Log inSubmit server
Spc logo

Spc

by @putervision

Scans codebases and AI configuration files for NASA Power of Ten, security, and prompt-injection issues.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Spc

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "putervision-spc": {
      "command": "npx",
      "args": [
        "-y",
        "@putervision/spc"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

We couldn’t confirm it starts correctly

We ran the install command but it didn't respond within our test window — this can mean a slow first-time install rather than a real problem.

npx -y @putervision/spc

Process exited before answering initialize.

This is an experimental automated check and can have false negatives — missing environment variables, a slow cold install, etc. It doesn’t necessarily mean something’s wrong. Last checked 3d ago.

Overview

@putervision/spc MCP server brings Space Proof Code’s local static analysis and AI configuration auditing into agent workflows. It scans code across 20 languages for NASA Power of Ten reliability rules and traditional security patterns, while also checking skills, prompts, MCP configs, and model deployment files. Use it when an agent needs to inspect a repository or audit AI-related configuration without sending source data over the network. Results can be emitted as console tables, JSON, GitHub Markdown, or SARIF.

Use cases

  • Scan a multilingual repository for NASA Power of Ten violations
  • Audit MCP configuration files for prompt-injection risks
  • Check agent skills and prompt instructions before deployment
  • Generate SARIF findings for GitHub Code Scanning
  • Fail a CI job when findings exceed a severity threshold

Key features

  • Static analysis for 20 programming languages
  • NASA Power of Ten reliability checks
  • AI agent, prompt, MCP, and model configuration auditing
  • JSON, SARIF, GitHub Markdown, and console reports
  • Local execution with zero external dependencies
  • Severity thresholds and CI failure gates

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 3d ago

Recent health check succeeded.

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 3d ago via OSV.dev · @putervision/spc (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars20Stargazers on the source repository.
npm downloads175Package downloads in the last 30 days.
Last commit2mo agoMost recent push to the default branch.
Install checkInconclusiveDidn't respond in our test window — often a slow first install.

How Spc works

What @putervision/spc does

@putervision/spc connects an MCP-compatible agent workflow to Space Proof Code, a zero-dependency static analysis package for code and AI configuration files. Its analysis covers 20 languages: Ada, Bash, C, C++, C#, Elixir, Fortran, Go, Haskell, Java, JavaScript, TypeScript, Julia, Kotlin, Lua, PHP, Python, Ruby, Rust, Scala, Swift, and Zig.

The scanner applies rules inspired by NASA’s Power of Ten, including checks for bounded loops, recursion, static memory allocation, assertion density, and restricted control flow. It also includes traditional security checks for patterns such as unchecked return values, unsafe pointer arithmetic, recursion hazards, and hardcoded credentials.

AI-focused checks cover agent skill files such as SKILL.md, instruction files including AGENTS.md and .windsurfrules, MCP server configuration in mcp.json, and LLM deployment settings in model_config.json. These checks look for prompt injection and other security flaws in agent-oriented configuration.

How it works

Analysis runs locally through the package’s static scanning and regular-expression parsing engine. The project describes the execution model as local-only, with no network calls, telemetry tracking, source-code collection, or transmission of scan results.

A scan can target a directory, restrict analysis to AI-related files with --ai-only, select an output format, write results to a file, or enforce a severity threshold. The command-line interface supports console output, JSON, GitHub Markdown PR comments, and SARIF 2.1.0. SARIF output can be used with GitHub Code Scanning workflows.

Setup and configuration

Install the package globally with npm:

Terminal
npm install -g @putervision/spc

A basic repository scan is:

bash
spc .

To create a SARIF report, run:

bash
spc ./src --format sarif -o spc-report.sarif

For an AI-focused audit that writes JSON results, use:

bash
spc . --ai-only --format json -o agent-audit.json

CI pipelines can fail when an issue reaches a selected risk level:

bash
spc . --max-severity 4.0 --fail-on-issue

The package also includes an MCP server configuration, agent tool specifications, and MCP tool schemas for use in agent integrations.

Tools and capabilities

  • Scan source code across 20 programming languages.
  • Check NASA Power of Ten reliability patterns.
  • Detect selected traditional security anti-patterns.
  • Audit agent skills, prompts, MCP configurations, and model configuration files.
  • Produce console, JSON, GitHub Markdown, and SARIF reports.
  • Run as a CI quality gate using severity thresholds and failure flags.
  • Provide programmatic Node.js APIs including scanCodebase, formatResults, and PATTERN_INFO.

Limitations and notes

Static analysis identifies matching patterns but cannot establish that a system has no runtime defects or mission-critical failures. For safety-critical software, the project recommends supplementing these checks with dynamic testing, fuzzing, and formal verification.

The rules are inspired by NASA’s Power of Ten and are presented for educational and compatibility purposes. They do not indicate NASA endorsement or affiliation. The package is released under the MIT License.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Spc

@putervision/spc is an MCP server that connects AI agent workflows to Space Proof Code for local codebase scanning and AI configuration auditing. Its main capabilities check NASA Power of Ten rules, traditional security patterns, prompt and skill files, MCP configurations, and LLM model deployment configuration across supported repositories.

Install it globally with npm using `npm install -g @putervision/spc`. The package provides the `spc` command for repository scans and includes MCP server configuration and tool schemas for agent integrations.

It can audit `SKILL.md` agent skills, `AGENTS.md` and `.windsurfrules` prompt instructions, `mcp.json` server configurations, and `model_config.json` deployment settings. Use `--ai-only` to focus a scan on AI-related files.

Yes, @putervision/spc runs its static analysis and parsing locally. Its stated execution model makes no network calls and does not transmit or collect source code, directory structures, scan results, or telemetry.

Related MCP servers

All in Developer Tools All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewSpc AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/putervision-spc?style=directory)](https://allmcps.com/mcp/putervision-spc)
HTML Embed
<a href="https://allmcps.com/mcp/putervision-spc"><img src="https://allmcps.com/api/badge/putervision-spc?style=directory" alt="Spc on AllMCPs" /></a>