renovate-mcp 1.0.4 → 1.1.0

package/README.md

@@ -38,7 +38,7 @@ Restart your client and try the prompt: *"List the namespaces available under `r
 
 ## Tools & resources
 
-Twelve tools and three resource templates. Each tool name below links to its full reference in [`docs/tools.md`](docs/tools.md).
+Thirteen tools and three resource templates. Each tool name below links to its full reference in [`docs/tools.md`](docs/tools.md).
 
 | Tool | Purpose |
 | --- | --- |
@@ -47,6 +47,7 @@ Twelve tools and three resource templates. Each tool name below links to its ful
 | [`read_config`](docs/tools.md#read_config) | Locate and parse a repo's Renovate config in Renovate's own discovery order. |
 | [`resolve_config`](docs/tools.md#resolve_config) | Expand every `extends` preset offline. Opt in to fetching `github>` / `gitlab>` presets over HTTPS. |
 | [`explain_config`](docs/tools.md#explain_config) | Inverse of `resolve_config`: annotate every leaf field with the chain of presets that set it. |
+| [`resolve_config_diff`](docs/tools.md#resolve_config_diff) | Offline structural diff of two fully-resolved configs — changed fields plus an order-insensitive set diff of array keys (`packageRules`, `customManagers`, …). The refactor-friendly counterpart to `dry_run_diff`. |
 | [`preview_custom_manager`](docs/tools.md#preview_custom_manager) | Preview a `customManagers` entry (regex or JSONata) against a local repo. Offline. |
 | [`validate_config`](docs/tools.md#validate_config) | Run `renovate-config-validator` against a file or inline object. |
 | [`lint_config`](docs/tools.md#lint_config) | Semantic lint pass for Renovate-specific footguns the schema validator declares valid. Offline. |
@@ -63,13 +64,14 @@ Twelve tools and three resource templates. Each tool name below links to its ful
 - **Linux or macOS.** Windows is not supported — `package.json` declares `"os": ["darwin", "linux"]`, so `npm i` surfaces an `EBADPLATFORM` warning on Windows and the server exits with a clear stderr message at startup. Use WSL2 or a Linux/macOS host instead.
 - **Node.js ≥ 24** (aligns with Renovate's own engine requirement).
 
-Renovate ships bundled — the `renovate` package is a runtime dependency, so `validate_config`, `dry_run`, and `write_config` work out of the box with no separate install. The offline tools (`read_config`, `resolve_config`, `explain_config`, `preview_custom_manager`, `lint_config`) never spawn Renovate at all.
+Renovate ships bundled — the `renovate` package is a runtime dependency, so `validate_config`, `dry_run`, and `write_config` work out of the box with no separate install. The offline tools (`read_config`, `resolve_config`, `explain_config`, `resolve_config_diff`, `preview_custom_manager`, `lint_config`) never spawn Renovate at all.
 
 **Optional env vars:**
 
 - `RENOVATE_BIN` / `RENOVATE_CONFIG_VALIDATOR_BIN` — override the bundled binaries. When set, the override always wins.
 - `RENOVATE_MCP_REQUIRE_CLI=false` — suppress the startup "partial availability" notice when you only intend to use the offline tools.
 - Platform + token env vars — see [`docs/platform-setup.md`](docs/platform-setup.md) for the per-platform matrix.
+- `GITHUB_COM_TOKEN` — authenticates github.com *datasource* lookups (release notes, `github-tags` / `github-releases` / `github-actions`). Distinct from the platform token and never auto-derived from it; set it when github.com-hosted deps are resolved under the default `dry_run` `platform: local`. See [`docs/security.md`](docs/security.md#github_com_token--a-separate-role).
 
