Safe Fix Mcp

io.github.pamela-0Published by GitHub account pamela-0v0.1.1Updated Oct 24, 2026

Finds real dead code and proposes a safe, test-gated branch+PR to remove it.

VerifiedSTDIODesktop onlyCloud & InfrastructureDeveloper Tools

Overview

AI-generated overview

Finds dead code in a Python repository and proposes a test-gated branch and pull request to remove unused imports.

What you can do
scan_dead_code runs vulture and deptry and returns a read-only list of findings such as unused imports, functions, classes, and dependencies. propose_removal_pr filters to unused imports at 90% or higher confidence on single-name import lines, creates a branch, removes them, and runs the repository's full test suite. Only if the tests really pass does it commit, push, and try to open a pull request with gh pr create. Other findings stay report-only, and the tool never merges.
When to use it
Use it when you maintain a Python repository with a real test suite and want dead-code findings turned into a minimal, reviewable pull request instead of manual cleanup. It suits teams that want automated removal limited to the safest case, unused single-name imports, while keeping riskier findings as reports. It is not for repositories without tests or for automatic merging.
Requirements
Local Python package (pip install safe-fix-mcp), Python 3.10 or newer, and git on PATH. The gh GitHub CLI must be installed and authenticated for propose_removal_pr to open a pull request; without it the branch is still pushed and PR creation must be done manually. No API keys or environment variables are declared.
Before you install
propose_removal_pr writes to your repository: it creates a branch, commits, and pushes to the remote, and may open a pull request via gh. It refuses on a dirty working tree, and if the test suite fails nothing is committed or pushed. It never merges; a human must review and merge. It requires git and, for PR creation, an authenticated gh CLI, so repository credentials are used. scan_dead_code is read-only.

Installation

In SourceWeft

  1. Open Safe Fix Mcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

safe-fix-mcp

[PyPI] [License: MIT]

A real MCP server that finds dead code in a Python repository and proposes a branch + PR for the one class of finding that's actually safe to auto-remove: unused imports on a single-name import line. Everything else it finds — unused functions, classes, unused dependencies — stays report-only. A human always merges. This tool never merges anything itself.

Why this exists

Most "dead code" tools stop at reporting. The ones that go further usually delete with no safety net. This does neither: it drafts a real, minimal, reviewable PR, gated on the target repo's own full test suite actually passing after the removal — not a heuristic, a real pytest run. If the suite fails, nothing is committed or pushed; the repo is left exactly as it started.

Tools

scan_dead_code(repo_path=".", min_confidence=60)

Read-only. Runs vulture (dead code) and deptry (dependency issues) and returns a human-readable list of findings. Never modifies anything.

propose_removal_pr(repo_path=".")

  • Refuses on a dirty working tree — never edits on top of uncommitted work.
  • Filters to unused imports at ≥90% vulture confidence, on single-name import lines only (from x import y, z is skipped — removing the whole line would silently remove z too).
  • Creates a real branch, removes the qualifying imports, runs the repo's real full test suite.
  • Only on a real pass: commits, pushes, and tries to open a PR via gh pr create.
  • If gh isn't installed/authenticated, the branch is still committed and pushed for real — only PR creation degrades, with the real error returned so you can open it manually.

Install

bash
pip install safe-fix-mcp

Add to your MCP client config (e.g. Claude Code):

bash
claude mcp add safe-fix-mcp -- safe-fix-mcp

Or run directly for local testing:

bash
python -m safe_fix_mcp.server

Installing from source instead of PyPI:

bash
pip install -e .

Skill

A SKILL.md ships inside this same package — not a separate download — and teaches Claude when and how to use the two tools correctly (e.g. that propose_removal_pr only ever auto-removes single-name unused imports, never functions/classes/dependencies). Install it into your project:

bash
safe-fix-mcp-install-skill

Run it from the project root you want the skill active in — it writes to .claude/skills/safe-fix-mcp/SKILL.md relative to your current directory.

Requirements

  • Python ≥ 3.10
  • git on PATH
  • gh (GitHub CLI) on PATH and authenticated, if you want propose_removal_pr to actually open the PR — without it, the branch still gets pushed for real, and the tool tells you to open the PR by hand.

Development

bash
pip install -e ".[dev]"pytest

Known limitation

vulture flags scan_dead_code/propose_removal_pr themselves as "unused" — a known false-positive class, not a real bug: they're dispatched by the @mcp.tool() decorator at runtime, not called directly anywhere in the source, so static call-graph analysis can't see the real caller (the MCP framework itself).

Verifying it for real

scripts/verify_real_client.py launches the packaged server as a real subprocess and talks to it with the real mcp.client.ClientSession — the same path a real MCP client uses. Useful as a smoke test after any change:

bash
python scripts/verify_real_client.py

Source: README.md at commit b9309a1

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.1LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts