Pachca API Agent Toolkit

README states MCP tools are scoped by employee role, plan and token type, and advises running `pachca auth login` in the user's own terminal rather than inside an agent command — positive signals for least privilege and sensitive credential handling, but they are prose claims with no code-level permission checks or confirmation flow shown, so least_privilege, user_confirmation and sensitive_data_handling each score 1. Data flow is described only at a high level (MCP server runs in Pachca's backend, skills use the CLI) with no retention or transport detail, score 1. Dependency security: package.json lists ordinary devDependencies and trustedDependencies but no audit or lockfile policy, score 1. External effects: the `pachca-watch-thread` skill runs a background script and calls the CLI, with no rollback or undo mechanism documented, so external_effects and rollback each score 1. Source attribution has a full MIT LICENSE naming Pachca, score 2; publisher identity is unverified by the FollowAgents registry and earns no extra credit.

The repo uses TypeSpec as a single source of truth to generate OpenAPI, SDKs, CLI and the n8n node, and check.yml enforces changelog sync, generated-file sync, docs formatting and markdown lint, giving strong self-consistency, score 2. Dependency availability: README shows npm/PyPI/NuGet/JitPack badges and install commands, so dependencies are publicly obtainable, score 2. Failure messages: only generic mentions of CLI validation and a skill covering 'missing permission or tool'; no concrete error codes or diagnostic output examples, score 1.

README clearly separates audiences and scenarios — MCP server, CLI, skills and plugin, SDKs, n8n — and lists Claude Code, Codex, VS Code, Cursor and Copilot clients, so audience_and_scenarios scores 3. Capability boundaries are fairly clear (skills are instructions only, except `pachca-watch-thread` which needs Node.js 22.20+ and a signed-in CLI), but unsupported capabilities are not systematically listed, score 2. Trigger precision: the agent is said to pick a skill automatically when a task matches, with explicit invocation like `/pachca-watch-thread`, but no trigger-condition detail, score 2. Environment fit covers many clients and six SDK languages, but some docs are Russian-only and the Node version requirement is recent, score 2.

Information architecture is clear, organized by MCP/CLI/skills/SDK/n8n/testing/AI integrations, score 3. Install notes are thorough with npx, global install, plugin marketplace commands and manual-install links, score 3. Naming stability: SDK naming rules are explicit (operationId prefix stripped, per-language style), but the n8n node carries V1/V2 compatibility maps and alias operations, showing a naming migration, score 2. Examples and FAQ: TypeScript and CLI examples exist, but no FAQ or troubleshooting section, score 2. Known limitations are only scattered (e.g. don't add skills twice when the plugin is installed) and not consolidated, score 1. License is full MIT text, score 3. Versioning/changelog: releases.json, docs/releases.md and a changelog-sync check exist, but no complete CHANGELOG file is in the provided files, score 2. Maintenance responsibility: only Issues and email addresses, no maintainer, SLA or deprecation policy, and the publisher is unverified, score 1.

Output usability: the CLI offers table/JSON/YAML/CSV output, pagination and `--describe`, and SDKs follow one call pattern, so outputs are directly usable, score 2. Marginal value: on top of an existing OpenAPI spec it adds MCP tools, skills and six SDKs, which is incremental value for agent scenarios but still fundamentally an API wrapper, score 2. Cost benefit: skills reduce context spend and the CLI's built-in API reference avoids opening the docs site, but Node.js 22.20+ and extra install steps add cost, score 2.

claim_traceability: most README claims map to repository files (LICENSE, package.json, workflows, test files), but claims about the MCP server running in the backend and skills published to dev.pachca.com cannot be checked in-repo, score 2. cross_source_corroboration: the n8n test files corroborate README statements about V1/V2 compatibility, pagination and credential testing, score 2. fact_inference_separation: README distinguishes hand-written skills from generated artifacts, but some capability claims (e.g. the agent auto-selecting skills) are inferential and not marked as such, score 1.