 > Heads up: MCP servers do **not** inherit your shell env. Set every env var via the `env` key in `.mcp.json` / `claude_desktop_config.json`. See [`docs/security.md`](docs/security.md#where-env-vars-must-live).
 

package/dist/data/managers.generated.d.ts

@@ -1,4 +1,4 @@
-export declare const RENOVATE_VERSION = "43.220.0";
+export declare const RENOVATE_VERSION = "43.233.3";
 /**
  * All manager names accepted by Renovate's `matchManagers` /
  * `excludeManagers` fields. Includes both regular managers and custom

package/dist/data/managers.generated.js

@@ -1,6 +1,6 @@
-// AUTO-GENERATED by scripts/generate-managers.mjs from renovate@43.220.0.
+// AUTO-GENERATED by scripts/generate-managers.mjs from renovate@43.233.3.
 // Do not edit by hand. Run `npm run generate:managers` to refresh.
-export const RENOVATE_VERSION = "43.220.0";
+export const RENOVATE_VERSION = "43.233.3";
 /**
  * All manager names accepted by Renovate's `matchManagers` /
  * `excludeManagers` fields. Includes both regular managers and custom

package/dist/data/migrations.generated.d.ts

@@ -1,4 +1,4 @@
-export declare const RENOVATE_VERSION = "43.220.0";
+export declare const RENOVATE_VERSION = "43.233.3";
 export interface DeprecatedKeyEntry {
     /** Key as it appeared in old configs. */
     readonly oldKey: string;

package/dist/data/migrations.generated.js

@@ -1,6 +1,6 @@
-// AUTO-GENERATED by scripts/generate-migrations.mjs from renovate@43.220.0.
+// AUTO-GENERATED by scripts/generate-migrations.mjs from renovate@43.233.3.
 // Do not edit by hand. Run `npm run generate:migrations` to refresh.
-export const RENOVATE_VERSION = "43.220.0";
+export const RENOVATE_VERSION = "43.233.3";
 /**
  * Deprecated config keys with their current replacement. Sourced from
  * Renovate's `MigrationsService.renamedProperties` — the "RenamePropertyMigration"

package/dist/data/presets.generated.d.ts

@@ -3,6 +3,6 @@ export interface GeneratedPreset {
     description: string | null;
     body: Record<string, unknown>;
 }
-export declare const RENOVATE_VERSION = "43.220.0";
+export declare const RENOVATE_VERSION = "43.233.3";
 export declare const PRESETS: Record<string, GeneratedPreset>;
 export declare const PRESET_NAMES: readonly string[];

package/dist/data/presets.generated.js

@@ -1,6 +1,6 @@
-// AUTO-GENERATED by scripts/generate-presets.mjs from renovate@43.220.0.
+// AUTO-GENERATED by scripts/generate-presets.mjs from renovate@43.233.3.
 // Do not edit by hand. Run `npm run generate:presets` to refresh.
-export const RENOVATE_VERSION = "43.220.0";
+export const RENOVATE_VERSION = "43.233.3";
 export const PRESETS = {
     "abandonments:recommended": {
         "namespace": "abandonments",
@@ -2108,6 +2108,27 @@ export const PRESETS = {
             ]
         }
     },
+    "group:arrow-rsMonorepo": {
+        "namespace": "group",
+        "description": null,
+        "body": {
+            "packageRules": [
+                {
+                    "description": "Group packages from arrow-rs monorepo together.",
+                    "extends": [
+                        "monorepo:arrow-rs"
+                    ],
+                    "groupName": "arrow-rs monorepo",
+                    "matchUpdateTypes": [
+                        "digest",
+                        "patch",
+                        "minor",
+                        "major"
+                    ]
+                }
+            ]
+        }
+    },
     "group:aspireMonorepo": {
         "namespace": "group",
         "description": null,
@@ -7221,6 +7242,7 @@ export const PRESETS = {
                 "group:arcus.securityMonorepo",
                 "group:arcus.webapiMonorepo",
                 "group:arrow-ktMonorepo",
+                "group:arrow-rsMonorepo",
                 "group:aspireMonorepo",
                 "group:aspnet aspnetwebstackMonorepo",
                 "group:aspnet extensionsMonorepo",
@@ -13384,6 +13406,15 @@ export const PRESETS = {
             ]
         }
     },
+    "monorepo:arrow-rs": {
+        "namespace": "monorepo",
+        "description": "arrow-rs monorepo",
+        "body": {
+            "matchSourceUrls": [
+                "https://github.com/apache/arrow-rs"
+            ]
+        }
+    },
     "monorepo:aspire": {
         "namespace": "monorepo",
         "description": "aspire monorepo",
@@ -20290,6 +20321,7 @@ export const PRESETS = {
                 "workarounds:containerbase",
                 "workarounds:bitnamiDockerImageVersioning",
                 "workarounds:clamavDockerImageVersioning",
+                "workarounds:grafanaDockerImageVersioning",
                 "workarounds:k3sKubernetesVersioning",
                 "workarounds:rke2KubernetesVersioning",
                 "workarounds:libericaJdkDockerVersioning",
@@ -20434,6 +20466,26 @@ export const PRESETS = {
             ]
         }
     },
+    "workarounds:grafanaDockerImageVersioning": {
+        "namespace": "workarounds",
+        "description": "Support security releases on Grafana (product) images",
+        "body": {
+            "packageRules": [
+                {
+                    "matchDatasources": [
+                        "docker"
+                    ],
+                    "matchPackageNames": [
+                        "grafana/grafana",
+                        "docker.io/grafana/grafana",
+                        "grafana/grafana-enterprise",
+                        "docker.io/grafana/grafana-enterprise"
+                    ],
+                    "versioning": "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)(?:-security-(?<build>\\d+))?(?:-(?<compatibility>.*))?$"
+                }
+            ]
+        }
+    },
     "workarounds:ignoreHttp4sDigestMilestones": {
         "namespace": "workarounds",
         "description": "Ignore `http4s` digest-based `1.x` milestones.",

package/dist/index.js

@@ -7,6 +7,7 @@ import { registerValidateConfig } from "./tools/validateConfig.js";
 import { registerLintConfig } from "./tools/lintConfig.js";
 import { registerResolveConfig } from "./tools/resolveConfig.js";
 import { registerExplainConfig } from "./tools/explainConfig.js";
+import { registerResolveConfigDiff } from "./tools/resolveConfigDiff.js";
 import { registerPreviewCustomManager } from "./tools/previewCustomManager.js";
 import { registerDryRun } from "./tools/dryRun.js";
 import { registerDryRunDiff } from "./tools/dryRunDiff.js";
@@ -33,13 +34,14 @@ const BASE_INSTRUCTIONS = [
     "  1. read_config            — inspect the current config in a repo",
     "  2. resolve_config         — expand built-in presets to see what a config actually becomes (offline)",
     "  3. explain_config         — inverse of resolve_config: trace which preset set each field (offline)",
-    "  4. preview_custom_manager — iterate on a regex-based customManagers entry; shows file/line hits and extracted deps",
-    "  5. validate_config        — check a proposed config against Renovate's schema",
-    "  6. lint_config            — semantic lint pass: catches Renovate-specific footguns schema validation misses (e.g. malformed /…/ regex patterns)",
-    "  7. dry_run                — preview what Renovate would actually do (no PRs)",
-    "  8. dry_run_diff           — semantic diff between two dry_run reports (added/removed/changed updates)",
-    "  9. migrate_config         — apply Renovate's built-in migrations (deprecated keys → current schema) and return the migrated config",
-    " 10. write_config           — save the agreed-upon config (validates first)",
+    "  4. resolve_config_diff    — offline structural diff of two resolved configs (changed fields + array/packageRules set diffs); use this over dry_run_diff for config refactors, especially when registries are unreachable",
+    "  5. preview_custom_manager — iterate on a regex-based customManagers entry; shows file/line hits and extracted deps",
+    "  6. validate_config        — check a proposed config against Renovate's schema",
+    "  7. lint_config            — semantic lint pass: catches Renovate-specific footguns schema validation misses (e.g. malformed /…/ regex patterns)",
+    "  8. dry_run                — preview what Renovate would actually do (no PRs)",
+    "  9. dry_run_diff           — semantic diff between two dry_run reports (added/removed/changed updates)",
+    " 10. migrate_config         — apply Renovate's built-in migrations (deprecated keys → current schema) and return the migrated config",
+    " 11. write_config           — save the agreed-upon config (validates first)",
     "",
     "Before the first repo-touching tool call in a session (read_config, resolve_config, dry_run, write_config, …), call check_setup with the same repoPath. It surfaces token / endpoint / connectivity problems up front (e.g. \"set GITHUB_TOKEN or github-actions deps will be skipped\") instead of waiting for dry_run to fail. Skip if the user has already confirmed setup or is doing offline-only work that doesn't depend on git origin or registries.",
     "If any tool fails unexpectedly, call check_setup to diagnose CLI availability.",
@@ -61,6 +63,7 @@ registerCheckSetup(server);
 registerReadConfig(server);
 registerResolveConfig(server);
 registerExplainConfig(server);
+registerResolveConfigDiff(server);
 registerPreviewCustomManager(server);
 registerValidateConfig(server);
 registerLintConfig(server);

package/dist/lib/resolveConfigDiff.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Pure structural diff over two *resolved* Renovate configs (the output of
+ * `resolve_config` — preset-expanded and merged). This is the resolve-level
+ * counterpart to `dryRunDiff.ts`: it answers "did this config refactor change
+ * the effective settings only in the ways I intended?" without running
+ * Renovate, so it works offline even when datasource lookups would fail.
+ *
+ * Two diff modes by key shape:
+ *   - Array-valued top-level keys (`packageRules`, `customManagers`,
+ *     `matchManagers`, `addLabels`, …) → order-insensitive *set* diff. Members
+ *     are normalized with `stableStringify` (recursive sort-keys) and compared
+ *     as a set, so a reordered array reads as no change and a tweaked rule
+ *     reads as one removed + one added (no pairing). Mirrors the throwaway
+ *     Python script this tool replaces.
+ *   - Everything else → deep-compare via `stableStringify` equality; a
+ *     difference emits the full before/after values.
+ *
+ * Only TOP-LEVEL keys are walked. Arrays nested inside an object are part of
+ * that object's deep-compare and surface as a whole-field change.
+ */
+export interface ResolveConfigFieldChange {
+    key: string;
+    before: unknown;
+    after: unknown;
+}
+export interface ResolveConfigArrayChange {
+    added: unknown[];
+    removed: unknown[];
+}
+export interface ResolveConfigDiffSummary {
+    fieldsChanged: number;
+    arraysChanged: number;
+    arrayItemsAdded: number;
+    arrayItemsRemoved: number;
+}
+export interface ResolveConfigDiff {
+    summary: ResolveConfigDiffSummary;
+    fieldChanges: ResolveConfigFieldChange[];
+    arrayChanges: Record<string, ResolveConfigArrayChange>;
+    text: string;
+}
+/**
+ * Deterministic JSON serialization with object keys sorted recursively, so two
+ * structurally-equal values produce byte-identical strings regardless of key
+ * insertion order. `JSON.stringify` alone preserves insertion order, which
+ * would make `{a,b}` and `{b,a}` compare unequal. Arrays keep their order
+ * (callers that want order-insensitivity sort the normalized members).
+ */
+export declare function stableStringify(value: unknown): string;
+export declare function diffResolvedConfigs(before: Record<string, unknown>, after: Record<string, unknown>): ResolveConfigDiff;

