static-analysis MCP servers & tools

Scans MCP servers for prompt injection, data exfiltration, and privilege escalation.

UI design MCP: design references, intent routing, anti-slop static detector and gate. No API key.

Static analysis scanner for MCP server code and multi-tenant SaaS applications.

JADX-AI-MCP is a plugin and MCP Server for the JADX decompiler that integrates directly with Model Context Protocol (MCP) to provide live reverse engineering support with LLMs like Claude.

Code Quality Auditor: Analyze code for SOLID principles, DRY violations, and more

Production readiness for vibe-coded apps. 52 checks for security, reliability, and performance.

APKTool MCP Server is a MCP server for the Apk Tool to provide automation in reverse engineering of Android APKs.

First MCP for the Xahau network — offline Hook WASM VM + static analyzer, read-only ledger tools.

AST-based code navigator. Analyzes callers, callees, and dependencies via tree-sitter.

An AST-aware structural repository graph engine and MCP server designed for AI agents. Understands Go struct embeds, public API surfaces, SQL queries, and error mapping to give agents instant codebase context without blindly grepping.

Codebase analysis tools for AI agents: complexity, prop drilling, doc coverage, code smells.

The static analyzer your AI agent reads — fix-ready, machine-readable scan reports over MCP.

Debug and analyze Nanostores apps with AI: scan stores, monitor runtime events, and search docs.

Pre-install security scanner for AI agent skills (local stdio MCP). Offline static scan; no upload.

Static compliance-controls checker for UK Online Safety Act & ICO Children's Code. CLI + MCP.

PHP static analysis MCP server for architecture and maintainability. 11 tools exposing 60+ code quality metrics, problem detection, refactoring priorities, dependency graphs, git hotspots, test coverage, and impact analysis. Installable via Composer.

Local static screening for MCP and AI-agent tool metadata before attachment

Ranked codebase search and static symbol navigation for coding agents.

Find and fix reliability and safety gaps in agent code, across nine agent SDKs.

Audit AI/LLM features for governance guardrails: confidence, fallback, validation, human-in-loop.

Checked language for AI-written agent workflows: limits, cost and data flows known before running.

Zero-cost MCP server for local code inspection and best-practice recommendations

Semantic code graph MCP server for AI coding agents. Indexes your codebase into a typed graph (functions/types/modules as nodes; CALLS/IMPORTS/DATAFLOW/EFFECTS as typed edges) and exposes 40+ tools for call-chain tracing, data-flow analysis, semantic search, and invariant checking — so agents navigate code structure instead of reading files line by line. npm install -g grafema

Static FE-BE contract-drift checker: finds frontend calls the backend does not expose. CLI + MCP.

Multi-language code intelligence MCP server: symbols, call graphs, references, semantic search.

AI-powered code refactor engine with 80+ MCP tools for code analysis, hotspot detection, complexity metrics, persistent memory, and automated refactoring plans.

MCP server for Java call graph generation, static analysis, method chains & config management

Pre-flight dependency-upgrade impact analysis: reports exactly which of your code's API usages break before you bump a dependency, with line numbers, severity, and fix hints. Also verifies AI-written code against the actually-installed API to catch hallucinated calls. Static analysis only — never runs third-party code. Python + .NET. pip install bumpguard-mcp

Hierarchical code intelligence for AI coding agents. Scans local source code, clusters files by behavioral roles, maps coupling seams, and provides in-repo twins/context for complex implementation tasks.

Static-analysis-powered context compiler for LLM coding agents. Parses Python repos into dependency graphs, selects the minimal code context for a change (callers, callees, related functions), and packs it into a token budget with a disclosure header. Optionally biases retrieval from the bug report text. Includes verify which mines your repo's git history and grades retrieval — printing NULL RESULT when it doesn't fit. Zero runtime dependencies. pip install "diffcontext[mcp]".

Code indexing MCP: 13 tools, 10 languages, hybrid search, call graphs, O(1) retrieval.

Code quality analysis MCP server - detects security issues, deceptive patterns, and placeholders

Find the LLM/AI calls you didn't need — where plain code or a regex does the job. No model.

Predicts the DDL a dbt change will execute, before you run it. Reads files, not the warehouse.

ABC complexity gate for AI-written code with an MCP inspection tool.

Python code intelligence for coding agents: call paths, control flow, and change impact.

MCP server for PMD static code analyzer - run code analysis and detect duplicates