Announcing Beacon: Self-improving memory for coding agents
BeaconIntel
2.9K
← All MCP servers
MCP server

mergelock

mcp:sadayamuthu/mergelock

Finds merge conflicts git can't see between branches: changed signatures vs new callers.

awesome-mcp-serversGlamaMCP Registry
Verdict
Inconclusive

The analysis could not cover enough of the artifact to decide.

Analyzed Oct 29, 2026, 16:07 UTC at c816d3c

Dispute security verdict

If you believe this verdict is incorrect, submit a dispute and we'll review it.

0
findings
—
highest severity
0
threat classes
127
files scanned
205/205
checks satisfied
0
package advisories

Why this verdict

  • inconclusive: gap no_dataflow_for_go at cmd/mergelock/check.go
  • inconclusive: gap no_dataflow_for_go at cmd/mergelock/main.go
  • inconclusive: gap no_dataflow_for_go at cmd/mergelock/serve.go
  • inconclusive: gap no_dataflow_for_go at internal/bench/gen.go
  • inconclusive: gap no_dataflow_for_go at internal/cache/cache.go
  • inconclusive: gap no_dataflow_for_go at internal/config/config.go
  • inconclusive: gap no_dataflow_for_go at internal/engine/checkdir.go
  • inconclusive: gap no_dataflow_for_go at internal/engine/delta.go
  • inconclusive: gap no_dataflow_for_go at internal/engine/engine.go
  • inconclusive: gap no_dataflow_for_go at internal/engine/loader.go
  • inconclusive: gap no_dataflow_for_go at internal/engine/resolve.go
  • inconclusive: gap no_dataflow_for_go at internal/gittest/gittest.go
  • inconclusive: gap no_dataflow_for_go at internal/gitx/gitx.go
  • inconclusive: gap no_dataflow_for_go at internal/gitx/mergetree.go
  • inconclusive: gap no_dataflow_for_go at internal/gitx/trees.go
  • inconclusive: gap no_dataflow_for_go at internal/lang/lang.go
  • inconclusive: gap no_dataflow_for_go at internal/lang/langs/langs.go
  • inconclusive: gap no_dataflow_for_go at internal/lang/python/adapter.go
  • inconclusive: gap no_dataflow_for_go at internal/lang/python/refs.go
  • inconclusive: gap no_dataflow_for_go at internal/lang/python/resolve.go
  • inconclusive: gap no_dataflow_for_go at internal/lang/python/symbols.go
  • inconclusive: gap no_dataflow_for_go at internal/lang/treesitter.go
  • inconclusive: gap no_dataflow_for_go at internal/lang/typescript/adapter.go
  • inconclusive: gap no_dataflow_for_go at internal/lang/typescript/refs.go
  • inconclusive: gap no_dataflow_for_go at internal/lang/typescript/resolve.go
  • inconclusive: gap no_dataflow_for_go at internal/lang/typescript/symbols.go
  • inconclusive: gap no_dataflow_for_go at internal/mcpserver/server.go
  • inconclusive: gap no_dataflow_for_go at internal/model/compat.go
  • inconclusive: gap no_dataflow_for_go at internal/model/hash.go
  • inconclusive: gap no_dataflow_for_go at internal/model/model.go
  • inconclusive: gap no_dataflow_for_go at internal/rules/add_add.go
  • inconclusive: gap no_dataflow_for_go at internal/rules/callsites.go
  • inconclusive: gap no_dataflow_for_go at internal/rules/duplicate_definition.go
  • inconclusive: gap no_dataflow_for_go at internal/rules/mergetree.go
  • inconclusive: gap no_dataflow_for_go at internal/rules/modify_delete.go
  • inconclusive: gap no_dataflow_for_go at internal/rules/rules.go
  • inconclusive: gap no_dataflow_for_go at internal/rules/signature_caller.go
  • inconclusive: gap no_dataflow_for_go at internal/rules/textual.go
  • inconclusive: gap no_dataflow_for_go at internal/verdict/finalize.go
  • inconclusive: gap no_dataflow_for_go at internal/verdict/text.go
  • inconclusive: gap no_dataflow_for_go at internal/verdict/verdict.go
  • inconclusive: gap unanalyzed_image at demo/demo.gif
  • inconclusive: gap vision_skipped at demo/demo.gif

Security findings 0

No individual findings recorded

The inconclusive verdict rests on the coverage gaps below.

Notes 2

Capabilities, vulnerabilities and disclosed behavior worth knowing. Nothing here works against the person who installs it, so notes never change the verdict.

Persistence

mediumNoteConfirmed on reviewmedium confidence

USAGE.md tells the user to paste a standing instruction into agent memory files (CLAUDE.md, AGENTS.md) that makes the agent call the mergelock check tool; a user-directed setting for the publisher's own tool, so a note.

USAGE.md:247
Then add this to the agent's standing instructions
vector:instruction
Reviewer's reasoning

The standing-instruction text is a documented setting the user chooses to add to their own agent files, and it only asks the agent to call the publisher's own check tool, which is the declared purpose. Under the note carve-outs for user-opted configuration and declared core capability, this is a note.

Supply chain

lowNoteConfirmed on reviewhigh confidence

The action's install step, when version is left at its default, downloads whichever mergelock release is latest from the publisher's own GitHub repository, checksum-checks it against that same release, and runs it; this is the publisher's own unpinned release and is a note.

action.yml:17
inputs.version.default: latest
vector:code
Reviewer's reasoning

The default version resolves to the publisher's own GitHub release, and the action only runs when the user adds it to their workflow. Fetching the publisher's own unpinned release is a carve-out for the publisher's own install path, so this is a note.

Coverage gaps 43

Parts of the artifact the static analysis could not fully examine.

no_dataflow_for_go go file: string-literal extraction only
cmd/mergelock/check.go
no_dataflow_for_go go file: string-literal extraction only
cmd/mergelock/main.go
no_dataflow_for_go go file: string-literal extraction only
cmd/mergelock/serve.go
no_dataflow_for_go go file: string-literal extraction only
internal/bench/gen.go
no_dataflow_for_go go file: string-literal extraction only
internal/cache/cache.go
no_dataflow_for_go go file: string-literal extraction only
internal/config/config.go
no_dataflow_for_go go file: string-literal extraction only
internal/engine/checkdir.go
no_dataflow_for_go go file: string-literal extraction only
internal/engine/delta.go
no_dataflow_for_go go file: string-literal extraction only
internal/engine/engine.go
no_dataflow_for_go go file: string-literal extraction only
internal/engine/loader.go
no_dataflow_for_go go file: string-literal extraction only
internal/engine/resolve.go
no_dataflow_for_go go file: string-literal extraction only
internal/gittest/gittest.go
no_dataflow_for_go go file: string-literal extraction only
internal/gitx/gitx.go
no_dataflow_for_go go file: string-literal extraction only
internal/gitx/mergetree.go
no_dataflow_for_go go file: string-literal extraction only
internal/gitx/trees.go
no_dataflow_for_go go file: string-literal extraction only
internal/lang/lang.go
no_dataflow_for_go go file: string-literal extraction only
internal/lang/langs/langs.go
no_dataflow_for_go go file: string-literal extraction only
internal/lang/python/adapter.go
no_dataflow_for_go go file: string-literal extraction only
internal/lang/python/refs.go
no_dataflow_for_go go file: string-literal extraction only
internal/lang/python/resolve.go
no_dataflow_for_go go file: string-literal extraction only
internal/lang/python/symbols.go
no_dataflow_for_go go file: string-literal extraction only
internal/lang/treesitter.go
no_dataflow_for_go go file: string-literal extraction only
internal/lang/typescript/adapter.go
no_dataflow_for_go go file: string-literal extraction only
internal/lang/typescript/refs.go
no_dataflow_for_go go file: string-literal extraction only
internal/lang/typescript/resolve.go
no_dataflow_for_go go file: string-literal extraction only
internal/lang/typescript/symbols.go
no_dataflow_for_go go file: string-literal extraction only
internal/mcpserver/server.go
no_dataflow_for_go go file: string-literal extraction only
internal/model/compat.go
no_dataflow_for_go go file: string-literal extraction only
internal/model/hash.go
no_dataflow_for_go go file: string-literal extraction only
internal/model/model.go
no_dataflow_for_go go file: string-literal extraction only
internal/rules/add_add.go
no_dataflow_for_go go file: string-literal extraction only
internal/rules/callsites.go
no_dataflow_for_go go file: string-literal extraction only
internal/rules/duplicate_definition.go
no_dataflow_for_go go file: string-literal extraction only
internal/rules/mergetree.go
no_dataflow_for_go go file: string-literal extraction only
internal/rules/modify_delete.go
no_dataflow_for_go go file: string-literal extraction only
internal/rules/rules.go
no_dataflow_for_go go file: string-literal extraction only
internal/rules/signature_caller.go
no_dataflow_for_go go file: string-literal extraction only
internal/rules/textual.go
no_dataflow_for_go go file: string-literal extraction only
internal/verdict/finalize.go
no_dataflow_for_go go file: string-literal extraction only
internal/verdict/text.go
no_dataflow_for_go go file: string-literal extraction only
internal/verdict/verdict.go
unanalyzed_image image text not analyzed
demo/demo.gif
vision_skipped animated GIF with 674 frames (models see one)
demo/demo.gif