# GitHits

- [GitHits documentation](https://docs.githits.com/index.md): Choose MCP or the CLI for your agent, Scan (Alpha) for SBOMs, dependency audits, and license checks, or the REST API for deeper integration.
- [What is GitHits?](https://docs.githits.com/introduction.md): Use MCP, the CLI, Scan (Alpha), or the REST API to work with open-source dependencies.
- [MCP quick start](https://docs.githits.com/quickstart.md): Connect your coding agent or software factory to GitHits through MCP.
- [Automatic local MCP setup](https://docs.githits.com/installation/automatic-setup.md): Use the GitHits hybrid CLI to automatically configure local MCP for supported AI coding tools.
- [Manual remote MCP setup](https://docs.githits.com/installation/manual-setup.md): Configure the hosted GitHits MCP server in any MCP-capable client that supports remote servers.
- [GitHits CLI Skills setup](https://docs.githits.com/installation/skills.md): Install GitHits Skills when you prefer a Skills workflow that calls the GitHits CLI instead of MCP tools.
- [Quick-start guidance for MCP clients](https://docs.githits.com/tools/quick-start.md): Load GitHits tool routing and usage instructions with quick_start.
- [Resolve a target](https://docs.githits.com/tools/target-resolution.md): Find canonical package, repository, or documentation targets from an open-source dependency name.
- [Code: search, grep, files, and source](https://docs.githits.com/tools/code-navigation.md): Search indexed code, grep matches, list files, and read exact source lines.
- [Documentation: hosted and repo-backed docs](https://docs.githits.com/tools/documentation-access.md): Use search, list, and read to find, browse, and read hosted docs and repository-backed docs for indexed packages.
- [Package Intelligence: metadata, vulnerabilities, dependencies, and upgrades](https://docs.githits.com/tools/package-inspection.md): Check package metadata, vulnerabilities, dependencies, changelogs, and upgrades.
- [Example](https://docs.githits.com/tools/code-examples.md): Generate implementation examples from how open-source projects use libraries and APIs.
- [Research](https://docs.githits.com/tools/research.md): Ask how a package or repository works and get an answer with cited sources.
- [Experimental tools](https://docs.githits.com/tools/experimental-tools.md): Migrate from experimental opt-ins to stable GitHits CLI and MCP tools.
- [GitHits CLI command reference: all commands and flags](https://docs.githits.com/cli/commands.md): Complete reference for every GitHits CLI command, organized by category: setup, authentication, MCP server, Code, Documentation, and Package Intelligence.
- [GitHits CLI environment variable reference](https://docs.githits.com/cli/environment-variables.md): GitHits CLI environment variables for authentication, request grouping, storage, profiling, and output.
- [GitHits CLI configuration: config.toml reference](https://docs.githits.com/cli/configuration.md): Reference for GitHits config.toml: file locations, OAuth storage, and automatic skill refresh.
- [Authentication special cases](https://docs.githits.com/authentication.md): Handle GitHits authentication manually for CI, headless machines, custom storage, and troubleshooting.
- [Scan your dependencies](https://docs.githits.com/scan/overview.md): Generate an SBOM, audit dependencies, and check license policy from your repository with githits-scan.
- [Install Scan](https://docs.githits.com/scan/installation.md): Install githits-scan with Homebrew on macOS or Linux, or use prebuilt binaries or Cargo. Set an API token and preview your package files.
- [Scan command reference](https://docs.githits.com/scan/commands.md): Find githits-scan commands, flags, output formats, offline replay inputs, and exit codes.
- [Configure Scan](https://docs.githits.com/scan/configuration.md): Choose which package files Scan uploads, save a reviewed inventory, and set a license policy in githits-scan.toml.
- [Use Scan in CI](https://docs.githits.com/scan/ci.md): Generate an SBOM and enforce license policy in GitHub Actions with a pinned githits-scan version and a secret token.
- [Troubleshoot Scan](https://docs.githits.com/scan/troubleshooting.md): Resolve githits-scan authentication, file selection, upload, network, and saved-report errors.
- [Use GitHits in agentic coding workflows](https://docs.githits.com/guides/agentic-workflow.md): Prompts for planning, implementation, debugging, review, and maintenance.
- [Trigger GitHits manually](https://docs.githits.com/guides/trigger-githits.md): Prompt your agent to use GitHits when it does not call the tools on its own.
- [Authenticate GitHits in CI and headless environments](https://docs.githits.com/guides/headless-ci.md): Authenticate GitHits in CI pipelines, SSH sessions, and containers with an API token, tunneled OAuth, or file storage.
- [Troubleshooting GitHits: auth, MCP, and startup issues](https://docs.githits.com/guides/troubleshooting.md): Fix common GitHits problems: keychain prompts, expired tokens, MCP server not loading, Node.js version errors, and slow npx startup.
- [GitHits REST API](https://docs.githits.com/api/overview.md): Direct HTTP access to dependency source, documentation, and package data.
- [API quickstart](https://docs.githits.com/api/quickstart.md): Inspect an exact package version with an authenticated HTTP request to the GitHits API.
- [API authentication](https://docs.githits.com/api/authentication.md): Authenticate automated workflows with GitHits API tokens, and use CLI login or the playground for local testing.
- [Requests and responses](https://docs.githits.com/api/requests-and-responses.md): Choose response information with fields, encode parameters and read documentation or source code through the unified GitHits API.
- [SBOM, audit and licenses](https://docs.githits.com/api/lockfile-analysis.md): Upload manifests and lockfiles to generate SBOMs, audit dependencies and read compact license reports through the experimental REST API.
- [API errors](https://docs.githits.com/api/errors.md): Handle GitHits problem responses, request IDs, rate limits and ambiguous request outcomes.
- [API versioning](https://docs.githits.com/api/versioning.md): Distinguish the GitHits v1 API contract from package versions and track reference updates.
- [Get a package or repository changelog](https://docs.githits.com/api-reference/v1/packages/get-a-package-or-repository-changelog.md): Read release notes for a package or repository, ordered newest first. Retrieve recent releases to catch up on changes, or a version range to review everything between two releases.
- [Review package upgrades](https://docs.githits.com/api-reference/v1/packages/review-package-upgrades.md): Compare the versions you currently use with proposed upgrades for up to 30 packages. Each review brings together security advisories, dependency changes, compatibility information, and release notes to help you decide what to upgrade.
- [Inspect a package release](https://docs.githits.com/api-reference/v1/packages/inspect-a-package-release.md): Get an overview of a package and one of its published releases, including its description, license, and deprecation status. You can also include download counts, GitHub repository details, security advisories, and release notes.
- [Inspect package dependencies](https://docs.githits.com/api-reference/v1/packages/inspect-package-dependencies.md): Explore the dependencies of a package release, from its direct dependencies to the full dependency graph. The response can also include dependency declarations, relationships between packages, and issues such as outdated or deprecated dependencies.
- [Inspect package vulnerabilities](https://docs.githits.com/api-reference/v1/packages/inspect-package-vulnerabilities.md): Find known security advisories for a package version, with assessment reasons, severity evidence, affected-version displays and evaluated source fix candidates.
- [Compare two exact source trees](https://docs.githits.com/api-reference/v1/code-diff/compare-two-exact-source-trees.md): Compare source changes between two package versions or two refs in a public repository. The response lists changed files and can include added and deleted line counts and patches.
- [Generate an example from open-source references](https://docs.githits.com/api-reference/v1/examples/generate-an-example-from-open-source-references.md): Generate a code example for a programming task using open-source references. The response contains Markdown with source references, license attribution, and a link to the saved example.
- [Compare two exact source trees](https://docs.githits.com/api-reference/v1/experimental/compare-two-exact-source-trees.md): Deprecated alias; use POST /v1/code/diff.
- [Compare two dependency snapshots](https://docs.githits.com/api-reference/v1/experimental/compare-two-dependency-snapshots.md): Submit a selected-input dependency comparison as one asynchronous job. Send a string request JSON control and raw base_files[]/head_files[] parts. All v1 controls are required; unknown fields, query controls and repeated controls are rejected. Each side explicitly declares supplied (one or more file…
- [Preview a compact dependency-license report](https://docs.githits.com/api-reference/v1/experimental/preview-a-compact-dependency-license-report.md): Create a compact informational license report from manifests and lockfiles. This separate experimental operation returns `schema_version: 2`; the existing `/v1/experimental/licenses` operation continues returning schema 1. The compact report preserves package occurrences, reported choices, publisher…
- [Preview a compact report for a completed analysis](https://docs.githits.com/api-reference/v1/experimental/preview-a-compact-report-for-a-completed-analysis.md): Retrieve compact report `schema_version: 2` for an existing authorized CycloneDX SBOM job. Use the analysis ID returned by `POST /v1/experimental/lockfile-jobs?kind=sbom&format=cyclonedx`, after its existing status/events indicate success. A component `bom_ref` is not an analysis ID. The synchronous…
- [Report dependency licenses from uploaded files](https://docs.githits.com/api-reference/v1/experimental/report-dependency-licenses-from-uploaded-files.md): Create a JSON license report from your project's manifests and lockfiles, including transitive dependencies found during analysis. The report lists projects, packages and source/file entries, their license choices, source observations and coverage. It can contain incomplete results or unknown licens…
- [Get dependency licenses for a completed analysis](https://docs.githits.com/api-reference/v1/experimental/get-dependency-licenses-for-a-completed-analysis.md): Retrieve a JSON license report for an analysis job you can access. Use the analysis `id` returned in the HTTP 202 submission response. The synchronous `POST /v1/experimental/licenses` response has no job ID; a component's `bom_ref` cannot be used here.
