Skip to main content
Glama

nextscan

Next.js 프로젝트를 스캔하여 간결한 요약을 반환하는 MCP 서버입니다. 도구 호출 한 번 → 전체 프로젝트 개요.

주요 기능

nextscan 없이

nextscan 사용 시

파일별 수동 탐색

scan 호출 한 번

라우트 파악을 위한 여러 도구 호출

플래그가 포함된 간결한 라우트 트리

보안 문제 누락

하드코딩된 비밀값 + 환경 변수 누출 감지

API 커버리지 불명확

엔드포인트별 인증 및 검증 상태

스키마 추측

Prisma/Drizzle 관계 매핑

Related MCP server: guardvibe

빠른 설치

# Clone and build
cd nextscan
npm install
npm run build

# Add to Claude Code
claude mcp add nextscan -- node /path/to/nextscan/dist/index.js

도구: scan

매개변수

유형

필수

설명

path

string

예

Next.js 프로젝트 루트의 절대 경로

focus

enum

아니요

routes | api | schema | security

예제 출력

nextscan — my-app
────────────────────────────────────────
Root: /Users/dev/my-app
   src/ : yes  app/ : yes  middleware: yes
   ORM  : prisma

Routes
   Pages: 12  Layouts: 3  API: 5
   Dynamic: 4  Static: 8
   Client: 3  Server: 9
   Groups: (marketing), (auth)
   Matchers: /dashboard/:path*, /api/:path*
   ┌─ Pages
   ├─ /
   ├─ /about
   ├─ /dashboard [client]
   ├─ /blog/[slug] [dyn,SSG]
   └─ /settings [client]

API Endpoints
   Total: 5  Unprotected: 1
   ├─ GET,POST /api/users [auth:next-auth | val:zod]
   ├─ GET /api/health [no-auth,no-rate-limit]
   └─ POST /api/webhook [no-auth,no-validation]

Schema
   Models: 5  Relations: 4
   Orphans: AuditLog
   User ─< Post (1:N)
   User ─ Profile (1:1)
   Post >─< Tag (N:N)

Security
   Score: 75/100  Headers: yes  Middleware: yes
   [high] API route /api/health has no auth: [GET]
   [medium] No rate limiting on /api/users

예제 프롬프트

  • "내 Next.js 프로젝트를 /Users/dev/my-app에서 스캔해 줘"

  • "내 Next.js 앱의 보안을 점검해 줘"

  • "라우트 구조를 보여 줘"

  • "데이터베이스 스키마를 분석해 줘"

아키텍처

src/
├── index.ts              # MCP server entry point
├── tools/scan.ts         # Orchestrator
├── analyzers/
│   ├── routes.ts         # App router analysis
│   ├── api.ts            # API endpoint analysis
│   ├── schema.ts         # Schema orchestration
│   └── security.ts       # Security scanning
├── parsers/
│   ├── typescript.ts     # ts-morph utilities
│   ├── prisma.ts         # Regex-based Prisma parser
│   └── drizzle.ts        # AST-based Drizzle parser
├── formatters/
│   └── compact.ts        # Unicode tree formatter
└── utils/
    ├── fs.ts             # File system utilities
    └── detect.ts         # Project detection

요구 사항

  • Node.js 18+

  • MCP 호환 클라이언트 (Claude Code, Claude Desktop 등)

개발

npm install
npm run build
npm test
npm run test:coverage

작성자

Berkay Derin — github.com/berkayderin

라이선스

MIT

Available Tools

1 tool
scanA

Scan a Next.js project and return a compact summary of routes, API endpoints, schema, and security issues

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYesAbsolute path to the Next.js project root
focusNoFocus on a specific area (omit for full scan)

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden of explaining behavior. It adds a useful piece of behavioral context by stating the output is a 'compact summary', but it does not clarify whether scanning is read-only, whether it traverses the filesystem, or what form the summary takes. This is adequate but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-structured sentence that leads with the action, specifies the target, and lists the scope. Every word earns its place; there is no filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 2-parameter tool with no output schema, the description reasonably covers the main deliverables and the optional focus areas. It does not describe the summary's exact format or nesting, but the tool is simple enough that the description provides sufficient context for an agent to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already documents both parameters with 100% coverage, including the enum values for 'focus'. The description does not add meaning beyond the schema, so the baseline score of 3 is appropriate. It introduces the high-level output categories but does not elaborate on parameter syntax or relationships.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Scan' with a specific resource ('Next.js project') and explicitly enumerates the output areas: routes, API endpoints, schema, and security issues. It is specific and self-contained, and there are no sibling tools requiring differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context for when to use the tool: analyzing a Next.js project and getting a summary of key areas. It does not explicitly state when not to use it or mention alternatives, but the absence of siblings reduces the need for exclusions. The optional 'focus' parameter also implicitly guides selective usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 1 tool updatev1.0.1
    • First observedscan

TDQS

A3.9/5.0

Scored across 1 tool

Disambiguation5/5

With only one tool, there is no possibility of confusion between tools. The single tool has a clear, distinct purpose of scanning a Next.js project.

Naming Consistency5/5

Only one tool exists, so naming is inherently consistent. The verb 'scan' clearly indicates the action.

Tool Count1/5

A single tool is extremely thin for a server, suggesting the surface is severely underdeveloped. Even if the purpose is narrow, most useful servers would expose multiple operations.

Completeness3/5

The scan tool provides a comprehensive overview of a Next.js project, but it is a read-only operation. Missing other aspects like specific security fix suggestions or detailed endpoint management, leaving notable gaps for deeper workflows.

Maintenance

ActivityInactive
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    D
    maintenance
    A utility tool that analyzes Next.js application routes and provides detailed information about API paths, HTTP methods, parameters, status codes, and request/response schemas.
    29 npm
    99
    MIT
  • A
    license
    B
    quality
    A
    maintenance
    Security MCP server with 300+ rules for AI-generated code. Scans Next.js, Supabase, Clerk, Stripe, Prisma, Hono, GraphQL and 20+ modules. Zero config, runs locally.
    39
    2,375 npm
    5
    Apache 2.0
  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables MCP-compatible clients to inspect Next.js codebases, analyze App Router and Pages Router structure, discover API routes, and audit build performance through controlled tools.
    12 npm
    MIT