# @putervision/spc [Health: Active]

**Category:** 💻 Developer Tools  
**Repository:** https://github.com/putervision/spc  
**GitHub Stars:** 20  
**npm Downloads (last month):** 174  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/putervision-spc

## Description
High-performance zero-dependency static analysis tool enforcing NASA Power of Ten rules across 20 programming languages, plus AI agent skill, MCP server config, prompt template, and LLM model security auditing.

## Claude Desktop Quick Installation
Install path inferred — verify against the README before running it. Uses `npx` (confidence: medium):

```json
"mcpServers": {
  "spc": {
    "command": "npx",
    "args": ["-y","@putervision/spc"]
  }
}
```

## Documentation

## What @putervision/spc does

@putervision/spc connects an MCP-compatible agent workflow to Space Proof Code, a zero-dependency static analysis package for code and AI configuration files. Its analysis covers 20 languages: Ada, Bash, C, C++, C#, Elixir, Fortran, Go, Haskell, Java, JavaScript, TypeScript, Julia, Kotlin, Lua, PHP, Python, Ruby, Rust, Scala, Swift, and Zig.

The scanner applies rules inspired by NASA’s Power of Ten, including checks for bounded loops, recursion, static memory allocation, assertion density, and restricted control flow. It also includes traditional security checks for patterns such as unchecked return values, unsafe pointer arithmetic, recursion hazards, and hardcoded credentials.

AI-focused checks cover agent skill files such as `SKILL.md`, instruction files including `AGENTS.md` and `.windsurfrules`, MCP server configuration in `mcp.json`, and LLM deployment settings in `model_config.json`. These checks look for prompt injection and other security flaws in agent-oriented configuration.

## How it works

Analysis runs locally through the package’s static scanning and regular-expression parsing engine. The project describes the execution model as local-only, with no network calls, telemetry tracking, source-code collection, or transmission of scan results.

A scan can target a directory, restrict analysis to AI-related files with `--ai-only`, select an output format, write results to a file, or enforce a severity threshold. The command-line interface supports console output, JSON, GitHub Markdown PR comments, and SARIF 2.1.0. SARIF output can be used with GitHub Code Scanning workflows.

## Setup and configuration

Install the package globally with npm:

```bash
npm install -g @putervision/spc
```

A basic repository scan is:

```bash
spc .
```

To create a SARIF report, run:

```bash
spc ./src --format sarif -o spc-report.sarif
```

For an AI-focused audit that writes JSON results, use:

```bash
spc . --ai-only --format json -o agent-audit.json
```

CI pipelines can fail when an issue reaches a selected risk level:

```bash
spc . --max-severity 4.0 --fail-on-issue
```

The package also includes an MCP server configuration, agent tool specifications, and MCP tool schemas for use in agent integrations.

## Tools and capabilities

- Scan source code across 20 programming languages.
- Check NASA Power of Ten reliability patterns.
- Detect selected traditional security anti-patterns.
- Audit agent skills, prompts, MCP configurations, and model configuration files.
- Produce console, JSON, GitHub Markdown, and SARIF reports.
- Run as a CI quality gate using severity thresholds and failure flags.
- Provide programmatic Node.js APIs including `scanCodebase`, `formatResults`, and `PATTERN_INFO`.

## Limitations and notes

Static analysis identifies matching patterns but cannot establish that a system has no runtime defects or mission-critical failures. For safety-critical software, the project recommends supplementing these checks with dynamic testing, fuzzing, and formal verification.

The rules are inspired by NASA’s Power of Ten and are presented for educational and compatibility purposes. They do not indicate NASA endorsement or affiliation. The package is released under the MIT License.

_Full upstream README: https://allmcps.com/mcp/putervision-spc/readme_