Skip to main content
Glama
JJJHoons

Python Code Review MCP Agent

by JJJHoons
OverviewSchemaRelated ServersScoreDiscussions
TypeScript
Hybrid

Python Code Review MCP Agent 🐍🔍

A comprehensive Model Context Protocol (MCP) server designed specifically for backend developers working with Python. This agent provides detailed code quality and security analysis with consistent, actionable reporting.

🎯 Key Features

🔒 Security-First Analysis

  • SQL Injection Detection - String formatting, concatenation, f-strings

  • Command Injection Prevention - os.system(), subprocess with shell=True

  • Code Injection Scanning - eval(), exec() usage detection

  • Secrets Detection - Hardcoded passwords, API keys, tokens

  • Crypto Security - Weak random number generation, SSL issues

📊 Code Quality Assessment

  • PEP 8 Compliance - Naming conventions, style guidelines

  • Exception Handling - Bare except, broad exceptions

  • Performance Patterns - Inefficient loops, list operations

  • Import Management - Wildcard imports, multiple imports

  • Code Complexity - Function length, maintainability

📋 Detailed Reporting

  • Executive Summaries - Risk assessment, deployment readiness

  • Quality Scorecards - 0-100 scoring for quality and security

  • Severity Levels - Critical, High, Medium, Low prioritization

  • Actionable Suggestions - Specific fix recommendations

  • Comparison Reports - Before/after improvement tracking

Related MCP server: MCP Vulnerability Checker Server

🛠️ Available MCP Tools

1. review_python_code

Comprehensive analysis with detailed, summary, or security-focused reports.

{
  "code": "your_python_code_here",
  "filename": "optional_filename.py",
  "reportType": "detailed" // "detailed", "summary", or "security"
}

2. security_audit

Focused security vulnerability scanning with threat analysis.

{
  "code": "your_python_code_here",
  "filename": "optional_filename.py"
}

3. analyze_code_quality

Deep code quality analysis with configurable focus areas.

{
  "code": "your_python_code_here",
  "filename": "optional_filename.py",
  "includeStyle": true,
  "includeMaintainability": true
}

4. compare_code_versions

Compare original vs. revised code to track improvements.

{
  "originalCode": "original_version_here",
  "revisedCode": "improved_version_here",
  "filename": "optional_filename.py"
}

5. get_improvement_suggestions

Get targeted suggestions for specific areas of concern.

{
  "code": "your_python_code_here",
  "filename": "optional_filename.py",
  "focusArea": "security" // "security", "quality", "performance", "style", "all"
}

🚀 Quick Start

Installation

npm install
npm run build

Running Tests

npm test

Starting the MCP Server

npm start

Running Demo

node dist/demo.js

⚙️ MCP Client Configuration

Add to your MCP client configuration:

{
  "mcpServers": {
    "python-code-review": {
      "command": "node",
      "args": ["/path/to/python_code_review_mcp/dist/index.js"]
    }
  }
}

📖 Usage Examples

Security Analysis

"Audit this Python Flask endpoint for security vulnerabilities"

@app.route('/user/<user_id>')
def get_user(user_id):
    query = f"SELECT * FROM users WHERE id = {user_id}"
    cursor.execute(query)
    return cursor.fetchone()

Result: Detects SQL injection vulnerability, provides secure parameterized query solution.

Code Quality Review

"Review this data processing function for quality issues"

def process_data(items):
    result = []
    for i in range(len(items)):
        result += [items[i].upper()]
    return result

Result: Identifies performance issues, suggests enumerate() and list comprehensions.

Improvement Tracking

"Compare my original code with the improved version"

Result: Shows quality score improvements, security enhancements, and resolved issues.

🎯 Perfect for Backend Developers

🏗️ Framework Support

  • Django - Models, views, security best practices

  • Flask - Route handlers, authentication, security

  • FastAPI - Async patterns, data validation

  • SQLAlchemy - Query security, ORM patterns

🔧 Development Workflow

  • Pre-commit Analysis - Catch issues before they reach production

  • Code Review Assistant - Comprehensive analysis for pull requests

  • Security Auditing - Regular vulnerability assessments

  • Refactoring Guide - Systematic improvement tracking

📊 Quality Metrics

  • Security Score (0-100) - Vulnerability risk assessment

  • Quality Score (0-100) - Code quality measurement

  • Issue Density - Problems per 100 lines of code

  • Risk Level - Overall deployment readiness

🧪 Comprehensive Testing

  • 40/40 Tests Passing - 100% test coverage

  • Security Detection - All major vulnerability types

  • Quality Analysis - PEP 8, best practices, performance

  • Report Generation - Multiple formats and detail levels

  • Edge Cases - Empty code, comments, mixed indentation

  • Real-World Examples - Flask apps, Django models, data processing

🔍 Detection Capabilities

🚨 Critical Security Issues

  • SQL injection vulnerabilities

  • Command injection risks

  • Code injection through eval/exec

  • Hardcoded secrets and credentials

⚠️ High Priority Issues

  • SSL verification disabled

  • Subprocess with shell=True

  • Broad exception handling

📋 Quality Improvements

  • PEP 8 naming conventions

  • Performance anti-patterns

  • Import organization

  • Documentation completeness

📈 Scoring System

Security Score Calculation

  • 100: No security vulnerabilities detected

  • 70-99: Minor security concerns

  • 30-69: Moderate security risks

  • 0-29: Critical security vulnerabilities

Quality Score Calculation

  • 90-100: Excellent code quality

  • 80-89: Good code quality

  • 70-79: Fair code quality

  • 60-69: Poor code quality

  • 0-59: Critical quality issues

🎉 Production Ready

  • ✅ Zero Dependencies - No external APIs required

  • ✅ Fast Analysis - Local pattern matching

  • ✅ Consistent Reports - Standardized output format

  • ✅ TypeScript - Full type safety and IntelliSense

  • ✅ Error Handling - Graceful failure and recovery

  • ✅ MCP Standards - Compatible with all MCP clients

Transform your Python code review process with intelligent, automated analysis focused on the specific needs of backend developers! 🐍✨

Available Tools

5 tools
analyze_code_qualityC

Deep code quality analysis including style, maintainability, performance, and best practices compliance.

ParametersJSON Schema
NameRequiredDescriptionDefault
codeYesPython code to analyze for quality issues
filenameNoName of the file (optional)unknown.py
includeStyleNoInclude style and naming convention checks
includeMaintainabilityNoInclude maintainability and documentation checks

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden for behavioral disclosure. While it mentions what aspects are analyzed, it doesn't describe important behavioral traits like whether this is a read-only operation, what the output format looks like, whether there are rate limits, computational costs, or specific authentication requirements. For a tool with 4 parameters and no annotations, this is a significant gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence that communicates the core purpose without unnecessary words. It's appropriately sized and front-loaded with the main action and scope, making it easy for an agent to quickly understand what the tool does.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 4 parameters, no annotations, and no output schema, the description is insufficient. It doesn't explain what the analysis returns, how results are structured, what happens with the optional parameters, or how this differs from similar sibling tools. The description should provide more context given the complexity and lack of structured metadata.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already fully documents all 4 parameters. The description doesn't add any parameter-specific information beyond what's in the schema. The baseline score of 3 is appropriate when the schema does all the parameter documentation work.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool performs 'Deep code quality analysis' and specifies the aspects covered: style, maintainability, performance, and best practices compliance. This provides a specific verb (analyze) and resource (code quality) with scope details, though it doesn't explicitly differentiate from sibling tools like 'review_python_code' or 'security_audit'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. With sibling tools like 'review_python_code', 'security_audit', and 'get_improvement_suggestions' available, there's no indication of when this comprehensive analysis is preferred over more specialized tools or what prerequisites might exist.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compare_code_versionsC

Compare two versions of Python code to identify improvements or regressions in quality and security.

ParametersJSON Schema
NameRequiredDescriptionDefault
originalCodeYesOriginal version of the Python code
revisedCodeYesRevised version of the Python code
filenameNoName of the file (optional)unknown.py

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It states the tool compares code for quality and security, but doesn't explain how this comparison works, what metrics are used, whether it's read-only or has side effects, or what the output format is. For a tool with no annotation coverage, this leaves significant gaps in understanding its behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence that directly states the tool's purpose without unnecessary words. It's front-loaded with the core action and scope, making it easy to parse. Every part of the sentence contributes essential information, earning its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity of code comparison and the lack of annotations and output schema, the description is insufficiently complete. It doesn't detail the comparison methodology, output format, or behavioral traits like error handling. For a tool with no structured data beyond the input schema, more context is needed to guide effective agent usage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema description coverage is 100%, with clear descriptions for all parameters (originalCode, revisedCode, filename). The description adds no additional semantic context beyond what the schema provides, such as explaining how the comparison uses these inputs or what 'filename' influences. With high schema coverage, the baseline score of 3 is appropriate as the schema handles parameter documentation adequately.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: comparing two Python code versions to identify improvements or regressions in quality and security. It specifies the verb 'compare' and resource 'Python code versions' with the goal of evaluating quality and security. However, it doesn't explicitly differentiate from sibling tools like 'analyze_code_quality' or 'security_audit', which might have overlapping functionality.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. It mentions identifying improvements or regressions, but doesn't specify contexts, prerequisites, or exclusions. With sibling tools like 'analyze_code_quality' and 'security_audit' available, the lack of differentiation leaves the agent uncertain about tool selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_improvement_suggestionsC

Get specific, actionable suggestions for improving Python code quality, security, and maintainability.

ParametersJSON Schema
NameRequiredDescriptionDefault
codeYesPython code to get improvement suggestions for
filenameNoName of the file (optional)unknown.py
focusAreaNoFocus area for suggestionsall

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It states the tool provides 'specific, actionable suggestions' but doesn't describe how suggestions are generated, whether they include code examples, if there are rate limits, or what the output format looks like. This is a significant gap for a tool that analyzes code without output schema details.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence that front-loads the core purpose without unnecessary words. Every part of the sentence contributes to understanding the tool's function, making it appropriately concise and well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity of code analysis, lack of annotations, and no output schema, the description is incomplete. It doesn't cover behavioral aspects like suggestion depth, error handling, or output format, which are crucial for an AI agent to use this tool effectively in context with its siblings.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds no parameter-specific information beyond what's in the schema, which has 100% coverage with clear descriptions for all parameters. The baseline score of 3 is appropriate since the schema adequately documents parameters, but the description doesn't enhance understanding of how parameters like 'focusArea' affect the suggestions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose with specific verbs ('get suggestions') and resources ('Python code quality, security, and maintainability'), making it easy to understand what the tool does. However, it doesn't explicitly differentiate from sibling tools like 'analyze_code_quality' or 'review_python_code', which might have overlapping functionality.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives like 'security_audit' or 'compare_code_versions'. It mentions 'focusArea' in the schema but doesn't explain in the description when to choose specific focus areas or when this tool is preferred over siblings, leaving usage context implied at best.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

review_python_codeC

Comprehensive Python code analysis focusing on quality and security. Provides detailed reports with actionable recommendations.

ParametersJSON Schema
NameRequiredDescriptionDefault
codeYesPython code to analyze
filenameNoName of the file (optional, defaults to unknown.py)unknown.py
reportTypeNoType of report to generatedetailed

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It mentions 'detailed reports with actionable recommendations,' which hints at output format, but lacks critical details like whether this is a read-only analysis, potential performance impacts, error handling, or authentication needs. For a tool with no annotation coverage, this is a significant gap in transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence that front-loads the core purpose ('Comprehensive Python code analysis focusing on quality and security') and adds a secondary detail ('Provides detailed reports with actionable recommendations'). It avoids redundancy and wastes no words, though it could be slightly more structured for clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity (3 parameters, no output schema, no annotations), the description is minimally adequate. It covers the purpose and output type but lacks details on behavioral traits, usage guidelines, and differentiation from siblings. Without annotations or output schema, more context on what the reports contain or how to interpret results would improve completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all parameters (code, filename, reportType) with descriptions and defaults. The description adds no additional meaning beyond what the schema provides, such as explaining how 'reportType' affects the analysis or providing examples. Baseline 3 is appropriate when the schema handles parameter documentation adequately.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose as 'Comprehensive Python code analysis focusing on quality and security' with 'detailed reports with actionable recommendations.' This specifies the verb (analyze), resource (Python code), and scope (quality and security). However, it doesn't explicitly differentiate from sibling tools like 'analyze_code_quality' or 'security_audit,' which likely have overlapping functionality.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives like 'analyze_code_quality' or 'security_audit.' It mentions 'quality and security' but doesn't specify contexts, exclusions, or prerequisites. Usage is implied through the purpose statement, but explicit alternatives or conditions are missing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

security_auditC

Focused security vulnerability analysis for Python code. Identifies SQL injection, command injection, and other security risks.

