
Mcp Server Analyzer
io.github.AnselmooPublished by GitHub account Anselmoov0.4.1Updated Oct 24, 2026
MCP server for Python, JavaScript, and TypeScript code analysis with Ruff, ty, Vulture, and Biome
Overview
A local MCP server that lets an assistant lint, format, type-check and dead-code-scan Python and JavaScript/TypeScript code with Ruff, ty, Vulture and Biome.
- What you can do
- Lint and format Python code with Ruff, including CI-oriented output for pipelines like GitHub Actions or GitLab CI. Type-check Python with ty and find unused imports, functions and variables with Vulture. Lint and format JavaScript and TypeScript with Biome. Run a combined Ruff, ty and Vulture analysis that returns a weighted quality score from 0 to 100.
- When to use it
- Useful when an assistant should review or clean up Python or JS/TS code in a project: catching style violations and likely bugs, checking type safety, removing dead code, or producing a quick quality assessment before a commit or code review.
- Requirements
- Runs as a local stdio process, typically launched with uvx (PyPI package) or Docker. Python 3.13+ and uv or pip are needed; Node.js 22+ is needed for the Biome JS/TS analysis. No accounts, API keys or environment variables are declared.
Installation
In SourceWeft
- Open Mcp Server Analyzer in the dashboard and add it to a workspace.
- Enable the server for the chats that should use its tools.
Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.
Other MCP clients
Follow the launch instructions in the repository.
README
MCP Server Analyzer for Python 🐍🔍
[CI/CD Pipeline] [PyPI version] [Python 3.13+] [Docker] [License: MIT] [Code Coverage] [AgentSeal MCP] [Docs]
A powerful Model Context Protocol (MCP) server that provides comprehensive Python code analysis using Ruff for linting, ty for type checking, and Vulture for dead code detection. Perfect for AI assistants, IDEs, and automated code review workflows.
🚀 Quick Start
VS Code Integration (One-Click Install)
For quick installation, use one of the one-click install buttons below...
[Install with UV in VS Code] [Install with UV in VS Code Insiders]
[Install with Docker in VS Code] [Install with Docker in VS Code Insiders]
For manual installation, add the following JSON block to your User Settings (JSON) file in VS Code. You can do this by pressing Ctrl + Shift + P and typing Preferences: Open User Settings (JSON).
Optionally, you can add it to a file called .vscode/mcp.json in your workspace. This will allow you to share the configuration with others.
Note that the
mcpkey is needed when using themcp.jsonfile.
Using uvx (recommended):
Using Docker:
Universal Installation
📋 Features
- 🔍 RUFF Analysis: Comprehensive Python linting with auto-fixes
- 🧠 ty Type Checking: Fast Python type analysis with rule-based diagnostics
- 🧹 Dead Code Detection: Find unused imports, functions, and variables with VULTURE
- ⚡ Biome JS/TS Analysis: Fast linting and formatting for JavaScript and TypeScript
- 📊 Quality Scoring: Combined analysis with quality metrics
- 🚀 FastMCP Framework: High-performance MCP server implementation
- 🐳 Docker Ready: Multi-architecture containers with security signing
- 🔒 Secure: All releases signed with Sigstore for supply chain security
📈 Analysis Examples
RUFF Linting Preview
See comprehensive linting analysis examples: 📋 RUFF Analysis Preview
VULTURE Dead Code Detection Preview
Explore dead code detection capabilities: 🧹 VULTURE Analysis Preview
🛠️ Available Tools
🔧 Configuration
Claude Desktop
Add to your claude_desktop_config.json:
Zed
Add to your Zed settings.json:
Claude Code (project-level)
Place .mcp.json at your project root:
🧪 Development
Prerequisites
Setup
Testing
📊 Quality Metrics
The server provides quality scoring based on:
- Ruff Issues: Style violations, potential bugs, complexity metrics
- ty Diagnostics: Static typing errors and warnings
- Dead Code Detection: Unused imports, functions, variables
- Combined Score: Weighted quality assessment (0-100)
🔒 Security
- Signed Releases: All releases signed with Sigstore
- Container Signing: Docker images signed with Cosign
- Trusted Publishing: PyPI releases use GitHub OIDC trusted publishing
- Vulnerability Scanning: Automated security scanning in CI/CD
- Supply Chain Security: SLSA Build Level 3 compliance
- Security Policy: See SECURITY.md for vulnerability reporting
🔍 Data Handling & Transparency
- In-memory only: Code passed to tools is written to a temporary file, analyzed, and the file is deleted immediately — nothing is persisted between calls.
- No network calls: The server makes no outbound network connections during analysis.
- No telemetry: No usage data, analytics, or crash reports are collected.
- Subprocess isolation: ruff, ty, and vulture are invoked with fixed argument lists — no shell expansion or arbitrary command execution.
📚 Documentation
- Full Documentation - GitHub Pages docs
- Tools Reference - Detailed tool parameters and return types
- MCP Specification - Learn about Model Context Protocol
- FastMCP Framework - High-performance MCP implementation
- Ruff Documentation - Python linter and formatter
- ty Documentation - Python type checker and language server
- Vulture Documentation - Dead code finder
🤝 Contributing
Contributions are welcome! Please see CONTRIBUTING.md for details.
- Fork the repository
- Create a feature branch (
git checkout -b feature/amazing-feature) - Commit your changes using Conventional Commits
- Push to the branch (
git push origin feature/amazing-feature) - Open a Pull Request
📝 License
This project is licensed under the MIT License - see the LICENSE file for details.
🙏 Acknowledgments
- Astral for RUFF and uv
- Jendrik Seipp for VULTURE
- Model Context Protocol team
- FastMCP framework
Made with ❤️ for better Python code quality
Source: README.md at commit ba675ff
Tools
0Version history
1- v0.4.1LatestSep 16, 2026
Score
50% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
- Reached in the last 30 days25 pts
Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.
- Auth declared10 pts
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
- Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
- DescriptionRequired15 pts
- Logo10 pts
- Documentation15 pts
- License10 pts