#static-analysis

CodeGraphX (CGX) is a local, token-efficient codebase graph engine for AI coding agents and human developers. It parses your source with Tree-sitter, stores a bi-temporal semantic graph in SQLite, and serves it over a CLI and an MCP server — so an agent can ask "what breaks if I change this function?" and get an exact answer in a few hundred tokens instead of reading 50 files.

GraphPilot gives coding agents persistent structural knowledge of a codebase. It parses TypeScript/JavaScript with tree-sitter into a graph of symbols and call edges, then exposes that graph over MCP so the agent can recall definitions, find callers, and trace change impact without re-reading files every conversation. Local-first: no network, no telemetry, no code ever leaves your machine. Four tools — gp_index, gp_recall, gp_callers, gp_impact.

Static technical-debt analysis across 14 languages, exposed as MCP tools and resources

mcp-cpp-project-indexer is a deterministic C++ source-range indexer for large, module-heavy projects and MCP-based AI code navigation. It is not a compiler, LSP replacement, refactoring engine, semantic analyzer, or call-graph builder. Its job is simple: Find code. Read code. Do not guess code. The indexer maps C++ symbols, files, and C++20 modules to exact source ranges so an AI can read only the code it needs.

Curated by Archimedes Market. Static security analysis exposed as MCP tools. OWASP top 10, secrets detection, custom rule packs. Baseline scanning focuses on newly-introduced findings. Built for production-grade security review. → archimedes.market/assets/21c4a8ab-80dc-4a69-8444-c209a130f27e

PCI DSS v4.0.1 static-analysis MCP server for Go payment service codebases. 12 scanners detect PAN/CVV exposure, weak crypto, missing audit logs, vulnerable deps, TLS misconfig, auth weaknesses, plus CycloneDX 1.6 SBOM generation. Each finding maps to the exact PCI requirement. AI-assisted triage via triage_findings tool. Keyless-signed multi-arch Docker image on ghcr.io.

Static code analyzer with MCP server. Gives AI agents access to complexity metrics, coupling analysis, community detection, risk scoring, and test quality, without reading every file.

npm: @tastehub/ckb brew tap SimplyLiz/ckb && brew install ckb Website: https://codeknowledge.dev Description: Code intelligence MCP server with 80+ tools for understanding, navigating, and safely changing codebases. **Key capabilities:** - Semantic symbol search, call graphs, and usage tracing - Change impact analysis with blast radius and risk scoring - Dead code detection and affected test identification - Architecture exploration and module dependency maps - Ownership lookup with drift detection - Compound operations (explore, understand, prepareChange) that reduce AI tool calls by 60-70% **Supports:** Go, TypeScript, Python, Rust, Java, Kotlin, C++, Dart, Ruby, C# **Install:** `npm install -g @tastehub/ckb && ckb init && ckb index && ckb setup` **Works with:** Claude Code, Cursor, Windsurf, VS Code, Grok, Claude Desktop, OpenCode, ...

Code Pathfinder's MCP Server provides AI coding assistants like Claude Code with deep semantic understanding of codebases through call graph analysis, symbol search, and dependency tracking. It enables developers to ask natural language questions like "who calls this function?" instead of manually using grep or searching code. The tool runs 100% locally (your code never leaves your machine), is free and open-source under AGPL-3.0, and installs in under 5 minutes. [codepathfinder](https://codepathfinder.dev/mcp)

Educational Python refactoring assistant with guided suggestions for AI assistants

Educational Python refactoring assistant with guided suggestions for AI assistants

AI-powered code quality analysis using MCP to help AI assistants review code more effectively. Analyze git changes for complexity, security issues, and more through structured prompts.