ParametersJSON Schema
NameRequiredDescriptionDefault
codeYesPython code to audit for security vulnerabilities
filenameNoName of the file (optional)unknown.py

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It states what the tool does (analyzes for security vulnerabilities) but doesn't describe how it behaves: no information about output format, whether it's a read-only analysis or modifies code, performance characteristics, error handling, or any limitations. For a security analysis tool with zero annotation coverage, this leaves significant gaps in understanding its operational behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise - just two sentences that directly state the tool's purpose and scope. Every word earns its place: 'Focused security vulnerability analysis for Python code' establishes the core function, and 'Identifies SQL injection, command injection, and other security risks' provides concrete examples without unnecessary elaboration. It's front-loaded with the most important information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given that this is a security analysis tool with no annotations and no output schema, the description is insufficiently complete. While concise, it doesn't explain what the tool returns (e.g., a vulnerability report, risk scores, remediation suggestions), how comprehensive the analysis is, what types of 'other security risks' it covers, or any limitations. For a tool that presumably produces important security findings, more context about outputs and scope would be valuable.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents both parameters thoroughly. The description doesn't add any meaningful parameter semantics beyond what's in the schema - it mentions 'Python code to audit' which aligns with the 'code' parameter description, but provides no additional context about parameter usage, constraints, or interactions. This meets the baseline expectation when schema coverage is complete.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Focused security vulnerability analysis for Python code' with specific examples of what it identifies (SQL injection, command injection, and other security risks). It distinguishes itself from siblings by focusing specifically on security vulnerabilities rather than general code quality, version comparison, or improvement suggestions. However, it doesn't explicitly contrast with the 'review_python_code' sibling, which might have some overlap.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. While it mentions 'focused security vulnerability analysis,' it doesn't specify when to choose this over 'review_python_code' (which might include security aspects) or 'analyze_code_quality' (which might cover security as part of broader quality metrics). There's no mention of prerequisites, limitations, or typical use cases.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 5 tool updates
    • First observedanalyze_code_quality
    • First observedcompare_code_versions
    • First observedget_improvement_suggestions
    • First observedreview_python_code
    • First observedsecurity_audit
Install Server
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

B3/5.0
Disambiguation2/5

Multiple tools have unclear boundaries and overlapping purposes. 'analyze_code_quality' and 'review_python_code' both describe comprehensive code analysis with quality and security focus, making them highly ambiguous. 'get_improvement_suggestions' also overlaps with these by providing actionable recommendations, while 'security_audit' is a subset of their security aspects. This will likely cause agent misselection.

Naming Consistency4/5

The naming follows a consistent verb_noun pattern with snake_case throughout, such as 'analyze_code_quality' and 'compare_code_versions'. All tools start with a verb and describe their function clearly, with no mixing of conventions. The consistency aids in readability and predictability.

Tool Count4/5

With 5 tools, the count is reasonable for a Python code review domain, allowing focused operations without being overwhelming. It aligns well with typical MCP server scopes of 3-15 tools, though the overlap in functionality might suggest some tools could be consolidated for better efficiency.

Completeness3/5

The tool set covers core aspects of code review like quality analysis, security, and suggestions, but there are notable gaps. For example, there is no tool for generating summaries, integrating with version control, or handling specific Python frameworks, which could limit agent workflows. The coverage is functional but not fully comprehensive for a code review agent.

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • MCP Vulnerability Checker

    firetix
    A
    license
    A
    quality
    D
    maintenance
    A Model Context Protocol server providing security vulnerability intelligence tools including CVE lookup, EPSS scoring, CVSS calculation, exploit detection, and Python package vulnerability checking.
    8
    9
    MIT

  • lsp-mcp

    flothjl
    A
    license
    B
    quality
    D
    maintenance
    A multi-language code analysis server that helps LLMs or humans automatically lint, type-check, and improve code with minimal installation friction, currently supporting Python with plans for other languages.
    1
    3
    MIT

Appeared in Searches

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/JJJHoons/python_code_review_mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server