grasp-mcp-server a
JSON →36 tools for dependency graphs, architecture analysis, security scanning, refactoring, and CI tracking for LLM agents
Install
npx -y grasp-mcp-server` Tools · 82
- grasp_analyze Full analysis of any repo or local path — returns session_id for follow-up queries
- grasp_sessions List active sessions (persist 7 days, survive restarts)
- grasp_diff Compare two snapshots — what changed between analyses?
- grasp_watch Re-analyse a directory and diff against a prior run
- grasp_rules_check Run grasp.yml architecture rules and report violations
- grasp_config_check Validate a session against architecture rules — returns violations
- grasp_file_deps What does this file depend on?
- grasp_dependents What breaks if I change this file?
- grasp_cycles Are there circular dependencies?
- grasp_architecture What layers does this codebase have?
- grasp_hotspots Which files are riskiest to touch?
- grasp_metrics Lines, complexity, fan-in/fan-out per file
- grasp_find_path How does file A connect to file B?
- grasp_patterns What design patterns are in use?
- grasp_unused Dead code — defined but never called
- grasp_explain Plain-English explanation of any file or function
- grasp_refactor Step-by-step refactor plan for a file or session
- grasp_suggest Ranked refactoring suggestions by effort-to-impact ratio
- grasp_onboard Ordered reading path for new engineers entering a codebase area
- grasp_types Type annotation coverage — prioritises high fan-in files lacking types
- grasp_similarity Ranked duplicate clusters and code-clone groups
- grasp_stale Active but abandoned files — low churn, high fan-in, no test counterpart
- grasp_change_risk Risk score 0–100 for a set of changed files
- grasp_security Hardcoded secrets, injection risks, dangerous patterns
- grasp_sbom SBOM in CycloneDX 1.4 or SPDX 2.3 JSON
- grasp_sarif SARIF 2.1.0 export for GitHub Code Scanning
- grasp_license Dependency licenses — flags copyleft and unknown
- grasp_pii_trace BFS trace from PII source files to all consumers
- grasp_duties Separation of duties — files that both initiate and approve
- grasp_reg_impact Regulatory change blast radius (GDPR/HIPAA/SOX/PCI-DSS)
- grasp_env_vars All env var reads — flags undocumented and test-only vars
- grasp_feature_flags All feature flag reads (LaunchDarkly, GrowthBook, env-var flags)
- grasp_pr_comment Generate PR health comment with blast radius for changed files
- grasp_pr_review Post inline review comments on a GitHub PR at high-severity lines
- grasp_commits Commit counts for last 7d and 30d
- grasp_ci_status Latest GitHub Actions run — passing/failing/in-progress
- grasp_dora DORA metrics — Deployment Frequency, Lead Time, CFR, MTTR
- grasp_adr AI-powered MADR-format Architecture Decision Record
- grasp_embed Generate iframe, README badge, React snippet for sharing
- grasp_timeline Last N commits with per-commit changed files + co-change matrix
- grasp_contributors Per-file ownership, bus-factor, top contributors
- grasp_coverage Test coverage overlay — which files lack tests?
- grasp_issues Map GitHub Issues to the files they mention
- grasp_jira_issues Map Jira issues to source files via project key
- grasp_service_graph Service-level dependency graph from OTEL / custom trace JSON
- grasp_deps_dev Ecosystem dependents via deps.dev — how many packages depend on this repo
- grasp_brain_index Analyse and persist a repo to the local SQLite brain
- grasp_brain_status What's indexed in the brain and when?
- grasp_context Rich file context — layer, complexity, coupling, security, dependents, dependencies
- grasp_arch_diff Compare current state vs brain baseline — detect degradations
- grasp_ask Ask a natural language question about your architecture
- graph_query Run read-only Cypher queries against the persistent function/file call graph
- call_chain Trace caller and callee chains for any function, up to configurable depth
- type_propagation Find all functions sharing a return type and their call neighbors
- function_graph Render a Mermaid / DOT / JSON subgraph centred on any named function
- grasp_dead_packages npm deps in package.json but never imported
- grasp_runtime_calls Merge a live runtime trace with static edges — actual hot paths
- grasp_db_coupling ORM/SQL-to-table coupling map — god tables, high-coupling files
- grasp_migration_plan Phased topologically-ordered plan for replacing a package/module
- grasp_api_surface Unified API surface from OpenAPI, GraphQL, Express/FastAPI routes
- grasp_events Event emitters and subscribers — orphaned emits, ghost subscriptions
- grasp_perf N+1 queries, synchronous I/O, JSON serialization in loops
- grasp_bundle Bundle size treemap — largest files by size category
- grasp_dep_impact Impact of upgrading a dependency across all files
- grasp_cross_repo Compare two sessions — shared files, diverged functions
- grasp_diagram Generate Mermaid flowchart or C4 diagrams from the dependency graph
- grasp_req_trace Requirement traceability — scan @REQ-NNN tags against a CSV
- grasp_anomaly Anomaly investigation — BFS blast radius, security in call chain, plain-English summary
- grasp_reuse Software reuse assessor — Red/Amber/Green compatibility matrix
- grasp_safety_trace Safety constraint tracer — finds paths that bypass all safety gates
- grasp_multilang Cross-language call graph (Ada→C, Python→C, JS→WASM)
- grasp_heritage Heritage software genealogy — zero-delta certification shortcuts
- grasp_icd ICD mapper — match Interface Control Document entries to code
- grasp_ecss ECSS-E-ST-40C compliance checker (DI-01, DI-04, DI-07, DI-10, DI-15)
- grasp_run_diff Training run diff — changed hyperparameters and affected code
- grasp_eval_coverage Eval coverage map — safety gates with no eval coverage flagged critical
- grasp_org_graph Org-level multi-repo dependency graph with inter-repo edges
- grasp_api_diff Breaking API change detector — removed/changed exported symbols
- grasp_plugins Extension-point map — plugin interfaces, hook points, strategy patterns
- grasp_semver Semantic versioning enforcer — validate semver bump for the change set
- grasp_abi_diff ABI/API stability checker — stability score 0–100
- grasp_subsystems Kernel/OS subsystem
Environment variables
GRASP_NVD_API_KEYGITHUB_TOKEN
Links
★ 6 GitHub stars