel || isConfigValidation || hasValidationError) {
+                    out.push(p);
+                }
+            }
+        }
+        for (const value of Object.values(obj))
+            visit(value);
+    };
+    visit(report);
+    return out;
+}
+/**
+ * Scan the repo's Renovate config for `extends` entries of the form
+ * `local>owner/repo[:preset]` and return them along with the config-file path
+ * they were found in. Returns `null` if no config is found (Renovate will
+ * handle that case itself with its usual error). Silently returns `null` on
+ * parse errors too — we don't want preflight to be stricter than Renovate's
+ * own config loader; any real problems will surface when Renovate runs.
+ */
+async function detectUnresolvableLocalPresets(repoPath) {
+    let located;
+    try {
+        located = await locateConfig(repoPath);
+    }
+    catch {
+        return null;
+    }
+    if (!located)
+        return null;
+    const extendsRaw = located.config.extends;
+    if (!Array.isArray(extendsRaw))
+        return null;
+    const presets = extendsRaw.filter((entry) => typeof entry === "string" && entry.startsWith("local>"));
+    return { relPath: located.relPath, presets };
+}
 export function registerDryRun(server) {
     server.registerTool("dry_run", {
         title: "Dry-run Renovate",
-        description: "Run Renovate in dry-run mode against a local repository to preview what it would do — no PRs opened, no git pushes. Uses --platform=local so no host token is required. Emits a structured JSON report of the updates Renovate would create.\n\nCredentials for private registries (e.g. `COMPOSER_AUTH` for Packagist/Satis proxies, `NPM_TOKEN` / `.npmrc` for npm, Docker registry creds, `RENOVATE_HOST_RULES` for anything else) must be set on the MCP server process itself — via the `env` key in `claude_desktop_config.json` / `.mcp.json`, not your shell, since the MCP server runs as a child of Claude and does not inherit shell env. Alternatively, encode credentials as `hostRules` in the Renovate config, or pass them per-call via the `hostRules` input on this tool (written to a mode-0600 temp file that is cleaned up after the run; token/password values are scrubbed from `logTail` and `problems`). Per-call `hostRules` are appended to any the repo's own config already declares. If a lookup can't auth to a registry, Renovate often reports 0 updates without a loud error; when that happens this tool surfaces detected auth failures under `problems` in the output so callers can distinguish a genuine \"no updates\" from a silent registry-auth failure.",
+        description: "Run Renovate in dry-run mode to preview what it would do — no PRs opened, no git pushes. Returns a structured JSON report plus a top-level `ok` boolean (false when the CLI failed OR the report records a validation/error-level problem, even if the exit code was 0).\n\nDefault mode runs `--platform=local` against the filesystem at `repoPath`. If your config extends `local>…` presets, pass `platform` (`github` or `gitlab`), `endpoint` (API base URL), `token`, and `repository` to run as a real platform client that can actually fetch those presets — Renovate still runs with `--dry-run`, so no PRs are opened. If you only need `gitlab>…` / `github>…` presets resolved against a self-hosted host (not a full remote run), pass just `endpoint` (and `token` if needed) while leaving `platform` unset — both flow through to Renovate in local mode too, which is enough to redirect those preset shortcuts away from the public defaults. The tool preflight-checks for `local>` presets under `--platform=local` (in `lookup` and `full` modes) and fails fast with remediation guidance rather than spawning a Renovate run that would fail opaquely with `config-validation`. The preflight is skipped for `dryRunMode=extract` so manifest-only extraction can be attempted regardless.\n\nWhen the `token` input is omitted, the tool falls back to `RENOVATE_TOKEN` from the MCP server's env, then to `GITLAB_TOKEN` (when `platform=gitlab`) or `GITHUB_TOKEN` (when `platform=github`) — whichever is auto-translated to `RENOVATE_TOKEN` for the spawned Renovate CLI. This matches the precedence `resolve_config` already uses, so a single `GITLAB_TOKEN` in `.mcp.json` works for both tools. For a remote-platform run, an actionable preflight error is returned before spawning Renovate when no token can be resolved at all.\n\nCredentials for private registries (e.g. `COMPOSER_AUTH` for Packagist/Satis proxies, `NPM_TOKEN` / `.npmrc` for npm, Docker registry creds, `RENOVATE_HOST_RULES` for anything else) must be set on the MCP server process itself — via the `env` key in `claude_desktop_config.json` / `.mcp.json`, not your shell, since the MCP server runs as a child of Claude and does not inherit shell env. Alternatively, encode credentials as `hostRules` in the Renovate config, or pass them per-call via the `hostRules` input on this tool (written to a mode-0600 temp file that is cleaned up after the run; token/password values — including the platform `token` input — are scrubbed from `logTail` and `problems`). Per-call `hostRules` are appended to any the repo's own config already declares. If a lookup can't auth to a registry, Renovate often reports 0 updates without a loud error; when that happens this tool surfaces detected auth failures under `problems` in the output so callers can distinguish a genuine \"no updates\" from a silent registry-auth failure.",