package/dist/lib/resolveConfigDiff.js

@@ -0,0 +1,139 @@
+/**
+ * Pure structural diff over two *resolved* Renovate configs (the output of
+ * `resolve_config` — preset-expanded and merged). This is the resolve-level
+ * counterpart to `dryRunDiff.ts`: it answers "did this config refactor change
+ * the effective settings only in the ways I intended?" without running
+ * Renovate, so it works offline even when datasource lookups would fail.
+ *
+ * Two diff modes by key shape:
+ *   - Array-valued top-level keys (`packageRules`, `customManagers`,
+ *     `matchManagers`, `addLabels`, …) → order-insensitive *set* diff. Members
+ *     are normalized with `stableStringify` (recursive sort-keys) and compared
+ *     as a set, so a reordered array reads as no change and a tweaked rule
+ *     reads as one removed + one added (no pairing). Mirrors the throwaway
+ *     Python script this tool replaces.
+ *   - Everything else → deep-compare via `stableStringify` equality; a
+ *     difference emits the full before/after values.
+ *
+ * Only TOP-LEVEL keys are walked. Arrays nested inside an object are part of
+ * that object's deep-compare and surface as a whole-field change.
+ */
+/**
+ * Deterministic JSON serialization with object keys sorted recursively, so two
+ * structurally-equal values produce byte-identical strings regardless of key
+ * insertion order. `JSON.stringify` alone preserves insertion order, which
+ * would make `{a,b}` and `{b,a}` compare unequal. Arrays keep their order
+ * (callers that want order-insensitivity sort the normalized members).
+ */
+export function stableStringify(value) {
+    return JSON.stringify(sortValue(value));
+}
+function sortValue(value) {
+    if (Array.isArray(value)) {
+        return value.map(sortValue);
+    }
+    if (value && typeof value === "object") {
+        const obj = value;
+        const out = {};
+        for (const key of Object.keys(obj).sort()) {
+            out[key] = sortValue(obj[key]);
+        }
+        return out;
+    }
+    return value;
+}
+function diffArrayKey(before, after) {
+    const beforeNorm = new Map();
+    for (const item of before)
+        beforeNorm.set(stableStringify(item), item);
+    const afterNorm = new Map();
+    for (const item of after)
+        afterNorm.set(stableStringify(item), item);
+    const removed = [];
+    for (const [norm, item] of beforeNorm) {
+        if (!afterNorm.has(norm))
+            removed.push(item);
+    }
+    const added = [];
+    for (const [norm, item] of afterNorm) {
+        if (!beforeNorm.has(norm))
+            added.push(item);
+    }
+    // Deterministic output regardless of source ordering.
+    removed.sort((a, b) => stableStringify(a).localeCompare(stableStringify(b)));
+    added.sort((a, b) => stableStringify(a).localeCompare(stableStringify(b)));
+    return { added, removed };
+}
+export function diffResolvedConfigs(before, after) {
+    const keys = Array.from(new Set([...Object.keys(before), ...Object.keys(after)])).sort();
+    const fieldChanges = [];
+    const arrayChanges = {};
+    for (const key of keys) {
+        const hasBefore = Object.prototype.hasOwnProperty.call(before, key);
+        const hasAfter = Object.prototype.hasOwnProperty.call(after, key);
+        const beforeVal = before[key];
+        const afterVal = after[key];
+        const beforeIsArray = Array.isArray(beforeVal);
+        const afterIsArray = Array.isArray(afterVal);
+        // Treat a key as "array-shaped" when it is an array on at least one side
+        // and never a non-array object on the other (so we don't set-diff an
+        // array against a scalar/object — that's a real type change).
+        if ((beforeIsArray || afterIsArray) &&
+            (!hasBefore || beforeIsArray) &&
+            (!hasAfter || afterIsArray)) {
+            const change = diffArrayKey(beforeIsArray ? beforeVal : [], afterIsArray ? afterVal : []);
+            if (change.added.length > 0 || change.removed.length > 0) {
+                arrayChanges[key] = change;
+            }
+            continue;
+        }
+        if (!hasBefore || !hasAfter || stableStringify(beforeVal) !== stableStringify(afterVal)) {
+            fieldChanges.push({
+                key,
+                before: hasBefore ? beforeVal : undefined,
+                after: hasAfter ? afterVal : undefined,
+            });
+        }
+    }
+    const summary = {
+        fieldsChanged: fieldChanges.length,
+        arraysChanged: Object.keys(arrayChanges).length,
+        arrayItemsAdded: Object.values(arrayChanges).reduce((n, c) => n + c.added.length, 0),
+        arrayItemsRemoved: Object.values(arrayChanges).reduce((n, c) => n + c.removed.length, 0),
+    };
+    return {
+        summary,
+        fieldChanges,
+        arrayChanges,
+        text: renderText(summary, fieldChanges, arrayChanges),
+    };
+}
+function renderText(summary, fieldChanges, arrayChanges) {
+    if (summary.fieldsChanged === 0 && summary.arraysChanged === 0) {
+        return "No differences between the two resolved configs.";
+    }
+    const lines = [];
+    lines.push(`${summary.fieldsChanged} field${summary.fieldsChanged === 1 ? "" : "s"} changed · ` +
+        `${summary.arraysChanged} array key${summary.arraysChanged === 1 ? "" : "s"} changed ` +
+        `(+${summary.arrayItemsAdded} / -${summary.arrayItemsRemoved})`);
+    if (fieldChanges.length > 0) {
+        lines.push("", "Changed fields:");
+        for (const fc of fieldChanges) {
+            lines.push(`  ${fc.key}: OLD=${formatValue(fc.before)}  NEW=${formatValue(fc.after)}`);
+        }
+    }
+    for (const key of Object.keys(arrayChanges).sort()) {
+        const change = arrayChanges[key];
+        lines.push("", `${key}:`);
+        for (const item of change.removed)
+            lines.push(`  - ${stableStringify(item)}`);
+        for (const item of change.added)
+            lines.push(`  + ${stableStringify(item)}`);
+    }
+    return lines.join("\n");
+}
+function formatValue(value) {
+    if (value === undefined)
+        return "(unset)";
+    return stableStringify(value);
+}

package/dist/lib/setupCheck.d.ts

@@ -32,6 +32,8 @@ export interface PlatformContext {
         RENOVATE_TOKEN: boolean;
         GITHUB_TOKEN: boolean;
         GITLAB_TOKEN: boolean;
+        /** github.com *datasource* token (release notes, github-tags/-releases/-actions). Distinct from the platform token; never auto-derived from the others. */
+        GITHUB_COM_TOKEN: boolean;
     };
     /**
      * What `dry_run` would pick for `--platform=` when its `platform` input is

package/dist/lib/setupCheck.js

@@ -339,6 +339,24 @@ function appendRepoHints(ctx, hints, platformContext) {
             hints.push("This repo's origin is on GitLab. Set `GITLAB_TOKEN` (or `RENOVATE_TOKEN`) in the MCP server's env, or private-preset / private-registry lookups will fail.");
         }
     }
+    // github.com *datasource* token gap. `dry_run` defaults to `platform: local`
+    // and never reads git origin, so for a github.com-origin repo the platform
+    // token (GITHUB_TOKEN/RENOVATE_TOKEN) is NOT applied to github.com datasource
+    // lookups under the default local run — Renovate reads GITHUB_COM_TOKEN for
+    // that, and it is never auto-derived. The origin-derived `effectivePlatform`
+    // can read "github" while the actual dry_run platform is "local"; this hint
+    // reconciles that divergence for the case that trips users up.
+    if (platformContext.effectiveDryRunPlatform === "local"
+        && ctx.remote?.host === "github.com"
+        && !platformContext.tokensPresent.GITHUB_COM_TOKEN) {
+        const hasPlatformToken = platformContext.tokensPresent.GITHUB_TOKEN || platformContext.tokensPresent.RENOVATE_TOKEN;
+        if (hasPlatformToken) {
+            hints.push("This repo's origin is github.com, but `dry_run` defaults to `platform: local` and does not read git origin. The `GITHUB_TOKEN` / `RENOVATE_TOKEN` you've set is used for Renovate's *platform* role only — and that role is active only when you run `platform: \"github\"`. Under the default local run it is NOT applied to github.com *datasource* lookups (release notes, `github-tags` / `github-releases` / `github-actions`) at all. Either (a) set `GITHUB_COM_TOKEN` (the same read-only PAT works) so those lookups are authenticated, or (b) call `dry_run` with `platform: \"github\"`, `repository: \"<owner>/<repo>\"`, and the token, which covers both roles. (Moot if your config already has a github.com `hostRules` entry.)");
+        }
+        else {
+            hints.push("This repo's origin is github.com. Under the default `dry_run` `platform: local`, github.com *datasource* lookups (release notes, `github-tags` / `github-releases` / `github-actions`) run anonymously — expect a low rate limit and possible `skipReason`. Set `GITHUB_COM_TOKEN` (a read-only PAT is enough) in the MCP server's env to authenticate them.");
+        }
+    }
     if (ctx.remote?.classified === "self-hosted"
         && !ctx.configEndpoint
         && !platformContext.renovateEndpoint) {
@@ -378,6 +396,7 @@ export function inspectPlatformContext(env) {
         RENOVATE_TOKEN: Boolean(env.RENOVATE_TOKEN),
         GITHUB_TOKEN: Boolean(env.GITHUB_TOKEN),
         GITLAB_TOKEN: Boolean(env.GITLAB_TOKEN),
+        GITHUB_COM_TOKEN: Boolean(env.GITHUB_COM_TOKEN),
     };
     const allowedPlatform = DRY_RUN_PLATFORMS.find((p) => p === renovatePlatformRaw);
     const effectiveDryRunPlatform = allowedPlatform ?? "local";