- [Submit a lockfile analysis job](https://docs.githits.com/api-reference/v1/experimental/submit-a-lockfile-analysis-job.md): Submit uploaded manifests and lockfiles for asynchronous dependency analysis. Authenticate with a GitHits Bearer credential for an active account that has accepted the required terms. Supply kind=sbom or kind=audit either as a query parameter or multipart field; when both are supplied, the multipart…
- [Get lockfile analysis status](https://docs.githits.com/api-reference/v1/experimental/get-lockfile-analysis-status.md): Return the latest complete job snapshot. The result_url is present in every state; only state=succeeded means the result is ready. Snapshots are full replacements. The associated events stream sends every update with a nondecreasing but nonunique revision, so state or attempt may change at an equal…
- [Stream lockfile analysis progress](https://docs.githits.com/api-reference/v1/experimental/stream-lockfile-analysis-progress.md): Open the public event stream for an authorized job. Each frame uses event: snapshot, id: <revision>, and data: <JSON LockfileJobSnapshot>; the data is a complete state replacement and contains the canonical result_url. Revisions are nondecreasing but nonunique: equal-revision snapshots may change st…
- [Download a completed lockfile analysis](https://docs.githits.com/api-reference/v1/experimental/download-a-completed-lockfile-analysis.md): Download the completed document in the format selected at submission. Only state=succeeded indicates that the result is ready. The response format is determined by the upstream's allowlisted media type; Accept does not select it. SBOM uses the same format-specific validation as synchronous /v1/exper…
- [Research a question with cited sources](https://docs.githits.com/api-reference/v1/experimental/research-a-question-with-cited-sources.md): Research a question about a package, GitHub repository, or documentation site and receive a Markdown answer with links to its sources. Continue the conversation with follow-up questions in the same thread. Answer generation can take up to 210 seconds.
- [Generate an SBOM from uploaded files](https://docs.githits.com/api-reference/v1/experimental/generate-an-sbom-from-uploaded-files.md): Generate a dependency inventory from manifest and lockfile uploads without creating a project. Manifest-only inputs resolve concrete versions and transitives. Compatible lockfiles supply recorded versions for associated manifests; uncovered manifests resolve separately.
- [Resolve a target name](https://docs.githits.com/api-reference/v1/experimental/resolve-a-target-name.md): Find packages, repositories, and documentation sites from a name. Results include ranked matches and related projects to help you identify the project you mean.
- [Submit solution or session feedback](https://docs.githits.com/api-reference/v1/feedback/submit-solution-or-session-feedback.md): Record whether a generated example or a session was useful, with optional written feedback. You can rate a saved example using its solution identifier or submit feedback for a session.
- [Find regex or literal matches across source and documentation](https://docs.githits.com/api-reference/v1/grep/find-regex-or-literal-matches-across-source-and-documentation.md): Find text in packages, repositories, and hosted documentation. Use this endpoint for exact text or regular-expression matches. Use list to find paths, search to discover topics, and read to retrieve more context for a match.
- [Search supported programming languages](https://docs.githits.com/api-reference/v1/languages/search-supported-programming-languages.md): Find supported programming languages by name or alias. Results provide a canonical name, a display name, and aliases for each match, ordered by relevance.
- [List files and documentation paths](https://docs.githits.com/api-reference/v1/list/list-files-and-documentation-paths.md): Browse files and documentation paths in a package, repository, or documentation site. Use this endpoint when you know the target and want to find something to read. Use grep to find text within its contents, or search to discover documentation by topic.
- [Read documentation or source code](https://docs.githits.com/api-reference/v1/read/read-documentation-or-source-code.md): Read a documentation page or an exact source file. The response identifies which kind was returned and includes the information needed to cite the page, package version, or repository commit.
- [Search documentation, code and symbols](https://docs.githits.com/api-reference/v1/search/search-documentation-code-and-symbols.md): Search documentation, source code, and symbols across packages, public repositories, and documentation sites. Results include matching text and source locations you can use to read the original page or file.
- [Get search status and retained results](https://docs.githits.com/api-reference/v1/search/get-search-status-and-retained-results.md): Retrieve the status and saved results of a search started with `POST /v1/searches`. Use this endpoint to follow a search that is still running or to retrieve its results again while they are retained.
- [Look up a vulnerability and affected packages](https://docs.githits.com/api-reference/v1/vulnerabilities/look-up-a-vulnerability-and-affected-packages.md): Look up a vulnerability ID or known alias for its current source explanation and one page of grouped package evidence. Authentication and `public_read` authorization are required. To assess an installed release, follow up with `GET /v1/packages/{registry}/{name}/vulnerabilities?version=...`.
- [Changelog](https://docs.githits.com/changelog/overview.md): Recent updates to GitHits — new features, improvements, and bug fixes.

## OpenAPI Specs

- [openapi](https://api.githits.dev/v1/openapi.json)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.