renovate-mcp 1.7.1 → 1.8.0

package/README.md

@@ -30,7 +30,7 @@ Then try the prompt: *"List the namespaces available under `renovate://presets`.
 
 ## Tools & resources
 
-Eighteen tools, seven resources, and four workflow prompts. Each tool name below links to its full reference in [`docs/tools.md`](docs/tools.md).
+Nineteen tools, seven resources, and four workflow prompts. Each tool name below links to its full reference in [`docs/tools.md`](docs/tools.md).
 
 | Tool | Purpose |
 | --- | --- |
@@ -50,6 +50,7 @@ Eighteen tools, seven resources, and four workflow prompts. Each tool name below
 | [`annotate_dry_run`](docs/tools.md#annotate_dry_run) | Attribute each proposed update in a `dry_run` report to the `packageRules` that caused it; flags rules that never matched and report fields the matchers needed but the report lacked. Stateless + offline. |
 | [`explain_dependency`](docs/tools.md#explain_dependency) | Answer "why was/wasn't dependency X updated?" from a `dry_run` report: per-occurrence `skipReason`, proposed `updates`, `warnings`, a one-line verdict and remedy hints; optionally the `packageRules` that matched it. Stateless + offline. |
 | [`explain_schedule`](docs/tools.md#explain_schedule) | Answer "when will this `schedule` actually run?": active-now plus the next run windows in UTC and the config's `timezone`, computed with Renovate's own schedule matcher; invalid schedules return Renovate's message and the fact that it then runs at any time. Offline. |
+| [`explain_paths`](docs/tools.md#explain_paths) | Show which files Renovate scans under `includePaths` / `ignorePaths` (preset-added ones included, each attributed to its source), flag dead patterns and `ignorePaths` entries that drop files only by substring (`test` dropping `src/latest/`), and count each `matchFileNames` entry against the real repo. Offline. |
 | [`migrate_config`](docs/tools.md#migrate_config) | Apply Renovate's built-in migrations and return the migrated config plus a unified diff. Does not write. |
 | [`write_config`](docs/tools.md#write_config) | Validate, then atomically write a config to disk. Preserves comments/key order on existing JSON-with-comments files; for `package.json` edits only the nested `renovate` key. |
 | [`renovate://presets`](docs/tools.md#renovatepresets) (resource) | Markdown index of all built-in presets grouped by namespace. |
@@ -74,7 +75,7 @@ Eighteen tools, seven resources, and four workflow prompts. Each tool name below
 - **Linux or macOS.** Windows is not supported — `package.json` declares `"os": ["darwin", "linux"]`, so `npm i` surfaces an `EBADPLATFORM` warning on Windows and the server exits with a clear stderr message at startup. Use WSL2 or a Linux/macOS host instead.
 - **Node.js ≥ 24.11** (aligns with Renovate's own engine requirement).
 
-Renovate ships bundled — the `renovate` package is a runtime dependency, so `validate_config`, `dry_run`, and `write_config` work out of the box with no separate install. The offline tools (`read_config`, `suggest_presets`, `resolve_config`, `explain_config`, `resolve_config_diff`, `test_package_rules`, `preview_custom_manager`, `lint_config`, `dry_run_diff`, `annotate_dry_run`, `explain_dependency`, `explain_schedule`, `migrate_config`) never spawn Renovate at all — nor do `check_setup` (by default it reads version metadata from the bundled install instead of spawning) or `get_version` (it only reports the renovate-mcp server's own version).
+Renovate ships bundled — the `renovate` package is a runtime dependency, so `validate_config`, `dry_run`, and `write_config` work out of the box with no separate install. The offline tools (`read_config`, `suggest_presets`, `resolve_config`, `explain_config`, `resolve_config_diff`, `test_package_rules`, `preview_custom_manager`, `lint_config`, `dry_run_diff`, `annotate_dry_run`, `explain_dependency`, `explain_schedule`, `explain_paths`, `migrate_config`) never spawn Renovate at all — nor do `check_setup` (by default it reads version metadata from the bundled install instead of spawning) or `get_version` (it only reports the renovate-mcp server's own version).
 
 **Optional env vars:**
 

package/dist/data/datasources.generated.js

@@ -1,6 +1,6 @@
-// AUTO-GENERATED by scripts/generate-datasources.mjs from renovate@44.181.5.
+// AUTO-GENERATED by scripts/generate-datasources.mjs from renovate@44.198.3.
 // Do not edit by hand. Run `npm run generate:datasources` to refresh.
-export const RENOVATE_VERSION = "44.181.5";
+export const RENOVATE_VERSION = "44.198.3";
 /**
  * All built-in datasource ids accepted by Renovate's `matchDatasources` and
  * `customManagers[].datasourceTemplate`. Custom datasources (`custom.<name>`)

package/dist/data/managers.generated.js

@@ -1,6 +1,6 @@
-// AUTO-GENERATED by scripts/generate-managers.mjs from renovate@44.181.5.
+// AUTO-GENERATED by scripts/generate-managers.mjs from renovate@44.198.3.
 // Do not edit by hand. Run `npm run generate:managers` to refresh.
-export const RENOVATE_VERSION = "44.181.5";
+export const RENOVATE_VERSION = "44.198.3";
 /**
  * All manager names accepted by Renovate's `matchManagers` /
  * `excludeManagers` fields. Includes both regular managers and custom
@@ -88,6 +88,7 @@ export const ALL_MANAGERS = Object.freeze([
     "nvm",
     "ocb",
     "osgi",
+    "paket",
     "pep621",
     "pep723",
     "pip-compile",