         inputSchema: {
-            repoPath: z.string().describe("Absolute path to the repository root"),
+            repoPath: z
+                .string()
+                .describe("Absolute path to the repository root. Required for the default `platform=local` mode. When `platform` is overridden (e.g. `gitlab` / `github`), Renovate runs against the remote `repository` instead — `repoPath` is still used as the child's working directory but its manifest files are ignored."),
             dryRunMode: z
                 .enum(["extract", "lookup", "full"])
                 .default("full")
@@ -28,17 +105,120 @@ export function registerDryRun(server) {
                 .max(15 * 60_000)
                 .default(5 * 60_000)
                 .describe("Max wait time in ms (default 5 minutes, capped at 15)"),
+            platform: z
+                .enum(["local", "github", "gitlab"])
+                .optional()
+                .describe("Renovate platform to run as. When unset, falls back to `RENOVATE_PLATFORM` from the MCP server's env (if it's one of `local`/`github`/`gitlab`), then to `local`. Default `local` runs against the filesystem at `repoPath`. Set `github` or `gitlab` (with `endpoint` + `token` + `repository`) to run a full remote dry-run — this is what you need when your config extends `local>` presets that live on a private GitHub Enterprise / self-hosted GitLab. Still no PRs opened because `--dry-run` is always set."),
+            endpoint: z
+                .string()
+                .optional()
+                .describe("Custom API base URL (e.g. `https://gitlab.example.com/api/v4/` or `https://ghe.example.com/api/v3/`). Forwarded as `--endpoint` regardless of `platform`: required for non-default GitHub/GitLab hosts when `platform=github`/`gitlab`, and also useful in the default `platform=local` mode to point `gitlab>…` / `github>…` preset shortcuts at a self-hosted host instead of the public defaults."),
+            token: z
+                .string()
+                .optional()
+                .describe("Auth token, exported as `RENOVATE_TOKEN` to the child. Scrubbed from any log output this tool returns. Used both for the platform connection (when `platform` is `github`/`gitlab`) and for preset resolution against private repos (e.g. when fetching a `gitlab>…` preset from a private project while in local mode). When omitted, falls back to `RENOVATE_TOKEN` from MCP env, then to `GITLAB_TOKEN` (when `platform=gitlab`) or `GITHUB_TOKEN` (when `platform=github`) — same precedence as `resolve_config`. Platform-specific fallbacks only kick in when the matching remote platform is selected; in `platform=local` they're ignored."),
+            repository: z
+                .string()
+                .optional()
+                .describe("Identifier of the repository Renovate should operate on, passed as a positional argument (Renovate has no `--repository` flag). For GitHub: `owner/repo`. For GitLab: `group/project` or a nested-group path like `group/subgroup/project` — both are accepted. Required when `platform` is `github`/`gitlab`. Ignored when `platform=local`."),
             hostRules: z
                 .array(hostRuleSchema)
                 .optional()
-                .describe("Optional per-invocation Renovate hostRules for private registry auth. Written to a mode-0600 temp file that is passed via --config-file and deleted after the run. Token/password values are scrubbed from any log output this tool returns. Appended to (not replacing) any hostRules declared in the repo's own config."),
+                .describe("Optional per-invocation Renovate hostRules for private registry auth. Written to a mode-0600 temp file that is passed via the RENOVATE_CONFIG_FILE env var and deleted after the run. Token/password values are scrubbed from any log output this tool returns. Appended to (not replacing) any hostRules declared in the repo's own config."),
         },
-    }, async ({ repoPath, dryRunMode, logLevel, timeoutMs, hostRules }, extra) => {
+    }, async ({ repoPath, dryRunMode, logLevel, timeoutMs, platform, endpoint, token, repository, hostRules }, extra) => {
         const reportPath = path.join(tmpdir(), `renovate-mcp-report-${randomUUID()}.json`);
