# flake-check

Checks a Nix flake for errors and returns structured check results, warnings, and errors.

Agent View of the PolicyLayer registry record for `flake-check`. HTML page: https://policylayer.com/tools/io-github-dave-london-github/flake-check

## Facts

- Tool: `flake-check`
- Server: Github (`@paretools/github`) — https://policylayer.com/tools/io-github-dave-london-github.md
- Install: `npx -y @paretools/github`
- Homepage: https://github.com/Dave-London/Pare
- Risk category: Read (Low risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 0
- Recommended policy verdict: Allowed

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "flake-check",
    "arguments": {}
  }
}
```

## Why flake-check is rated Low

The tool performs a read/analysis operation — inspecting a Nix flake for errors and returning results. It does not modify, delete, or execute anything beyond static analysis. However, 'nix flake check' can evaluate Nix expressions and run build checks, which could have side effects depending on the flake contents.

From the tool's own definition: "'Checks a Nix flake for errors and returns structured check results, warnings, and errors'"

## Use case

AI agents call flake-check to retrieve information from Github without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

## Recommended policy (PolicyLayer)

Verdict: **Allowed**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Github:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "flake-check": {}
  }
}
```

## Other tools on Github (201)

- `branch` — Destructive — https://policylayer.com/tools/io-github-dave-london-github/branch.md
- `clean` — Destructive — https://policylayer.com/tools/io-github-dave-london-github/clean.md
- `remove` — Destructive — https://policylayer.com/tools/io-github-dave-london-github/remove.md
- `reset` — Destructive — https://policylayer.com/tools/io-github-dave-london-github/reset.md
- `secret-delete` — Destructive — https://policylayer.com/tools/io-github-dave-london-github/secret-delete.md
- `stash` — Destructive — https://policylayer.com/tools/io-github-dave-london-github/stash.md
- `tag` — Destructive — https://policylayer.com/tools/io-github-dave-london-github/tag.md
- `variable-delete` — Destructive — https://policylayer.com/tools/io-github-dave-london-github/variable-delete.md
- `workspace` — Destructive — https://policylayer.com/tools/io-github-dave-london-github/workspace.md
- `worktree` — Destructive — https://policylayer.com/tools/io-github-dave-london-github/worktree.md
- `add` — Execute — https://policylayer.com/tools/io-github-dave-london-github/add.md
- `add-package` — Execute — https://policylayer.com/tools/io-github-dave-london-github/add-package.md
- `ansible-galaxy` — Execute — https://policylayer.com/tools/io-github-dave-london-github/ansible-galaxy.md
- `ansible-playbook` — Execute — https://policylayer.com/tools/io-github-dave-london-github/ansible-playbook.md
- `api` — Execute — https://policylayer.com/tools/io-github-dave-london-github/api.md
- `apply` — Execute — https://policylayer.com/tools/io-github-dave-london-github/apply.md
- `audit` — Execute — https://policylayer.com/tools/io-github-dave-london-github/audit.md
- `bazel` — Execute — https://policylayer.com/tools/io-github-dave-london-github/bazel.md
- `biome-check` — Execute — https://policylayer.com/tools/io-github-dave-london-github/biome-check.md
- `bisect` — Execute — https://policylayer.com/tools/io-github-dave-london-github/bisect.md
- `black` — Execute — https://policylayer.com/tools/io-github-dave-london-github/black.md
- `build` — Execute — https://policylayer.com/tools/io-github-dave-london-github/build.md
- `bundle-exec` — Execute — https://policylayer.com/tools/io-github-dave-london-github/bundle-exec.md
- `bundle-install` — Execute — https://policylayer.com/tools/io-github-dave-london-github/bundle-install.md
- `check` — Execute — https://policylayer.com/tools/io-github-dave-london-github/check.md
- `cherry-pick` — Execute — https://policylayer.com/tools/io-github-dave-london-github/cherry-pick.md
- `clippy` — Execute — https://policylayer.com/tools/io-github-dave-london-github/clippy.md
- `cmake` — Execute — https://policylayer.com/tools/io-github-dave-london-github/cmake.md
- `compose-build` — Execute — https://policylayer.com/tools/io-github-dave-london-github/compose-build.md
- `compose-down` — Execute — https://policylayer.com/tools/io-github-dave-london-github/compose-down.md
- …and 171 more: https://policylayer.com/tools/io-github-dave-london-github.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=io-github-dave-london-github · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/io-github-dave-london-github