package/dist/data/migrations.generated.js

@@ -1,6 +1,6 @@
-// AUTO-GENERATED by scripts/generate-migrations.mjs from renovate@44.181.5.
+// AUTO-GENERATED by scripts/generate-migrations.mjs from renovate@44.198.3.
 // Do not edit by hand. Run `npm run generate:migrations` to refresh.
-export const RENOVATE_VERSION = "44.181.5";
+export const RENOVATE_VERSION = "44.198.3";
 /**
  * Deprecated config keys. Sourced from Renovate's `MigrationsService`:
  * `renamedProperties` (plain renames, with `newKey`) plus every

package/dist/data/options.generated.js

@@ -1,6 +1,6 @@
-// AUTO-GENERATED by scripts/generate-options.mjs from renovate@44.181.5.
+// AUTO-GENERATED by scripts/generate-options.mjs from renovate@44.198.3.
 // Do not edit by hand. Run `npm run generate:options` to refresh.
-export const RENOVATE_VERSION = "44.181.5";
+export const RENOVATE_VERSION = "44.198.3";
 export const OPTIONS = {
     "abandonmentThreshold": {
         "description": "Flags packages that have not been updated within this period as abandoned.",
@@ -643,6 +643,7 @@ export const OPTIONS = {
             "major",
             "minor",
             "patch",
+            "prerelease",
             "sync"
         ],
         "parents": [
@@ -1403,7 +1404,7 @@ export const OPTIONS = {
     "dockerSidecarImage": {
         "description": "Change this value to override the default Renovate sidecar image.",
         "type": "string",
-        "default": "ghcr.io/renovatebot/base-image:13.142.5",
+        "default": "ghcr.io/renovatebot/base-image:13.149.0",
         "globalOnly": true,
         "deprecationMsg": "The usage of `binarySource=docker` is deprecated, and will be removed in the future"
     },
@@ -1545,6 +1546,7 @@ export const OPTIONS = {
             "nvm",
             "ocb",
             "osgi",
+            "paket",
             "pep621",
             "pep723",
             "pip-compile",
@@ -3421,6 +3423,18 @@ export const OPTIONS = {
         "type": "array",
         "stage": "package"
     },
+    "paket": {
+        "description": "Configuration object for the paket manager",
+        "type": "object",
+        "default": {
+            "managerFilePatterns": [
+                "/(^|/)paket\\.dependencies$/"
+            ],
+            "versioning": "paket"
+        },
+        "stage": "package",
+        "cli": false
+    },
     "password": {
         "description": "Password for authentication.",
         "type": "string",

package/dist/data/presets.generated.js

@@ -1,6 +1,6 @@
-// AUTO-GENERATED by scripts/generate-presets.mjs from renovate@44.181.5.
+// AUTO-GENERATED by scripts/generate-presets.mjs from renovate@44.198.3.
 // Do not edit by hand. Run `npm run generate:presets` to refresh.
-export const RENOVATE_VERSION = "44.181.5";
+export const RENOVATE_VERSION = "44.198.3";
 export const PRESETS = {
     "abandonments:recommended": {
         "namespace": "abandonments",
@@ -6965,6 +6965,27 @@ export const PRESETS = {
             ]
         }
     },
+    "group:logtapeMonorepo": {
+        "namespace": "group",
+        "description": null,
+        "body": {
+            "packageRules": [
+                {
+                    "description": "Group packages from logtape monorepo together.",
+                    "extends": [
+                        "monorepo:logtape"
+                    ],
+                    "groupName": "logtape monorepo",
+                    "matchUpdateTypes": [
+                        "digest",
+                        "patch",
+                        "minor",
+                        "major"
+                    ]
+                }
+            ]
+        }
+    },
     "group:loopbackMonorepo": {
         "namespace": "group",
         "description": null,
@@ -7587,6 +7608,7 @@ export const PRESETS = {
                 "group:linkifyjsMonorepo",
                 "group:log4j2Monorepo",
                 "group:logbackMonorepo",
+                "group:logtapeMonorepo",
                 "group:loopbackMonorepo",
                 "group:lrnwebcomponentsMonorepo",
                 "group:lucideMonorepo",
@@ -15784,6 +15806,15 @@ export const PRESETS = {
             ]
         }
     },
+    "monorepo:logtape": {
+        "namespace": "monorepo",
+        "description": "logtape monorepo",
+        "body": {
+            "matchSourceUrls": [
+                "https://github.com/dahlia/logtape"
+            ]
+        }
+    },
     "monorepo:loopback": {
         "namespace": "monorepo",
         "description": "loopback monorepo",
@@ -16525,7 +16556,9 @@ export const PRESETS = {
         "description": "prisma monorepo",
         "body": {
             "matchSourceUrls": [
-                "https://github.com/prisma/prisma"
+                "https://github.com/prisma/orm",
+                "https://github.com/prisma/prisma",
+                "https://github.com/prisma/prisma-cli"
             ]
         }
     },
@@ -18042,7 +18075,9 @@ export const PRESETS = {
                 "packages:tslint"
             ],
             "matchPackageNames": [
+                "@biomejs/**",
                 "@oxlint/**",
+                "oxfmt",
                 "oxlint",
                 "prettier",
                 "remark-lint",
@@ -18290,6 +18325,7 @@ export const PRESETS = {
                 "replacements:mem-rename",
                 "replacements:messageFormat-to-scoped",
                 "replacements:middie-to-scoped",
+                "replacements:monochromata-cucumber-reporting-plugin-to-jvt",
                 "replacements:now-to-vercel",
                 "replacements:npm-run-all-to-maintenance-fork",
                 "replacements:ojdbc-to-ojdbc11",
@@ -19835,6 +19871,24 @@ export const PRESETS = {
             ]
         }
     },
+    "replacements:monochromata-cucumber-reporting-plugin-to-jvt": {
+        "namespace": "replacements",
+        "description": "`de.monochromata.cucumber:reporting-plugin` was moved to `me.jvt.cucumber:reporting-plugin`.",
+        "body": {
+            "packageRules": [
+                {
+                    "matchDatasources": [
+                        "maven"
+                    ],
+                    "matchPackageNames": [
+                        "de.monochromata.cucumber:reporting-plugin"
+                    ],
+                    "replacementName": "me.jvt.cucumber:reporting-plugin",
+                    "replacementVersion": "5.0.0"
+                }
+            ]
+        }
+    },
     "replacements:now-to-vercel": {
         "namespace": "replacements",
         "description": "`now` was renamed to `vercel`.",
@@ -21203,7 +21257,8 @@ export const PRESETS = {
                 "workarounds:libericaJdkDockerVersioning",
                 "workarounds:ubuntuDockerVersioning",
                 "workarounds:groupings",
-                "workarounds:helmDocs"
+                "workarounds:helmDocs",
+                "workarounds:guavaVariants"
             ],
             "overrideDescription": [
                 "Apply crowd-sourced workarounds for known problems with packages."
@@ -21384,6 +21439,38 @@ export const PRESETS = {
                     "matchUpdateTypes": [
                         "major"
                     ]
+                },
+                {
+                    "description": "Group SimpleWebAuthn major updates to keep browser and server compatible.",
+                    "groupName": "SimpleWebAuthn",
+                    "matchDatasources": [
+                        "npm"
+                    ],
+                    "matchPackageNames": [
+                        "@simplewebauthn/browser",
+                        "@simplewebauthn/server"
+                    ],
+                    "matchUpdateTypes": [
+                        "major"
+                    ]
+                }
+            ]
+        }
+    },
+    "workarounds:guavaVariants": {
+        "namespace": "workarounds",
+        "description": "Keep Guava on its `-jre` or `-android` variant.",
+        "body": {
+            "packageRules": [
+                {
+                    "matchDatasources": [
+                        "maven",
+                        "sbt-package"
+                    ],
+                    "matchPackageNames": [
+                        "com.google.guava:guava"
+                    ],
+                    "versionCompatibility": "^(?<version>.+)-(?<compatibility>jre|android)$"
                 }
             ]
         }