         const bin = resolveRenovateTool("renovate");
         const ruleList = hostRules ?? [];
+        // When the caller doesn't pass `platform`, fall back to RENOVATE_PLATFORM
+        // from the MCP server's env before defaulting to `local`. Without this,
+        // the wrapper unconditionally appended `--platform=local` and that won
+        // over a `RENOVATE_PLATFORM=gitlab` env var the user had set in their
+        // mcp.json, silently downgrading correctly-configured self-hosted setups
+        // to local mode. Only the platforms in this tool's schema are honored
+        // from env; anything else (e.g. `bitbucket`) must be passed explicitly.
+        const envPlatform = process.env.RENOVATE_PLATFORM;
+        const envPlatformAllowed = envPlatform === "local" || envPlatform === "github" || envPlatform === "gitlab"
+            ? envPlatform
+            : undefined;
+        const effectivePlatform = platform ?? envPlatformAllowed ?? "local";
+        const isRemotePlatform = effectivePlatform !== "local";
+        // Renovate only reads `RENOVATE_TOKEN` (plus `GITHUB_COM_TOKEN`) — it
+        // doesn't know about `GITLAB_TOKEN`/`GITHUB_TOKEN`. When the caller
+        // doesn't pass `token`, fall back to MCP env in the same precedence
+        // order `resolve_config` uses, then export the resolved value as
+        // `RENOVATE_TOKEN` to the spawned child. The platform-specific
+        // fallback only kicks in when the matching remote platform is selected
+        // (in `local` mode we don't want a stray `GITLAB_TOKEN` in the user's
+        // env to suddenly be promoted to a Renovate auth token).
+        const platformFallbackVar = effectivePlatform === "gitlab"
+            ? "GITLAB_TOKEN"
+            : effectivePlatform === "github"
+                ? "GITHUB_TOKEN"
+                : null;
+        const credentialEnvVars = platformFallbackVar
+            ? ["RENOVATE_TOKEN", platformFallbackVar]
+            : ["RENOVATE_TOKEN"];
+        const envCredential = resolveCredential(credentialEnvVars);
+        const resolvedToken = token ?? envCredential.token;
         const secrets = collectSecrets(ruleList);
+        if (resolvedToken)
+            secrets.push(resolvedToken);
         let hostRulesConfigPath;
+        if (isRemotePlatform && !repository) {
+            return {
+                isError: true,
+                content: [
+                    {
+                        type: "text",
+                        text: `\`repository\` is required when \`platform\` is \`${effectivePlatform}\`. Pass the target repo as \`owner/repo\` (GitHub) or \`group/project\` / \`group/subgroup/project\` (GitLab — nested groups are accepted), or unset \`platform\` to run against the local filesystem at \`repoPath\`.`,
+                    },
+                ],
+            };
+        }
+        if (isRemotePlatform && !resolvedToken) {
+            const fallbackHint = platformFallbackVar
+                ? `\`RENOVATE_TOKEN\` (preferred) or \`${platformFallbackVar}\``
+                : "`RENOVATE_TOKEN`";
+            return {
+                isError: true,
+                content: [
+                    {
+                        type: "text",
+                        text: `No auth token found for \`platform=${effectivePlatform}\`. Set ${fallbackHint} in the MCP server's \`env\` ` +
+                            "(in `.mcp.json` / `claude_desktop_config.json` — not your shell, since the MCP server runs as a child of Claude and does not inherit shell env), " +
+                            "or pass `token` as a tool input. Run `check_setup` to see which env vars the server currently sees.",
+                    },
+                ],
+            };
+        }
+        // Preflight: if the repo's config extends any `local>…` preset and we're
+        // about to run with `--platform=local`, Renovate will fail opaquely with
+        // a generic "config-validation" error, because `local>` has no platform
+        // context to resolve against in local mode. Detect this up front and
+        // return an actionable message instead of spawning Renovate.
+        // Skipped for `dryRunMode=extract` so manifest-only extraction can be
+        // attempted regardless — Renovate may still fail config resolution, but
+        // letting the spawn happen surfaces its real error rather than ours.
+        if (!isRemotePlatform && dryRunMode !== "extract") {
+            const unresolvable = await detectUnresolvableLocalPresets(repoPath);
+            if (unresolvable && unresolvable.presets.length > 0) {
+                const sample = unresolvable.presets.slice(0, 3).join(", ");
+                const more = unresolvable.presets.length > 3
+                    ? ` (+${unresolvable.presets.length - 3} more)`
+                    : "";
+                return {
+                    isError: true,
