# Ai Scrummaster

> AI-powered scrum master that automates GitHub project management

- **Type:** MCP server
- **Install:** `agentstack add mcp-mangobanaani-ai-scrummaster`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [mangobanaani](https://agentstack.voostack.com/s/mangobanaani)
- **Installs:** 0
- **Category:** [Developer Tools](https://agentstack.voostack.com/c/developer-tools)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [mangobanaani](https://github.com/mangobanaani)
- **Source:** https://github.com/mangobanaani/ai-scrummaster

## Install

```sh
agentstack add mcp-mangobanaani-ai-scrummaster
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# AI Scrum Master

[](https://github.com/mangobanaani/ai-scrummaster/actions/workflows/ci.yml)
[](https://github.com/mangobanaani/ai-scrummaster/actions/workflows/release.yml)
[](https://github.com/mangobanaani/ai-scrummaster/releases)
[](https://www.python.org)
[](LICENSE)

An AI-powered scrum master that automates GitHub project management — triaging issues, decomposing stories into tickets, detecting duplicates, running security checks on pull requests, and maintaining project hygiene.

## What it does

- **Story decomposition** — submit a plain-text feature description and the crew breaks it down into epics, stories, and tasks, creates GitHub issues with labels, and links sub-issues automatically
- **Deduplication** — before creating tickets, existing open issues are checked for overlap (Jaccard similarity) so the same story can be submitted multiple times safely
- **Triage** — incoming GitHub webhook events are classified and routed to the appropriate handler
- **DevSecOps** — pull requests and issues are scanned for secrets (17 regex patterns), CVEs via the OSV API (with CVSS vector severity parsing), OWASP categories, and branch naming policy violations
- **Security scan** — on-demand repository scan fetches dependency manifests (requirements.txt, package.json, go.mod) and checks for known vulnerabilities
- **Maintenance** — detects stale issues, enforces WIP limits, and auto-closes abandoned issues based on configurable policy
- **Standup** — generates daily standup summaries from recent issue and PR activity

## Architecture

```
POST /stories      →  story decomposer agent  →  GitHub issues (with sub-issue linking)
POST /webhook      →  triage agent  →  dedup + devsecops + action agents
POST /scan         →  fetch dep files  →  CVE scan  →  findings summary
POST /maintenance  →  stale/WIP check  →  maintenance agent  →  nudge/close issues
POST /standup      →  recent activity  →  standup agent  →  summary issue
```

Agents are built with [CrewAI](https://github.com/crewai-ai/crewai) and run against a local [Ollama](https://ollama.com) instance. GitHub interactions use the REST API and an MCP server (SSE transport).

## Requirements

- Python 3.12+
- Docker and Docker Compose
- A GitHub personal access token with `repo` scope
- Ollama running `qwen2.5:27b` (production) or `qwen2.5:7b` (development)

## Setup

Copy `.env.example` to `.env` and fill in the values:

```
GITHUB_TOKEN=ghp_...
GITHUB_WEBHOOK_SECRET=your-webhook-secret
API_KEY=your-api-key
OLLAMA_BASE_URL=http://ollama:11434
OLLAMA_MODEL=qwen2.5:27b
MCP_SERVER_URL=http://github-mcp:3000
```

All three credential fields (`GITHUB_TOKEN`, `GITHUB_WEBHOOK_SECRET`, `API_KEY`) are required — the app will fail to start if any are missing.

Start the stack:

```bash
docker compose up -d
```

## Usage

### Decompose a story into tickets

```bash
curl -X POST http://localhost:8000/stories \
  -H "Content-Type: application/json" \
  -H "X-Api-Key: your-api-key" \
  -d '{"repo":"owner/repo","story":"As a user I want to log in with email and password."}'
```

### Trigger a security scan

```bash
curl -X POST http://localhost:8000/scan \
  -H "Content-Type: application/json" \
  -H "X-Api-Key: your-api-key" \
  -d '{"repo":"owner/repo"}'
```

### Run maintenance

```bash
curl -X POST http://localhost:8000/maintenance \
  -H "Content-Type: application/json" \
  -H "X-Api-Key: your-api-key" \
  -d '{"repo":"owner/repo"}'
```

### Generate a standup summary

```bash
curl -X POST http://localhost:8000/standup \
  -H "Content-Type: application/json" \
  -H "X-Api-Key: your-api-key" \
  -d '{"repo":"owner/repo","since_hours":24}'
```

The `since_hours` parameter accepts an integer between 1 and 720 (default: 24).

### GitHub webhook

Point your repository webhook at `POST /webhook` with `application/json` content type and the same secret as `GITHUB_WEBHOOK_SECRET`. Supported events: `issues`, `pull_request`, `push`.

## Policy configuration

Edit `policies/rules.yaml` to configure:

- **WIP limits** — per-label caps on open issues (e.g., feature: 5, bug: 10)
- **Stale thresholds** — days before nudge (default: 7) and auto-close (default: 30)
- **Branch naming** — regex pattern for allowed branch names
- **CVE policy** — severity levels that trigger automatic ticket creation
- **Dedup threshold** — confidence level for LLM-based duplicate detection

## Development

```bash
pip install -e ".[dev]"
pytest
```

## License

MIT

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [mangobanaani](https://github.com/mangobanaani)
- **Source:** [mangobanaani/ai-scrummaster](https://github.com/mangobanaani/ai-scrummaster)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-mangobanaani-ai-scrummaster
- Seller: https://agentstack.voostack.com/s/mangobanaani
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.