package/dist/index.js

@@ -16,6 +16,7 @@ import { registerTestPackageRules } from "./tools/testPackageRules.js";
 import { registerAnnotateDryRun } from "./tools/annotateDryRun.js";
 import { registerExplainDependency } from "./tools/explainDependency.js";
 import { registerExplainSchedule } from "./tools/explainSchedule.js";
+import { registerExplainPaths } from "./tools/explainPaths.js";
 import { registerWriteConfig } from "./tools/writeConfig.js";
 import { registerMigrateConfig } from "./tools/migrateConfig.js";
 import { registerGetVersion } from "./tools/getVersion.js";
@@ -52,8 +53,9 @@ const BASE_INSTRUCTIONS = [
     " 12. annotate_dry_run       — attribute each proposed update in a dry_run report to the packageRules that caused it (and flag rules that never matched)",
     " 13. explain_dependency     — why was/wasn't a given dependency updated: skipReason, updates, warnings and matched rules, read from a dry_run report (offline)",
     " 14. explain_schedule       — when will a `schedule` actually run: active-now plus the next windows in UTC and the config's timezone, or Renovate's own invalid-schedule message (offline)",
-    " 15. migrate_config         — apply Renovate's built-in migrations (deprecated keys → current schema) and return the migrated config",
-    " 16. write_config           — save the agreed-upon config (validates first)",
+    " 15. explain_paths          — which files Renovate scans under includePaths / ignorePaths (presets included), with dead patterns, substring-only ignorePaths surprises and per-rule matchFileNames counts (offline)",
+    " 16. migrate_config         — apply Renovate's built-in migrations (deprecated keys → current schema) and return the migrated config",
+    " 17. write_config           — save the agreed-upon config (validates first)",
     "",
     "Before the first repo-touching tool call in a session (read_config, resolve_config, dry_run, write_config, …), call check_setup with the same repoPath. It surfaces token / endpoint / connectivity problems up front (e.g. \"set GITHUB_TOKEN or github-actions deps will be skipped\") instead of waiting for dry_run to fail. Skip if the user has already confirmed setup or is doing offline-only work that doesn't depend on git origin or registries.",
     "If any tool fails unexpectedly, call check_setup to diagnose CLI availability.",
@@ -87,6 +89,7 @@ registerTestPackageRules(server);
 registerAnnotateDryRun(server);
 registerExplainDependency(server);
 registerExplainSchedule(server);
+registerExplainPaths(server);
 registerMigrateConfig(server);
 registerWriteConfig(server);
 registerGetVersion(server);