+                    content: [
+                        {
+                            type: "text",
+                            text: `\`${unresolvable.relPath}\` extends \`local>\` presets (${sample}${more}) that cannot be resolved under \`--platform=local\` — Renovate has no platform context to expand them against, so the run would fail with an opaque \`config-validation\` error.\n\n` +
+                                `To fix: pass \`platform\` (e.g. \`gitlab\` or \`github\`), \`endpoint\`, \`token\`, and \`repository\` so Renovate runs as a real platform client and can fetch the preset. Alternatively, rewrite the \`extends\` entries from \`local>…\` to \`gitlab>…\` / \`github>…\` in your config.`,
+                        },
+                    ],
+                };
+            }
+        }
         // Hybrid progress reporter: a heartbeat tick every HEARTBEAT_MS keeps
         // MCP clients informed during long runs, and each tick enriches its
         // message with the latest Renovate JSON-log `msg` we saw (best-effort —
@@ -67,14 +247,33 @@ export function registerDryRun(server) {
         };
         try {
             const args = [
-                "--platform=local",
+                `--platform=${effectivePlatform}`,
                 `--dry-run=${dryRunMode}`,
                 "--report-type=file",
                 `--report-path=${reportPath}`,
             ];
+            const childEnv = {
+                LOG_LEVEL: logLevel,
+                LOG_FORMAT: "json",
+            };
+            // `endpoint` and the resolved token flow through regardless of
+            // platform: in local mode they redirect `gitlab>…`/`github>…` preset
+            // shortcuts to a self-hosted host (Renovate's preset shortcut hosts
+            // are otherwise hardcoded to gitlab.com/github.com).
+            if (endpoint)
+                args.push(`--endpoint=${endpoint}`);
+            if (resolvedToken)
+                childEnv.RENOVATE_TOKEN = resolvedToken;
+            // Renovate has no `--repository` flag — repos are positional args.
+            if (isRemotePlatform && repository) {
+                args.push(repository);
+            }
             if (ruleList.length > 0) {
                 hostRulesConfigPath = await writeHostRulesConfig(ruleList);
-                args.push(`--config-file=${hostRulesConfigPath}`);
+                // Renovate reads this config file via the RENOVATE_CONFIG_FILE env
+                // var, not a CLI flag — `--config-file` is not a real Renovate flag
+                // and passing it crashes the CLI with "unknown option".
+                childEnv.RENOVATE_CONFIG_FILE = hostRulesConfigPath;
             }
             if (progressEnabled) {
                 emit(`Starting Renovate dry-run (${dryRunMode})`);
@@ -82,7 +281,7 @@ export function registerDryRun(server) {
             }
             const result = await run(bin, args, {
                 cwd: repoPath,
-                env: { LOG_LEVEL: logLevel, LOG_FORMAT: "json" },
+                env: childEnv,
                 timeoutMs,
                 onStdoutLine: progressEnabled
                     ? (line) => {
@@ -104,7 +303,15 @@ export function registerDryRun(server) {
             catch {
                 // no report produced (e.g., renovate errored before writing)
             }
+            const reportErrors = collectReportErrors(report);
             const summary = {
+                // `ok` collapses the three failure modes (spawn error, non-zero
+                // exit, in-report validation/error-level problems) into a single
+                // field so callers don't need to know which one fired. Renovate
+                // frequently writes a report with exitCode=0 while its `problems`
+                // array records a validation/config failure — judging only by
+                // exitCode hides those runs.
+                ok: result.exitCode === 0 && reportErrors.length === 0,
                 exitCode: result.exitCode,
                 hasReport: report !== null,
                 report,
@@ -115,6 +322,9 @@ export function registerDryRun(server) {
             if (problems.length > 0) {
                 summary.problems = problems;
             }
+            if (reportErrors.length > 0) {
+                summary.reportErrors = reportErrors;
+            }
             // If no structured report, surface the last bit of stderr so Claude can
             // debug without blowing up the context with Renovate's verbose logs.
             if (!report) {
@@ -137,7 +347,7 @@ export function registerDryRun(server) {
                         text: JSON.stringify(summary, null, 2),
                     },
                 ],
-                isError: result.exitCode !== 0,
+                isError: !summary.ok,
             };
         }
         catch (err) {

package/dist/tools/dryRunDiff.d.ts

@@ -0,0 +1,2 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export declare function registerDryRunDiff(server: McpServer): void;

package/dist/tools/dryRunDiff.js

@@ -0,0 +1,25 @@
+import { z } from "zod";
+import { diffDryRunReports } from "../lib/dryRunDiff.js";
+const reportShape = z
+    .record(z.string(), z.unknown())
+    .describe("A Renovate dry-run report. Pass either the raw report (an object with a `repositories` key) or the full `dry_run` tool summary (an object with a `report` key); the tool unwraps `report` automatically.");
+export function registerDryRunDiff(server) {
+    server.registerTool("dry_run_diff", {
+        title: "Diff two Renovate dry-run reports",
+        description: "Compute a semantic diff between two `dry_run` reports — the proposed updates that were added, removed, or changed. Stateless: pass both reports as inputs. Updates are keyed by `(manager, packageFile, depName)`, so a version bump on the same dep shows up under `changed` rather than as `removed + added`. Compared fields per identity: `newValue`, `newVersion`, `updateType`, `branchName`, `groupName`, `schedule`. Returns a structured summary object plus a compact human-readable text rendering. Useful when iterating on a Renovate config: capture a `dry_run`, tweak the config, run again, then feed both reports here to see exactly what your tweaks did.",
+        inputSchema: {
+            before: reportShape,
+            after: reportShape,
+        },
+    }, async ({ before, after }) => {
+        const diff = diffDryRunReports(before, after);
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: JSON.stringify(diff, null, 2),
+                },
+            ],
+        };
+    });
+}

package/dist/tools/getVersion.d.ts

@@ -0,0 +1,2 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export declare function registerGetVersion(server: McpServer): void;

package/dist/tools/getVersion.js

@@ -0,0 +1,18 @@
+import { describeVersion, getVersionInfo } from "../lib/version.js";
+export function registerGetVersion(server) {
+    server.registerTool("get_version", {
+        title: "Get renovate-mcp version",
+        description: "Report the renovate-mcp server version and whether it's a released build (running from node_modules) or a local/dev build (typically launched via `command: node` against a checkout). Useful when the user asks which version is wired up.",
+        inputSchema: {},
+    }, async () => {
+        const info = getVersionInfo();
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: `${describeVersion(info)}\n\n${JSON.stringify(info, null, 2)}`,
+                },
+            ],
+        };
+    });
+}

package/dist/tools/lintConfig.js

@@ -6,7 +6,7 @@ import { lintConfig } from "../lib/configLinter.js";
 export function registerLintConfig(server) {
     server.registerTool("lint_config", {
         title: "Lint Renovate config for semantic footguns",
-        description: "Run a semantic lint pass over a Renovate config. Complements validate_config: schema validation catches structural bugs, this catches Renovate-specific footguns schema validation misses — primarily malformed '/…/' regex patterns in fields like matchPackageNames, matchDepNames, matchSourceUrls, matchCurrentVersion. Offline; does not shell out. Pass either configPath (file on disk, JSON or JSON5) or configContent (inline object).",
+        description: "Run a semantic lint pass over a Renovate config. Complements validate_config: schema validation catches structural bugs, this catches Renovate-specific footguns schema validation misses — malformed '/…/' regex patterns in fields like matchPackageNames, matchDepNames, matchSourceUrls, matchCurrentVersion, plus unknown manager names in matchManagers / excludeManagers (typos that Renovate silently ignores). Offline; does not shell out. Pass either configPath (file on disk, JSON or JSON5) or configContent (inline object).",
         inputSchema: {
             configPath: z
                 .string()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "renovate-mcp",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "MCP server for designing Renovate configurations interactively.",
   "type": "module",
   "bin": {
@@ -23,6 +23,7 @@
     "pretest:coverage": "npm run build",
     "test:coverage": "vitest run --coverage",
     "generate:presets": "node scripts/generate-presets.mjs",
+    "generate:managers": "node scripts/generate-managers.mjs",
     "prepack": "npm run build && chmod +x dist/index.js"
   },
   "keywords": [