package/dist/lib/version.d.ts

@@ -1,4 +1,4 @@
-export declare const SERVER_VERSION = "1.0.4";
+export declare const SERVER_VERSION = "1.1.0";
 export type BuildMode = "local" | "released";
 export interface VersionInfo {
     version: string;

package/dist/lib/version.js

@@ -1,5 +1,5 @@
 import { fileURLToPath } from "node:url";
-export const SERVER_VERSION = "1.0.4"; // x-release-please-version
+export const SERVER_VERSION = "1.1.0"; // x-release-please-version
 // "released" = the server is running from a `node_modules/` install (global
 // `npm i -g`, project-local `npm i`, or `npx renovate-mcp`). Anything else —
 // most commonly an MCP config of `{"command": "node", "args": [".../dist/index.js"]}`

package/dist/tools/resolveConfigDiff.d.ts

@@ -0,0 +1,2 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export declare function registerResolveConfigDiff(server: McpServer): void;

package/dist/tools/resolveConfigDiff.js

@@ -0,0 +1,95 @@
+import { z } from "zod";
+import { locateConfig } from "../lib/configLocations.js";
+import { resolveConfig } from "../lib/presetResolver.js";
+import { diffResolvedConfigs } from "../lib/resolveConfigDiff.js";
+import { configRecord, endpointString, pathString } from "../lib/inputLimits.js";
+const sideSchema = z
+    .object({
+    repoPath: pathString("Absolute path to the repository root. The tool locates the repo's renovate config automatically.").optional(),
+    configContent: configRecord("Inline config object to resolve — use instead of repoPath.").optional(),
+})
+    .describe("One side of the diff: pass repoPath OR configContent.");
+async function resolveSide(label, input, options) {
+    if (!input.repoPath && !input.configContent) {
+        return { ok: false, error: `Provide either repoPath or configContent for ${label}.` };
+    }
+    let source;
+    let sourcePath;
+    if (input.configContent) {
+        source = input.configContent;
+    }
+    else {
+        const located = await locateConfig(input.repoPath);
+        if (!located) {
+            return { ok: false, error: `No Renovate configuration found in ${input.repoPath} (${label}).` };
+        }
+        source = located.config;
+        sourcePath = located.relPath;
+    }
+    const result = await resolveConfig(source, options);
+    return { ok: true, result, path: sourcePath };
+}
+export function registerResolveConfigDiff(server) {
+    server.registerTool("resolve_config_diff", {
+        title: "Diff two resolved Renovate configs",
+        description: "Compute a structural diff between two *fully-resolved* Renovate configs — the `before` and `after` of a config refactor — entirely offline. This is the resolve-level counterpart to `dry_run_diff`: where `dry_run_diff` shows how the *proposed PRs* change (and collapses to a vacuous 0-vs-0 when the environment can't reach registries), this answers \"does the new config produce the same effective settings as the old one, modulo the intended changes?\". Each side accepts `repoPath` (locates the repo's config) OR `configContent` (an inline config object); both sides are resolved with `resolve_config`'s preset expansion + faithful merge. Non-array top-level keys are deep-compared and reported with before/after values; array-valued top-level keys (`packageRules`, `customManagers`, `matchManagers`, …) get an order-insensitive set diff (members only in `before` are `removed`, only in `after` are `added` — a tweaked rule shows as one of each). Shared `externalPresets` / `endpoint` / `platform` knobs apply to both sides. Returns a structured diff (`summary`, `fieldChanges`, `arrayChanges`) plus a human-readable `text` rendering and per-side `resolution` metadata (`mergeQuality`, `presetsUnresolved`, `warnings`).",