package/dist/lib/configLinter.js

@@ -338,23 +338,22 @@ function checkAutomergeIncludesMajor(config, findings) {
     const pkgRules = config.packageRules;
     if (!Array.isArray(pkgRules))
         return;
-    // ponytail: suppressing the WHOLE rule on any later `matchUpdateTypes:
-    // ["major"]` + `automerge: false` guard entry, without checking that the
-    // guard's selectors actually cover the same deps as the offending entry.
-    // Ceiling: a guard scoped to a different dep subset silently suppresses
-    // findings for unrelated entries. Upgrade path: track guard ordering /
+    // Renovate applies packageRules in order and a later match overrides an
+    // earlier one, so only a `matchUpdateTypes` including "major" + `automerge:
+    // false` guard AFTER an offending entry protects it; an earlier guard is
+    // itself overridden.
+    // ponytail: an entry counts as guarded by any later guard, without checking
+    // that the guard's selectors actually cover the same deps as the offending
+    // entry. Ceiling: a guard scoped to a different dep subset silently
+    // suppresses findings for unrelated earlier entries. Upgrade path: track
     // selector overlap per-entry if false negatives show up in practice.
-    const hasLaterMajorGuard = pkgRules.some((entry) => {
-        if (!isRecord(entry))
-            return false;
-        if (entry.automerge !== false)
-            return false;
-        return (Array.isArray(entry.matchUpdateTypes) &&
-            entry.matchUpdateTypes.includes("major"));
-    });
-    if (hasLaterMajorGuard)
-        return;
+    const lastGuardIndex = pkgRules.findLastIndex((entry) => isRecord(entry) &&
+        entry.automerge === false &&
+        Array.isArray(entry.matchUpdateTypes) &&
+        entry.matchUpdateTypes.includes("major"));
     pkgRules.forEach((entry, i) => {
+        if (i < lastGuardIndex)
+            return;
         if (!isRecord(entry))
             return;
         if (entry.automerge !== true)

package/dist/lib/configLocations.js

@@ -35,7 +35,11 @@ export async function locateConfig(repoPath) {
             // Renovate parses every candidate JSONC-then-JSON5 regardless of
             // extension (and write_config round-trips comments into renovate.json);
             // JSON5 is a superset of JSONC, so one parser covers all of them.
-            const config = JSON5.parse(raw);
+            // A 0-length file reads as `{}`, as in Renovate's detectRepoFileConfig
+            // (`if (!configFileRaw.length) configFileRaw = "{}"`). Length only: a
+            // whitespace-only file still throws, as in Renovate. This intentionally
+            // differs from configWriter.ts, which treats whitespace-only as absent.
+            const config = raw.length === 0 ? {} : JSON5.parse(raw);
             if (!isRecord(config)) {
                 throw new Error(`${candidate.path} does not contain a JSON object`);
             }
@@ -55,17 +59,41 @@ export async function locateConfig(repoPath) {
     const pkgAbs = path.join(repoPath, "package.json");
     try {
         const raw = await fs.readFile(pkgAbs, "utf8");
-        const pkg = JSON.parse(raw);
-        if (isRecord(pkg) &&
-            "renovate" in pkg &&
-            isRecord(pkg.renovate)) {
-            return {
-                absPath: pkgAbs,
-                relPath: "package.json",
-                format: "package.json",
-                raw,
-                config: pkg.renovate,
-            };
+        let pkg;
+        try {
+            pkg = JSON.parse(raw);
+        }
+        catch (err) {
+            // Invalid JSON means no config, mirroring Renovate's `catch {}`. Other
+            // read errors (EACCES etc.) still throw: a deliberate divergence.
+            if (err instanceof SyntaxError)
+                return null;
+            throw err;
+        }
+        if (isRecord(pkg) && "renovate" in pkg) {
+            const value = pkg.renovate;
+            if (isRecord(value)) {
+                return {
+                    absPath: pkgAbs,
+                    relPath: "package.json",
+                    format: "package.json",
+                    raw,
+                    config: value,
+                };
+            }
+            // Renovate expands a string package.json#renovate to `extends`.
+            if (typeof value === "string" && value.length > 0) {
+                return {
+                    absPath: pkgAbs,
+                    relPath: "package.json",
+                    format: "package.json",
+                    raw,
+                    config: { extends: [value] },
+                };
+            }
+            // An empty string or other non-object value (true, a number, an array)
+            // is reported as no config. Deliberate divergence for these truthy
+            // values: Renovate selects the file but ends up with no usable settings.
         }
     }
     catch (err) {

package/dist/lib/customManagerPreview.js

@@ -33,7 +33,7 @@ export async function parseStructured(content, fileFormat) {
 const DEFAULT_MAX_FILES_WALKED = 2000;
 const DEFAULT_MAX_FILES_MATCHED = 500;
 const DEFAULT_MAX_HITS_PER_FILE = 100;
-const DEFAULT_MATCH_TIMEOUT_MS = 2000;
+export const DEFAULT_MATCH_TIMEOUT_MS = 2000;
 const DEFAULT_MAX_FILE_BYTES = 5 * 1024 * 1024;
 const SKIP_DIRS = new Set([".git", "node_modules"]);
 const TEMPLATE_FIELD_MAP = [
@@ -114,7 +114,7 @@ function parseRegexPattern(pattern) {
  * therefore ADDS its complement rather than excluding — Renovate's
  * `ignorePaths` is the exclusion mechanism. Walk order is preserved.
  */
-async function matchFilePatterns(allPaths, patterns, matchTimeoutMs, warnings) {
+export async function matchFilePatterns(allPaths, patterns, matchTimeoutMs, warnings) {
     const matched = new Set();
     for (let i = 0; i < patterns.length; i++) {
         const pattern = patterns[i];

package/dist/lib/dependencyExplainer.js

@@ -25,7 +25,7 @@ export const SKIP_HINTS = {
 const NOT_FOUND_HINTS = [
     "Check `enabledManagers`: the manager that owns this dependency's file may not be enabled.",
     "Check the manager's `fileMatch` / `managerFilePatterns`: the file holding this dependency may not match the pattern.",
-    "Check `ignorePaths`: the file may live under an ignored path (defaults include `**/node_modules/**`, `**/bower_components/**`, …).",
+    "Check `ignorePaths`: the file may live under an ignored path (defaults include `**/node_modules/**`, `**/bower_components/**`, …). Run explain_paths with repoPath to see which pattern drops it.",
     'Re-run dry_run with `dryRunMode: "extract"` and search the report to see which files and dependencies Renovate extracted at all.',
 ];
 const NO_LOOKUP_HINT = 'A hit carries no `updates` array, so no lookup ran — the report is likely from `dryRunMode: "extract"`. Re-run dry_run with `dryRunMode: "lookup"` (or `"full"`) to see whether updates exist.';

package/dist/lib/externalPresetFetcher.js

@@ -1,3 +1,4 @@
+import JSON5 from "json5";
 import { resolveCredential } from "./credentialResolver.js";
 import { validateEndpoint } from "./endpointValidator.js";
 import { classifyExternalSource, } from "./presetResolver.js";
@@ -219,7 +220,11 @@ async function fetchJson(url, headers, timeoutMs, presetName, fetchImpl, platfor
             };
         }
         try {
-            const body = JSON.parse(text);
+            // Renovate parses preset files as JSONC, falling back to JSON5 (`.json5`
+            // straight to JSON5); JSON5 is a superset of JSONC, so one parser covers
+            // all of them. It also accepts JSON5 syntax in a `.jsonc` file, which
+            // Renovate rejects — matching that would need jsonc-parser here.
+            const body = JSON5.parse(text);
             if (!body || typeof body !== "object" || Array.isArray(body)) {
                 return {
                     ok: false,

package/dist/lib/pathSelection.js

@@ -0,0 +1,266 @@
+import { execFile } from "node:child_process";
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import { isDeepStrictEqual, promisify } from "node:util";
+import { Minimatch } from "minimatch";
+import { OPTIONS } from "../data/options.generated.js";
+import { explainConfig } from "./configExplainer.js";
+import { DEFAULT_MATCH_TIMEOUT_MS, matchFilePatterns } from "./customManagerPreview.js";
+import { isRecord } from "./util.js";
+const execFileP = promisify(execFile);
+export const DEFAULT_MAX_FILES = 50_000;
+const SAMPLE_SIZE = 5;
+const MAX_SUBSTRING_HITS = 50;
+const RENOVATE_DEFAULT = "<renovate default>";
+// ---------------------------------------------------------------------------
+// Renovate's own filters, mirrored from
+// node_modules/renovate/dist/workers/repository/extract/file-match.js
+// (`getIncludedFiles` / `filterIgnoredFiles`). Mirrored rather than
+// worker-imported because they are two one-liners over minimatch (already a
+// direct dep pinned to Renovate's major); test/unit/pathSelection.test.ts runs
+// the real functions as an oracle so the mirror can't drift silently.
+// ---------------------------------------------------------------------------
+const mmCache = new Map();
+function glob(pattern) {
+    let mm = mmCache.get(pattern);
+    if (!mm)
+        mmCache.set(pattern, (mm = new Minimatch(pattern, { dot: true })));
+    return mm;
+}
+/** includePaths: exact path or case-sensitive glob. */
+function includeHit(file, pattern) {
+    if (file === pattern)
+        return "exact";
+    return glob(pattern).match(file) ? "glob" : null;
+}
+/** ignorePaths: substring OR case-sensitive glob. */
+function ignoreHit(file, pattern) {
+    return { substring: file.includes(pattern), glob: glob(pattern).match(file) };
+}
+/** Renovate's `getFilteredFileList`: includePaths first, then ignorePaths. */
+export function filterFileList(files, includePaths, ignorePaths) {
+    const included = includePaths.length
+        ? files.filter((f) => includePaths.some((p) => includeHit(f, p)))
+        : files;
+    return ignorePaths.length
+        ? included.filter((f) => !ignorePaths.some((p) => {
+            const h = ignoreHit(f, p);
+            return h.substring || h.glob;
+        }))
+        : included;
+}
+// ---------------------------------------------------------------------------
+// File list
+// ---------------------------------------------------------------------------
+/**
+ * Renovate's local platform lists files with `git ls-files` and falls back to
+ * a `**` glob (dot files included, nothing pruned) — see
+ * node_modules/renovate/dist/modules/platform/local/scm.js. Mirror both so
+ * `**\/node_modules/**` style ignores are visible, unlike the
+ * .gitignore-honouring walk in customManagerPreview.ts.
+ */
+export async function listRepoFiles(repoPath) {
+    try {
+        const { stdout } = await execFileP("git", ["ls-files", "-z"], {
+            cwd: repoPath,
+            maxBuffer: 512 * 1024 * 1024,
+        });
+        return { files: stdout.split("\0").filter(Boolean), source: "git" };
+    }
+    catch {
+        const entries = await fs.readdir(repoPath, { recursive: true, withFileTypes: true });
+        const files = entries
+            .filter((e) => e.isFile() || e.isSymbolicLink())
+            .map((e) => path.relative(repoPath, path.join(e.parentPath, e.name)).split(path.sep).join("/"))
+            // ponytail: Renovate's glob would include .git/ internals too; they only add noise.
+            .filter((f) => !f.startsWith(".git/"))
+            .sort();
+        return { files, source: "walk" };
+    }
+}
+function isLeaf(node) {
+    return isRecord(node) && "setBy" in node && Array.isArray(node.setBy);
+}
+/** Last contribution whose (array) value contains `el` — works for overwritten and concatenated arrays. */
+function sourceOf(leaf, el) {
+    for (let i = leaf.setBy.length - 1; i >= 0; i--) {
+        const c = leaf.setBy[i];
+        if (Array.isArray(c.value) ? c.value.some((v) => isDeepStrictEqual(v, el)) : isDeepStrictEqual(c.value, el)) {
+            return { source: c.source, via: c.via };
+        }
+    }
+    return { source: "<unknown>", via: [] };
+}
+function stringList(leaf) {
+    return Array.isArray(leaf?.value) ? leaf.value.filter((v) => typeof v === "string") : [];
+}
+// ponytail: naive "what was meant" heuristic; only offered for bare (non-glob) patterns.
+function suggestGlob(pattern) {
+    const p = pattern.replace(/\/+$/, "");
+    if (p.includes("/"))
+        return `${p}/**`;
+    if (p.includes("."))
+        return `**/${p}`;
+    return `**/${p}/**`;
+}
+/** Only the user's own config and external presets can be edited; built-in/default dead globs are just noise. */
+function userOwned(source) {
+    return source === "<own>" || (!source.startsWith("<") && source.includes(">"));
+}
+export async function explainPaths(repoPath, config, options = {}) {
+    const warnings = [];
+    const maxFiles = options.maxFiles ?? DEFAULT_MAX_FILES;
+    const explained = await explainConfig(config, options);
+    const tree = explained.explanation;
+    // Only the merge-fallback warning matters here; the rest are about Handlebars
+    // templates, irrelevant to paths (unresolved presets have their own field).
+    warnings.push(...explained.warnings.filter((w) => w.preset === "<merge>").map((w) => w.message));
+    const includeLeaf = isLeaf(tree.includePaths) ? tree.includePaths : undefined;
+    const ignoreLeaf = isLeaf(tree.ignorePaths) ? tree.ignorePaths : undefined;
+    const includePaths = stringList(includeLeaf);
+    // ignorePaths is non-mergeable with a non-empty default: unset → Renovate's default applies.
+    const ignorePaths = ignoreLeaf ? stringList(ignoreLeaf) : [...OPTIONS.ignorePaths.default];
+    const attribute = (leaf, p) => leaf ? sourceOf(leaf, p) : { source: RENOVATE_DEFAULT, via: [] };
+    for (const [key, node] of Object.entries(tree)) {
+        if (isLeaf(node) || !isRecord(node))
+            continue;
+        for (const field of ["includePaths", "ignorePaths"]) {
+            if (field in node) {
+                warnings.push(`${key}.${field} is a manager-level override (it replaces the top-level list for the ${key} manager only) and is not evaluated here.`);
+            }
+        }
+    }
+    const listed = await listRepoFiles(repoPath);
+    if (listed.source === "walk") {
+        warnings.push("repoPath is not a git work tree (or git is unavailable), so the file list comes from a full directory walk — Renovate's own fallback. In a git repo Renovate scans only `git ls-files` output.");
+    }
+    const truncated = listed.files.length > maxFiles;
+    const files = listed.files.slice(0, maxFiles);
+    if (truncated) {
+        warnings.push(`The repo lists ${listed.files.length} files; only the first ${maxFiles} were evaluated. Raise maxFiles for exact counts.`);
+    }
+    const patterns = [];
+    // includePaths, against the full list.
+    includePaths.forEach((pattern, index) => {
+        const matched = files.filter((f) => includeHit(f, pattern));
+        patterns.push({
+            field: "includePaths",
+            index,
+            pattern,
+            ...attribute(includeLeaf, pattern),
+            matchKind: matched.length === 0 ? "none" : matched.includes(pattern) ? "exact" : "glob",
+            matchedCount: matched.length,
+            sampleFiles: matched.slice(0, SAMPLE_SIZE),
+        });
+    });
+    const included = filterFileList(files, includePaths, []);
+    // ignorePaths, against the include-filtered list (Renovate's order).
+    const globIgnored = new Set();
+    const substringHits = new Map(); // file → patterns that hit it by substring only
+    ignorePaths.forEach((pattern, index) => {
+        const matched = [];
+        let anyGlob = false;
+        for (const f of included) {
+            const h = ignoreHit(f, pattern);
+            if (h.glob) {
+                anyGlob = true;
+                globIgnored.add(f);
+            }
+            else if (h.substring) {
+                substringHits.set(f, [...(substringHits.get(f) ?? []), pattern]);
+            }
+            if (h.glob || h.substring)
+                matched.push(f);
+        }
+        patterns.push({
+            field: "ignorePaths",
+            index,
+            pattern,
+            ...attribute(ignoreLeaf, pattern),
+            matchKind: matched.length === 0 ? "none" : anyGlob ? "glob" : "substring",
+            matchedCount: matched.length,
+            sampleFiles: matched.slice(0, SAMPLE_SIZE),
+        });
+    });
+    const kept = filterFileList(included, [], ignorePaths);
+    const allSubstringOnly = [];
+    for (const [file, pats] of substringHits) {
+        if (globIgnored.has(file))
+            continue;
+        for (const pattern of pats) {
+            const suggestedGlob = suggestGlob(pattern);
+            allSubstringOnly.push({
+                file,
+                pattern,
+                suggestedGlob,
+                suggestedGlobMatches: new Minimatch(suggestedGlob, { dot: true }).match(file),
+            });
+        }
+    }
+    // Likely surprises first.
+    allSubstringOnly.sort((a, b) => Number(a.suggestedGlobMatches) - Number(b.suggestedGlobMatches));
+    if (allSubstringOnly.length > MAX_SUBSTRING_HITS) {
+        warnings.push(`${allSubstringOnly.length} substring-only ignorePaths hits; listing the first ${MAX_SUBSTRING_HITS}.`);
+    }
+    // packageRules[].matchFileNames, against the kept files (matchRegexOrGlob, case-insensitive).
+    const matchFileNames = [];
+    const rulesLeaf = isLeaf(tree.packageRules) ? tree.packageRules : undefined;
+    const rules = Array.isArray(rulesLeaf?.value) ? rulesLeaf.value : [];
+    for (const [rule, r] of rules.entries()) {
+        if (!isRecord(r) || !Array.isArray(r.matchFileNames))
+            continue;
+        const { source } = sourceOf(rulesLeaf, r);
+        for (const [index, pattern] of r.matchFileNames.entries()) {
+            if (typeof pattern !== "string")
+                continue;
+            let matched = [];
+            try {
+                matched = await matchFilePatterns(kept, [pattern], DEFAULT_MATCH_TIMEOUT_MS, warnings);
+            }
+            catch (err) {
+                warnings.push(`packageRules[${rule}].matchFileNames[${index}] ${pattern}: ${err.message}`);
+            }
+            matchFileNames.push({
+                rule,
+                ...(typeof r.description === "string" ? { description: r.description } : {}),
+                source,
+                index,
+                pattern,
+                matchedCount: matched.length,
+                sampleFiles: matched.slice(0, SAMPLE_SIZE),
+            });
+        }
+    }
+    const deadPatterns = [
+        ...patterns
+            .filter((p) => p.matchedCount === 0 && userOwned(p.source))
+            .map(({ field, index, pattern, source }) => ({ field, index, pattern, source })),
+        ...matchFileNames
+            .filter((m) => m.matchedCount === 0 && userOwned(m.source))
+            .map(({ rule, index, pattern, source }) => ({
+            field: `packageRules[${rule}].matchFileNames`,
+            index,
+            pattern,
+            source,
+        })),
+    ];
+    return {
+        patterns,
+        deadPatterns,
+        substringOnlyHits: allSubstringOnly.slice(0, MAX_SUBSTRING_HITS),
+        matchFileNames,
+        summary: {
+            fileListSource: listed.source,
+            totalFiles: listed.files.length,
+            evaluatedFiles: files.length,
+            truncated,
+            keptCount: kept.length,
+            excludedByIncludePaths: files.length - included.length,
+            excludedByIgnorePaths: included.length - kept.length,
+            substringOnlyHitCount: allSubstringOnly.length,
+        },
+        mergeQuality: explained.mergeQuality,
+        presetsUnresolved: explained.presetsUnresolved,
+        warnings,
+    };
+}

