Log inSubmit server
Candor logo

Candor

Read-only MCP queries for TypeScript effect reports, call graphs, blast radius, blind spots, and policy verdicts.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Candor

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "candor": {
      "command": "npx",
      "args": [
        "-y",
        "candor-ts"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Install not yet sandbox-tested— we haven't run this command through our automated sandbox yet. Not a red flag; we're working through the catalog.

Overview

The candor MCP server exposes read-only queries over candor-ts reports for TypeScript projects. It lets agents inspect per-function effects, trace callers, identify direct sources and transitive inheritors, map module effects, and rank unresolved blind spots. Reach for candor when an agent needs evidence about network, filesystem, database, execution, environment, or other side effects without modifying the analyzed project.

Use cases

  • Inspect a function's transitive side effects
  • Trace the blast radius of a database or network helper
  • Find unresolved calls ranked by affected callers
  • Review module-level effect boundaries
  • Check hypothetical changes against an architecture policy

Key features

  • Read-only MCP access to candor-ts reports
  • Per-function transitive effect queries
  • Caller and call-graph inspection
  • Module effect maps and containment checks
  • Unknown-source blind-spot ranking
  • Policy what-if and baseline comparison queries

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 1d ago

Recent health check succeeded.

9/9 checks healthy over the last 44d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 13d ago via OSV.dev · candor-ts (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars3Stargazers on the source repository.
npm downloads4.3kPackage downloads in the last 30 days.
Last commit2d agoMost recent push to the default branch.
Directory activity2 viewsConfig copies, upvotes, and views on AllMCPs.

How Candor works

What candor MCP server does

candor MCP server gives coding agents a read-only interface to candor-ts analysis data. candor-ts uses the TypeScript compiler API to resolve calls and calculates the effects reachable from each function, including effects inherited through call chains that cross files. Recognized effect categories include Net, Fs, Db, Exec, Env, and Clock.

The resulting report records function-level effects, a call graph, and literal details where static analysis can determine them. Network calls can carry host information, database calls can carry table information, executable commands can carry command details, and filesystem operations can carry path-shaped values. These details support architectural checks such as keeping a domain layer away from network access or limiting a service to approved tables.

The analysis also marks unresolved behavior as Unknown rather than treating it as pure. Callback values, any-typed callees, and other unresolved calls can therefore remain visible to an agent reviewing a report.

How it works

A separate candor-ts scan produces .candor/report.json and .callgraph.json for a project. The scan honors tsconfig.json and excludes tests. The MCP layer exposes the report’s read-only query surface so an agent can inspect existing analysis rather than run mutations against the source tree.

Available query operations cover several review tasks:

  • Show the effects associated with a function, using the report’s function-name matching rules.
  • Find direct effect sources and functions that inherit those effects transitively.
  • List transitive callers to estimate a function’s blast radius.
  • Summarize effects by module.
  • Show boundary-effect containment and dispersion.
  • Rank Unknown sources by the blast radius they can affect.
  • Evaluate a hypothetical added effect against a policy.
  • Compare a report with a baseline and identify effect changes.
  • Apply a policy to an existing report without rescanning its source.

Function keys use module-qualified names such as src.db.save. Namespace segments are retained in function and call-graph keys, which allows policies to target namespaces. The report also preserves an invisible list for transitively reached packages that the classifier does not classify or mark as reviewed-pure.

Limitations and notes

candor is a static, curated classifier rather than a complete runtime-effects inventory. An unlisted npm package contributes no inferred effect, although the report identifies calls to packages outside the classifier. Node core is handled as a denylist: an unclassified native member is reported as Unknown instead of silently reading as pure.

The MCP interface is read-only. Policy gates and baseline guards belong to the scan and command-line surfaces: a policy violation exits with status 1, while an unreadable or unusable policy or baseline exits with status 2. The separate report comparison can disclose a producing-build mismatch, whereas the scan-time baseline guard fails closed for an invalid baseline. Reports and baselines should therefore be interpreted with their producing engine build in mind.

Results describe what static resolution can establish. Runtime-computed hosts, tables, commands, and paths are not turned into literal surfaces, and unresolved calls remain uncertainty rather than evidence of purity.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Candor

candor is an MCP server that connects coding agents to read-only candor-ts reports for TypeScript projects. Its main tools query per-function effects, transitive callers, call graphs, module maps, containment, blind spots, policy what-if results, and report differences, including disclosed Unknown results when static resolution fails.

candor analyzes compiler-resolved TypeScript calls transitively across files. It classifies recognized operations such as network, filesystem, database, execution, environment, and clock access, while reporting unresolved calls as Unknown instead of assuming they are pure.

Yes. Use the caller query to list transitive callers and estimate the network call's blast radius. The report can also distinguish direct effect sources from functions that inherit an effect through their call chains.

No. The MCP interface exposes read-only queries over candor-ts analysis data. Scanning, policy gating, baseline enforcement, and report generation are handled by the candor-ts command-line workflow.

No. candor uses a curated classifier, so an unlisted package contributes no inferred effect. The report names packages the code calls that are outside the classifier and carries those dependencies in the relevant invisible lists.

Related MCP servers

All in Biology & Bioinformatics All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewCandor AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/candor?style=directory)](https://allmcps.com/mcp/candor)
HTML Embed
<a href="https://allmcps.com/mcp/candor"><img src="https://allmcps.com/api/badge/candor?style=directory" alt="Candor on AllMCPs" /></a>