+        inputSchema: {
+            before: sideSchema,
+            after: sideSchema,
+            externalPresets: z
+                .boolean()
+                .optional()
+                .describe("When true, fetch external presets (github>, gitlab>) over HTTPS for BOTH sides. Credentials come from RENOVATE_TOKEN (preferred) or GITHUB_TOKEN / GITLAB_TOKEN as platform-specific fallbacks, set on the MCP server process. Default false (fully offline)."),
+            endpoint: endpointString("API base URL for github>/gitlab> fetches, applied to both sides. Use for GitHub Enterprise (e.g. https://ghe.example.com/api/v3) or self-hosted GitLab (e.g. https://gitlab.example.com/api/v4).").optional(),
+            platform: z
+                .enum(["github", "gitlab"])
+                .optional()
+                .describe("Platform flavour of `endpoint`, applied to both sides. When set, `local>owner/repo` presets are fetched as if they were `<platform>>owner/repo`."),
+        },
+    }, async ({ before, after, externalPresets, endpoint, platform }) => {
+        const options = { fetchExternal: externalPresets ?? false, endpoint, platform };
+        const [beforeRes, afterRes] = await Promise.all([
+            resolveSide("before", before, options),
+            resolveSide("after", after, options),
+        ]);
+        if (!beforeRes.ok) {
+            return { isError: true, content: [{ type: "text", text: beforeRes.error }] };
+        }
+        if (!afterRes.ok) {
+            return { isError: true, content: [{ type: "text", text: afterRes.error }] };
+        }
+        const diff = diffResolvedConfigs(beforeRes.result.resolved, afterRes.result.resolved);
+        const resolution = {
+            before: sideMeta(beforeRes.result, beforeRes.path),
+            after: sideMeta(afterRes.result, afterRes.path),
+        };
+        const advisory = degradedAdvisory(beforeRes.result, afterRes.result);
+        const text = advisory ? `${advisory}\n\n${diff.text}` : diff.text;
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: JSON.stringify({ ...diff, text, resolution }, null, 2),
+                },
+            ],
+        };
+    });
+}
+function sideMeta(result, path) {
+    return {
+        ...(path ? { path } : {}),
+        mergeQuality: result.mergeQuality,
+        presetsUnresolved: result.presetsUnresolved,
+        warnings: result.warnings,
+    };
+}
+function degradedAdvisory(before, after) {
+    const notes = [];
+    if (before.mergeQuality === "preview" || after.mergeQuality === "preview") {
+        notes.push("one or both sides used the approximate in-process merge (mergeQuality: \"preview\") — the diff may not be authoritative");
+    }
+    if (before.presetsUnresolved.length > 0 || after.presetsUnresolved.length > 0) {
+        notes.push("one or both sides have unresolved presets — fields they would contribute are absent from this diff (see resolution.presetsUnresolved)");
+    }
+    return notes.length > 0 ? `⚠ ${notes.join("; ")}.` : null;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "renovate-mcp",
-  "version": "1.0.4",
+  "version": "1.1.0",
   "description": "MCP server for designing Renovate configurations interactively.",
   "type": "module",
   "bin": {
@@ -64,7 +64,7 @@
     "json5": "^2.2.3",
     "jsonata": "2.2.1",
     "jsonc-parser": "^3.3.1",
-    "renovate": "^43.220.0",
+    "renovate": "^43.233.3",
     "smol-toml": "^1.6.1",
     "yaml": "^2.9.0",
     "zod": "^4.0.0"