package/dist/lib/setupCheck.js

@@ -485,6 +485,7 @@ export const OFFLINE_TOOLS = [
     "annotate_dry_run",
     "explain_dependency",
     "explain_schedule",
+    "explain_paths",
     "migrate_config",
 ];
 // Returns the tool names that cannot currently run because their backing

package/dist/lib/version.js

@@ -1,5 +1,5 @@
 import { fileURLToPath } from "node:url";
-export const SERVER_VERSION = "1.7.1"; // x-release-please-version
+export const SERVER_VERSION = "1.8.0"; // x-release-please-version
 // "released" = the server is running from a `node_modules/` install (global
 // `npm i -g`, project-local `npm i`, or `npx renovate-mcp`). Anything else —
 // most commonly an MCP config of `{"command": "node", "args": [".../dist/index.js"]}`

package/dist/prompts/workflows.js

@@ -33,7 +33,7 @@ export function registerWorkflowPrompts(server) {
             ? `3. Call suggest_presets with query "${intent}" to get ranked presets and, if coverage is weak, an unvalidated draft config skeleton.`
             : '3. Ask the user what they want Renovate to do, then call suggest_presets with that intent as the query.',
         "4. Call resolve_config and explain_config on the resulting draft/config so you can show what it actually resolves to and which preset set each field.",
-        "5. Call validate_config and lint_config against the draft to catch schema errors and Renovate-specific footguns.",
+        "5. Call validate_config and lint_config against the draft to catch schema errors and Renovate-specific footguns, and explain_paths with repoPath (plus the draft as configContent) to check which files its includePaths / ignorePaths keep — presets like config:recommended silently ignore test/ and examples/ directories.",
         "6. Call dry_run against the repo to preview the actual updates Renovate would propose.",
         "7. Summarize the plan (presets used, resolved effective config, dry-run results) and ask the user to confirm.",
         "8. Only after the user explicitly confirms, call write_config with repoPath to save. Never call write_config before that confirmation.",
@@ -105,7 +105,7 @@ export function registerWorkflowPrompts(server) {
         intent
             ? `4. Call suggest_presets with a query combining the detected ecosystems and the user's intent "${intent}" (e.g. "npm and github-actions monorepo, automerge patch updates, pin digests"), and use the returned draft.config as the starting point.`
             : '4. Ask the user what they want Renovate to do, then call suggest_presets with a query combining the detected ecosystems and that intent (e.g. "npm and github-actions monorepo, automerge patch updates, pin digests"), and use the returned draft.config as the starting point.',
-        "5. Call lint_config and validate_config against the draft and fix any findings.",
+        "5. Call lint_config and validate_config against the draft and fix any findings. Then call explain_paths with repoPath and the draft as configContent to confirm its ignorePaths (including the ones presets add) do not drop package files detected in step 3.",
         "6. Summarize the draft config and the detected ecosystems, and ask the user to confirm. dry_run has no inline config input, so the draft must be written before a full dry run can use it.",
         "7. Only after the user explicitly confirms, call write_config with repoPath to save. Never call write_config before that confirmation.",
         `8. Call dry_run with repoPath "${repoPath}" (default full mode) to preview the actual updates Renovate would propose with the new config, and report the result.`,

package/dist/tools/explainPaths.js

@@ -0,0 +1,58 @@
+import { z } from "zod";
+import { configRecord, endpointString, pathString } from "../lib/inputLimits.js";
+import { DEFAULT_MAX_FILES, explainPaths } from "../lib/pathSelection.js";
+import { FETCH_PLATFORMS } from "../lib/presetResolver.js";
+import { assertRepoDir, loadConfigSource, MERGE_PREVIEW_DISCLAIMER, NETWORK_READ_ONLY_ANNOTATIONS, } from "../lib/toolInputs.js";
+const EXPLAIN_PATHS_DISCLAIMER = "Files are listed the way Renovate's local platform does (`git ls-files`, else a full walk) and filtered with a mirror of Renovate's own getIncludedFiles / filterIgnoredFiles; the config is resolved with Renovate's mergeChildConfig. Remote platforms list the base branch's committed tree, so uncommitted files may differ. Built-in managers' own managerFilePatterns are not applied — run dry_run with dryRunMode \"extract\" for the files each manager actually extracts.";
+export function registerExplainPaths(server) {
+    server.registerTool("explain_paths", {
+        title: "Explain which files Renovate scans",
+        annotations: NETWORK_READ_ONLY_ANNOTATIONS,
+        description: "Offline: resolve the repo's config (presets included, so hidden ignorePaths like `:ignoreModulesAndTests` from config:recommended show up), list the repo's files the way Renovate does (`git ls-files`), and apply Renovate's includePaths → ignorePaths filter. Returns every pattern with the preset or `<own>` config that set it, how many files it matched and a sample; `deadPatterns` (user-owned patterns matching no file, including packageRules[].matchFileNames entries); `substringOnlyHits` (files dropped only because an ignorePaths entry is a substring of the path, e.g. `test` dropping `src/latest/package.json`, with the glob that was probably meant); per-rule matchFileNames counts against the kept files; and a summary. Pass `configContent` to try a config other than the repo's own. Same `externalPresets` / `endpoint` / `platform` opt-ins as resolve_config.",
+        inputSchema: {
+            repoPath: pathString("Absolute path to the repository root whose files are evaluated."),
+            configContent: configRecord("Inline config to evaluate instead of the repo's own config file.").optional(),
+            externalPresets: z
+                .boolean()
+                .optional()
+                .describe("When true, fetch external presets (github>, gitlab>, gitea>, forgejo>) over HTTPS — same as resolve_config. Default false."),
+            endpoint: endpointString("API base URL for external preset fetches — same semantics as resolve_config.").optional(),
+            platform: z
+                .enum(FETCH_PLATFORMS)
+                .optional()
+                .describe("Platform flavour of `endpoint`; routes `local>` presets — same semantics as resolve_config."),
+            maxFiles: z
+                .number()
+                .int()
+                .min(1)
+                .max(1_000_000)
+                .optional()
+                .describe(`Cap on the number of listed files evaluated (default ${DEFAULT_MAX_FILES}); truncation is reported.`),
+        },
+    }, async ({ repoPath, configContent, externalPresets, endpoint, platform, maxFiles }) => {
+        const repoError = await assertRepoDir(repoPath);
+        if (repoError)
+            return { isError: true, content: [{ type: "text", text: repoError }] };
+        const src = configContent !== undefined ? { config: configContent } : await loadConfigSource({ repoPath });
+        if ("error" in src)
+            return { isError: true, content: [{ type: "text", text: src.error }] };
+        const result = await explainPaths(repoPath, src.config, {
+            fetchExternal: externalPresets ?? false,
+            endpoint,
+            platform,
+            maxFiles,
+        });
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: JSON.stringify({
+                        ...("path" in src && src.path ? { path: src.path } : {}),
+                        ...result,
+                        disclaimer: result.mergeQuality === "faithful" ? EXPLAIN_PATHS_DISCLAIMER : MERGE_PREVIEW_DISCLAIMER,
+                    }, null, 2),
+                },
+            ],
+        };
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "renovate-mcp",
-  "version": "1.7.1",
+  "version": "1.8.0",
   "description": "MCP server for designing Renovate configurations interactively.",
   "type": "module",
   "bin": {
@@ -66,7 +66,7 @@
     "jsonata": "2.2.1",
     "jsonc-parser": "^3.3.1",
     "minimatch": "^10.2.6",
-    "renovate": "44.181.5",
+    "renovate": "44.198.3",
     "smol-toml": "^1.6.1",
     "yaml": "^2.9.0",
     "zod": "^4.0.0"